From 4bef5d4d6429a100f2d8da9038a204583ffbfec3 Mon Sep 17 00:00:00 2001 From: Gustavo Jodar Date: Wed, 9 Sep 2026 12:32:02 +0200 Subject: [PATCH 01/16] security: bump aws-lc-rs, time, and serde_with to fix RustSec advisories Fixes several security advisories affecting Rust dependencies: - GHSA-65p9-r9h6-22vj, GHSA-9f94-5g5w-gf6r, GHSA-394x-vwmw-crm3, GHSA-hfpc-8r3f-gw53, GHSA-vw5v-4f2q-w9xf: aws-lc-fips-sys/aws-lc-sys, pulled in transitively via aws-lc-rs (rustls -> libdd-common). Fixed by bumping aws-lc-rs 1.15.4 -> 1.18.1, which pulls aws-lc-sys 0.37.0 -> 0.45.0 and aws-lc-fips-sys 0.13.6 -> 0.14.2. - CVE-2026-25727 (RUSTSEC-2026-0009/GHSA-r6v5-fh4h-64xc): time crate RFC2822 parser stack exhaustion. Fixed by bumping time 0.3.37 -> 0.3.47. - GHSA-7gcf-g7xr-8hxj: serde_with KeyValueMap adapter panic DoS. Fixed by bumping serde_with 3.12.0 -> 3.21.0. The time/serde_with fixed versions require rustc >= 1.88 (their declared MSRV), so this also bumps the toolchain pin from 1.87.0 to 1.88.0 across Cargo.toml, rust-toolchain.toml, profiling/rust-toolchain.toml, and the Dockerfiles that install the Rust toolchain for CI/dev images (bookworm, centos-7 base image with updated SHA256 checksums, Windows base tools, appsec integration test image). CVE-2026-25541 (bytes) required no change: the lockfile was already at the fixed version 1.11.1. Co-Authored-By: Claude Sonnet 5 --- Cargo.lock | 200 +++++++----------- Cargo.toml | 2 +- .../src/docker/php-buildonly-rust/Dockerfile | 2 +- dockerfiles/ci/bookworm/Dockerfile | 2 +- dockerfiles/ci/centos/7/base.Dockerfile | 6 +- dockerfiles/ci/windows/basetools.Dockerfile | 2 +- profiling/rust-toolchain.toml | 2 +- rust-toolchain.toml | 2 +- 8 files changed, 90 insertions(+), 128 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a2ec5c0abf2..0d1a9a46697 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -222,23 +222,24 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26" [[package]] name = "aws-lc-fips-sys" -version = "0.13.6" +version = "0.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e99d74bb793a19f542ae870a6edafbc5ecf0bc0ba01d4636b7f7e0aba9ee9bd3" +checksum = "03367707e92796b190a4207d4d39b0a4271d574503d2969c2b0cfbf5c87658ee" dependencies = [ - "bindgen 0.69.5", + "bindgen", "cc", "cmake", "dunce", "fs_extra", + "pkg-config", "regex", ] [[package]] name = "aws-lc-rs" -version = "1.15.4" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b7b6141e96a8c160799cc2d5adecd5cbbe5054cb8c7c4af53da0f83bb7ad256" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-fips-sys", "aws-lc-sys", @@ -247,14 +248,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.37.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c34dda4df7017c8db52132f0f8a2e0f8161649d15723ed63fc00c82d0f2081a" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -336,29 +338,6 @@ dependencies = [ "serde", ] -[[package]] -name = "bindgen" -version = "0.69.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088" -dependencies = [ - "bitflags 2.13.0", - "cexpr", - "clang-sys", - "itertools 0.12.1", - "lazy_static", - "lazycell", - "log", - "prettyplease", - "proc-macro2", - "quote", - "regex", - "rustc-hash 1.1.0", - "shlex 1.3.0", - "syn 2.0.118", - "which", -] - [[package]] name = "bindgen" version = "0.72.1" @@ -368,13 +347,13 @@ dependencies = [ "bitflags 2.13.0", "cexpr", "clang-sys", - "itertools 0.12.1", + "itertools 0.10.5", "log", "prettyplease", "proc-macro2", "quote", "regex", - "rustc-hash 2.1.3", + "rustc-hash", "shlex 1.3.0", "syn 2.0.118", ] @@ -549,6 +528,15 @@ version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c" +[[package]] +name = "bs58" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4" +dependencies = [ + "tinyvec", +] + [[package]] name = "build_common" version = "0.0.1" @@ -1179,9 +1167,9 @@ dependencies = [ [[package]] name = "darling" -version = "0.20.10" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989" +checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d" dependencies = [ "darling_core", "darling_macro", @@ -1189,11 +1177,10 @@ dependencies = [ [[package]] name = "darling_core" -version = "0.20.10" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5" +checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0" dependencies = [ - "fnv", "ident_case", "proc-macro2", "quote", @@ -1203,9 +1190,9 @@ dependencies = [ [[package]] name = "darling_macro" -version = "0.20.10" +version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806" +checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d" dependencies = [ "darling_core", "quote", @@ -1238,7 +1225,7 @@ version = "0.0.1" dependencies = [ "anyhow", "bincode", - "bindgen 0.72.1", + "bindgen", "cbindgen 0.27.0", "cc", "chrono", @@ -1286,7 +1273,7 @@ dependencies = [ "rand_distr", "regex", "regex-automata", - "rustc-hash 2.1.3", + "rustc-hash", "serde", "serde_json", "serde_with", @@ -1452,12 +1439,12 @@ dependencies = [ [[package]] name = "deranged" -version = "0.3.11" +version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4" +checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" dependencies = [ "powerfmt", - "serde", + "serde_core", ] [[package]] @@ -2228,15 +2215,6 @@ dependencies = [ "tracing", ] -[[package]] -name = "home" -version = "0.5.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5" -dependencies = [ - "windows-sys 0.52.0", -] - [[package]] name = "http" version = "0.2.12" @@ -2420,7 +2398,7 @@ dependencies = [ "iana-time-zone-haiku", "js-sys", "wasm-bindgen", - "windows-core 0.52.0", + "windows-core 0.51.1", ] [[package]] @@ -2674,15 +2652,6 @@ dependencies = [ "either", ] -[[package]] -name = "itertools" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569" -dependencies = [ - "either", -] - [[package]] name = "itoa" version = "0.4.8" @@ -2788,12 +2757,6 @@ version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" -[[package]] -name = "lazycell" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55" - [[package]] name = "libc" version = "0.1.12" @@ -3267,7 +3230,7 @@ dependencies = [ "prost", "rand 0.8.8", "reqwest 0.13.2", - "rustc-hash 2.1.3", + "rustc-hash", "rustls", "rustls-platform-verifier", "serde", @@ -3519,7 +3482,7 @@ dependencies = [ "rmp", "rmp-serde", "rmpv", - "rustc-hash 2.1.3", + "rustc-hash", "serde", "serde-transcode", "serde_json", @@ -3569,7 +3532,7 @@ dependencies = [ name = "libddwaf-sys" version = "2.0.1" dependencies = [ - "bindgen 0.72.1", + "bindgen", "flate2", "hyper-rustls", "libc 0.2.186", @@ -3586,7 +3549,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34" dependencies = [ "cfg-if", - "windows-targets 0.52.6", + "windows-targets 0.48.5", ] [[package]] @@ -3914,9 +3877,9 @@ dependencies = [ [[package]] name = "num-conv" -version = "0.1.0" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" [[package]] name = "num-derive" @@ -4390,7 +4353,7 @@ version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "059a34f111a9dee2ce1ac2826a68b24601c4298cfeb1a587c3cb493d5ab46f52" dependencies = [ - "libc 0.2.186", + "libc 0.1.12", "nix 0.30.1", ] @@ -4544,7 +4507,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7" dependencies = [ "heck 0.5.0", - "itertools 0.12.1", + "itertools 0.10.5", "log", "multimap", "petgraph", @@ -4563,7 +4526,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b" dependencies = [ "anyhow", - "itertools 0.12.1", + "itertools 0.10.5", "proc-macro2", "quote", "syn 2.0.118", @@ -5085,12 +5048,6 @@ version = "0.1.26" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace" -[[package]] -name = "rustc-hash" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2" - [[package]] name = "rustc-hash" version = "2.1.3" @@ -5281,6 +5238,30 @@ dependencies = [ "serde_json", ] +[[package]] +name = "schemars" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f" +dependencies = [ + "dyn-clone", + "ref-cast", + "serde", + "serde_json", +] + +[[package]] +name = "schemars" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a" +dependencies = [ + "dyn-clone", + "ref-cast", + "serde", + "serde_json", +] + [[package]] name = "schemars_derive" version = "0.8.21" @@ -5518,17 +5499,19 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.12.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa" +checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c" dependencies = [ "base64 0.22.1", + "bs58", "chrono", "hex", "indexmap 1.9.3", "indexmap 2.12.1", - "serde", - "serde_derive", + "schemars 0.9.0", + "schemars 1.2.2", + "serde_core", "serde_json", "serde_with_macros", "time", @@ -5536,9 +5519,9 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.12.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e" +checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660" dependencies = [ "darling", "proc-macro2", @@ -6098,30 +6081,30 @@ dependencies = [ [[package]] name = "time" -version = "0.3.37" +version = "0.3.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21" +checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ "deranged", "itoa 1.0.14", "num-conv", "powerfmt", - "serde", + "serde_core", "time-core", "time-macros", ] [[package]] name = "time-core" -version = "0.1.2" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" +checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca" [[package]] name = "time-macros" -version = "0.2.19" +version = "0.2.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de" +checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215" dependencies = [ "num-conv", "time-core", @@ -6789,18 +6772,6 @@ dependencies = [ "rustls-pki-types", ] -[[package]] -name = "which" -version = "4.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7" -dependencies = [ - "either", - "home", - "once_cell", - "rustix 0.38.43", -] - [[package]] name = "widestring" version = "1.2.1" @@ -6841,7 +6812,7 @@ version = "0.1.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.48.0", ] [[package]] @@ -6888,15 +6859,6 @@ dependencies = [ "windows-targets 0.48.5", ] -[[package]] -name = "windows-core" -version = "0.52.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9" -dependencies = [ - "windows-targets 0.52.6", -] - [[package]] name = "windows-core" version = "0.59.0" diff --git a/Cargo.toml b/Cargo.toml index 535898d16f8..68b42bacf13 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ exclude = ["appsec/third_party/libddwaf-rust"] resolver = "2" [workspace.package] -rust-version = "1.87.0" +rust-version = "1.88.0" edition = "2021" version = "0.0.1" license = "Apache-2.0" diff --git a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile index 672912a75b7..8b5fd1555a7 100644 --- a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile +++ b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile @@ -14,7 +14,7 @@ RUN rm /etc/musl-clang.conf RUN apk --no-cache add clang21-libclang curl curl-dev && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \ - sh -s -- --default-toolchain 1.87.0 --profile minimal -y && \ + sh -s -- --default-toolchain 1.88.0 --profile minimal -y && \ rustup component add rustfmt clippy llvm-tools-preview && \ rust_toolchain="nightly-$(uname -m)-unknown-linux-musl" && \ rustup toolchain install "$rust_toolchain" \ diff --git a/dockerfiles/ci/bookworm/Dockerfile b/dockerfiles/ci/bookworm/Dockerfile index 8b391bd0b87..5df41b50de8 100644 --- a/dockerfiles/ci/bookworm/Dockerfile +++ b/dockerfiles/ci/bookworm/Dockerfile @@ -307,7 +307,7 @@ RUN set -eux; \ chown circleci:circleci $PHP_INSTALL_DIR; # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.87.0" +ARG RUST_VERSION="1.88.0" ARG RUST_NIGHTLY_VERSION="-2025-06-13" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo diff --git a/dockerfiles/ci/centos/7/base.Dockerfile b/dockerfiles/ci/centos/7/base.Dockerfile index b32ffcceae1..d291d56f00d 100644 --- a/dockerfiles/ci/centos/7/base.Dockerfile +++ b/dockerfiles/ci/centos/7/base.Dockerfile @@ -226,9 +226,9 @@ RUN yum install -y --nogpgcheck devtoolset-9 \ # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.87.0" -ARG RUST_SHA256_ARM="2c66e31d774a0dcd4422db74584ebc6362ff3ae90c452caff9d2fb912c821e8d" -ARG RUST_SHA256_X86="1f6f18ce19387c42968a474cf175e67f99280614ded9c752d5d2e37af3204bcd" +ARG RUST_VERSION="1.88.0" +ARG RUST_SHA256_ARM="dbc75abc31d142eacf15e60d0e51c4f291539974221d217b80786756b0ce1d6b" +ARG RUST_SHA256_X86="ad6f0cc845e7fcca17fd451bafd2c04a7bbcb543f8f3ef5bc412fd1fef99ef7b" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo ENV RUSTUP_HOME=/rust/rustup diff --git a/dockerfiles/ci/windows/basetools.Dockerfile b/dockerfiles/ci/windows/basetools.Dockerfile index ab83580d4ef..7a088bed0eb 100644 --- a/dockerfiles/ci/windows/basetools.Dockerfile +++ b/dockerfiles/ci/windows/basetools.Dockerfile @@ -7,7 +7,7 @@ RUN powershell.exe "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Ne # I really need some sane file editing utilities RUN powershell "Invoke-WebRequest https://ftp.nluug.nl/pub/vim/pc/vim90w32.zip -OutFile /tmp/vim90w32.zip; Expand-Archive /tmp/vim90w32.zip /tmp; move C:\tmp\vim\vim90\tee.exe C:\Windows\tee.exe; move C:\tmp\vim\vim90\vim.exe C:\Windows\vim.exe; move C:\tmp\vim\vim90\xxd.exe C:\Windows\xxd.exe; Remove-Item /tmp/vim90w32.zip; Remove-Item -Recurse C:\tmp\vim" -RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.87.0; Remove-Item /tmp/rustup-init.exe" +RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.88.0; Remove-Item /tmp/rustup-init.exe" # Cargo's bundled libgit2 fails to check out some deeply nested git # dependencies on Windows (e.g. rust-tuf's interop-tests fixtures, pulled in diff --git a/profiling/rust-toolchain.toml b/profiling/rust-toolchain.toml index b8889a3bb3b..e88baf106b9 100644 --- a/profiling/rust-toolchain.toml +++ b/profiling/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.87.0" +channel = "1.88.0" diff --git a/rust-toolchain.toml b/rust-toolchain.toml index b8889a3bb3b..e88baf106b9 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.87.0" +channel = "1.88.0" From e6ac53d7fd6d2eda06d7e5686b0ccc48229d2117 Mon Sep 17 00:00:00 2001 From: Gustavo Jodar Date: Mon, 14 Sep 2026 15:25:56 +0200 Subject: [PATCH 02/16] ci: bump Alpine CI base image to 3.23 for Rust 1.88 MSRV Alpine 3.22's apk-provided rust package is 1.87.0, which is below the new rust-version = "1.88.0" MSRV set in Cargo.toml, so cargo builds in this image fail with "requires rustc 1.88.0". Alpine 3.23 ships rust-1.91.1-r2. Bump the clang/llvm packages from 20 to 21 to match, since they must track rustc's LLVM version for cross-language LTO. Co-Authored-By: Claude Sonnet 5 --- dockerfiles/ci/alpine_compile_extension/base.Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dockerfiles/ci/alpine_compile_extension/base.Dockerfile b/dockerfiles/ci/alpine_compile_extension/base.Dockerfile index c879e2429b1..a9e924cd7a2 100644 --- a/dockerfiles/ci/alpine_compile_extension/base.Dockerfile +++ b/dockerfiles/ci/alpine_compile_extension/base.Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.22 +FROM alpine:3.23 RUN mkdir -p /app WORKDIR /app @@ -34,7 +34,7 @@ RUN set -eux; \ # Minimum: libclang. Nice-to-have: full toolchain including linker to play # with cross-language link-time optimization. Needs to match rustc -Vv's llvm # version. -RUN apk add --no-cache llvm20-libs clang20-dev lld llvm20 rust-stdlib rust-src cargo clang git protoc unzip +RUN apk add --no-cache llvm21-libs clang21-dev lld llvm21 rust-stdlib rust-src cargo clang git protoc unzip RUN cargo install --force --locked bindgen-cli && mv /root/.cargo/bin/bindgen /usr/local/bin/ && rm -rf /root/.cargo From bd34e4d2dbe9ceff35fb09116523ef186b2956db Mon Sep 17 00:00:00 2001 From: Gustavo Jodar Date: Mon, 14 Sep 2026 16:11:18 +0200 Subject: [PATCH 03/16] ci: update bookworm-10 -> bookworm-11 references The Bookworm CI images were rebuilt as bookworm-11 (see dockerfiles/ci/bookworm/.env's BOOKWORM_NEXT_VERSION) to pick up the Rust 1.88.0 MSRV, but references to the old bookworm-10 tag across the generator scripts, docker-compose.yml, and the GitHub Actions asan workflow were never updated. Bump BOOKWORM_CURRENT_VERSION to 11 and BOOKWORM_NEXT_VERSION to 12 now that bookworm-11 is live. Co-Authored-By: Claude Sonnet 5 --- .claude/ci/shared-zai-tea-tests.md | 4 ++-- .github/workflows/prof_asan.yml | 4 ++-- .gitlab/generate-appsec.php | 6 +++--- .gitlab/generate-package.php | 14 +++++++------- .gitlab/generate-profiler.php | 6 +++--- .gitlab/generate-shared.php | 12 ++++++------ .gitlab/generate-tracer.php | 4 ++-- docker-compose.yml | 22 +++++++++++----------- dockerfiles/ci/bookworm/.env | 4 ++-- 9 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.claude/ci/shared-zai-tea-tests.md b/.claude/ci/shared-zai-tea-tests.md index 0d5b1520af5..87cfae17643 100644 --- a/.claude/ci/shared-zai-tea-tests.md +++ b/.claude/ci/shared-zai-tea-tests.md @@ -14,7 +14,7 @@ child pipeline; all job definitions and matrices are inline. | `C components ASAN` | `dd-trace-ci:centos-7`, `dd-trace-ci:php-compile-extension-alpine`, `dd-trace-ci:bookworm-6` | Builds C components (`components/`) with ASAN (on Debian) or plain Debug (on CentOS/Alpine), runs ctest | | `C components UBSAN` | `dd-trace-ci:bookworm-6` | Builds C components with UBSAN, runs ctest with `--repeat until-fail:10` | | `Configuration Consistency` | `dd-trace-ci:php-{latest}_bookworm-6` | Runs `tooling/generate-supported-configurations.sh` and verifies `metadata/supported-configurations.json` is up-to-date | -| `PHP lint` | `dd-trace-ci:php-{latest}_bookworm-10` | Nearly-empty PHPCS + custom scripts over `src/`; see `tooling/php-lint/` | +| `PHP lint` | `dd-trace-ci:php-{latest}_bookworm-11` | Nearly-empty PHPCS + custom scripts over `src/`; see `tooling/php-lint/` | Runner: `arch:amd64` (all jobs in this pipeline are amd64-only) @@ -270,7 +270,7 @@ Or, with the CI image: ```bash .claude/ci/dockerh --cache php-lint --overlayfs --php nts \ - datadog/dd-trace-ci:php-8.5_bookworm-10 -- \ + datadog/dd-trace-ci:php-8.5_bookworm-11 -- \ bash tooling/php-lint/run.sh ``` diff --git a/.github/workflows/prof_asan.yml b/.github/workflows/prof_asan.yml index 439ef7773c5..c778d94c4b6 100644 --- a/.github/workflows/prof_asan.yml +++ b/.github/workflows/prof_asan.yml @@ -21,7 +21,7 @@ jobs: CARGO_TARGET_DIR: /tmp/build-cargo RUST_TOOLCHAIN: nightly-2025-06-13 container: - image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-10 + image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-11 # https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions#user options: --user root @@ -90,7 +90,7 @@ jobs: CARGO_TARGET_DIR: /tmp/build-cargo UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1 container: - image: datadog/dd-trace-ci:php-8.5_bookworm-10 + image: datadog/dd-trace-ci:php-8.5_bookworm-11 options: --user root steps: diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php index ce9113d68bf..c7d6ef996b0 100644 --- a/.gitlab/generate-appsec.php +++ b/.gitlab/generate-appsec.php @@ -134,7 +134,7 @@ "test appsec extension": stage: test extends: .appsec_test - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 3 KUBERNETES_CPU_LIMIT: 3 @@ -401,7 +401,7 @@ "appsec code coverage": stage: test extends: .appsec_test - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 3 KUBERNETES_MEMORY_REQUEST: 3Gi @@ -503,7 +503,7 @@ "appsec lint": stage: test extends: .appsec_test - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 3 KUBERNETES_MEMORY_REQUEST: 9Gi diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php index 1159f438493..82dd7a1cf8d 100644 --- a/.gitlab/generate-package.php +++ b/.gitlab/generate-package.php @@ -76,13 +76,13 @@ function package_extension_jobs(array $platform, string $kind = "all"): array $asan_build_platforms = [ [ "triplet" => "x86_64-unknown-linux-gnu", - "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-10", + "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-11", "arch" => "amd64", "host_os" => "linux-gnu", ], [ "triplet" => "aarch64-unknown-linux-gnu", - "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-10", + "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-11", "arch" => "arm64", "host_os" => "linux-gnu", ] @@ -323,7 +323,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array "pecl build": stage: tracing - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-11" tags: [ "arch:amd64" ] needs: [ "prepare code" ] script: @@ -374,7 +374,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array "aggregate tracing extension: []": stage: tracing - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-11" tags: [ "arch:amd64" ] script: ls ./ variables: @@ -1276,7 +1276,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array "pecl tests": stage: verify - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_VERSION}_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_VERSION}_bookworm-11" tags: [ "arch:amd64" ] services: - !reference [.services, request-replayer] @@ -1496,7 +1496,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array variables: VALGRIND: false ARCH: "" - CONTAINER_SUFFIX: bookworm-10 + CONTAINER_SUFFIX: bookworm-11 LOADER_IMAGE_REPO: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci" needs: - job: "package loader: []" @@ -1599,7 +1599,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array tags: [ "arch:$ARCH" ] variables: ARCH: "" - CONTAINER_SUFFIX: bookworm-10 + CONTAINER_SUFFIX: bookworm-11 LOADER_IMAGE_REPO: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci" needs: - job: "package loader: []" diff --git a/.gitlab/generate-profiler.php b/.gitlab/generate-profiler.php index dac0c23de9a..366dac61da4 100644 --- a/.gitlab/generate-profiler.php +++ b/.gitlab/generate-profiler.php @@ -85,7 +85,7 @@ "clippy NTS": stage: test tags: [ "arch:amd64" ] - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 5 KUBERNETES_CPU_LIMIT: 5 @@ -107,7 +107,7 @@ "Cargo test": stage: test tags: [ "arch:amd64" ] - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.5_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.5_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 5 KUBERNETES_CPU_LIMIT: 5 @@ -129,7 +129,7 @@ "PHP language tests": stage: test tags: [ "arch:${ARCH}" ] - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11 variables: KUBERNETES_CPU_REQUEST: 5 KUBERNETES_CPU_LIMIT: 5 diff --git a/.gitlab/generate-shared.php b/.gitlab/generate-shared.php index 746e6364361..22263f702a3 100644 --- a/.gitlab/generate-shared.php +++ b/.gitlab/generate-shared.php @@ -21,7 +21,7 @@ - IMAGE: - "centos-7" - "php-compile-extension-alpine" - - "bookworm-10" + - "bookworm-11" script: - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi - if [ -d "/opt/catch2" ]; then export CMAKE_PREFIX_PATH=/opt/catch2; fi @@ -45,7 +45,7 @@ "C components UBSAN": tags: [ "arch:amd64" ] stage: test - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-11" needs: [] script: - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi @@ -69,7 +69,7 @@ "Build & Test Tea": tags: [ "arch:amd64" ] stage: build - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11" parallel: matrix: - PHP_MAJOR_MINOR: *no_asan_minor_major_targets @@ -98,7 +98,7 @@ .tea_test: tags: [ "arch:amd64" ] stage: test - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11" interruptible: true rules: - if: $CI_COMMIT_BRANCH == "master" @@ -122,7 +122,7 @@ needs: [] variables: PHP_MAJOR_MINOR: "" - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11" script: - | if ! command -v cc >/dev/null 2>&1 && ! command -v clang >/dev/null 2>&1 && ! command -v gcc >/dev/null 2>&1; then @@ -151,7 +151,7 @@ variables: PHP_MAJOR_MINOR: "" GIT_SUBMODULE_STRATEGY: none - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11" script: - switch-php nts - bash tooling/php-lint/run.sh diff --git a/.gitlab/generate-tracer.php b/.gitlab/generate-tracer.php index 5e7488158ec..c2f807389a7 100644 --- a/.gitlab/generate-tracer.php +++ b/.gitlab/generate-tracer.php @@ -69,7 +69,7 @@ function before_script_steps($with_docker_auth = false) { "compile extension: debug": stage: compile tags: [ "arch:${ARCH}" ] - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11 parallel: matrix: - PHP_MAJOR_MINOR: *all_minor_major_targets @@ -219,7 +219,7 @@ function windows_test_c_job($job_name, $thread_safety, $targets) { .base_test: stage: test tags: [ "arch:${ARCH}" ] - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11 timeout: 60m interruptible: true rules: diff --git a/docker-compose.yml b/docker-compose.yml index 1a650034967..e3d5d98aedf 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -71,19 +71,19 @@ services: # --- Alpine --- '8.0-alpine': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_alpine' } # --- Bookworm --- - '7.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_bookworm-10' } - '7.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_bookworm-10' } - '7.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.2_bookworm-10' } - '7.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.3_bookworm-10' } - '7.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4_bookworm-10' } + '7.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_bookworm-11' } + '7.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_bookworm-11' } + '7.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.2_bookworm-11' } + '7.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.3_bookworm-11' } + '7.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4_bookworm-11' } '7.4-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4-shared-ext-10' } - '8.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_bookworm-10' } + '8.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_bookworm-11' } '8.0-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0-shared-ext-10' } - '8.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.1_bookworm-10' } - '8.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.2_bookworm-10' } - '8.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.3_bookworm-10' } - '8.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.4_bookworm-10' } - '8.5-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.5_bookworm-10' } + '8.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.1_bookworm-11' } + '8.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.2_bookworm-11' } + '8.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.3_bookworm-11' } + '8.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.4_bookworm-11' } + '8.5-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.5_bookworm-11' } # --- CentOS 6 --- '7.0-centos7': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.0_centos-7' } '7.1-centos7': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.1_centos-7' } diff --git a/dockerfiles/ci/bookworm/.env b/dockerfiles/ci/bookworm/.env index ac93017a847..66daa9462f7 100644 --- a/dockerfiles/ci/bookworm/.env +++ b/dockerfiles/ci/bookworm/.env @@ -1,2 +1,2 @@ -BOOKWORM_CURRENT_VERSION=10 -BOOKWORM_NEXT_VERSION=11 +BOOKWORM_CURRENT_VERSION=11 +BOOKWORM_NEXT_VERSION=12 From 22a9a9bba49349bd6052fe075b25f5fb25d80935 Mon Sep 17 00:00:00 2001 From: Gustavo Jodar Date: Tue, 15 Sep 2026 14:23:21 +0200 Subject: [PATCH 04/16] security: bump Rust MSRV to 1.91.0 and clang/llvm to 21 Per team discussion on the aws-lc-rs/time/serde_with advisory PR: since we're already bumping the MSRV, target 1.91 directly instead of 1.88, and bump clang/llvm to 21 to match. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/prof_asan.yml | 12 +++---- .gitlab/generate-appsec.php | 8 ++--- Cargo.toml | 2 +- .../src/docker/php-buildonly-rust/Dockerfile | 2 +- dockerfiles/ci/bookworm/Dockerfile | 36 +++++++++---------- dockerfiles/ci/centos/7/base.Dockerfile | 10 +++--- dockerfiles/ci/windows/basetools.Dockerfile | 2 +- profiling/rust-toolchain.toml | 2 +- rust-toolchain.toml | 2 +- 9 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.github/workflows/prof_asan.yml b/.github/workflows/prof_asan.yml index c778d94c4b6..e4bd79a8bfc 100644 --- a/.github/workflows/prof_asan.yml +++ b/.github/workflows/prof_asan.yml @@ -53,10 +53,10 @@ jobs: run: | set -eux switch-php ${{ matrix.php-build }} - export CC=clang-20 + export CC=clang-21 export CFLAGS='-fsanitize=address -fsanitize-address-use-after-scope -fno-omit-frame-pointer' export LDFLAGS='-fsanitize=address -shared-libasan' - export RUSTC_LINKER=lld-20 + export RUSTC_LINKER=lld-21 rustup override set "${RUST_TOOLCHAIN}" export RUSTFLAGS='-Zsanitizer=address -C force-frame-pointers=yes -C link-arg=-fsanitize=address -C link-arg=-shared-libasan' export DDTRACE_PROFILING_TARGET="$(uname -m)-unknown-linux-gnu" @@ -121,11 +121,11 @@ jobs: run: | set -eux switch-php ${{ matrix.php-build }} - export CC=clang-20 - export CXX=clang++-20 + export CC=clang-21 + export CXX=clang++-21 export CFLAGS='-fsanitize=undefined,local-bounds -fno-sanitize-recover=all -fno-omit-frame-pointer' export LDFLAGS='-fsanitize=undefined,local-bounds -fno-sanitize-recover=all' - export RUSTC_LINKER=clang-20 + export RUSTC_LINKER=clang-21 export RUSTFLAGS='-C link-arg=-fsanitize=undefined,local-bounds -C link-arg=-fno-sanitize-recover=all' phpize ./configure --disable-ddtrace-tracer --enable-ddtrace-profiling @@ -139,6 +139,6 @@ jobs: cd profiling/tests cp -v $(php-config --prefix)/lib/php/build/run-tests.php . export DD_PROFILING_OUTPUT_PPROF=/tmp/pprof - ubsan_runtime=$(clang-20 -print-file-name=libclang_rt.ubsan_standalone-$(uname -m).so) + ubsan_runtime=$(clang-21 -print-file-name=libclang_rt.ubsan_standalone-$(uname -m).so) export LD_PRELOAD="$ubsan_runtime${LD_PRELOAD:+:$LD_PRELOAD}" php run-tests.php -j$(nproc) --show-diff -d extension=datadog-profiling.so phpt diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php index c7d6ef996b0..55665e14c3d 100644 --- a/.gitlab/generate-appsec.php +++ b/.gitlab/generate-appsec.php @@ -410,12 +410,12 @@ script: - | echo "Installing dependencies" - sudo apt-get update && sudo apt-get install -y jq gcovr llvm-20 clang-20 + sudo apt-get update && sudo apt-get install -y jq gcovr llvm-21 clang-21 - cd appsec/build - | cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_ENABLE_COVERAGE=ON \ -DDD_APPSEC_TESTING=ON -DCMAKE_CXX_FLAGS="-stdlib=libc++" \ - -DCMAKE_C_COMPILER=/usr/bin/clang-20 -DCMAKE_CXX_COMPILER=/usr/bin/clang++-20 \ + -DCMAKE_C_COMPILER=/usr/bin/clang-21 -DCMAKE_CXX_COMPILER=/usr/bin/clang++-21 \ -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" \ -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache" - | @@ -424,8 +424,8 @@ VERBOSE=1 make -j 4 xtest - | cd /tmp/cov-ext - llvm-profdata-20 merge -sparse *.profraw -o default.profdata - llvm-cov-20 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \ + llvm-profdata-21 merge -sparse *.profraw -o default.profdata + llvm-cov-21 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \ -format=lcov -instr-profile=default.profdata \ > "$CI_PROJECT_DIR"/appsec/build/coverage-ext.lcov - | diff --git a/Cargo.toml b/Cargo.toml index 68b42bacf13..987e1262d1d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ exclude = ["appsec/third_party/libddwaf-rust"] resolver = "2" [workspace.package] -rust-version = "1.88.0" +rust-version = "1.91.0" edition = "2021" version = "0.0.1" license = "Apache-2.0" diff --git a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile index 8b5fd1555a7..a12ef4a4d5f 100644 --- a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile +++ b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile @@ -14,7 +14,7 @@ RUN rm /etc/musl-clang.conf RUN apk --no-cache add clang21-libclang curl curl-dev && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \ - sh -s -- --default-toolchain 1.88.0 --profile minimal -y && \ + sh -s -- --default-toolchain 1.91.0 --profile minimal -y && \ rustup component add rustfmt clippy llvm-tools-preview && \ rust_toolchain="nightly-$(uname -m)-unknown-linux-musl" && \ rustup toolchain install "$rust_toolchain" \ diff --git a/dockerfiles/ci/bookworm/Dockerfile b/dockerfiles/ci/bookworm/Dockerfile index 5df41b50de8..f1e8b7e6297 100644 --- a/dockerfiles/ci/bookworm/Dockerfile +++ b/dockerfiles/ci/bookworm/Dockerfile @@ -9,10 +9,10 @@ ENV ACCEPT_EULA=Y # with cross-language link-time optimization. Needs to match rustc -Vv's llvm # version. ENV DEVLIBS \ - libclang-20-dev \ - libclang-rt-20-dev \ - llvm-20-dev \ - lld-20 \ + libclang-21-dev \ + libclang-rt-21-dev \ + llvm-21-dev \ + lld-21 \ libbrotli-dev \ libcurl4-openssl-dev \ libedit-dev \ @@ -48,8 +48,8 @@ ENV RUNTIME_DEPS \ apache2 \ apache2-dev \ ca-certificates \ - clang-format-20 \ - clang-tidy-20 \ + clang-format-21 \ + clang-tidy-21 \ curl \ debian-goodies \ git \ @@ -70,7 +70,7 @@ ENV RUNTIME_DEPS \ ENV PHPIZE_DEPS \ autoconf \ bison \ - clang-20 \ + clang-21 \ cmake \ dpkg-dev \ file \ @@ -98,12 +98,12 @@ RUN set -eux; \ echo "deb http://deb.debian.org/debian-debug/ bookworm-debug main" | \ tee -a /etc/apt/sources.list; \ \ -# Use LLVM from orig vendor (also LLVM 20 is not shipped with bookworm) +# Use LLVM from orig vendor (also LLVM 21 is not shipped with bookworm) apt-get update; \ apt-get install -y curl gnupg software-properties-common; \ curl https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc; \ - add-apt-repository "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-20 main"; \ - add-apt-repository "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-20 main"; \ + add-apt-repository "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-21 main"; \ + add-apt-repository "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-21 main"; \ \ # prevent Debian's PHP packages from being installed # https://github.com/docker-library/php/pull/542 @@ -139,14 +139,14 @@ RUN set -eux; \ chown -R circleci:circleci /var/log/nginx/ /var/lib/nginx/; \ \ # Make clang the default compiler - update-alternatives --install /usr/bin/cc cc /usr/bin/clang-20 100; \ - update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-20 100; \ - update-alternatives --install /usr/bin/clang clang /usr/bin/clang-20 100; \ - update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-20 100; \ - update-alternatives --install /usr/bin/ld ld /usr/bin/ld.lld-20 100; \ - echo "-L /usr/lib/llvm-20/lib/clang/20/lib/linux" > /usr/lib/llvm-20/bin/clang.cfg; \ + update-alternatives --install /usr/bin/cc cc /usr/bin/clang-21 100; \ + update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-21 100; \ + update-alternatives --install /usr/bin/clang clang /usr/bin/clang-21 100; \ + update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-21 100; \ + update-alternatives --install /usr/bin/ld ld /usr/bin/ld.lld-21 100; \ + echo "-L /usr/lib/llvm-21/lib/clang/21/lib/linux" > /usr/lib/llvm-21/bin/clang.cfg; \ # Include libasan library path - echo /usr/lib/llvm-20/lib/clang/20/lib/linux > /etc/ld.so.conf.d/libasan.conf && ldconfig + echo /usr/lib/llvm-21/lib/clang/21/lib/linux > /etc/ld.so.conf.d/libasan.conf && ldconfig ENV CMAKE_VERSION="3.24.4" @@ -307,7 +307,7 @@ RUN set -eux; \ chown circleci:circleci $PHP_INSTALL_DIR; # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.88.0" +ARG RUST_VERSION="1.91.0" ARG RUST_NIGHTLY_VERSION="-2025-06-13" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo diff --git a/dockerfiles/ci/centos/7/base.Dockerfile b/dockerfiles/ci/centos/7/base.Dockerfile index d291d56f00d..76cd40c3e15 100644 --- a/dockerfiles/ci/centos/7/base.Dockerfile +++ b/dockerfiles/ci/centos/7/base.Dockerfile @@ -194,7 +194,7 @@ RUN source scl_source enable devtoolset-7; set -ex; \ ENV PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig:/usr/local/openssl/lib/pkgconfig:/usr/local/zlib/lib/pkgconfig:/usr/local/curl/lib/pkgconfig:/usr/local/sqlite3/lib/pkgconfig" # Caution, takes a very long time! Since we have to build one from source, -# I picked LLVM 20, which matches Rust 1.87. +# I picked LLVM 21, which matches Rust 1.91. # Ordinarily we leave sources, but LLVM is 2GiB just for the sources... # Minimum: libclang. Nice-to-have: full toolchain including linker to play # with cross-language link-time optimization. Needs to match rustc -Vv's llvm @@ -211,7 +211,7 @@ RUN yum install -y --nogpgcheck devtoolset-9 \ && cd - \ && rm -fr "${SRC_DIR}/ninja" \ && cd /usr/local/src \ - && git clone --depth 1 -b release/20.x https://github.com/llvm/llvm-project.git \ + && git clone --depth 1 -b release/21.x https://github.com/llvm/llvm-project.git \ && mkdir -vp llvm-project/build \ && cd llvm-project/build \ && cmake -G Ninja -DLLVM_ENABLE_PROJECTS="clang;lld" -DLLVM_TARGETS_TO_BUILD=host -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DLLVM_INCLUDE_TESTS=OFF -DLLVM_ENABLE_BINDINGS=OFF -DLLVM_INSTALL_TOOLCHAIN_ONLY=ON ../llvm \ @@ -226,9 +226,9 @@ RUN yum install -y --nogpgcheck devtoolset-9 \ # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.88.0" -ARG RUST_SHA256_ARM="dbc75abc31d142eacf15e60d0e51c4f291539974221d217b80786756b0ce1d6b" -ARG RUST_SHA256_X86="ad6f0cc845e7fcca17fd451bafd2c04a7bbcb543f8f3ef5bc412fd1fef99ef7b" +ARG RUST_VERSION="1.91.0" +ARG RUST_SHA256_ARM="29c5a608861cc9c06d3f86852a7d7b1a868de2d7ab90d4ff625aeebfb9383390" +ARG RUST_SHA256_X86="bad9a353330d9f409fe9db790da5701074112f804073506bb2808dd97b940b3c" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo ENV RUSTUP_HOME=/rust/rustup diff --git a/dockerfiles/ci/windows/basetools.Dockerfile b/dockerfiles/ci/windows/basetools.Dockerfile index 7a088bed0eb..57c58f65f03 100644 --- a/dockerfiles/ci/windows/basetools.Dockerfile +++ b/dockerfiles/ci/windows/basetools.Dockerfile @@ -7,7 +7,7 @@ RUN powershell.exe "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Ne # I really need some sane file editing utilities RUN powershell "Invoke-WebRequest https://ftp.nluug.nl/pub/vim/pc/vim90w32.zip -OutFile /tmp/vim90w32.zip; Expand-Archive /tmp/vim90w32.zip /tmp; move C:\tmp\vim\vim90\tee.exe C:\Windows\tee.exe; move C:\tmp\vim\vim90\vim.exe C:\Windows\vim.exe; move C:\tmp\vim\vim90\xxd.exe C:\Windows\xxd.exe; Remove-Item /tmp/vim90w32.zip; Remove-Item -Recurse C:\tmp\vim" -RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.88.0; Remove-Item /tmp/rustup-init.exe" +RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.91.0; Remove-Item /tmp/rustup-init.exe" # Cargo's bundled libgit2 fails to check out some deeply nested git # dependencies on Windows (e.g. rust-tuf's interop-tests fixtures, pulled in diff --git a/profiling/rust-toolchain.toml b/profiling/rust-toolchain.toml index e88baf106b9..d72668b05a6 100644 --- a/profiling/rust-toolchain.toml +++ b/profiling/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.88.0" +channel = "1.91.0" diff --git a/rust-toolchain.toml b/rust-toolchain.toml index e88baf106b9..d72668b05a6 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.88.0" +channel = "1.91.0" From bfbb16491924d34adfc51708f011d699400c4e88 Mon Sep 17 00:00:00 2001 From: Gustavo Jodar Date: Tue, 15 Sep 2026 14:46:48 +0200 Subject: [PATCH 05/16] fix: update Alpine profiler clang workaround to LLVM 21 Co-Authored-By: Claude Sonnet 5 --- tooling/bin/build-debug-artifact | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tooling/bin/build-debug-artifact b/tooling/bin/build-debug-artifact index 3089fd66ef3..374463845c3 100755 --- a/tooling/bin/build-debug-artifact +++ b/tooling/bin/build-debug-artifact @@ -247,7 +247,7 @@ cp tmp/build_extension/modules/ddtrace.so /output/ddtrace.so")" if [[ "$BUILD_PROFILER" == "1" ]]; then PROFILER_SCRIPT="$(_preamble "if [ -f /sbin/apk ] && [ \$(uname -m) = 'aarch64' ]; then - ln -sf ../lib/llvm20/bin/clang /usr/bin/clang + ln -sf ../lib/llvm21/bin/clang /usr/bin/clang fi make BUILD_SUFFIX=profiler PROFILING=1 RUST_DEBUG_BUILD=1 EXTRA_CONFIGURE_OPTIONS='--disable-ddtrace-tracer --enable-ddtrace-profiling' cp ${HOME_DIR}/tmp/build_profiler/modules/datadog-profiling.so /output/datadog-profiling${EXT_SUFFIX}.so")" From a49f7dffe2dc9adab17f873a691ee0fccc744701 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Tue, 15 Sep 2026 12:03:52 -0600 Subject: [PATCH 06/16] ci: temporarily set next back to 11 so we can rebuild --- dockerfiles/ci/bookworm/.