From d1c4dadaa18ef5621f8f00a5da6f8b5b097645a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 17:09:23 +0200
Subject: [PATCH 01/24] ci: create a static build of FrankenPHP

---
 .github/workflows/static.yml | 55 ++++++++++++++++++++++++++++++++++++
 docs/compile.md              |  5 ++++
 docs/static.md               | 25 ++++++++++++++++
 frankenphp.go                | 11 ++++++--
 frankenphp_test.go           |  1 +
 5 files changed, 94 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/static.yml
 create mode 100644 docs/static.md

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
new file mode 100644
index 000000000..1c285ec88
--- /dev/null
+++ b/.github/workflows/static.yml
@@ -0,0 +1,55 @@
+name: Build binary releases
+on: [push, pull_request]
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php-versions: ['8.2']
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+
+      - name: Clone static-php-cli
+        run: git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
+
+      - name: Install static-php-cli dependencies
+        working-directory: static-php-cli
+        run: composer install --no-dev -a
+
+      - name: Install missing dependencies
+        working-directory: static-php-cli
+        run: bin/spc doctor --auto-fix
+
+      - name: Download libraries sources
+        working-directory: static-php-cli
+        run: bin/spc fetch --with-php=${{ matrix.php-versions }} -A 
+
+      - name: Build static libraries
+        working-directory: static-php-cli
+        run: bin/spc build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+
+      - name: Set CGO flags
+        working-directory: static-php-cli
+        run: |
+          echo "CGO_CFLAGS=-I$PWD/source/php-src -I$PWD/source/php-src/main -I$PWD/source/php-src/TSRM -I$PWD/source/php-src/Zend -I$PWD/source/php-src/ext -I$PWD/source/php-src/ext/date/lib" >> "$GITHUB_ENV"
+          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g' | tr ' ' '\n' | sort -u | xargs)" >> "$GITHUB_ENV"
+
+      - name: Build
+        working-directory: caddy/frankenphp/
+        run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: frankenphp-linux-php-${{ matrix.php-versions }}-dev
+          path: caddy/frankenphp/frankenphp
+
+      - name: Run library tests
+        run: go test -race -v ./...
+
+      - name: Run Caddy module tests
+        working-directory: caddy/
+        run: go test -race -v ./...
diff --git a/docs/compile.md b/docs/compile.md
index 0b1f89c81..3191e4191 100644
--- a/docs/compile.md
+++ b/docs/compile.md
@@ -1,5 +1,10 @@
 # Compile From Sources
 
+This document explain how to create a FrankenPHP build that will load PHP as a dymanic library.
+This is the recommended method.
+
+Alternatively, [creating static builds](static.md) is also possible.
+
 ## Install PHP
 
 FrankenPHP is compatible with the PHP 8.2 and superior.
diff --git a/docs/static.md b/docs/static.md
new file mode 100644
index 000000000..e40cdc89e
--- /dev/null
+++ b/docs/static.md
@@ -0,0 +1,25 @@
+# Create a Static Build
+
+Instead of using a local installation of the PHP library,
+it's possible to create a static build of FrankenPHP thanks to the great [static-php-cli project](https://github.com/crazywhalecc/static-php-cli) (despite its name, this project support all SAPIs, not only CLI).
+
+With this method, a single, portable, binary will contain the PHP interpreter, the Caddy web server and FrankenPHP!
+
+## Build Instructions
+
+```console
+git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
+cd static-php-cli
+bin/spc-alpine-docker fetch --with-php=8.2 -A
+bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+export CGO_CFLAGS="-I$PWD/source/php-src -I$PWD/source/php-src/main -I$PWD/source/php-src/TSRM -I$PWD/source/php-src/Zend -I$PWD/source/php-src/ext -I$PWD/source/php-src/ext/date/lib"
+export CGO_LDFLAGS="-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g' | tr ' ' '\n' | sort -u | xargs)"
+
+cd ..
+
+git clone https://github.com/dunglas/frankenphp
+cd frankenphp/caddy/frankenphp
+go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+```
+
+The `frankenphp` file in the current directory is a static build of FrankenPHP!
diff --git a/frankenphp.go b/frankenphp.go
index 962a55870..6e90c2544 100644
--- a/frankenphp.go
+++ b/frankenphp.go
@@ -12,13 +12,18 @@ package frankenphp
 // Use PHP includes corresponding to your PHP installation by running:
 //
 //   export CGO_CFLAGS=$(php-config --includes)
+//   export CGO_LDFLAGS=$(php-config --ldflags --libs)
+//
+// We also set these flags for hardening: https://github.com/docker-library/php/blob/master/8.2/bookworm/zts/Dockerfile#L57-L59
 
-// #cgo pkg-config: libxml-2.0 sqlite3
-// #cgo CFLAGS: -Wall -Werror
+// #cgo darwin pkg-config: libxml-2.0 sqlite3
+// #cgo CFLAGS: -Wall -Werror -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
 // #cgo CFLAGS: -I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/TSRM -I/usr/local/include/php/Zend -I/usr/local/include/php/ext -I/usr/local/include/php/ext/date/lib
 // #cgo linux CFLAGS: -D_GNU_SOURCE
+// #cgo CPPFLAGS: -fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
 // #cgo darwin LDFLAGS: -L/opt/homebrew/opt/libiconv/lib -liconv
-// #cgo LDFLAGS: -L/usr/local/lib -L/usr/lib -lphp -lresolv -ldl -lm -lutil
+// #cgo linux LDFLAGS: -Wl,-O1
+// #cgo LDFLAGS: -pie -L/usr/local/lib -L/usr/lib -lphp -lresolv -ldl -lm -lutil
 // #include <stdlib.h>
 // #include <stdint.h>
 // #include <php_variables.h>
diff --git a/frankenphp_test.go b/frankenphp_test.go
index 0f0174834..2cffec06b 100644
--- a/frankenphp_test.go
+++ b/frankenphp_test.go
@@ -335,6 +335,7 @@ func testSession(t *testing.T, opts *testOptions) {
 func TestPhpInfo_module(t *testing.T) { testPhpInfo(t, nil) }
 func TestPhpInfo_worker(t *testing.T) { testPhpInfo(t, &testOptions{workerScript: "phpinfo.php"}) }
 func testPhpInfo(t *testing.T, opts *testOptions) {
+	t.Skip()
 	var logOnce sync.Once
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/phpinfo.php?i=%d", i), nil)

From 3c021577802fe0517ac3cd33408a1258e4f5fa15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 17:44:24 +0200
Subject: [PATCH 02/24] try to use alpine