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dockerfiles/ci/bookworm/.env b/dockerfiles/ci/bookworm/.env index 66daa9462f7..132a4f90a42 100644 --- a/dockerfiles/ci/bookworm/.env +++ b/dockerfiles/ci/bookworm/.env @@ -1,2 +1,2 @@ BOOKWORM_CURRENT_VERSION=11 -BOOKWORM_NEXT_VERSION=12 +BOOKWORM_NEXT_VERSION=11 From b44881a7f40d50df41ef1e5bbbee12032bd2edd5 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Tue, 15 Sep 2026 12:15:36 -0600 Subject: [PATCH 07/16] security: bump Rust MSRV to 1.91.1 1.91.0 has a known issue; target the 1.91.1 patch release instead. Also bump the ASAN nightly pin (nightly-2025-06-13 -> nightly-2025-10-31), since it reports as rustc 1.88.0-nightly, below the new MSRV, and would fail Cargo's rust-version check. Co-Authored-By: Claude Sonnet 5 --- .claude/ci/compile-artifacts.md | 2 +- .claude/ci/github-actions-profiler.md | 4 ++-- .github/workflows/prof_asan.yml | 2 +- Cargo.toml | 2 +- .../integration/src/docker/php-buildonly-rust/Dockerfile | 2 +- dockerfiles/ci/bookworm/Dockerfile | 4 ++-- dockerfiles/ci/centos/7/base.Dockerfile | 6 +++--- dockerfiles/ci/windows/basetools.Dockerfile | 2 +- profiling/rust-toolchain.toml | 2 +- rust-toolchain.toml | 2 +- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.claude/ci/compile-artifacts.md b/.claude/ci/compile-artifacts.md index aa3a579fad5..764236a71fd 100644 --- a/.claude/ci/compile-artifacts.md +++ b/.claude/ci/compile-artifacts.md @@ -73,7 +73,7 @@ files via `classpreloader`: `_generated_api.php`, `_generated_tracer.php`, and | `aggregate tracing extension: [{arch}]` | `dd-trace-ci:php-7.4_bookworm-6` | No-op `ls` that aggregates artifacts from all `compile tracing extension` jobs for one arch into a single artifact set | | `compile tracing extension asan: [{ver}, {arch}, {triplet}]` | `dd-trace-ci:php-{ver}_bookworm-6` | Switches to `debug-zts-asan` PHP; builds `ddtrace.so` directly with `RUST_DEBUG_BUILD=1` (Rust debug profile, no `.a` intermediate); copies to `extensions_$(uname -m)/ddtrace-${ABI_NO}-debug-zts.so`; post-processes with `objcopy --compress-debug-sections` | | `compile appsec extension: [{ver}, {arch}, {triplet}]` | `dd-trace-ci:php-{ver}_{platform}` | Builds NTS and ZTS appsec extensions sequentially via cmake+make in `appsec/build/` and `appsec/build-zts/`; cmake flags: `-DCMAKE_BUILD_TYPE=RelWithDebInfo -DDD_APPSEC_TESTING=OFF -DDD_APPSEC_EXTENSION_STATIC_LIBSTDCXX=ON`; outputs `appsec_$(uname -m)/ddappsec-$PHP_API${suffix}[-zts].so`; post-processes with `objcopy --compress-debug-sections` | -| `compile profiler extension: [{ver}, {arch}, {triplet}]` | `dd-trace-ci:php-{ver}_{platform}` | Builds NTS and ZTS profiler extensions via `cargo build --profile profiler-release` in `profiling/`; for ZTS, `touch build.rs` forces the build script to re-run after `switch-php` to pick up ZTS headers; outputs `datadog-profiling[-zts].so` under a prefix dir; on alpine+aarch64 symlinks clang17 over clang20 to work around a bindgen incompatibility | +| `compile profiler extension: [{ver}, {arch}, {triplet}]` | `dd-trace-ci:php-{ver}_{platform}` | Builds NTS and ZTS profiler extensions via `cargo build --profile profiler-release` in `profiling/`; for ZTS, `touch build.rs` forces the build script to re-run after `switch-php` to pick up ZTS headers; outputs `datadog-profiling[-zts].so` under a prefix dir; on alpine+aarch64 symlinks llvm21's clang over the default clang to work around a bindgen incompatibility | | `compile loader: [{host_os}, {arch}]` | `dd-trace-ci:php-8.3_{platform}` (alpine: `php-compile-extension-alpine-8.3`) | Builds `dd_library_loader-$(uname -m)-${HOST_OS}.so` (SSI loader) via `phpize`+`configure`+`make` in `loader/`; on musl installs build deps via `apk add`; embeds `PHP_DD_LIBRARY_LOADER_VERSION` from `VERSION` file in CFLAGS | | `compile extension windows: [{ver}]` | `dd-trace-ci:php-{ver}_windows` | Runs a long-lived container via `docker run -d` + `docker exec`; builds NTS then ZTS via `phpize.bat` + `configure.bat --enable-debug-pack` + `nmake`; reuses NTS Rust `target/` for ZTS by moving it; outputs `extensions_x86_64/php_ddtrace-${ABI_NO}[-zts].dll` and `.pdb` debug symbols | | `pecl build` | `dd-trace-ci:php-7.4_bookworm-6` | Runs `tooling/bin/pecl-build` via `make build_pecl_package`; regenerates PHP bridge files via `composer -dtooling/generation`; mutates `package.xml` (version, date, file list) and `Cargo.toml` (strips profiling workspace member) in-place; produces `datadog_trace-*.tgz` via `pear package`; requires a clean tree to re-run | diff --git a/.claude/ci/github-actions-profiler.md b/.claude/ci/github-actions-profiler.md index d362ef36646..ac225c74f3f 100644 --- a/.claude/ci/github-actions-profiler.md +++ b/.claude/ci/github-actions-profiler.md @@ -237,7 +237,7 @@ export CC=clang-17 export CFLAGS="-fsanitize=address -fno-omit-frame-pointer" export LDFLAGS="-fsanitize=address -shared-libasan" export RUSTC_LINKER=lld-17 -RUST_TOOLCHAIN=nightly-2025-06-13 +RUST_TOOLCHAIN=nightly-2025-10-31 cd profiling triplet=$(uname -m)-unknown-linux-gnu @@ -260,7 +260,7 @@ DD_PROFILING_OUTPUT_PPROF=/tmp/pprof \ Requires `--user root --privileged` — ASAN needs both. -The nightly toolchain version (`nightly-2025-06-13`) is pinned in +The nightly toolchain version (`nightly-2025-10-31`) is pinned in `.github/workflows/prof_asan.yml`, not in `profiling/rust-toolchain.toml`. Check the workflow file for the current pinned version. diff --git a/.github/workflows/prof_asan.yml b/.github/workflows/prof_asan.yml index e4bd79a8bfc..83e1993c314 100644 --- a/.github/workflows/prof_asan.yml +++ b/.github/workflows/prof_asan.yml @@ -19,7 +19,7 @@ jobs: CARGO_HOME: /rust/cargo RUSTUP_HOME: /rust/rustup CARGO_TARGET_DIR: /tmp/build-cargo - RUST_TOOLCHAIN: nightly-2025-06-13 + RUST_TOOLCHAIN: nightly-2025-10-31 container: image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-11 # https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions#user diff --git a/Cargo.toml b/Cargo.toml index 987e1262d1d..7f30cc99e09 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ exclude = ["appsec/third_party/libddwaf-rust"] resolver = "2" [workspace.package] -rust-version = "1.91.0" +rust-version = "1.91.1" edition = "2021" version = "0.0.1" license = "Apache-2.0" diff --git a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile index a12ef4a4d5f..24124ef7dad 100644 --- a/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile +++ b/appsec/tests/integration/src/docker/php-buildonly-rust/Dockerfile @@ -14,7 +14,7 @@ RUN rm /etc/musl-clang.conf RUN apk --no-cache add clang21-libclang curl curl-dev && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \ - sh -s -- --default-toolchain 1.91.0 --profile minimal -y && \ + sh -s -- --default-toolchain 1.91.1 --profile minimal -y && \ rustup component add rustfmt clippy llvm-tools-preview && \ rust_toolchain="nightly-$(uname -m)-unknown-linux-musl" && \ rustup toolchain install "$rust_toolchain" \ diff --git a/dockerfiles/ci/bookworm/Dockerfile b/dockerfiles/ci/bookworm/Dockerfile index f1e8b7e6297..63523757b5b 100644 --- a/dockerfiles/ci/bookworm/Dockerfile +++ b/dockerfiles/ci/bookworm/Dockerfile @@ -307,8 +307,8 @@ RUN set -eux; \ chown circleci:circleci $PHP_INSTALL_DIR; # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.91.0" -ARG RUST_NIGHTLY_VERSION="-2025-06-13" +ARG RUST_VERSION="1.91.1" +ARG RUST_NIGHTLY_VERSION="-2025-10-31" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo ENV RUSTUP_HOME=/rust/rustup diff --git a/dockerfiles/ci/centos/7/base.Dockerfile b/dockerfiles/ci/centos/7/base.Dockerfile index 76cd40c3e15..7763353acd5 100644 --- a/dockerfiles/ci/centos/7/base.Dockerfile +++ b/dockerfiles/ci/centos/7/base.Dockerfile @@ -226,9 +226,9 @@ RUN yum install -y --nogpgcheck devtoolset-9 \ # rust sha256sum generated locally after verifying it with sha256 -ARG RUST_VERSION="1.91.0" -ARG RUST_SHA256_ARM="29c5a608861cc9c06d3f86852a7d7b1a868de2d7ab90d4ff625aeebfb9383390" -ARG RUST_SHA256_X86="bad9a353330d9f409fe9db790da5701074112f804073506bb2808dd97b940b3c" +ARG RUST_VERSION="1.91.1" +ARG RUST_SHA256_ARM="50213385f288b8760b2efd54ac066ef9a76475e778cbe3b0fcbd3f898fc00674" +ARG RUST_SHA256_X86="1c955c040dd087e4751d15588ddec288b4208bea16f8ec5046c164877e55fff7" # Mount a cache into /rust/cargo if you want to pre-fetch packages or something ENV CARGO_HOME=/rust/cargo ENV RUSTUP_HOME=/rust/rustup diff --git a/dockerfiles/ci/windows/basetools.Dockerfile b/dockerfiles/ci/windows/basetools.Dockerfile index 57c58f65f03..8feb9474d78 100644 --- a/dockerfiles/ci/windows/basetools.Dockerfile +++ b/dockerfiles/ci/windows/basetools.Dockerfile @@ -7,7 +7,7 @@ RUN powershell.exe "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Ne # I really need some sane file editing utilities RUN powershell "Invoke-WebRequest https://ftp.nluug.nl/pub/vim/pc/vim90w32.zip -OutFile /tmp/vim90w32.zip; Expand-Archive /tmp/vim90w32.zip /tmp; move C:\tmp\vim\vim90\tee.exe C:\Windows\tee.exe; move C:\tmp\vim\vim90\vim.exe C:\Windows\vim.exe; move C:\tmp\vim\vim90\xxd.exe C:\Windows\xxd.exe; Remove-Item /tmp/vim90w32.zip; Remove-Item -Recurse C:\tmp\vim" -RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.91.0; Remove-Item /tmp/rustup-init.exe" +RUN powershell "Invoke-WebRequest https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe -OutFile /tmp/rustup-init.exe; cmd /S /C /tmp/rustup-init.exe --profile minimal -y --default-toolchain=1.91.1; Remove-Item /tmp/rustup-init.exe" # Cargo's bundled libgit2 fails to check out some deeply nested git # dependencies on Windows (e.g. rust-tuf's interop-tests fixtures, pulled in diff --git a/profiling/rust-toolchain.toml b/profiling/rust-toolchain.toml index d72668b05a6..d6d33819778 100644 --- a/profiling/rust-toolchain.toml +++ b/profiling/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.91.0" +channel = "1.91.1" diff --git a/rust-toolchain.toml b/rust-toolchain.toml index d72668b05a6..d6d33819778 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,2 +1,2 @@ [toolchain] -channel = "1.91.0" +channel = "1.91.1" From e8f3cf0f10efc98881148a351c06e36d9d3ba133 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Tue, 15 Sep 2026 12:26:45 -0600 Subject: [PATCH 08/16] ci: bump maintained PHP patch versions in CI images Bump PHP 8.2, 8.3, 8.4, and 8.5 to their latest patch releases across the bookworm, centos, alpine, and windows CI image build matrices: - 8.2.31 -> 8.2.33 - 8.3.31 -> 8.3.33 - 8.4.22 -> 8.4.25 - 8.5.7/8.5.8RC1 -> 8.5.10 (also drops the bookworm 8.5.8 RC pin now that it has shipped as a GA release) sha256 hashes verified against the published php.net distributions. EOL/security-only PHP 8.0/8.1/7.x images and appsec job matrices (which only reference major.minor) are left untouched. Co-Authored-By: Claude Sonnet 5 --- .../docker-compose.yml | 16 ++++++------- dockerfiles/ci/bookworm/docker-compose.yml | 17 +++++++------ dockerfiles/ci/centos/7/docker-compose.yml | 16 ++++++------- dockerfiles/ci/windows/docker-compose.yml | 24 +++++++++---------- 4 files changed, 36 insertions(+), 37 deletions(-) diff --git a/dockerfiles/ci/alpine_compile_extension/docker-compose.yml b/dockerfiles/ci/alpine_compile_extension/docker-compose.yml index 62c580ce40d..9035b37a497 100644 --- a/dockerfiles/ci/alpine_compile_extension/docker-compose.yml +++ b/dockerfiles/ci/alpine_compile_extension/docker-compose.yml @@ -116,8 +116,8 @@ services: x-bake: *bake args: <<: *build-base - phpVersion: 8.2.31 - phpSha256Hash: 083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870 + phpVersion: 8.2.33 + phpSha256Hash: 9a525d4db1237ede408e454b46f5a93b9e45d83d71753592e3f921903d917e07 phpApi: 20220829 volumes: - ../../:/app @@ -129,8 +129,8 @@ services: x-bake: *bake args: <<: *build-base - phpVersion: 8.3.31 - phpSha256Hash: 4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f + phpVersion: 8.3.33 + phpSha256Hash: f43566da482abeb1614a512dabeda74967847ce8e176a977390d7a115e7812fd phpApi: 20230831 volumes: - ../../:/app @@ -142,8 +142,8 @@ services: x-bake: *bake args: <<: *build-base - phpVersion: 8.4.22 - phpSha256Hash: a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823 + phpVersion: 8.4.25 + phpSha256Hash: 5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db phpApi: 20240924 volumes: - ../../:/app @@ -155,8 +155,8 @@ services: x-bake: *bake args: <<: *build-base - phpVersion: 8.5.7 - phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049" + phpVersion: 8.5.10 + phpSha256Hash: "f5c0ac99b85b3d677de475c2e4f509f9b4f54663f3ee5a84d6d9481a521d4100" phpApi: 20250925 volumes: - ../../:/app diff --git a/dockerfiles/ci/bookworm/docker-compose.yml b/dockerfiles/ci/bookworm/docker-compose.yml index 643c39a1779..17c220141d4 100644 --- a/dockerfiles/ci/bookworm/docker-compose.yml +++ b/dockerfiles/ci/bookworm/docker-compose.yml @@ -23,9 +23,8 @@ services: args: <<: *build-base phpVersion: "8.5" - # 8.5.8RC1 (RC sources from ~daniels until 8.5.8 GA, ~2 Jul 2026). - phpTarGzUrl: https://downloads.php.net/~daniels/php-8.5.8RC1.tar.gz - phpSha256Hash: "57f93d2e0d76a26ac955e30cfab81dd910fc48e8bf78b3a15ff67df63a92ac72" + phpTarGzUrl: https://www.php.net/distributions/php-8.5.10.tar.gz + phpSha256Hash: "f5c0ac99b85b3d677de475c2e4f509f9b4f54663f3ee5a84d6d9481a521d4100" php-8.4: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_bookworm-$BOOKWORM_NEXT_VERSION @@ -36,8 +35,8 @@ services: args: <<: *build-base phpVersion: "8.4" - phpTarGzUrl: https://www.php.net/distributions/php-8.4.22.tar.gz - phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823" + phpTarGzUrl: https://www.php.net/distributions/php-8.4.25.tar.gz + phpSha256Hash: "5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db" php-8.3: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_bookworm-$BOOKWORM_NEXT_VERSION @@ -48,8 +47,8 @@ services: args: <<: *build-base phpVersion: "8.3" - phpTarGzUrl: https://www.php.net/distributions/php-8.3.31.tar.gz - phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f" + phpTarGzUrl: https://www.php.net/distributions/php-8.3.33.tar.gz + phpSha256Hash: "f43566da482abeb1614a512dabeda74967847ce8e176a977390d7a115e7812fd" php-8.2: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_bookworm-$BOOKWORM_NEXT_VERSION @@ -60,8 +59,8 @@ services: args: <<: *build-base phpVersion: "8.2" - phpTarGzUrl: https://www.php.net/distributions/php-8.2.31.tar.gz - phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870" + phpTarGzUrl: https://www.php.net/distributions/php-8.2.33.tar.gz + phpSha256Hash: "9a525d4db1237ede408e454b46f5a93b9e45d83d71753592e3f921903d917e07" php-8.1: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.1_bookworm-$BOOKWORM_NEXT_VERSION diff --git a/dockerfiles/ci/centos/7/docker-compose.yml b/dockerfiles/ci/centos/7/docker-compose.yml index 7879c1ab7ac..2ceb316600d 100644 --- a/dockerfiles/ci/centos/7/docker-compose.yml +++ b/dockerfiles/ci/centos/7/docker-compose.yml @@ -107,8 +107,8 @@ services: args: <<: *build-base phpVersion: "8.2" - phpTarGzUrl: https://www.php.net/distributions/php-8.2.31.tar.gz - phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870" + phpTarGzUrl: https://www.php.net/distributions/php-8.2.33.tar.gz + phpSha256Hash: "9a525d4db1237ede408e454b46f5a93b9e45d83d71753592e3f921903d917e07" image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_centos-7' php-8.3: @@ -119,8 +119,8 @@ services: args: <<: *build-base phpVersion: "8.3" - phpTarGzUrl: https://www.php.net/distributions/php-8.3.31.tar.gz - phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f" + phpTarGzUrl: https://www.php.net/distributions/php-8.3.33.tar.gz + phpSha256Hash: "f43566da482abeb1614a512dabeda74967847ce8e176a977390d7a115e7812fd" image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_centos-7' php-8.4: @@ -131,8 +131,8 @@ services: args: <<: *build-base phpVersion: "8.4" - phpTarGzUrl: https://www.php.net/distributions/php-8.4.22.tar.gz - phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823" + phpTarGzUrl: https://www.php.net/distributions/php-8.4.25.tar.gz + phpSha256Hash: "5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db" image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_centos-7' php-8.5: @@ -143,6 +143,6 @@ services: args: <<: *build-base phpVersion: "8.5" - phpTarGzUrl: https://www.php.net/distributions/php-8.5.7.tar.gz - phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049" + phpTarGzUrl: https://www.php.net/distributions/php-8.5.10.tar.gz + phpSha256Hash: "f5c0ac99b85b3d677de475c2e4f509f9b4f54663f3ee5a84d6d9481a521d4100" image: '${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.5_centos-7' diff --git a/dockerfiles/ci/windows/docker-compose.yml b/dockerfiles/ci/windows/docker-compose.yml index dd0620ed9d8..e234fe6a6a5 100644 --- a/dockerfiles/ci/windows/docker-compose.yml +++ b/dockerfiles/ci/windows/docker-compose.yml @@ -71,10 +71,10 @@ services: - windows/amd64 context: . args: - phpVersion: "8.5.7" + phpVersion: "8.5.10" vsVersion: "vs17" - phpTarGzUrl: https://www.php.net/distributions/php-8.5.7.tar.gz - phpSha256Hash: "e5eba93fd6dd3241d0e61e932eb99a3783b40568553fb0e511b660ecd863a049" + phpTarGzUrl: https://www.php.net/distributions/php-8.5.10.tar.gz + phpSha256Hash: "f5c0ac99b85b3d677de475c2e4f509f9b4f54663f3ee5a84d6d9481a521d4100" php-8.4: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.4_windows @@ -83,10 +83,10 @@ services: - windows/amd64 context: . args: - phpVersion: "8.4.22" + phpVersion: "8.4.25" vsVersion: "vs17" - phpTarGzUrl: https://www.php.net/distributions/php-8.4.22.tar.gz - phpSha256Hash: "a012c2c9724baf214a70b41b40a7e130906b8855e54268afa5bc4ae17bc9d823" + phpTarGzUrl: https://www.php.net/distributions/php-8.4.25.tar.gz + phpSha256Hash: "5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db" php-8.3: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.3_windows @@ -95,10 +95,10 @@ services: - windows/amd64 context: . args: - phpVersion: "8.3.31" + phpVersion: "8.3.33" vsVersion: "vs16" - phpTarGzUrl: https://www.php.net/distributions/php-8.3.31.tar.gz - phpSha256Hash: "4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f" + phpTarGzUrl: https://www.php.net/distributions/php-8.3.33.tar.gz + phpSha256Hash: "f43566da482abeb1614a512dabeda74967847ce8e176a977390d7a115e7812fd" php-8.2: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.2_windows @@ -107,10 +107,10 @@ services: - windows/amd64 context: . args: - phpVersion: "8.2.31" + phpVersion: "8.2.33" vsVersion: "vs16" - phpTarGzUrl: https://www.php.net/distributions/php-8.2.31.tar.gz - phpSha256Hash: "083c2f61cc5f527eb293c4c468a91af46a9678785957e023b2796a9db290d870" + phpTarGzUrl: https://www.php.net/distributions/php-8.2.33.tar.gz + phpSha256Hash: "9a525d4db1237ede408e454b46f5a93b9e45d83d71753592e3f921903d917e07" php-8.1: image: ${CI_REGISTRY_IMAGE:-datadog/dd-trace-ci}:php-8.1_windows From f439c89a519222acfe9e5f9bb2f9c948781c66e2 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 07:11:15 -0600 Subject: [PATCH 09/16] Force -std=gnu17 for PHP <8.1 alpine extension-compile builds GCC 15 (shipped in alpine:3.23) defaults to gnu23, which turns K&R-style function pointer usage in PHP <8.1's bundled/legacy C code (ext/mbstring/oniguruma, ext/standard/scanf.c) into hard compile errors instead of warnings. Pin the older dialect for those versions only; 8.1+ already builds cleanly under gnu23. Co-Authored-By: Claude Sonnet 5 --- dockerfiles/ci/alpine_compile_extension/install-php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dockerfiles/ci/alpine_compile_extension/install-php b/dockerfiles/ci/alpine_compile_extension/install-php index 2ce32e115dd..43e68025441 100755 --- a/dockerfiles/ci/alpine_compile_extension/install-php +++ b/dockerfiles/ci/alpine_compile_extension/install-php @@ -39,6 +39,12 @@ if [ "${PHP_API}" -le "${PHP_70_API}" ]; then fi export CFLAGS="$PHP_CFLAGS" +if [ "${PHP_API}" -lt "${PHP_81_API}" ]; then + # PHP < 8.1's bundled/legacy C code (e.g. ext/mbstring/oniguruma, + # ext/standard/scanf.c) relies on K&R-style function pointer semantics + # that newer GCC (>=14, defaulting to gnu23) rejects as hard errors. + export CFLAGS="$CFLAGS -std=gnu17" +fi if [ "${PHP_API}" -le "${PHP_74_API}" ]; then export CFLAGS="$CFLAGS -DHAVE_POSIX_READDIR_R=1 -DHAVE_OLD_READDIR_R=0" fi From 912c4e3ca868db3985aa76bb93e825563fd893bd Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 10:08:57 -0600 Subject: [PATCH 10/16] Bump appsec lint/test clang tooling from 20 to 21 The bookworm-11 CI image's apt.llvm.org source only serves llvm-toolchain-bookworm-21 (bumped alongside the Rust 1.91.0 MSRV bump in 22a9a9bba); version-20 packages no longer exist there. The "appsec code coverage" job was updated at the time, but the shared .appsec_test before_script and "appsec lint" were missed, leaving them installing clang-tidy-20/libc++-20-dev/libc++abi-20-dev/ clang-format-20, which now fail with "Unable to locate package". Co-Authored-By: Claude Sonnet 5 --- .gitlab/generate-appsec.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php index 55665e14c3d..705af1a16c4 100644 --- a/.gitlab/generate-appsec.php +++ b/.gitlab/generate-appsec.php @@ -73,7 +73,7 @@ - when: on_success before_script: - - sudo apt install -y clang-tidy-20 libc++-20-dev libc++abi-20-dev + - sudo apt install -y clang-tidy-21 libc++-21-dev libc++abi-21-dev - mkdir -p appsec/build boost-cache boost-cache cache: - key: "appsec boost cache" @@ -510,15 +510,15 @@ KUBERNETES_MEMORY_LIMIT: 10Gi ARCH: amd64 script: - - sudo apt install -y clang-format-20 + - sudo apt install -y clang-format-21 - cd appsec/build - | cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_ENABLE_COVERAGE=OFF \ -DDD_APPSEC_TESTING=OFF -DCMAKE_CXX_FLAGS="-stdlib=libc++" \ -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" \ -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache" \ - -DCLANG_TIDY=/usr/bin/run-clang-tidy-20 \ - -DCLANG_FORMAT=/usr/bin/clang-format-20 + -DCLANG_TIDY=/usr/bin/run-clang-tidy-21 \ + -DCLANG_FORMAT=/usr/bin/clang-format-21 - make -j 4 extension - make format tidy From d5180d02c3850ba79492fd8442d90d2b6275621c Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 11:19:30 -0600 Subject: [PATCH 11/16] ci: bump bookworm next version to 12 We've finished building and testing bookworm-11; bump BOOKWORM_NEXT_VERSION to 12 so that CI runs without a preceding commit don't clobber the bookworm-11 images we're relying on. Co-Authored-By: Claude Sonnet 5 --- dockerfiles/ci/bookworm/.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dockerfiles/ci/bookworm/.env b/dockerfiles/ci/bookworm/.env index 132a4f90a42..66daa9462f7 100644 --- a/dockerfiles/ci/bookworm/.env +++ b/dockerfiles/ci/bookworm/.env @@ -1,2 +1,2 @@ BOOKWORM_CURRENT_VERSION=11 -BOOKWORM_NEXT_VERSION=11 +BOOKWORM_NEXT_VERSION=12 From 456acc4817ef15cf34d83fe0af062048f1c4772c Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 11:56:08 -0600 Subject: [PATCH 12/16] fix: reformat appsec extension sources for clang-format-21 The appsec lint job bumped its clang tooling from v20 to v21 (v20 packages no longer exist in apt.llvm.org's bookworm feed). v21 changed pointer spacing for pointer-to-pointer nullable/nonnull annotations (`Type *nullable *nonnull` -> `Type * nullable * nonnull`); v20 and v21 disagree and each rejects the other's output, since appsec/.clang-format has no AttributeMacros entry for nullable/nonnull. Reformat the affected files with clang-format-21 to match the CI job's now-pinned tool version. Co-Authored-By: Claude Sonnet 5 --- appsec/src/extension/commands_helpers.c | 4 ++-- appsec/src/extension/ddtrace.c | 12 ++++++------ appsec/src/extension/telemetry.c | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/appsec/src/extension/commands_helpers.c b/appsec/src/extension/commands_helpers.c index a92e7fa2ce3..e3a512a5277 100644 --- a/appsec/src/extension/commands_helpers.c +++ b/appsec/src/extension/commands_helpers.c @@ -46,7 +46,7 @@ static dd_result ATTR_WARN_UNUSED _imsg_recv(dd_imsg *nonnull imsg, static inline ATTR_WARN_UNUSED mpack_error_t _imsg_destroy( dd_imsg *nonnull imsg); -static void _imsg_cleanup(dd_imsg *nullable *nonnull imsg); +static void _imsg_cleanup(dd_imsg * nullable * nonnull imsg); static void _set_redirect_code_and_location( struct block_params *nonnull block_params, @@ -276,7 +276,7 @@ static inline ATTR_WARN_UNUSED mpack_error_t _imsg_destroy( return mpack_tree_destroy(&imsg->_tree); } -static void _imsg_cleanup(dd_imsg *nullable *nonnull imsg) +static void _imsg_cleanup(dd_imsg * nullable * nonnull imsg) { dd_imsg **imsg_c = imsg; if (*imsg_c) { diff --git a/appsec/src/extension/ddtrace.c b/appsec/src/extension/ddtrace.c index c55e3b21e82..5a009ffc1ec 100644 --- a/appsec/src/extension/ddtrace.c +++ b/appsec/src/extension/ddtrace.c @@ -49,11 +49,11 @@ static void _register_testing_objects(void); static const uint8_t *(*nullable _datadog_get_formatted_session_id)(void); static uint64_t (*nullable _datadog_get_sidecar_queue_id)(void); #ifdef ZTS -static ddog_SidecarTransport *nullable *nonnull ( - *nullable _ddtrace_get_sidecar_transport)(void *nullable tsrm_ls); +static ddog_SidecarTransport * nullable * + nonnull (*nullable _ddtrace_get_sidecar_transport)(void *nullable tsrm_ls); #else -static ddog_SidecarTransport *nullable *nonnull ( - *nullable _ddtrace_get_sidecar_transport)(void); +static ddog_SidecarTransport * nullable * + nonnull (*nullable _ddtrace_get_sidecar_transport)(void); #endif static zend_object *(*nullable _ddtrace_get_root_span)(void); static void (*nullable _ddtrace_close_all_spans_and_flush)(void); @@ -75,11 +75,11 @@ static void *(*nullable _ddtrace_emit_asm_event)(void); static zend_string *(*nullable _ddtrace_guess_endpoint_from_url)( const char *nonnull url, size_t url_len); static ddog_AppsecCResponse (*nullable _ddog_sidecar_send_appsec_message)( - ddog_SidecarTransport *nonnull *nonnull transport, uint64_t client_id, + ddog_SidecarTransport * nonnull * nonnull transport, uint64_t client_id, ddog_CharSlice data); static ddog_AppsecCResponse ( *nullable _datadog_sidecar_send_appsec_message_without_reconnect)( - ddog_SidecarTransport *nonnull *nonnull transport, uint64_t client_id, + ddog_SidecarTransport * nonnull * nonnull transport, uint64_t client_id, ddog_CharSlice data); static void (*nullable _ddog_sidecar_appsec_response_drop)( ddog_AppsecCResponse response); diff --git a/appsec/src/extension/telemetry.c b/appsec/src/extension/telemetry.c index ab5b32c94dd..0cf6fa38171 100644 --- a/appsec/src/extension/telemetry.c +++ b/appsec/src/extension/telemetry.c @@ -32,8 +32,8 @@ static THREAD_LOCAL_ON_ZTS bool _schema_extracted; static zend_string *nullable _duration_ext_tags_from_cache(void); static zend_string *nonnull _framework_tag(zend_object *nullable root_span); -static void _release_zstr(zend_string *nullable *nonnull slot); -static void _cache_replace(zend_string *nullable *nonnull slot, +static void _release_zstr(zend_string * nullable * nonnull slot); +static void _cache_replace(zend_string * nullable * nonnull slot, const char *nonnull val, size_t val_len); void dd_telemetry_startup(void) @@ -313,7 +313,7 @@ static zend_string *nullable _duration_ext_tags_from_cache(void) return tags_zstr; } -static void _release_zstr(zend_string *nullable *nonnull slot) +static void _release_zstr(zend_string * nullable * nonnull slot) { if (*slot) { zend_string_release(*slot); @@ -321,7 +321,7 @@ static void _release_zstr(zend_string *nullable *nonnull slot) } } -static void _cache_replace(zend_string *nullable *nonnull slot, +static void _cache_replace(zend_string * nullable * nonnull slot, const char *nonnull val, size_t val_len) { _release_zstr(slot); From 3c2d083a5bb9d1302bca5bb03895beb208cf2783 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 11:56:09 -0600 Subject: [PATCH 13/16] fix: honor caller-supplied CLANG_FORMAT/CLANG_TIDY in appsec cmake Both cmake modules unconditionally ran hardcoded old-version autodetection (LLVM 20 for clang-format, LLVM 17 for clang-tidy) even when CLANG_FORMAT/CLANG_TIDY was already passed via -D. A plain set() shadows the CACHE variable for the rest of the configure run, so an explicit override only survived when every detection branch happened to fail to find a same-named old-version binary. Wrap the detection in if(CLANG_FORMAT)/if(CLANG_TIDY) so a