---
 .github/workflows/static.yml | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 1c285ec88..f901883ae 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -16,21 +16,13 @@ jobs:
       - name: Clone static-php-cli
         run: git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 
-      - name: Install static-php-cli dependencies
-        working-directory: static-php-cli
-        run: composer install --no-dev -a
-
-      - name: Install missing dependencies
-        working-directory: static-php-cli
-        run: bin/spc doctor --auto-fix
-
       - name: Download libraries sources
         working-directory: static-php-cli
-        run: bin/spc fetch --with-php=${{ matrix.php-versions }} -A 
+        run: bin/spc-alpine-docker fetch --with-php=${{ matrix.php-versions }} -A 
 
       - name: Build static libraries
         working-directory: static-php-cli
-        run: bin/spc build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+        run: bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
       - name: Set CGO flags
         working-directory: static-php-cli

From 377a9c0748e2043f6e10728809cbb220d50fa1b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 19:26:26 +0200
Subject: [PATCH 03/24] path mapping

---
 .github/workflows/static.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index f901883ae..ae69587ee 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -13,22 +13,22 @@ jobs:
         with:
           go-version: '1.21'
 
-      - name: Clone static-php-cli
+      - name: Clone static-php-cli/
         run: git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 
       - name: Download libraries sources
-        working-directory: static-php-cli
+        working-directory: static-php-cli/
         run: bin/spc-alpine-docker fetch --with-php=${{ matrix.php-versions }} -A 
 
       - name: Build static libraries
-        working-directory: static-php-cli
+        working-directory: static-php-cli/
         run: bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
       - name: Set CGO flags
-        working-directory: static-php-cli
+        working-directory: static-php-cli/
         run: |
-          echo "CGO_CFLAGS=-I$PWD/source/php-src -I$PWD/source/php-src/main -I$PWD/source/php-src/TSRM -I$PWD/source/php-src/Zend -I$PWD/source/php-src/ext -I$PWD/source/php-src/ext/date/lib" >> "$GITHUB_ENV"
-          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g' | tr ' ' '\n' | sort -u | xargs)" >> "$GITHUB_ENV"
+          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#/app#$PWD#g)" >> "$GITHUB_ENV"
+          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lxml2//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
 
       - name: Build
         working-directory: caddy/frankenphp/

From 4afb6394aa7b1922a5a7471c4d0850f7d13fcb10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 19:48:17 +0200
Subject: [PATCH 04/24] cache and fixes

---
 .github/workflows/static.yml | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index ae69587ee..4353ca563 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,7 +1,7 @@
 name: Build binary releases
 on: [push, pull_request]
 jobs:
-  tests:
+  build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -14,11 +14,30 @@ jobs:
           go-version: '1.21'
 
       - name: Clone static-php-cli/
-        run: git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
+        run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 
-      - name: Download libraries sources
+      - id: cache-composer-deps
+        name: Download cached Composer
+        uses: actions/cache@v3
+        with:
+          path: static-php-cli/vendor
+          key: composer-dependencies
+
+      - if: steps.cache-composer-deps.outputs.cache-hit != 'true'
+        name: Install Composer dependencies
         working-directory: static-php-cli/
-        run: bin/spc-alpine-docker fetch --with-php=${{ matrix.php-versions }} -A 
+        run: composer install --no-dev -a
+
+      - id: cache-download
+        name: Download cached sources
+        uses: actions/cache@v3
+        with:
+          path: static-php-cli/downloads
+          key: php-${{ matrix.php-versions }}-dependencies
+
+      - if: steps.cache-download.outputs.cache-hit != 'true'
+        name: Download sources
+        run: ./bin/spc-alpine-docker download --with-php=${{ matrix.php-versions }} --all
 
       - name: Build static libraries
         working-directory: static-php-cli/
@@ -27,7 +46,7 @@ jobs:
       - name: Set CGO flags
         working-directory: static-php-cli/
         run: |
-          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#/app#$PWD#g)" >> "$GITHUB_ENV"
+          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include#-I$PWD/source/php-src/include#g)" >> "$GITHUB_ENV"
           echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lxml2//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
 
       - name: Build

From 8656e417e8982151484993fe6a9183297c132f70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 19:51:57 +0200
Subject: [PATCH 05/24] fix

---
 .github/workflows/static.yml | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 4353ca563..3071bc009 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -16,17 +16,17 @@ jobs:
       - name: Clone static-php-cli/
         run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 
-      - id: cache-composer-deps
-        name: Download cached Composer
-        uses: actions/cache@v3
-        with:
-          path: static-php-cli/vendor
-          key: composer-dependencies
-
-      - if: steps.cache-composer-deps.outputs.cache-hit != 'true'
-        name: Install Composer dependencies
-        working-directory: static-php-cli/
-        run: composer install --no-dev -a
+      #- id: cache-composer-deps
+      #  name: Download cached Composer
+      #  uses: actions/cache@v3
+      #  with:
+      #    path: static-php-cli/vendor
+      #    key: composer-dependencies
+#
+      #- if: steps.cache-composer-deps.outputs.cache-hit != 'true'
+      #  name: Install Composer dependencies
+      #  working-directory: static-php-cli/
+      #  run: composer install --no-dev -a
 
       - id: cache-download
         name: Download cached sources
@@ -37,6 +37,7 @@ jobs:
 
       - if: steps.cache-download.outputs.cache-hit != 'true'
         name: Download sources
+        working-directory: static-php-cli/
         run: ./bin/spc-alpine-docker download --with-php=${{ matrix.php-versions }} --all
 
       - name: Build static libraries

From 86e3920152413a37716735869da95d4b5fb84ba7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Fri, 25 Aug 2023 23:56:38 +0200
Subject: [PATCH 06/24] fix include path

---
 .github/workflows/static.yml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 3071bc009..5a3f737ab 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -16,17 +16,17 @@ jobs:
       - name: Clone static-php-cli/
         run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 
-      #- id: cache-composer-deps
-      #  name: Download cached Composer
-      #  uses: actions/cache@v3
-      #  with:
-      #    path: static-php-cli/vendor
-      #    key: composer-dependencies
-#
-      #- if: steps.cache-composer-deps.outputs.cache-hit != 'true'
-      #  name: Install Composer dependencies
-      #  working-directory: static-php-cli/
-      #  run: composer install --no-dev -a
+      - id: cache-composer-deps
+        name: Download cached Composer
+        uses: actions/cache@v3
+        with:
+          path: static-php-cli/vendor
+          key: composer-dependencies
+
+      - if: steps.cache-composer-deps.outputs.cache-hit != 'true'
+        name: Install Composer dependencies
+        working-directory: static-php-cli/
+        run: composer install --no-dev -a
 