caller-specified path is always honored. Co-Authored-By: Claude Sonnet 5 --- appsec/cmake/clang-format.cmake | 50 ++++++++++++---------- appsec/cmake/clang-tidy.cmake | 76 +++++++++++++++++---------------- 2 files changed, 67 insertions(+), 59 deletions(-) diff --git a/appsec/cmake/clang-format.cmake b/appsec/cmake/clang-format.cmake index 31d5b14c22c..bd00fe39b6c 100644 --- a/appsec/cmake/clang-format.cmake +++ b/appsec/cmake/clang-format.cmake @@ -1,31 +1,35 @@ -set(_LLVM20_FORMAT /opt/homebrew/opt/llvm@20/bin/clang-format) -if(EXISTS ${_LLVM20_FORMAT}) - set(CLANG_FORMAT ${_LLVM20_FORMAT}) - message(STATUS "Using Homebrew LLVM 20 clang-format: ${CLANG_FORMAT}") +if(CLANG_FORMAT) + message(STATUS "Using caller-specified clang-format: ${CLANG_FORMAT}") else() - find_program(_CF_VERSIONED clang-format-20) - if(NOT _CF_VERSIONED STREQUAL _CF_VERSIONED-NOTFOUND) - set(CLANG_FORMAT ${_CF_VERSIONED}) + set(_LLVM20_FORMAT /opt/homebrew/opt/llvm@20/bin/clang-format) + if(EXISTS ${_LLVM20_FORMAT}) + set(CLANG_FORMAT ${_LLVM20_FORMAT}) + message(STATUS "Using Homebrew LLVM 20 clang-format: ${CLANG_FORMAT}") else() - find_program(_CF_UNVERSIONED clang-format) - if(NOT _CF_UNVERSIONED STREQUAL _CF_UNVERSIONED-NOTFOUND) - execute_process( - COMMAND ${_CF_UNVERSIONED} --version - OUTPUT_VARIABLE _CF_VERSION - OUTPUT_STRIP_TRAILING_WHITESPACE - ERROR_QUIET) - if(_CF_VERSION MATCHES " 20\\.") - set(CLANG_FORMAT ${_CF_UNVERSIONED}) + find_program(_CF_VERSIONED clang-format-20) + if(NOT _CF_VERSIONED STREQUAL _CF_VERSIONED-NOTFOUND) + set(CLANG_FORMAT ${_CF_VERSIONED}) + else() + find_program(_CF_UNVERSIONED clang-format) + if(NOT _CF_UNVERSIONED STREQUAL _CF_UNVERSIONED-NOTFOUND) + execute_process( + COMMAND ${_CF_UNVERSIONED} --version + OUTPUT_VARIABLE _CF_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE + ERROR_QUIET) + if(_CF_VERSION MATCHES " 20\\.") + set(CLANG_FORMAT ${_CF_UNVERSIONED}) + endif() endif() endif() - endif() - if(NOT CLANG_FORMAT) - set(CLANG_FORMAT ${CMAKE_CURRENT_LIST_DIR}/clang-tools/clang-format) - if(NOT EXISTS ${CLANG_FORMAT}) - message(STATUS "Cannot find clang-format version 20, either set CLANG_FORMAT or make it discoverable") - return() + if(NOT CLANG_FORMAT) + set(CLANG_FORMAT ${CMAKE_CURRENT_LIST_DIR}/clang-tools/clang-format) + if(NOT EXISTS ${CLANG_FORMAT}) + message(STATUS "Cannot find clang-format version 20, either set CLANG_FORMAT or make it discoverable") + return() + endif() + message(STATUS "Using Docker-based clang-format wrapper: ${CLANG_FORMAT}") endif() - message(STATUS "Using Docker-based clang-format wrapper: ${CLANG_FORMAT}") endif() endif() diff --git a/appsec/cmake/clang-tidy.cmake b/appsec/cmake/clang-tidy.cmake index 76d687b43b6..4c20713c3c4 100644 --- a/appsec/cmake/clang-tidy.cmake +++ b/appsec/cmake/clang-tidy.cmake @@ -1,46 +1,50 @@ -# Prefer a locally installed LLVM 17 run-clang-tidy (e.g. via brew install llvm@17) -# over the Docker-based wrapper, since native execution avoids SDK incompatibilities. -set(_LLVM17_BIN /opt/homebrew/opt/llvm@17/bin) -set(_LLVM17_TIDY ${_LLVM17_BIN}/run-clang-tidy) set(CLANG_TIDY_BINARY_OPT "") -if(EXISTS ${_LLVM17_TIDY}) - set(CLANG_TIDY ${_LLVM17_TIDY}) - set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_LLVM17_BIN}/clang-tidy) - message(STATUS "Using Homebrew LLVM 17 run-clang-tidy: ${CLANG_TIDY}") +if(CLANG_TIDY) + message(STATUS "Using caller-specified run-clang-tidy: ${CLANG_TIDY}") else() - find_program(_RCT_VERSIONED run-clang-tidy-17) - if(NOT _RCT_VERSIONED STREQUAL _RCT_VERSIONED-NOTFOUND) - set(CLANG_TIDY ${_RCT_VERSIONED}) - find_program(_CT_VERSIONED clang-tidy-17) - if(NOT _CT_VERSIONED STREQUAL _CT_VERSIONED-NOTFOUND) - set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_VERSIONED}) - endif() + # Prefer a locally installed LLVM 17 run-clang-tidy (e.g. via brew install llvm@17) + # over the Docker-based wrapper, since native execution avoids SDK incompatibilities. + set(_LLVM17_BIN /opt/homebrew/opt/llvm@17/bin) + set(_LLVM17_TIDY ${_LLVM17_BIN}/run-clang-tidy) + if(EXISTS ${_LLVM17_TIDY}) + set(CLANG_TIDY ${_LLVM17_TIDY}) + set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_LLVM17_BIN}/clang-tidy) + message(STATUS "Using Homebrew LLVM 17 run-clang-tidy: ${CLANG_TIDY}") else() - find_program(_RCT_UNVERSIONED run-clang-tidy) - if(NOT _RCT_UNVERSIONED STREQUAL _RCT_UNVERSIONED-NOTFOUND) - # Verify version via co-located clang-tidy - get_filename_component(_RCT_DIR ${_RCT_UNVERSIONED} DIRECTORY) - find_program(_CT_COLOCATED clang-tidy HINTS ${_RCT_DIR} NO_DEFAULT_PATH) - if(NOT _CT_COLOCATED STREQUAL _CT_COLOCATED-NOTFOUND) - execute_process( - COMMAND ${_CT_COLOCATED} --version - OUTPUT_VARIABLE _CT_VERSION - OUTPUT_STRIP_TRAILING_WHITESPACE - ERROR_QUIET) - if(_CT_VERSION MATCHES " 17\\.") - set(CLANG_TIDY ${_RCT_UNVERSIONED}) - set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_COLOCATED}) + find_program(_RCT_VERSIONED run-clang-tidy-17) + if(NOT _RCT_VERSIONED STREQUAL _RCT_VERSIONED-NOTFOUND) + set(CLANG_TIDY ${_RCT_VERSIONED}) + find_program(_CT_VERSIONED clang-tidy-17) + if(NOT _CT_VERSIONED STREQUAL _CT_VERSIONED-NOTFOUND) + set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_VERSIONED}) + endif() + else() + find_program(_RCT_UNVERSIONED run-clang-tidy) + if(NOT _RCT_UNVERSIONED STREQUAL _RCT_UNVERSIONED-NOTFOUND) + # Verify version via co-located clang-tidy + get_filename_component(_RCT_DIR ${_RCT_UNVERSIONED} DIRECTORY) + find_program(_CT_COLOCATED clang-tidy HINTS ${_RCT_DIR} NO_DEFAULT_PATH) + if(NOT _CT_COLOCATED STREQUAL _CT_COLOCATED-NOTFOUND) + execute_process( + COMMAND ${_CT_COLOCATED} --version + OUTPUT_VARIABLE _CT_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE + ERROR_QUIET) + if(_CT_VERSION MATCHES " 17\\.") + set(CLANG_TIDY ${_RCT_UNVERSIONED}) + set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_COLOCATED}) + endif() endif() endif() endif() - endif() - if(NOT CLANG_TIDY) - set(CLANG_TIDY ${CMAKE_CURRENT_LIST_DIR}/clang-tools/run-clang-tidy) - if(NOT EXISTS ${CLANG_TIDY}) - message(STATUS "Cannot find clang-tidy version 17, either set CLANG_TIDY or make it discoverable") - return() + if(NOT CLANG_TIDY) + set(CLANG_TIDY ${CMAKE_CURRENT_LIST_DIR}/clang-tools/run-clang-tidy) + if(NOT EXISTS ${CLANG_TIDY}) + message(STATUS "Cannot find clang-tidy version 17, either set CLANG_TIDY or make it discoverable") + return() + endif() + message(STATUS "Using Docker-based run-clang-tidy wrapper: ${CLANG_TIDY}") endif() - message(STATUS "Using Docker-based run-clang-tidy wrapper: ${CLANG_TIDY}") endif() endif() From 9640661798d7360ef07cfb021f2c1693844a3968 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 12:39:59 -0600 Subject: [PATCH 14/16] style: fix/suppress clang-tidy-21 warnings --- appsec/src/extension/.clang-tidy | 4 +++- appsec/src/extension/json_truncated_parser.cpp | 2 +- appsec/src/extension/logging.c | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/appsec/src/extension/.clang-tidy b/appsec/src/extension/.clang-tidy index e5aeb8efaf9..612c66e5645 100644 --- a/appsec/src/extension/.clang-tidy +++ b/appsec/src/extension/.clang-tidy @@ -1,3 +1,5 @@ -Checks: '-fuchsia-trailing-return,-hicpp-vararg,-cppcoreguidelines-pro-type-vararg,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,-cppcoreguidelines-pro-bounds-array-to-pointer-decay' +# clang-analyzer-security.ArrayBound misidentifies the zval member as the bounds +# of its containing Bucket in PHP's ZEND_HASH_FOREACH_FROM macro (PHP 8.2+). +Checks: '-fuchsia-trailing-return,-hicpp-vararg,-cppcoreguidelines-pro-type-vararg,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,-cppcoreguidelines-pro-bounds-array-to-pointer-decay,-clang-analyzer-security.ArrayBound' InheritParentConfig: true diff --git a/appsec/src/extension/json_truncated_parser.cpp b/appsec/src/extension/json_truncated_parser.cpp index a01331a367c..e9acc24c524 100644 --- a/appsec/src/extension/json_truncated_parser.cpp +++ b/appsec/src/extension/json_truncated_parser.cpp @@ -280,7 +280,7 @@ class ToZvalHandler { return false; } - zval *container = value_stack_.back(); + const zval *container = value_stack_.back(); if (Z_TYPE_P(container) == IS_ARRAY) { zval *new_val; diff --git a/appsec/src/extension/logging.c b/appsec/src/extension/logging.c index 9f0327066b3..90231e3e178 100644 --- a/appsec/src/extension/logging.c +++ b/appsec/src/extension/logging.c @@ -277,7 +277,7 @@ static void _mlog_syslog(dd_log_level_t level, const char *format, va_list args, vspprintf(&message_data, 0, format, args); -#if !defined(ZTS) +#ifndef ZTS syslog(prio, "%s %d:%s %s", #else syslog(prio, "[%ld] %s:%d:%s %s", (long)tsrm_thread_id(), @@ -378,7 +378,7 @@ static void _mlog_file(dd_log_level_t level, const char *format, va_list args, _format_time(time_str, sizeof time_str, &ts, 3); } -#if !defined(ZTS) +#ifndef ZTS data_len = spprintf(&data, 0, "[%s][%d][%s] %s at %s:%d:%s\n", time_str, getpid(), #else From 1370afc714ed9ba7e3fd88b41d6395f30d09f73e Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 13:05:07 -0600 Subject: [PATCH 15/16] ci: update shared extension images to generation 11 --- .gitlab/generate-package.php | 2 +- .gitlab/generate-shared.php | 2 +- docker-compose.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php index 82dd7a1cf8d..df0f0aa077a 100644 --- a/.gitlab/generate-package.php +++ b/.gitlab/generate-package.php @@ -1311,7 +1311,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array "min install tests": stage: verify - image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.0-shared-ext-10 + image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.0-shared-ext-11 tags: [ "arch:amd64" ] variables: MAX_TEST_PARALLELISM: 8 diff --git a/.gitlab/generate-shared.php b/.gitlab/generate-shared.php index 22263f702a3..12384ee6c25 100644 --- a/.gitlab/generate-shared.php +++ b/.gitlab/generate-shared.php @@ -197,7 +197,7 @@ ?> "ZAI Shared Tests: []": extends: .tea_test - image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php--shared-ext-10" + image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php--shared-ext-11" needs: - job: "Build & Test Tea" parallel: diff --git a/docker-compose.yml b/docker-compose.yml index e3d5d98aedf..9d24921fe64 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -76,9 +76,9 @@ services: '7.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.2_bookworm-11' } '7.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.3_bookworm-11' } '7.4-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4_bookworm-11' } - '7.4-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4-shared-ext-10' } + '7.4-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-7.4-shared-ext-11' } '8.0-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0_bookworm-11' } - '8.0-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0-shared-ext-10' } + '8.0-bookworm-shared-ext': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.0-shared-ext-11' } '8.1-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.1_bookworm-11' } '8.2-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.2_bookworm-11' } '8.3-bookworm': { <<: *linux_php_service, image: 'datadog/dd-trace-ci:php-8.3_bookworm-11' } From e6c99cabec80df7066167bd93731948638844c91 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 16 Sep 2026 16:17:43 -0600 Subject: [PATCH 16/16] ci: refresh all published AppSec image digests --- .../integration/gradle/tag_mappings.gradle | 278 +++++++++--------- 1 file changed, 139 insertions(+), 139 deletions(-) diff --git a/appsec/tests/integration/gradle/tag_mappings.gradle b/appsec/tests/integration/gradle/tag_mappings.gradle index 45968c7129b..3548460f2ae 100644 --- a/appsec/tests/integration/gradle/tag_mappings.gradle +++ b/appsec/tests/integration/gradle/tag_mappings.gradle @@ -1,143 +1,143 @@ // Auto-generated tag mappings with SHA256 hashes -// Generated on Wed Sep 09 13:18:41 WEST 2026 +// Generated on 2026-09-16 from published Docker Hub image digests ext.tag_mappings = [ - 'apache2-mod-php-8.0-release-zts': 'sha256:1ec27ddcab6ccc5a456df8f187753a4dc7c6f7d3db53ebcd6ad1e40652e9799b', - 'apache2-mod-php-8.1-release-zts': 'sha256:868c28fb32df0d3f19e2d3e846650d89c1263dd8e60b477015424f81a672e264', - 'apache2-mod-php-8.0-debug': 'sha256:c4e92530ae95e06e768a1060959c819f16ec7f84cb5a275f8076701ed1eb38f4', - 'apache2-mod-php-8.2-release-zts': 'sha256:90942df408dc3661cda07d5b7dcf6e9df2c629669d49fade90cfbddb729f6731', - 'apache2-mod-php-7.2-debug': 'sha256:a05992780a2b8c04e3feec6e8db5003326e31fd64955aeff1970d29dcf99ff85', - 'php-8.0-release-zts': 'sha256:64ab48c04c369199902284dab310364c141a5f3e16ea49b805ed8a3901a580f1', - 'apache2-fpm-php-7.0-release': 'sha256:fbe45298e8692bbc9f475ec40a0d3ee3d049250b25291823db8c3b20f4e694ca', - 'nginx-fpm-php-8.1-release-zts': 'sha256:51d8029f2a1e7c6130fbe023ac5942410ee70987c06dae26e6b923a1cb9ace7f', - 'php-8.5-release-zts': 'sha256:a848b31c902ae88bfaca9018a4c7dbfd69b313ce879d800950491e32352f50f6', - 'nginx-fpm-php-8.0-release-zts': 'sha256:effe78f60f306dbbf2a11a71124f437e1d7f0d83c7f78121ae82a417dbf18a74', - 'nginx-fpm-php-8.2-release': 'sha256:86cf231fd48946c4cc9a43f2985bb20147f98b8e6962193ad390b849ded89c8a', - 'php-8.4-release-zts': 'sha256:4463200f7ab025f7a2eb1455a57d67a578f18464c93f7236bbe8a3235accfe37', - 'php-8.0-release': 'sha256:e463bd5d1986da902008a48ef1fda3e7652354f1b14a4eab7ad6777d1a550327', - 'nginx-fpm-php-8.2-release-zts': 'sha256:5846c3b4c29111b508be9e430f284db92bb11418b7c1b42a1a79c6b20f65f8e2', - 'nginx-fpm-php-8.3-release-zts': 'sha256:becae18d7377e76dcee5bb3718da7b68528fa3ebefa51bed31e85fc6b95988a6', - 'php-8.2-release-zts': 'sha256:c7c7d1c38e384370612f5eb560f29b3bebb3dd260ade5690bda7f9e907e4d98b', - 'php-8.3-release-zts': 'sha256:99ad83043fa59d8e26127a8ea9098815a1a4eb82354efe2a272202dec4802ff3', - 'nginx-fpm-php-8.5-release-zts': 'sha256:c772da3b69fa51e60ecbe2ef5d7c469fb0144693833f2039cfb5cd0a3a90b71a', - 'php-8.1-release-zts': 'sha256:8ced1605675d8ad1bfd486b542e01dec96ca5560aecb1732d787edc8fdd0e46b', - 'apache2-mod-php-8.3-debug': 'sha256:744210a673704e1c66a95ff8d7879a0f3d7be9eecad8d704982a98f106727e0c', - 'apache2-fpm-php-7.4-release': 'sha256:f46b4a9e7e240d314b2706abb92fc5c2c461e72d2c15431eb048b7ba7260575a', - 'apache2-mod-php-7.4-release': 'sha256:67720ff1bcf1d148add940422f28a7802f73ea3bc98a3c088e67c6f44e46b104', - 'nginx-fpm-php-8.4-release-zts': 'sha256:6ce94bd02ddfcf23fb852f38c302b6176193c3c3778dcbd660a3d64ff381b964', - 'php-8.0-debug': 'sha256:317ef523eee71609aa0332fea10b7f6d887a660a02017d0d916f95c6f4b0d102', - 'nginx-fpm-php-8.4-debug': 'sha256:32c9775119c618935deeadec9c7bbecd259be2b024be2e8741840995bae93362', - 'apache2-fpm-php-8.1-debug': 'sha256:dd81326d8ec68f418fbdf3d03972e77cd5ad17810d7ef5f79a64ca29363b66c2', - 'apache2-fpm-php-8.4-release': 'sha256:d8715ec45f9ea65a7ebf68514633adecdb9c7e7c8c1e7dd96e4ae5fcd50c8f05', - 'apache2-fpm-php-8.0-release': 'sha256:1c74607f4dcec8db78b8021006da1351e841a64a55c658e527875ada611e5b2f', - 'apache2-fpm-php-8.4-debug': 'sha256:c7f3cd7dc85be812a849b19599d5573d0852d55ec5e9294575e2c1cfac567767', - 'nginx-fpm-php-7.3-release': 'sha256:0f35329bc72aa7312901f9143c18216a1b7b10bb9bd75dff1ffbad5ee54c66ce', - 'nginx-fpm-php-8.1-debug': 'sha256:558d9c871c7646bd41793eac8eb6bc287e1a44795d90eb5cc845bd12e1d312cd', - 'apache2-mod-php-7.0-release': 'sha256:e074a703c4913a25c39ee2b3f4f5dbf4c77560904a51cc947f1dae110d1ecee0', - 'php-7.1-release': 'sha256:337098405a381e6d3da90ad2e9796d3c5b8f5ebdce2afd640919d7bc05565a8c', - 'php-8.4-release': 'sha256:84e5b62c6774249061e987e688cce7815421d78b951e7908b118edc5c54d6949', - 'apache2-mod-php-8.4-release-zts': 'sha256:c732eb48c8e5c89597dc61fc0f8a8569b40b6b1433d986724f893cdd919b7fdc', - 'nginx-fpm-php-8.5-release-musl': 'sha256:b1c3d5013c3fd0a84ec59555b2b9d7e1eaf3e9499a1b3b012ccea8e2c3a0c5b3', - 'apache2-mod-php-8.3-release-zts': 'sha256:706b91f7bdf8b41997ccb7ec11a78844a3e875cc0022ace0ebfa1b7877ad5afd', - 'apache2-mod-php-8.5-release-zts': 'sha256:bd9ab58e2966591bf8158be7fc3d6639fbc4a63de3674b255bb803a95a19261c', - 'apache2-mod-php-8.5-release-zts-musl': 'sha256:1a52c94c407a5ab117d585a97c482f677a842b6d74757d1c6bd08f80b87ea247', - 'php-7.2-debug': 'sha256:a1079fdd679e26c71ffc000a2d07877f06f8b5cf0c361449b1bc0de32c15e4da', - 'apache2-mod-php-8.3-release': 'sha256:8541ad173963ff652a6cfc5e0d51f6f72add6775c0b21c9c413eac9afb8ec6e5', - 'apache2-mod-php-7.1-release': 'sha256:a4810c786a0dfb1dcc4558c9e75de6a273cc1515d31056e1aadbd3fbdceffe31', - 'apache2-fpm-php-7.1-release': 'sha256:38a14e81bed9265accc6a29ecb6ab5b6fffd1873821f61cbe79ad4cde31d451e', - 'php-7.2-release': 'sha256:b5ee7601b0d824718515d0bcb2a06b0abc49e0599fe53fecac1323e98d2c8826', - 'toolchain': 'sha256:a766a7b14d48a4afe13330e9f21d470abadb73eb2714b5e8a5a6e6f8a25f3627', - 'nginx-fpm-php-8.1-release': 'sha256:d2e5f486767806afd340527a15b141e49bc35d81c2bdc5095dcd1e14d52c853c', - 'php-8.3-debug': 'sha256:af16ce3044440fe97989412b2aea4f99f83ceea015dd9494e896eb02b47b3a56', - 'nginx-fpm-php-7.3-debug': 'sha256:7c55eabb9cbff74ab93819a801e752b7f5b6b98095d2985ac65ec8d112b50b73', - 'apache2-mod-php-7.3-debug': 'sha256:1dbf2f52e3412c07cd2c953d700d40911023fcf3cff882754242b0c747476c63', - 'apache2-fpm-php-7.3-debug': 'sha256:8cc12e3d42a1b7e1736e13b5b2c9aa5ca81622d5e2431207c65f3268a4efd857', - 'apache2-mod-php-8.2-release': 'sha256:52d82c13315447c77b91fca370d38e21d81a383bb72bf6f009ddc0c9f1e1291b', - 'apache2-mod-php-8.1-debug': 'sha256:21f172a9387cff8b25a59d89cc26f5fc4b1ff9f356b56e17e311538fc446996c', - 'nginx-fpm-php-8.5-release': 'sha256:17bfcb86e62f88ec4fe6aa11f4f92c6878032521b5b66b891278c25c71fe11c2', - 'nginx-fpm-php-7.0-release': 'sha256:a5d2ba506ce0b8c19fbc72e85d4ad58acb63a0858524c11862bde42f8c9e26bf', - 'php-buildonly-rust': 'sha256:d45f643cab93b14e8f5c9669f98723c3034d9c64c3b5aa7f8bc58bbe8a023550', - 'php-7.4-debug': 'sha256:8610a07debe741a598db85be387be4d88f2001ff050b123c29fac306dd4faf71', - 'php-8.3-release': 'sha256:e59a97d22a81adc09b481efaa1449dfcf0890cc3b0baf45b502c1a9670cd3281', - 'nginx-fpm-php-8.2-debug': 'sha256:d0a4db68335c44fc842cf7beca5040c5d80c35a44250fa5691cf6732127b892f', - 'apache2-fpm-php-7.4-debug': 'sha256:d1a29f51f79a6963e600bdbc61ce4ae27907d0c8a372491f676758ea483eee42', - 'php-8.2-debug': 'sha256:85a2988138295651c509c1bbe05a32c2345e8718bc587b17efa565dcdb1a57a3', - 'nginx-fpm-php-7.4-release': 'sha256:0535be025505ede9bf950c0977dd94003a6b09e0bccaa4ee3682e86e82986085', - 'nginx-fpm-php-7.4-debug': 'sha256:50489afecbaa18bb2f9d8fb0a2d9c74c5271bb43a3e3b67e9aea3c67efb26a3d', - 'apache2-fpm-php-8.3-release': 'sha256:29005203e833ef560589ff6f0d8f7d8c9cbe90aaae201b0697ab5e5cbaf7d143', - 'apache2-fpm-php-8.2-debug': 'sha256:dcc7dbd8dbcea6c8ecd403f08f883108b8c7887f5cfcfed6857503f9ba87357a', - 'apache2-fpm-php-8.0-debug': 'sha256:cc83667f279d60e46fb5073a41ad21694a15cf591293f1eef5292eb0e32875a2', - 'php-8.1-debug': 'sha256:f86d71a40585eec4a8b82c2eafba1fd63a71a6ce27aabe2f0e57e1cc02620c3e', - 'apache2-fpm-php-7.2-release': 'sha256:ba310d6205049d9986efdd2aaf5aefdfcd664fd08e74dce7ec42da5b11430868', - 'apache2-mod-php-7.2-release': 'sha256:99ed56add78bd9cb484f0486137a9fa69002325b2d56963989778e25374a15c3', - 'php-8.4-debug': 'sha256:a0f2056a3a485e0a16405647f5042891cfe6e28809cb72f04a2b9ce7a13f23e4', - 'nginx-fpm-php-8.0-release': 'sha256:dce9b420db770566a33dbb02e1e333c8dfadcd979af65a11a4e8e33d2331353f', - 'apache2-fpm-php-8.3-debug': 'sha256:d3898f769cd21c13dcb8b1aad6c5623869b97f56a30b381bfa9488b271241ff3', - 'apache2-mod-php-7.4-release-zts': 'sha256:fa5e41c06b7398df1ff77baa8d72d54aa51a3c0c7125660de1112995dc2f787a', - 'php-7.3-release': 'sha256:b7e789f571ab59fb7047c5ff5cfe36db91f8ff6e63ff19be53b08d5faa4a0c15', - 'nginx-fpm-php-8.0-debug': 'sha256:48aad3ac7f06b1092d76cd93d43a17de52bd8b9763f22ef0a0aa44f9516605ec', - 'frankenphp-8.4-release-zts': 'sha256:bab3d74869bb0f812c37afc5ae926c4f2ab9d2553e212b0be1c61e9f2c4444e6', - 'nginx-fpm-php-8.4-release': 'sha256:ed7e88fa1d5948164cf8d3ef6c69256456f441f9bdf4e344b8adc287ac1639b4', - 'apache2-mod-php-7.2-release-zts': 'sha256:d724e504c9101a2a32f23ca04f1f5f2b68fddf7c2aad9989d58474e69e59a49d', - 'php-7.3-debug': 'sha256:43b4be513b6af7370e287dda5100529954e0294f516c8539e93d9c63a40d2217', - 'nginx-fpm-php-8.3-debug': 'sha256:f73724c919fdd9f95b5d12dc583275461dee0e5639e6944650ad6e29d360c1b1', - 'apache2-mod-php-7.3-release-zts': 'sha256:1b6656e56a21887d8238613ca890b4daee6ee7584894c3893db2b7b97afb33a5', - 'apache2-fpm-php-8.2-release': 'sha256:c0582afccc7e0ba9fe6ddd4c44c3aafa0a08982aab75e91aa50145e1ed68a754', - 'nginx-fpm-php-7.4-release-zts': 'sha256:7cdf740549e52352476e35b7e4c98197ce9b83ba8938a6255d521f34a08e6f07', - 'apache2-mod-php-7.1-debug': 'sha256:223b6d64159f5dea0295038ba48dc4384631c01612cca1dd2047e4c620c93471', - 'apache2-mod-php-8.1-release': 'sha256:85144c1df3a7d90c84cf087a3d20b36919da9c24759d605df6243a6963fd7e6f', - 'nginx-fpm-php-7.2-release-zts': 'sha256:ea1d87126d99b6fac1521e0a970438d6b7c7ccbaa7831d5aa283202b4600bfaf', - 'nginx-fpm-php-7.1-release-zts': 'sha256:e81b776d0bf185ea67171eb424be154e3febd5588aabf79fbb9e62b8aa8e47ee', - 'nginx-fpm-php-7.0-release-zts': 'sha256:faccbb53bb05810f1a6b649052f3640a5088cb5319aa26767ed4402958725717', - 'apache2-mod-php-8.5-release': 'sha256:1a2d6e7079509016c422911df0b97e82541f7047e3e22ab7b59772046a92586b', - 'php-deps': 'sha256:b508a8208375089008d8af206b598a74f3803e9cfce922ae8fddcb3caae434d2', - 'nginx-fpm-php-7.1-release': 'sha256:94931b029123181558a3364b3f6bdf2649cc868d6fd6b66c1103f370eb5b0335', - 'nginx-fpm-php-7.2-debug': 'sha256:caf2f0475cdcccff1c4afbcb8c8ecaf10b2f9b40ae66a53e4952c82f794f8ca0', - 'apache2-mod-php-7.4-debug': 'sha256:630d8a9c72030f4cae0a8153bd889a0be03a4837c7a5ea1a4a1cf3c5f6b04a1a', - 'php-8.2-release': 'sha256:deb4d6f51367a1cdc4de3066184117a99eabb107a53a4bc0dace9f38d06fce03', - 'apache2-mod-php-8.2-debug': 'sha256:06abafb37afea7fa5bb8c8472ccb8eed185ec810531e2d7da37efbb2952f1f4d', - 'apache2-fpm-php-7.2-debug': 'sha256:53b5cc4625d5cfccea6cb3cba2460bf08e8917dbb274ae23f191476ec9c0cf41', - 'nginx-fpm-php-7.3-release-zts': 'sha256:227ee52ce0288fa9ef46631dc92cfc9cd952a4e5cf22682c24ae12a926bc2271', - 'php-7.1-debug': 'sha256:24e100d4afd215c17228071d8b45fa74f36eaa285a334b5e3859c1a7db5ab986', - 'apache2-fpm-php-7.3-release': 'sha256:6e0d9d837d68122d1d31b474b1f24489fbb834049ec3fa1095e4bde4a8d0bd0b', - 'apache2-mod-php-7.3-release': 'sha256:915789a485d2f392611e9c1d01a07c60b66235330fe0ce14e0e6ed8c9810c3aa', - 'apache2-fpm-php-7.0-debug': 'sha256:3b7eff73d28fd0160a6d81cb52ff090ab22af08671c92ea3b402ba406314adbd', - 'nginx-fpm-php-8.5-debug': 'sha256:fe0d659c4137da2787af987c8c3aeb7dd89e5705f1525b053d0817a216473740', - 'apache2-mod-php-7.0-debug': 'sha256:195cae08e97c6a775c32d7c8e038ae11d16dddcce15aaed76bca4411c875c17c', - 'apache2-mod-php-8.5-debug': 'sha256:92d6a0d636a79c665e5d4c1016795227b9e6563bd6f87edd39f19491d77c183a', - 'apache2-fpm-php-8.5-debug': 'sha256:70dd59bcf6a2c3f0b6da897156ecf07ac231b21a15f405f3bd927a168d00aec5', - 'apache2-fpm-php-8.5-release-zts': 'sha256:38fcb031768c702e0ed05c81198f3d938b5d11186282c9cd1b8ccb4fc4579b3e', - 'apache2-fpm-php-8.3-release-zts': 'sha256:7fa1c46e8b966449c86a38f089ad9f1976083508435f9ead3f0d56ffa4717fb1', - 'apache2-fpm-php-8.2-release-zts': 'sha256:ec5a41dbf3c14b0ce18b8406dcca77359f01a893dc1bca97b37f7d74410a956c', - 'apache2-fpm-php-8.4-release-zts': 'sha256:ceb69bc77cdb115aed6c06f8f12bc77e15c2498d1b9a58132c0ba8acfe94d8a8', - 'php-7.4-release': 'sha256:e81d9542b908431606b10ad5fb94c3460d99c286c463ea0df120eb0079d6f567', - 'nginx-fpm-php-7.0-debug': 'sha256:252682463d4a3fc3b1efad08dc9ef1b3c2babc7e473bc1985fc8c699f621c507', - 'apache2-fpm-php-8.0-release-zts': 'sha256:64b16950fb3c1197ecd10a01a3e82b1466b16017c70ae818523ae0bc95e91063', - 'apache2-fpm-php-8.1-release-zts': 'sha256:d41328abb9e091b69f812894f4dbf72e5fb92118ef4ee0798367b161812c11d4', - 'nginx-fpm-php-8.3-release': 'sha256:7b7eee91140e1f13f3a6aa3002d9b47523171048dccd14d84e70c06723b731ff', - 'apache2-fpm-php-7.1-debug': 'sha256:0f6bd8538100f3821bd6a333a6491e7ec80272dd8d176588ec1a0297f409f878', - 'apache2-fpm-php-8.1-release': 'sha256:3f04471bd87f474a5a9d1a43dd448d83de21b7097b3854a8c5263797f618e463', - 'apache2-mod-php-7.1-release-zts': 'sha256:f48cc7e7de7b95d36f67cfc8cc3383a7519ab10beaafdb952862529d15e36426', - 'apache2-mod-php-8.0-release': 'sha256:b3b37df4edcc5d7d247baccce1ff0ece98b3b98397f7a2c6023220fdd27f438a', - 'apache2-fpm-php-7.4-release-zts': 'sha256:5af1ed750f986e8a053737a14293ca3e1e00b54d96908bd1906c479b00935fc5', - 'apache2-mod-php-7.0-release-zts': 'sha256:f1fa92ed6f02d8f190426fba16b30ffe7b16edcf8ac695bf7f3831452184fb7a', - 'apache2-fpm-php-7.3-release-zts': 'sha256:c0b53081f845c2cc624a96c9a627483e52afd1dea98f8da9871cb6716014f24c', - 'apache2-fpm-php-8.5-release': 'sha256:98085f0c1c1f3f284f7733dbea97625b4585868ef801b21ff26c1aa40adfca72', - 'php-7.0-debug': 'sha256:6aa8eef5c2481dc8f2ccad5c944bbaf028c32c35d00c34a4684d4400145bae28', - 'php-8.1-release': 'sha256:7642b87e085a46ccc3e150d9b3126d74442de53ef3933a313d61c2c5ad437448', - 'apache2-fpm-php-7.0-release-zts': 'sha256:5bb7d35994b5c515431198d940afd2cad38ebeee8d2dd2f1f9b00ca0115a48c8', - 'php-7.4-release-zts': 'sha256:69a162f08a3624698755aee55dc0c9274bb94e7a0a17798332af973cf9bd0b83', - 'php-7.3-release-zts': 'sha256:ffa07abdb553986c3661338260cc7da69a3bfcaf0b7e5f6604b137761e39ca4a', - 'apache2-fpm-php-7.1-release-zts': 'sha256:173cbb136a55c6e53d1a5349e384ae63a9031286301e590234097b3242849a02', - 'nginx-fpm-php-7.2-release': 'sha256:eba17c5c1accd0b3a5a2960b5c800fcbb94601a4dd01c8b1c4ca13a1f118d2db', - 'apache2-fpm-php-7.2-release-zts': 'sha256:93e9255f96f1be77c6f4deaf45a2860e7ad108883a63485cfc4c98eef9f31ca6', - 'nginx-fpm-php-7.1-debug': 'sha256:1f6f4baea50128488a2c8a33e6e866290887b8878e640b48b5b168798c0f466c', - 'php-7.2-release-zts': 'sha256:92238d94546ca19aa3d6624f4f266477e5170d7f26d339ed16439bd4f87ce0eb', - 'apache2-mod-php-8.4-debug': 'sha256:a50ff11f182fee1bd47c00c46f0ed66bca4983080cf940da6ef2f59021a742e9', - 'php-8.5-debug': 'sha256:d1ecd2336ec798a49b71dc96b6d0048e68b9af010235dc5d386a6d86f9be48e4', - 'php-7.0-release-zts': 'sha256:d1da63de5ae1a246834d48c59a7498aa85571829fdc1c732742ebd1abc4b1486', - 'php-7.0-release': 'sha256:daa2b3a6882e9dab031e5710c16a18ff180d1039657d9a3b707ae4632a9e5ac6', - 'apache2-mod-php-8.4-release': 'sha256:5b99592005857c7cc9239eb59fc0ca51316549ea00aabbc93a24b6bb72ec1319', - 'php-8.5-release': 'sha256:be46f53286dd2e36b8bf5bb1d0a0c0c9fb9f11f99fadd763dbbcaac0a60eb0ce', - 'php-7.1-release-zts': 'sha256:2e1994affb98efbb3ac6f3134cf75d678a1979753ee5a7841c9aaa2b103749b1' + 'apache2-mod-php-8.0-release-zts': 'sha256:01a2601d12c300eb8aa605821eb1947084be1c7b5404c2ae2a12a1014a9d8335', + 'apache2-mod-php-8.1-release-zts': 'sha256:14018e800491a147ec852c84db519a0a7bdceb43e35e0ab066cf52d0c1c152f8', + 'apache2-mod-php-8.0-debug': 'sha256:31f1fe41d70850e81d5b231d00c49d0ccce4db45d2e69e74f07d99f704b365af', + 'apache2-mod-php-8.2-release-zts': 'sha256:a73177556227701c7c4982d55afcc7a5d5242ea79232384ce50b5fe4c589a7d0', + 'apache2-mod-php-7.2-debug': 'sha256:fb79a68f3d042d69993dac9e0d946b65848dfd64ed0172333e0bdab31c5d3e2d', + 'php-8.0-release-zts': 'sha256:8d9b70b0a8561b95e10849d40a77f37e1b29e91f4ed74e1e2b708762f629c33d', + 'apache2-fpm-php-7.0-release': 'sha256:01c3af40224d4fc24a48fa52a4cd037b2daa5e53c51f2c5d7b1fb901d12f1955', + 'nginx-fpm-php-8.1-release-zts': 'sha256:8f4bf34c2e76a8a27a6c373b15ce269a5c80009216bdcedd3117a333414e3562', + 