       - id: cache-download
         name: Download cached sources
@@ -47,7 +47,7 @@ jobs:
       - name: Set CGO flags
         working-directory: static-php-cli/
         run: |
-          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include#-I$PWD/source/php-src/include#g)" >> "$GITHUB_ENV"
+          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include#-I$PWD/source/php-src#g)" >> "$GITHUB_ENV"
           echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lxml2//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
 
       - name: Build

From c1993c3ef98fd33556b157f073fd26386ecf94fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sat, 26 Aug 2023 00:26:33 +0200
Subject: [PATCH 07/24] fix include path

---
 .github/workflows/static.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 5a3f737ab..89356c1d4 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Set CGO flags
         working-directory: static-php-cli/
         run: |
-          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include#-I$PWD/source/php-src#g)" >> "$GITHUB_ENV"
+          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I$PWD/source/php-src#g)" >> "$GITHUB_ENV"
           echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lxml2//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
 
       - name: Build

From c63b5388fa9a079e319e1ac9329c02e5a010bc81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sat, 26 Aug 2023 00:44:33 +0200
Subject: [PATCH 08/24] fix include path

---
 .github/workflows/static.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 89356c1d4..92e1e53d9 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -48,7 +48,7 @@ jobs:
         working-directory: static-php-cli/
         run: |
           echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I$PWD/source/php-src#g)" >> "$GITHUB_ENV"
-          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lxml2//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
+          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lgcc_s//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
 
       - name: Build
         working-directory: caddy/frankenphp/

From 9bd18167948ae004b853c9ffd6ab976ebd49dc1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sat, 26 Aug 2023 19:20:39 +0200
Subject: [PATCH 09/24] switch to Docker

---
 .github/workflows/static.yml | 90 ++++++++++++++----------------------
 docker-bake.hcl              | 20 +++++++-
 docs/static.md               |  6 ++-
 static-builder.Dockerfile    | 68 +++++++++++++++++++++++++++
 4 files changed, 125 insertions(+), 59 deletions(-)
 create mode 100644 static-builder.Dockerfile

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 92e1e53d9..f00c44bbd 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,67 +1,45 @@
 name: Build binary releases
-on: [push, pull_request]
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+  workflow_dispatch:
+    inputs: {}
 jobs:
   build:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        php-versions: ['8.2']
     steps:
       - uses: actions/checkout@v3
 
-      - uses: actions/setup-go@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
         with:
-          go-version: '1.21'
-
-      - name: Clone static-php-cli/
-        run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed
-
-      - id: cache-composer-deps
-        name: Download cached Composer
-        uses: actions/cache@v3
-        with:
-          path: static-php-cli/vendor
-          key: composer-dependencies
-
-      - if: steps.cache-composer-deps.outputs.cache-hit != 'true'
-        name: Install Composer dependencies
-        working-directory: static-php-cli/
-        run: composer install --no-dev -a
-
-      - id: cache-download
-        name: Download cached sources
-        uses: actions/cache@v3
-        with:
-          path: static-php-cli/downloads
-          key: php-${{ matrix.php-versions }}-dependencies
-
-      - if: steps.cache-download.outputs.cache-hit != 'true'
-        name: Download sources
-        working-directory: static-php-cli/
-        run: ./bin/spc-alpine-docker download --with-php=${{ matrix.php-versions }} --all
-
-      - name: Build static libraries
-        working-directory: static-php-cli/
-        run: bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
-
-      - name: Set CGO flags
-        working-directory: static-php-cli/
-        run: |
-          echo "CGO_CFLAGS=$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I$PWD/source/php-src#g)" >> "$GITHUB_ENV"
-          echo "CGO_LDFLAGS=-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags | sed s#/app#$PWD#g) $(sh $PWD/source/php-src/scripts/php-config --libs | sed -e 's/-lgcc_s//g' -e s#/app#$PWD#g)" >> "$GITHUB_ENV"
+          version: latest
 
       - name: Build
-        working-directory: caddy/frankenphp/
-        run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
-
-      - uses: actions/upload-artifact@v3
+        id: build
+        uses: docker/bake-action@v3
         with:
-          name: frankenphp-linux-php-${{ matrix.php-versions }}-dev
-          path: caddy/frankenphp/frankenphp
-
-      - name: Run library tests
-        run: go test -race -v ./...
-
-      - name: Run Caddy module tests
-        working-directory: caddy/
-        run: go test -race -v ./...
+          pull: true
+          load: true
+          targets: static-builder
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-static-builder
+            *.cache-from=type=gha,scope=refs/heads/main-static-builder
+            *.cache-to=type=gha,scope=${{github.ref}}-static-builder
+        env:
+          VERSION: ${{github.ref_name}}
+
+      - name: Copy binary
+        run: docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/caddy/frankenphp/frankenphp frankenphp ; docker rm static-builder
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v3
+        with:
+          name: frankenphp-dev
+          path: frankenphp
diff --git a/docker-bake.hcl b/docker-bake.hcl
index dc5d2a7a4..e781975ae 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -6,6 +6,10 @@ variable "VERSION" {
     default = "dev"
 }
 
+variable "GO_VERSION" {
+    default = "1.21"
+}
+
 variable "SHA" {}
 
 variable "LATEST" {
@@ -50,6 +54,7 @@ function "__semver" {
     result = v == {} ? [clean_tag(VERSION)] : v.prerelease == null ? ["latest", v.major, "${v.major}.${v.minor}", "${v.major}.${v.minor}.${v.patch}"] : ["${v.major}.${v.minor}.${v.patch}-${v.prerelease}"]
 }
 