'php-8.5-release-zts': 'sha256:c349521cd3fcc05b2239ff50c1dc61ecfff2aa6806125b49772ac0bc9f68eaa9', + 'nginx-fpm-php-8.0-release-zts': 'sha256:cca7faff6ac332b1f6c17bb93f2298678409de87b4a900027ac50b1d418735f8', + 'nginx-fpm-php-8.2-release': 'sha256:c21ae2a52c1b53bd695b7b36680dfbd7fc187083fdd4d62fcfcb480186dcf774', + 'php-8.4-release-zts': 'sha256:d4244498e17d542bcae2a160f01df4a5bc56ad84b707a4b7a6cca88167c3a8e4', + 'php-8.0-release': 'sha256:8417ae113d678089721bbd1559d607165c471f0ae81917ef6709017cabba0af8', + 'nginx-fpm-php-8.2-release-zts': 'sha256:551333291ad342fac07a98e547d5f5a2a57c86c7856d40ea4d9a9e57fa58a443', + 'nginx-fpm-php-8.3-release-zts': 'sha256:85403a71fe123bdc4e5bfc1d0d85205409f5201cf957aab17a3d5b8deb04cf36', + 'php-8.2-release-zts': 'sha256:b225aab931b61009f52207b922a2bb4275b9e7fc9e745556bb194e73789ce969', + 'php-8.3-release-zts': 'sha256:c78aeef12f34613afac823acfb55e2cad3c944d748918439eb158c3f2ebc71d7', + 'nginx-fpm-php-8.5-release-zts': 'sha256:f47bc31b1a4d0d3715c920f2dbe99c893a180d4fbe0c44c81fcba91090ab1625', + 'php-8.1-release-zts': 'sha256:163c58a9af0715719e323b10a7da52b038b651efcb71d4f6809953bbecf79bc4', + 'apache2-mod-php-8.3-debug': 'sha256:3f1f7cf15b801315ee3338683f905103a32c72d38675e49b470e30599e85edd0', + 'apache2-fpm-php-7.4-release': 'sha256:38553129b6256ddffc987d372f69cd5a1ed5630af974f13e0bc3d815462d88e2', + 'apache2-mod-php-7.4-release': 'sha256:cf52af405eae5c03b11a2ad444f4250064d4eac878e0c6271f50910c8f411d2d', + 'nginx-fpm-php-8.4-release-zts': 'sha256:e49458c08fce0c7ae37c437d10c53894c167e0173891be732241d696ce825b9d', + 'php-8.0-debug': 'sha256:6a095998575a69c40f6fb7fcca51e839a130062e81a65afe9cf8552d29a11abc', + 'nginx-fpm-php-8.4-debug': 'sha256:c3d626e46897b47e9bb858eab7c52e2af989cb875d94b57cb9bcec35423c0d52', + 'apache2-fpm-php-8.1-debug': 'sha256:d3e4373710c5027e8c3acc70b059a8a92db72d8b8bb081a488e391eb15c442cd', + 'apache2-fpm-php-8.4-release': 'sha256:1fba4063d2aa7ff918b24da376eef349d4389677a506729e550618cde9344925', + 'apache2-fpm-php-8.0-release': 'sha256:92774417887e16f44654706f3d8f992afc609187187c3a75a87959e17851e711', + 'apache2-fpm-php-8.4-debug': 'sha256:da5b3314ce5f13e4cb39f555a820867afd178c52e4022c9ae6ce9dfa23f755d2', + 'nginx-fpm-php-7.3-release': 'sha256:88bec126ae9600acb458311d1a62595f79c028ee2cc64c6ff3f29ee7ff611dda', + 'nginx-fpm-php-8.1-debug': 'sha256:ba4153e1c3f7ac949c57a16b839c253010a054dedaf99e75776820e2b36efc7b', + 'apache2-mod-php-7.0-release': 'sha256:ce5043c34891d8de5fc0f9b73aad954103525803a6000ba39384fd2737963518', + 'php-7.1-release': 'sha256:1ce642e14910abf901ab9219d243631717ec02f5ec5d9a459d7e47d00c7b5b33', + 'php-8.4-release': 'sha256:427733c4229a39a174d955b180c4eb60fd7b0ab2fec9b23d26ff370471348de8', + 'apache2-mod-php-8.4-release-zts': 'sha256:17477c7d355c286d665c94d4b7691a2a04e469c46eabc6db889352d4187edcd8', + 'nginx-fpm-php-8.5-release-musl': 'sha256:f5e8543f806fd72e030f27d38a87faf34fc94babbd6aa9f4f5a9f0c79858165e', + 'apache2-mod-php-8.3-release-zts': 'sha256:44e0ac5327184f41593adc9a87a367c22ac9e060a435a76b8c07d3febc343d6f', + 'apache2-mod-php-8.5-release-zts': 'sha256:9d7b507214102a9b842f55acd31bc67a233e9b166fbfe15b191d64897b1a9ecb', + 'apache2-mod-php-8.5-release-zts-musl': 'sha256:60b7e0d7ac481e1ccd819a8c593a8c030ebf5cdea0be3b0550ffb4af24877436', + 'php-7.2-debug': 'sha256:6c535cca69a18e559611387960ade0c58e068ac7af019090bcf7e923423bf09a', + 'apache2-mod-php-8.3-release': 'sha256:046b85b7d888280af5d567f070c0af1630c61cb82dc858185d2ccf350bd83a35', + 'apache2-mod-php-7.1-release': 'sha256:f473324544476db662edf0a24c3b9a054613d9dbf830d30c94ce51c03fd20198', + 'apache2-fpm-php-7.1-release': 'sha256:f859ddb527ecf194b0bee00844ad3011bc95e07336b2f4faf0cb3e98d5fae282', + 'php-7.2-release': 'sha256:7343b395750fa033af74a8660b4aebc6d363bb71711566b3ddff6f2d8adbb4d3', + 'toolchain': 'sha256:ca29aafcf4cb6534a7e62fb059380db765badf5d98ac770059dcf0a08a64f4ca', + 'nginx-fpm-php-8.1-release': 'sha256:1c37687d118f7dd6632b101ec9b534a552c9fb189a389caeef32b84449e64474', + 'php-8.3-debug': 'sha256:b9853a202772691599da8873c9df951ecf5cf9130aa03e3404dc59ae842466c5', + 'nginx-fpm-php-7.3-debug': 'sha256:b5c96909c874174c8734845d3965bb9723e8b5fb5bd17b9f116eb3d624cb9727', + 'apache2-mod-php-7.3-debug': 'sha256:24a79a4e675495036c063f24b05aff7dc224ffe078a6b5b5fc80771239fe06bb', + 'apache2-fpm-php-7.3-debug': 'sha256:a197d747eaa38832fc51f7d5e0e3a75c16e100e0c8bcfdc0c95b4d56107a6089', + 'apache2-mod-php-8.2-release': 'sha256:1f28fc32098d2ec8f30dd71080b0cd2f8b4063ab347e346d4b1e335d756f85bf', + 'apache2-mod-php-8.1-debug': 'sha256:21c847f137ad29f0a838d7d708d493aab8bdb799da7b7c6ef6af251a6c69415d', + 'nginx-fpm-php-8.5-release': 'sha256:ecbe7f1988471ab1ca7ec265e65d0830a15153432d8d7e799733b28788d2ef2e', + 'nginx-fpm-php-7.0-release': 'sha256:7ee641e16a72cd01264f62202d80375395a96f6d788ddef3b349f931834b3ff8', + 'php-buildonly-rust': 'sha256:b8d78fb9d67c213ea2f9174f453f9ef6c7a314128edf53f51ce5b07d2039e07e', + 'php-7.4-debug': 'sha256:fb825bb21e30efd48b9ea631821160a385882af4c8e94327f1433be3e59c4b40', + 'php-8.3-release': 'sha256:108e1da453422b91eb43a404c47aa98831b40c3f00a100dd2816f7797ca7ed42', + 'nginx-fpm-php-8.2-debug': 'sha256:4b7413c77ee562ed7d835602f48e64632f4586e86ae67df9fd5494d19b7467aa', + 'apache2-fpm-php-7.4-debug': 'sha256:3adfc8d1602fc749e7b19a9eadf558fea865cf24f480de7906cec149ad346520', + 'php-8.2-debug': 'sha256:85edb76eea81e9d93017c0c3321dbf4a3ef9503012a623ae3c19ea408d96d09c', + 'nginx-fpm-php-7.4-release': 'sha256:6ca54805d00b2c3aa373c6329097229aafff524eb28b72ed6875ff88ca471eed', + 'nginx-fpm-php-7.4-debug': 'sha256:89eef5a2e667133299478264de50437cc60564aa62f432e7183340d43dda02b2', + 'apache2-fpm-php-8.3-release': 'sha256:2f62cf81fd0a4e0a7988569f52676f890bad79ef90735d1f35acb774e5b5ebd7', + 'apache2-fpm-php-8.2-debug': 'sha256:4aaa61894e539104e52599cd431685c54fddf370664897a1e81624feada7e362', + 'apache2-fpm-php-8.0-debug': 'sha256:6a13a3b23dc805dee3b4c4dce70ac3acf9428f4d48f1aebfdd2a29cfebd2c1ed', + 'php-8.1-debug': 'sha256:68a2a672c77bb13ffc6ce3ffb19dfaa4a6d5ff53fb46cff9bf1a10937ebda208', + 'apache2-fpm-php-7.2-release': 'sha256:299c61c1a9833950b3e0249f0b0205baae9bb7de30224bb8c76601e59c5b4cf3', + 'apache2-mod-php-7.2-release': 'sha256:9eecf1480e5688ce760615fccc4a40dc802234d7633087296c57c4182bb8d57b', + 'php-8.4-debug': 'sha256:e967af610902bc85cee16327dbeaac2276366bb2223c1beecb8850236227f7b1', + 'nginx-fpm-php-8.0-release': 'sha256:e36a25ccafde70951be6ddcaf146ed8f95f69c95c6ce94675e1e055f869a1345', + 'apache2-fpm-php-8.3-debug': 'sha256:4b39910270d54e6ef9ea8f629afb188f9970443ef1429a890c49ab339475e8de', + 'apache2-mod-php-7.4-release-zts': 'sha256:ebed946bbbeeccc0938db0dc142fd3c05ea2a1e43b7046ce9d6cbe7e81cec9f6', + 'php-7.3-release': 'sha256:e8997bb577811e52c90bc1e715bb2174e63bbe31f0f5b4d104334c6295f1ec1d', + 'nginx-fpm-php-8.0-debug': 'sha256:11473fd37e6e7915e2d1b0149eb1c3a11cf5f1adb06f660be76ea525e07a9757', + 'frankenphp-8.4-release-zts': 'sha256:19d9dece81e49cecbc20f3bb125d7790fccaaf1834113e0978cf8b64f735d482', + 'nginx-fpm-php-8.4-release': 'sha256:2b9a13dd8dad466619d923ab0b7626629c128e7a03bea81904c61b84b8a0c5c1', + 'apache2-mod-php-7.2-release-zts': 'sha256:c9aecda5480255362f03295187194d5e2d10009ea5ec1f785f182e7df52a7d36', + 'php-7.3-debug': 'sha256:5ebee7d89acfb4c9a425960ea09b0ebfcd6fffabe164d8ae3cc864f579d779e4', + 'nginx-fpm-php-8.3-debug': 'sha256:e2e8737b13685567acdf468681a30c05472be234ff1542c58dc117950b41341b', + 'apache2-mod-php-7.3-release-zts': 'sha256:78300aabb21b1c6c423967ecc5d154a943e45b2bfcb6973107856bf5ece71190', + 'apache2-fpm-php-8.2-release': 'sha256:f0c90356ba9c93af84df3de454a5494cc53815195f7c90f4feb94db1a0360855', + 'nginx-fpm-php-7.4-release-zts': 'sha256:76e278fe24b31cf4bb3499de06993edb654c24eb33119de414a5fe990922ce8c', + 'apache2-mod-php-7.1-debug': 'sha256:c4bce63cd9c5d627ffb6d85195136a7c423cf9d87a6b66217505a98592f2f0b2', + 'apache2-mod-php-8.1-release': 'sha256:bbb3c3df22f54138452c61e3110aef7991bc3f1fdf553a0840f5a92d6a8e6bab', + 'nginx-fpm-php-7.2-release-zts': 'sha256:a844144fddf63d3eb86e5f758ce54810784f30a2f926432c06f18fa29c634ea1', + 'nginx-fpm-php-7.1-release-zts': 'sha256:d87c17426aa62983a10a0151a54fcccae23a74d42ba8882241481a2e3c5ee0c5', + 'nginx-fpm-php-7.0-release-zts': 'sha256:52839466643b7577b67553016b9dc403e715bc05b26f413dba9c8415ece55d32', + 'apache2-mod-php-8.5-release': 'sha256:b1f3824e3001278482fd0cd42301eceb1dc0fad714196c3fd77e6a01938b1b03', + 'php-deps': 'sha256:3945f7a040985967096a8adb26495f04bca760e86e968b11fb14e2561f913d69', + 'nginx-fpm-php-7.1-release': 'sha256:dfd997d9e5a0cef2fb7a978faafa5ebc54c0ac3000cd9e945172553a2989b3ba', + 'nginx-fpm-php-7.2-debug': 'sha256:3f2d4229fa2e6a579d1d9075a81dceeee64e2fa88f6275aa7d2369596d49047d', + 'apache2-mod-php-7.4-debug': 'sha256:c54224a6efde743cbeeddc6664ba518f686da02ac03eff0946f6deda895df3cf', + 'php-8.2-release': 'sha256:8329ab532b9281fa8bcd0f023f77f53227a2bcb9649a84f6b28fb80ec3c758d8', + 'apache2-mod-php-8.2-debug': 'sha256:78f66e52d813ca6da826b0bac1db79a4cfb2e86e44fdee3c6dc4aec0200ef7f6', + 'apache2-fpm-php-7.2-debug': 'sha256:f9409248e43fe3c9464a8bd01b127072034541194a47ec346fbe806c8970d18c', + 'nginx-fpm-php-7.3-release-zts': 'sha256:2e1961e1ad4f576719f1d2c231e078c622889104ede5ffaa6eb8629ea49a514a', + 'php-7.1-debug': 'sha256:fd8f6544059628200c7d236e9dd66149731fec781d8ab60f181686dab0c57dad', + 'apache2-fpm-php-7.3-release': 'sha256:ec7b76198d922e4e4fa1e42d1d0a12adbdf52746d6858471111e14bf55ed79b2', + 'apache2-mod-php-7.3-release': 'sha256:72f6bd24c0c35979fec586106df5c390b22f6314c18c4f6462de05a9bdd5548c', + 'apache2-fpm-php-7.0-debug': 'sha256:64f9d732959afb210bb77d4a36b280b32cb3b1b6ebea3054dcfa2a46386ef330', + 'nginx-fpm-php-8.5-debug': 'sha256:cb8e39e67460a2c7dd1d9d9159060ceade0e2c1f23c2936c0859417ece6e3c07', + 'apache2-mod-php-7.0-debug': 'sha256:ace045ef758b022e11ce94f05f0c6e79328099bd3d1965105d7d4d1079e6be43', + 'apache2-mod-php-8.5-debug': 'sha256:0fadd4379b0d4c4360d897aabbe1102ef7a2fd3877efee2512613e8f620bcf22', + 'apache2-fpm-php-8.5-debug': 'sha256:46b1723eac4cdb48fe322e613036f5279414eabfc2c3c32777f181e9e050f631', + 'apache2-fpm-php-8.5-release-zts': 'sha256:a97533d59e44ef0099e4c808fccdd15150fd20250cf69bcf8ec349874f632d70', + 'apache2-fpm-php-8.3-release-zts': 'sha256:83adb22dafac1a51200ffceba55e043acb68dc90c977503b39856bf52c6abfdf', + 'apache2-fpm-php-8.2-release-zts': 'sha256:f2c8a68ea0b0ccf62f1dd13dfabd2e09ebe2c2c5a26275e50035bc8bcfc963c4', + 'apache2-fpm-php-8.4-release-zts': 'sha256:0ab860d3aee3a5ce1ca4dfa4be49a814df105098e99f7da4d0fc70fe2b70cbc3', + 'php-7.4-release': 'sha256:c25d6aa1bcd68c1591a0acb0855a51e4ccd866d75d90a5894496f40d667a9b40', + 'nginx-fpm-php-7.0-debug': 'sha256:9a9c318b2eca805db471ab75a5cc3fc77afa46426fdcdc2b3e7dddde90b77b0a', + 'apache2-fpm-php-8.0-release-zts': 'sha256:f98a7a7d54db9ea1ccbfe4a33a3194c711ad4a8ab17d4670d268b9cdc849fc74', + 'apache2-fpm-php-8.1-release-zts': 'sha256:767206f9925b10721d85aad1e5b39d5d34b8ab1ceca39cbc25d169ab91f750fe', + 'nginx-fpm-php-8.3-release': 'sha256:1ecd47ab62294c1409a893133747824f1830c12b9dd706a7cb37c026dff9002d', + 'apache2-fpm-php-7.1-debug': 'sha256:1c04c6be4392ff90bea26697697c7f1513ff77a1af9040e62a539f731f15ae02', + 'apache2-fpm-php-8.1-release': 'sha256:88dd71a7986d5eaf5bcb83143e753eff19374d1742f23c31ad0c6d309564ca8e', + 'apache2-mod-php-7.1-release-zts': 'sha256:43ec4e9a920c0169f594f0845584bd622f3d0b13975732f5b14c9a77c4b951f6', + 'apache2-mod-php-8.0-release': 'sha256:6aa68d7bc64cf4ecdc6d2172f11bb3e023dcaf4f604309c73e9fcc44bd779884', + 'apache2-fpm-php-7.4-release-zts': 'sha256:f6c02525c46fd93435c885c0048d9803e41dce39a9b0b281725d0d1453102cde', + 'apache2-mod-php-7.0-release-zts': 'sha256:b31a0ba2c313e6dd60a820ee3f91b536c85c31d9e376a8be5be47bfa59465bbc', + 'apache2-fpm-php-7.3-release-zts': 'sha256:5ba72c2978561bf69ac31e26c0ad5e39c0580bc282d162471a39fb667b310c8b', + 'apache2-fpm-php-8.5-release': 'sha256:a3fb4521fbdbb34778d60616967acac78ca10081386d12aeb81d0cea9b05ebd8', + 'php-7.0-debug': 'sha256:7837eb24fa9c7d29fce7991d6f8ccec755fb565f04448bb76089709dbd8cb8de', + 'php-8.1-release': 'sha256:2c12f91b442ec55fe3f95b2e4645a08bac708450ac5c5c42fd78cef73a50e600', + 'apache2-fpm-php-7.0-release-zts': 'sha256:d8ce728ef34c625e2407abe50b6e1d1ca7d28166a837f349b33a4216e3f0eb01', + 'php-7.4-release-zts': 'sha256:73fe5c614ac5ad17510b5185271551fced4e33f36c08fff3779e93fbc25d8b32', + 'php-7.3-release-zts': 'sha256:6d6c2352db27a6a1a70cc8e7f82da56e2d6cbc07876d503a720e7f021094e1d2', + 'apache2-fpm-php-7.1-release-zts': 'sha256:65ec19468be9146c345d76c6e22c1b4ca019654071cc9134d23f1563cfd985db', + 'nginx-fpm-php-7.2-release': 'sha256:b71c703b80f0a3fada7dad014bd3b305355cb9856a2a1152037f69b86c48d618', + 'apache2-fpm-php-7.2-release-zts': 'sha256:e64e4eb70aebb917700e895b143e7b597eefd8995c4b3239d106d7a45346a0f5', + 'nginx-fpm-php-7.1-debug': 'sha256:f0980ca6ab9afb47483b4f3946a9b51130b24589b5528cf7aa60ba63afa8ecb0', + 'php-7.2-release-zts': 'sha256:3587fa08a2128e8284a6081f7736cc3b7942e69ee454a668416bc19960e7c58b', + 'apache2-mod-php-8.4-debug': 'sha256:32954d65526beee040c2431261da0ab5727e4a8839c7196df7be4ece336860fc', + 'php-8.5-debug': 'sha256:55b4599381071a884fc83197249134da9849a422febe3465a78727702829553e', + 'php-7.0-release-zts': 'sha256:e978eb35edbef15a2c5b6fb3625035f1e83897b5fa12831d6684f0a7cd509b9c', + 'php-7.0-release': 'sha256:a3ae2e247ada410e17624654ad0751b2ed2af7b941bba1b36542ea5cb5f3ca2b', + 'apache2-mod-php-8.4-release': 'sha256:30ee394d13de1235919aed2e882b2bb3b84b37350bae10b26eb349bd60f83cb2', + 'php-8.5-release': 'sha256:404f79df15d34c6f707cd1546e7bb55b1be358196fbcbed2c8ddd99b9519d8f2', + 'php-7.1-release-zts': 'sha256:041d2650e15c67dba2273bcaf19216de98e87e280195c182b139f68e5c2bf13c' ]