+
 target "default" {
     name = "${tgt}-php-${replace(php-version, ".", "-")}-${os}"
     matrix = {
@@ -59,7 +64,7 @@ target "default" {
     }
     contexts = {
         php-base = "docker-image://php:${php-version}-zts-${os}"
-        golang-base = "docker-image://golang:1.21-${os}"
+        golang-base = "docker-image://golang:${GO_VERSION}-${os}"
     }
     dockerfile = os == "alpine" ? "alpine.Dockerfile" : "Dockerfile"
     context = "./"
@@ -91,3 +96,16 @@ target "default" {
         FRANKENPHP_VERSION = VERSION
     }
 }
+
+target "static-builder" {
+    contexts = {
+        golang-base = "docker-image://golang:${GO_VERSION}-alpine"
+    }
+    dockerfile = "static-builder.Dockerfile"
+    context = "./"
+    tags = ["${IMAGE_NAME}:static-builder"]
+    args = {
+        FRANKENPHP_VERSION = VERSION
+    }
+    secret = ["type=env,id=GITHUB_TOKEN"]
+}
diff --git a/docs/static.md b/docs/static.md
index e40cdc89e..8599e9f25 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -12,8 +12,8 @@ git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
 cd static-php-cli
 bin/spc-alpine-docker fetch --with-php=8.2 -A
 bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
-export CGO_CFLAGS="-I$PWD/source/php-src -I$PWD/source/php-src/main -I$PWD/source/php-src/TSRM -I$PWD/source/php-src/Zend -I$PWD/source/php-src/ext -I$PWD/source/php-src/ext/date/lib"
-export CGO_LDFLAGS="-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g' | tr ' ' '\n' | sort -u | xargs)"
+export CGO_CFLAGS="$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I$PWD/source/php-src#g)"
+export CGO_LDFLAGS="-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g')"
 
 cd ..
 
@@ -23,3 +23,5 @@ go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkm
 ```
 
 The `frankenphp` file in the current directory is a static build of FrankenPHP!
+
+Customize the extensions to build using [the command generator](https://static-php-cli.zhamao.me/en/guide/cli-generator.html).
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
new file mode 100644
index 000000000..f1f5553f6
--- /dev/null
+++ b/static-builder.Dockerfile
@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+FROM golang-base
+
+ARG FRANKENPHP_VERSION='dev'
+ARG PHP_VERSION='8.2'
+
+RUN apk update; \
+    apk add --no-cache \
+        autoconf \
+        automake \
+        bash \
+        binutils \
+        bison \
+        build-base \
+        cmake \
+        composer \
+        curl \
+        file \
+        flex \
+        g++ \
+        gcc \
+        git \
+        jq \
+        libgcc \
+        libstdc++ \
+        linux-headers \
+        m4 \
+        make \
+        php81 \
+        php81-common \
+        php81-pcntl \
+        php81-phar \
+        php81-posix \
+        php81-tokenizer \
+        php81-xml \
+        pkgconfig \
+        wget \
+        xz
+
+WORKDIR /static-php-cli
+
+RUN git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed . && \
+    composer install --no-cache --no-dev --classmap-authoritative
+
+RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./bin/spc download --with-php=$PHP_VERSION --all
+
+RUN ./bin/spc build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+
+RUN echo "CGO_CFLAGS=$CGO_CFLAGS"
+
+WORKDIR /go/src/app
+
+COPY go.mod go.sum ./
+RUN go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
+
+RUN mkdir caddy && cd caddy
+COPY caddy/go.mod caddy/go.sum ./caddy/
+
+RUN cd caddy && go mod graph | awk '{if ($1 !~ "@") print $2}' | xargs go get
+
+COPY *.* ./
+COPY caddy caddy
+COPY C-Thread-Pool C-Thread-Pool
+
+RUN cd caddy/frankenphp && \
+    CGO_CFLAGS="$(sh /static-php-cli/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I/static-php-cli/source/php-src#g)" \
+    CGO_LDFLAGS="-L/static-php-cli/source/php-src/libs $(sh /static-php-cli/source/php-src/scripts/php-config --ldflags) $(sh /static-php-cli/source/php-src/scripts/php-config --libs | sed -e 's/-lgcc_s//g')" \
+    go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -s -w -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION Caddy'"

From d0e7eb9bec7fe037a3118edcd7ebf5c7460738c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sat, 26 Aug 2023 19:31:16 +0200
Subject: [PATCH 10/24] fix github token

---
 .github/workflows/static.yml | 1 +
 docker-bake.hcl              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index f00c44bbd..5b6b42981 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -34,6 +34,7 @@ jobs:
             *.cache-to=type=gha,scope=${{github.ref}}-static-builder
         env:
           VERSION: ${{github.ref_name}}
+          ENV: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Copy binary
         run: docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/caddy/frankenphp/frankenphp frankenphp ; docker rm static-builder
diff --git a/docker-bake.hcl b/docker-bake.hcl
index e781975ae..1a2660766 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -107,5 +107,5 @@ target "static-builder" {
     args = {
         FRANKENPHP_VERSION = VERSION
     }
-    secret = ["type=env,id=GITHUB_TOKEN"]
+    secret = ["id=github-token,env=GITHUB_TOKEN"]
 }

From 533cfd54a0f344925696672d77014845f1a120bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sun, 27 Aug 2023 12:39:29 +0200
Subject: [PATCH 11/24] cleanup

---
 .github/workflows/static.yml | 2 +-
 frankenphp_test.go           | 1 -
 static-builder.Dockerfile    | 5 ++---
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 5b6b42981..2f602c7fd 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -34,7 +34,7 @@ jobs:
             *.cache-to=type=gha,scope=${{github.ref}}-static-builder
         env:
           VERSION: ${{github.ref_name}}
-          ENV: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Copy binary
         run: docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/caddy/frankenphp/frankenphp frankenphp ; docker rm static-builder
diff --git a/frankenphp_test.go b/frankenphp_test.go
index 2cffec06b..0f0174834 100644
--- a/frankenphp_test.go
+++ b/frankenphp_test.go
@@ -335,7 +335,6 @@ func testSession(t *testing.T, opts *testOptions) {
 func TestPhpInfo_module(t *testing.T) { testPhpInfo(t, nil) }
 func TestPhpInfo_worker(t *testing.T) { testPhpInfo(t, &testOptions{workerScript: "phpinfo.php"}) }
 func testPhpInfo(t *testing.T, opts *testOptions) {
-	t.Skip()
 	var logOnce sync.Once
 	runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, i int) {
 		req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/phpinfo.php?i=%d", i), nil)
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index f1f5553f6..07a01b571 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -3,6 +3,7 @@ FROM golang-base
 
 ARG FRANKENPHP_VERSION='dev'
 ARG PHP_VERSION='8.2'
+ARG PHP_EXTENSIONS='bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu'
 
 RUN apk update; \
     apk add --no-cache \
@@ -44,9 +45,7 @@ RUN git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=f
 
 RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./bin/spc download --with-php=$PHP_VERSION --all
 
-RUN ./bin/spc build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
-
-RUN echo "CGO_CFLAGS=$CGO_CFLAGS"
+RUN ./bin/spc build --build-embed --enable-zts --debug "$PHP_EXTENSIONS"
 
 WORKDIR /go/src/app
 

From 024e27a3a1295ae74e5f725636185877d6d0cff2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 28 Aug 2023 16:31:27 +0200
Subject: [PATCH 12/24] various improvements

---
 docker-bake.hcl           |  1 -
 docs/static.md            | 44 ++++++++++++++++++++++++++-------------
 static-builder.Dockerfile |  6 ++++--
 3 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/docker-bake.hcl b/docker-bake.hcl
index 1a2660766..b7c1fec5f 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -54,7 +54,6 @@ function "__semver" {
     result = v == {} ? [clean_tag(VERSION)] : v.prerelease == null ? ["latest", v.major, "${v.major}.${v.minor}", "${v.major}.${v.minor}.${v.patch}"] : ["${v.major}.${v.minor}.${v.patch}-${v.prerelease}"]
 }
 
-
 target "default" {
     name = "${tgt}-php-${replace(php-version, ".", "-")}-${os}"
     matrix = {
diff --git a/docs/static.md b/docs/static.md
index 8599e9f25..7fa22e9c2 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -5,23 +5,37 @@ it's possible to create a static build of FrankenPHP thanks to the great [static
 
 With this method, a single, portable, binary will contain the PHP interpreter, the Caddy web server and FrankenPHP!
 
-## Build Instructions
+## Linux
+
+We provide a Docker image to build a Linux static binary:
 
 ```console
-git clone https://github.com/dunglas/static-php-cli.git --branch=feat/embed
-cd static-php-cli
-bin/spc-alpine-docker fetch --with-php=8.2 -A
-bin/spc-alpine-docker build --build-embed --enable-zts --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_sqlite,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
-export CGO_CFLAGS="$(sh $PWD/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I$PWD/source/php-src#g)"
-export CGO_LDFLAGS="-L$PWD/source/php-src/libs $(sh $PWD/source/php-src/scripts/php-config --ldflags) $(sh $PWD/source/php-src/scripts/php-config --libs | sed 's/-lgcc_s//g')"
-
-cd ..
-
-git clone https://github.com/dunglas/frankenphp
-cd frankenphp/caddy/frankenphp
-go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+docker buildx bake --load static-builder
+docker cp $(docker create --name static-builder dunglas/frankenphp:static-builder):/go/src/app/caddy/frankenphp/frankenphp frankenphp ; docker rm static-builder
 ```
 
-The `frankenphp` file in the current directory is a static build of FrankenPHP!
+The resulting static binary is named `frankenphp` and is available in the current directory.
+
+If you want to build the static binary without Docker, take a look to the `static-builder.Dockerfile` file.
+
+### Custom Extensions
+
+By default, most popular PHP extensions are compiled.
 
-Customize the extensions to build using [the command generator](https://static-php-cli.zhamao.me/en/guide/cli-generator.html).
+To reduce the size of the binary and to reduce the attack surface, you can choose the list of extensions to build using the `PHP_EXTENSIONS` Docker ARG.
+
+For instance, run the following command to only build the `opcache` extension:
+
+```console
+docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache static-builder
+# ...
+```
+
+### GitHub Token
+
+If you hit the GitHub API rate limit, set a GitHub Personal Access Token in an environment variable named `GITHUB_TOKEN`:
+
+```console
+GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
+# ...
+```
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index 07a01b571..d0a3bccfb 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -47,6 +47,8 @@ RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-t
 
 RUN ./bin/spc build --build-embed --enable-zts --debug "$PHP_EXTENSIONS"
 
+ENV PATH="/static-php-cli/buildroot/bin:/static-php-cli/buildroot/usr/bin:$PATH"
+
 WORKDIR /go/src/app
 
 COPY go.mod go.sum ./
@@ -62,6 +64,6 @@ COPY caddy caddy
 COPY C-Thread-Pool C-Thread-Pool
 
 RUN cd caddy/frankenphp && \
-    CGO_CFLAGS="$(sh /static-php-cli/source/php-src/scripts/php-config --includes | sed s#-I/include/php#-I/static-php-cli/source/php-src#g)" \
-    CGO_LDFLAGS="-L/static-php-cli/source/php-src/libs $(sh /static-php-cli/source/php-src/scripts/php-config --ldflags) $(sh /static-php-cli/source/php-src/scripts/php-config --libs | sed -e 's/-lgcc_s//g')" \
+    CGO_CFLAGS="$(php-config --includes | sed s#-I/#-I/static-php-cli/buildroot/#g)" \
+    CGO_LDFLAGS="-L/static-php-cli/buildroot/lib $(php-config --ldflags) $(php-config --libs | sed -e 's/-lgcc_s//g')" \
     go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -s -w -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION Caddy'"

From 5bdb3040078009550c2d1db16fe700cb66e604be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 28 Aug 2023 23:38:27 +0200
Subject: [PATCH 13/24] macOS instructions

---
 docs/static.md            | 19 +++++++++++++++++++
 static-builder.Dockerfile |  1 +
 2 files changed, 20 insertions(+)

diff --git a/docs/static.md b/docs/static.md
index 7fa22e9c2..d97e6cdf5 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -39,3 +39,22 @@ If you hit the GitHub API rate limit, set a GitHub Personal Access Token in an e
 GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
 # ...
 ```
+
+## macOS
+
+Run the following command to create a static binary for macOS:
+
+```console
+git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
+cd static-php-cli
+composer install --no-dev -a
+./bin/spc doctor
+./bin/spc fetch --with-php=8.2 -A
+./bin/spc build --enable-zts --build-embed --debug "opcache"
+export CGO_CFLAGS="$(./buildroot/bin/php-config --includes | sed s#-I/#-I$PWD/buildroot/#g)"
+export CGO_LDFLAGS="-L$PWD/buildroot/lib $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)"
+
+git clone --depth=1 https://github.com/dunglas/frankenphp.git
+cd frankenphp/caddy/frankenphp
+go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+```
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index d0a3bccfb..6bc2dc06a 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -64,6 +64,7 @@ COPY caddy caddy
 COPY C-Thread-Pool C-Thread-Pool
 
 RUN cd caddy/frankenphp && \
+    PATH="/static-php-cli/buildroot/bin:$PATH" \
     CGO_CFLAGS="$(php-config --includes | sed s#-I/#-I/static-php-cli/buildroot/#g)" \
     CGO_LDFLAGS="-L/static-php-cli/buildroot/lib $(php-config --ldflags) $(php-config --libs | sed -e 's/-lgcc_s//g')" \
     go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -s -w -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION Caddy'"

From d5d5a8f24608d5b2cbfa78af7d7fb81ff3c5023b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Tue, 29 Aug 2023 10:15:36 +0200
Subject: [PATCH 14/24] fix GHA

---
 docs/static.md            | 3 +++
 static-builder.Dockerfile | 5 ++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/docs/static.md b/docs/static.md
index d97e6cdf5..18faeb8cc 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -42,6 +42,9 @@ GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
 
 ## macOS
 
+Note: only a very limited subset of extensions are currently available for static builds on macOS
+because of a weird linking issue.
+
 Run the following command to create a static binary for macOS:
 
 ```console
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index 6bc2dc06a..e1053a7c3 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -64,7 +64,6 @@ COPY caddy caddy
 COPY C-Thread-Pool C-Thread-Pool
 
 RUN cd caddy/frankenphp && \
-    PATH="/static-php-cli/buildroot/bin:$PATH" \
-    CGO_CFLAGS="$(php-config --includes | sed s#-I/#-I/static-php-cli/buildroot/#g)" \
-    CGO_LDFLAGS="-L/static-php-cli/buildroot/lib $(php-config --ldflags) $(php-config --libs | sed -e 's/-lgcc_s//g')" \
+    CGO_CFLAGS="$(/static-php-cli/buildroot/bin/php-config --includes | sed s#-I/#-I/static-php-cli/buildroot/#g)" \
+    CGO_LDFLAGS="-L/static-php-cli/buildroot/lib $(/static-php-cli/buildroot/bin/php-config --ldflags) $(/static-php-cli/buildroot/bin/php-config --libs | sed -e 's/-lgcc_s//g')" \
     go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -s -w -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION Caddy'"

From 076443d215965c38b1a7620927feec87daecb5e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Tue, 29 Aug 2023 14:44:58 +0200
Subject: [PATCH 15/24] docs

---
 docs/static.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/static.md b/docs/static.md
index 18faeb8cc..2cd4b0edc 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -27,10 +27,12 @@ To reduce the size of the binary and to reduce the attack surface, you can choos
 For instance, run the following command to only build the `opcache` extension:
 
 ```console
-docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache static-builder
+docker buildx bake --load --set static-builder.args.PHP_EXTENSIONS=opcache,pdo_sqlite static-builder
 # ...
 ```
 
+See [the list of supported extensions](https://static-php-cli.zhamao.me/en/guide/extensions.html).
+
 ### GitHub Token
 
 If you hit the GitHub API rate limit, set a GitHub Personal Access Token in an environment variable named `GITHUB_TOKEN`:

From 1478282242961a8101840f61abea24f950905ad6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Wed, 30 Aug 2023 20:49:45 +0200
Subject: [PATCH 16/24] feat: mac static builds

---
 .github/workflows/static.yml | 53 ++++++++++++++++++++++++++++++++++--
 docs/static.md               | 12 ++++----
 static-builder.Dockerfile    |  2 +-
 3 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 2f602c7fd..008d5b086 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -11,7 +11,8 @@ on:
   workflow_dispatch:
     inputs: {}
 jobs:
-  build:
+  build-linux:
+    name: Build Linux x86_64 binary
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -42,5 +43,53 @@ jobs:
       - name: Upload binary
         uses: actions/upload-artifact@v3
         with:
-          name: frankenphp-dev
+          name: frankenphp-linux-x86_64-dev
+          path: frankenphp
+
+  build-mac:
+    name: Build macOS binaries
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+
+      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
+
+      - name: Install static-php-cli dependencies
+        working-directory: static-php-cli/
+        run: composer install --no-dev -a
+
+      - name: Install missing system dependencies
+        run: ./bin/spc doctor --auto-fix
+        working-directory: static-php-cli/
+
+      - name: Fetch libraries sources
+        working-directory: static-php-cli/
+        run: ./bin/spc fetch --with-php=8.2 -A
+
+      - name: Build static libphp
+        working-directory: static-php-cli/
+        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+
+      - name: Set include flags
+        working-directory: static-php-cli/
+        run: echo "CGO_CFLAGS=$(php-config --includes)" >> "$GITHUB_ENV"
+
+      - name: Set CGO flags
+        run: |
+           echo "CGO_CFLAGS=$(./buildroot/bin/php-config --includes | sed s#-I/#-I$PWD/buildroot/#g)" >> "$GITHUB_ENV"
+           echo "CGO_LDFLAGS=-framework CoreFoundation -framework SystemConfiguration $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)" >> "$GITHUB_ENV"
+
+      - name: Build FrankenPHP
+        working-directory: caddy/frankenphp/
+        run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v3
+        with:
+          name: frankenphp-mac-x86_64-dev
           path: frankenphp
diff --git a/docs/static.md b/docs/static.md
index 2cd4b0edc..9598708da 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -44,22 +44,22 @@ GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
 
 ## macOS
 
-Note: only a very limited subset of extensions are currently available for static builds on macOS
-because of a weird linking issue.
-
 Run the following command to create a static binary for macOS:
 
 ```console
 git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
 cd static-php-cli
 composer install --no-dev -a
-./bin/spc doctor
+./bin/spc doctor --auto-fix
 ./bin/spc fetch --with-php=8.2 -A
-./bin/spc build --enable-zts --build-embed --debug "opcache"
+./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwri
+ter,zip,zlib,apcu"
 export CGO_CFLAGS="$(./buildroot/bin/php-config --includes | sed s#-I/#-I$PWD/buildroot/#g)"
-export CGO_LDFLAGS="-L$PWD/buildroot/lib $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)"
+export CGO_LDFLAGS="-framework CoreFoundation -framework SystemConfiguration $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)"
 
 git clone --depth=1 https://github.com/dunglas/frankenphp.git
 cd frankenphp/caddy/frankenphp
 go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
 ```
+
+See [the list of supported extensions](https://static-php-cli.zhamao.me/en/guide/extensions.html).
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index e1053a7c3..85be39b7b 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -65,5 +65,5 @@ COPY C-Thread-Pool C-Thread-Pool
 
 RUN cd caddy/frankenphp && \
     CGO_CFLAGS="$(/static-php-cli/buildroot/bin/php-config --includes | sed s#-I/#-I/static-php-cli/buildroot/#g)" \
-    CGO_LDFLAGS="-L/static-php-cli/buildroot/lib $(/static-php-cli/buildroot/bin/php-config --ldflags) $(/static-php-cli/buildroot/bin/php-config --libs | sed -e 's/-lgcc_s//g')" \
+    CGO_LDFLAGS="$(/static-php-cli/buildroot/bin/php-config --ldflags) $(/static-php-cli/buildroot/bin/php-config --libs | sed -e 's/-lgcc_s//g')" \
     go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -s -w -X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP $FRANKENPHP_VERSION Caddy'"

From dd22134713bfe39b4b2b38ae0208d2878e656942 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Wed, 30 Aug 2023 20:51:29 +0200
Subject: [PATCH 17/24] minor fix

---
 .github/workflows/static.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 008d5b086..d38f7ccce 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -86,10 +86,10 @@ jobs:
 
       - name: Build FrankenPHP
         working-directory: caddy/frankenphp/
-        run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie"
+        run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -w -s"
 
       - name: Upload binary
         uses: actions/upload-artifact@v3
         with:
           name: frankenphp-mac-x86_64-dev
-          path: frankenphp
+          path: caddy/frankenphp/frankenphp

From 12c971575b9ea5adf7e8873d0e3c95ffccd26ff4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Wed, 30 Aug 2023 23:20:24 +0200
Subject: [PATCH 18/24] fix wd

---
 .github/workflows/static.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index d38f7ccce..22bdc3f61 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -70,16 +70,15 @@ jobs:
       - name: Fetch libraries sources
         working-directory: static-php-cli/
         run: ./bin/spc fetch --with-php=8.2 -A
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build static libphp
         working-directory: static-php-cli/
         run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
-      - name: Set include flags
-        working-directory: static-php-cli/
-        run: echo "CGO_CFLAGS=$(php-config --includes)" >> "$GITHUB_ENV"
-
       - name: Set CGO flags
+        working-directory: static-php-cli/
         run: |
            echo "CGO_CFLAGS=$(./buildroot/bin/php-config --includes | sed s#-I/#-I$PWD/buildroot/#g)" >> "$GITHUB_ENV"
            echo "CGO_LDFLAGS=-framework CoreFoundation -framework SystemConfiguration $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)" >> "$GITHUB_ENV"

From 7a2997e0920c2e490b2b4317feaaac01a89486b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sat, 2 Sep 2023 21:34:33 +0200
Subject: [PATCH 19/24] Apple silicon build

---
 .github/workflows/static.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 22bdc3f61..55c4ec469 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -50,6 +50,11 @@ jobs:
     name: Build macOS binaries
     runs-on: macos-latest
 
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: ['arm64', 'x86_64']
+
     steps:
       - uses: actions/checkout@v3
 
@@ -57,7 +62,7 @@ jobs:
         with:
           go-version: '1.21'
 
-      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
+      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/cross-compile-apple
 
       - name: Install static-php-cli dependencies
         working-directory: static-php-cli/
@@ -75,7 +80,9 @@ jobs:
 
       - name: Build static libphp
         working-directory: static-php-cli/
-        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+        run: |
+          clang --print-targets
+          ./bin/spc build --arch ${{ matrix.arch }} --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu" || cat source/pkg-config/config.log
 
       - name: Set CGO flags
         working-directory: static-php-cli/
@@ -86,9 +93,11 @@ jobs:
       - name: Build FrankenPHP
         working-directory: caddy/frankenphp/
         run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -w -s"
+        env:
+          GOARCH: ${{ matrix.arch == 'arm64' && 'arm64' || 'amd64' }}
 
       - name: Upload binary
         uses: actions/upload-artifact@v3
         with:
-          name: frankenphp-mac-x86_64-dev
+          name: frankenphp-mac-${{ matrix.arch }}-dev
           path: caddy/frankenphp/frankenphp

From 6e5f9643ca5005d85bd81144c6cec27961eac465 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sun, 3 Sep 2023 19:09:04 +0200
Subject: [PATCH 20/24] Revert "Apple silicon build"

This reverts commit 7a2997e0920c2e490b2b4317feaaac01a89486b4.
---
 .github/workflows/static.yml | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 55c4ec469..22bdc3f61 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -50,11 +50,6 @@ jobs:
     name: Build macOS binaries
     runs-on: macos-latest
 
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: ['arm64', 'x86_64']
-
     steps:
       - uses: actions/checkout@v3
 
@@ -62,7 +57,7 @@ jobs:
         with:
           go-version: '1.21'
 
-      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/cross-compile-apple
+      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
 
       - name: Install static-php-cli dependencies
         working-directory: static-php-cli/
@@ -80,9 +75,7 @@ jobs:
 
       - name: Build static libphp
         working-directory: static-php-cli/
-        run: |
-          clang --print-targets
-          ./bin/spc build --arch ${{ matrix.arch }} --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu" || cat source/pkg-config/config.log
+        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
       - name: Set CGO flags
         working-directory: static-php-cli/
@@ -93,11 +86,9 @@ jobs:
       - name: Build FrankenPHP
         working-directory: caddy/frankenphp/
         run: go build -buildmode=pie -tags "cgo netgo osusergo static_build" -ldflags "-linkmode=external -extldflags -static-pie -w -s"
-        env:
-          GOARCH: ${{ matrix.arch == 'arm64' && 'arm64' || 'amd64' }}
 
       - name: Upload binary
         uses: actions/upload-artifact@v3
         with:
-          name: frankenphp-mac-${{ matrix.arch }}-dev
+          name: frankenphp-mac-x86_64-dev
           path: caddy/frankenphp/frankenphp

From 4bf4eccb369bdc8dcceb0ab9b4a258072c1a3743 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Sun, 3 Sep 2023 19:54:22 +0200
Subject: [PATCH 21/24] add opcache

---
 .github/workflows/static.yml | 2 +-
 static-builder.Dockerfile    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 22bdc3f61..5a07f059a 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -75,7 +75,7 @@ jobs:
 
       - name: Build static libphp
         working-directory: static-php-cli/
-        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
       - name: Set CGO flags
         working-directory: static-php-cli/
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index 85be39b7b..f47a9456e 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -3,7 +3,7 @@ FROM golang-base
 
 ARG FRANKENPHP_VERSION='dev'
 ARG PHP_VERSION='8.2'
-ARG PHP_EXTENSIONS='bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu'
+ARG PHP_EXTENSIONS='bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu'
 
 RUN apk update; \
     apk add --no-cache \

From 21ca707fba97b64e9dbaf267646f319fed96da17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 11 Sep 2023 17:27:47 +0200
Subject: [PATCH 22/24] update builder

---
 static-builder.Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index f47a9456e..425930bd1 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -29,11 +29,13 @@ RUN apk update; \
         make \
         php81 \
         php81-common \
+        php81-dom \
         php81-pcntl \
         php81-phar \
         php81-posix \
         php81-tokenizer \
         php81-xml \
+        php81-xmlwriter \
         pkgconfig \
         wget \
         xz
@@ -41,7 +43,7 @@ RUN apk update; \
 WORKDIR /static-php-cli
 
 RUN git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed . && \
-    composer install --no-cache --no-dev --classmap-authoritative
+    COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --classmap-authoritative --no-cache
 
 RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./bin/spc download --with-php=$PHP_VERSION --all
 

From fb6f0693866b8313032e1546e5d2d64b5abec005 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Tue, 12 Sep 2023 12:09:24 +0200
Subject: [PATCH 23/24] upgrade to PHP 8.2

---
 static-builder.Dockerfile | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index 425930bd1..697d3c9ca 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -14,7 +14,6 @@ RUN apk update; \
         bison \
         build-base \
         cmake \
-        composer \
         curl \
         file \
         flex \
@@ -27,23 +26,32 @@ RUN apk update; \
         linux-headers \
         m4 \
         make \
-        php81 \
-        php81-common \
-        php81-dom \
-        php81-pcntl \
-        php81-phar \
-        php81-posix \
-        php81-tokenizer \
-        php81-xml \
-        php81-xmlwriter \
+        php82 \
+        php82-common \
+        php82-dom \
+        php82-mbstring \
+        php82-openssl \
+        php82-pcntl \
+        php82-phar \
+        php82-posix \
+        php82-tokenizer \
+        php82-xml \
+        php82-xmlwriter \
         pkgconfig \
         wget \
-        xz
+        xz ; \
+    ln -sf /usr/bin/php82 /usr/bin/php
+
+# https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
+ENV COMPOSER_ALLOW_SUPERUSER=1
+ENV PATH="${PATH}:/root/.composer/vendor/bin"
+
+COPY --from=composer/composer:2-bin --link /composer /usr/bin/composer
 
 WORKDIR /static-php-cli
 
 RUN git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed . && \
-    COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --classmap-authoritative --no-cache
+    composer install --no-cache --no-dev --classmap-authoritative
 
 RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./bin/spc download --with-php=$PHP_VERSION --all
 

From 807afe8d35c33260648f09b44d0b4292a06eb512 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Tue, 12 Sep 2023 17:42:31 +0200
Subject: [PATCH 24/24] switch to upstream static-php-cli, add intl

---
 .github/workflows/docker.yml |  4 ++--
 .github/workflows/static.yml | 13 ++++++++-----
 .github/workflows/tests.yml  |  2 +-
 docs/static.md               |  5 ++---
 static-builder.Dockerfile    |  4 ++--
 5 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b20fe4f41..b2d5964f8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -20,7 +20,7 @@ jobs:
       platforms: ${{ steps.matrix.outputs.platforms }}
       metadata: ${{ steps.matrix.outputs.metadata }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
@@ -57,7 +57,7 @@ jobs:
           - platform: linux/386
             qemu: false
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up QEMU
         if: matrix.qemu
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 5a07f059a..0fce2df02 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -15,7 +15,7 @@ jobs:
     name: Build Linux x86_64 binary
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
@@ -51,14 +51,17 @@ jobs:
     runs-on: macos-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+
+      - uses: actions/checkout@v4
+        with:
+          repository: crazywhalecc/static-php-cli
+          path: static-php-cli
 
       - uses: actions/setup-go@v4
         with:
           go-version: '1.21'
 
-      - run: git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
-
       - name: Install static-php-cli dependencies
         working-directory: static-php-cli/
         run: composer install --no-dev -a
@@ -75,7 +78,7 @@ jobs:
 
       - name: Build static libphp
         working-directory: static-php-cli/
-        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
+        run: ./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,intl,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 
       - name: Set CGO flags
         working-directory: static-php-cli/
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c27afae7a..20bb1c19c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,7 +7,7 @@ jobs:
       matrix:
         php-versions: ['8.2', '8.3']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v4
         with:
diff --git a/docs/static.md b/docs/static.md
index 9598708da..c2d7eabc1 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -47,13 +47,12 @@ GITHUB_TOKEN="xxx" docker --load buildx bake static-builder
 Run the following command to create a static binary for macOS:
 
 ```console
-git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed 
+git clone --depth=1 https://github.com/crazywhalecc/static-php-cli.git
 cd static-php-cli
 composer install --no-dev -a
 ./bin/spc doctor --auto-fix
 ./bin/spc fetch --with-php=8.2 -A
-./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwri
-ter,zip,zlib,apcu"
+./bin/spc build --enable-zts --build-embed --debug "bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,intl,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu"
 export CGO_CFLAGS="$(./buildroot/bin/php-config --includes | sed s#-I/#-I$PWD/buildroot/#g)"
 export CGO_LDFLAGS="-framework CoreFoundation -framework SystemConfiguration $(./buildroot/bin/php-config --ldflags) $(./buildroot/bin/php-config --libs)"
 
diff --git a/static-builder.Dockerfile b/static-builder.Dockerfile
index 697d3c9ca..60f0b3219 100644
--- a/static-builder.Dockerfile
+++ b/static-builder.Dockerfile
@@ -3,7 +3,7 @@ FROM golang-base
 
 ARG FRANKENPHP_VERSION='dev'
 ARG PHP_VERSION='8.2'
-ARG PHP_EXTENSIONS='bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu'
+ARG PHP_EXTENSIONS='bcmath,calendar,ctype,curl,dba,dom,exif,filter,fileinfo,gd,iconv,intl,mbstring,mbregex,mysqli,mysqlnd,opcache,openssl,pcntl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,pgsql,phar,posix,readline,redis,session,simplexml,sockets,sqlite3,tokenizer,xml,xmlreader,xmlwriter,zip,zlib,apcu'
 
 RUN apk update; \
     apk add --no-cache \
@@ -50,7 +50,7 @@ COPY --from=composer/composer:2-bin --link /composer /usr/bin/composer
 
 WORKDIR /static-php-cli
 
-RUN git clone --depth=1 https://github.com/dunglas/static-php-cli.git --branch=feat/embed . && \
+RUN git clone --depth=1 https://github.com/crazywhalecc/static-php-cli . && \
     composer install --no-cache --no-dev --classmap-authoritative
 
 RUN --mount=type=secret,id=github-token GITHUB_TOKEN=$(cat /run/secrets/github-token) ./bin/spc download --with-php=$PHP_VERSION --all