STF-1307: Add bundled libmaxminddb build mode

[claude]

configuregains--with-maxminddb-bundled, which compiles the new ext/libmaxminddbsubmodule (pinned to 1.13.3) into the extension instead of linking a system library. Bothconfig.m4andconfig.w32implement it. The default build is unchanged on either platform: on Unix it still resolves libmaxminddb through pkg-config, so distro packaging keeps working, and on Windows it still takeslibmaxminddb.libormaxminddb.lib. Verified that the default Unix build's compile and link command lines are identical to main's, and that config.w32`'s non-bundled path is byte-for-byte what it was.

PIE's Unix installer copies only {extension-name}.so, so a prebuilt cannot
depend on a system libmaxminddb. This mirrors what the Python reader does, which
compiles the same two sources on Windows as well and needs no import library
there at all.

A new test-bundled.yml builds the bundled mode across the same PHP version
matrix and runners as test.yml, with no libmaxminddb installed, plus one
build with --enable-maxminddb-debug to show the vendored sources survive
-Werror. It then gates on the properties a prebuilt needs: no libmaxminddb in
ldd, no RUNPATH/RPATH, no undefined MMDB_ symbols, and a glibc floor at
or below GLIBC_2.38 (what the current sources measure, from
__isoc23_strtol). Finally it copies the lone .so to an empty directory and
does a real lookup there.

Windows

Windows links libmaxminddb 1.5.0, published January 2021 and the only version
PHP publishes; that staleness is what forced the two-name CHECK_LIB in #263.
Bundling puts Windows on the same pinned 1.13.3 as every other platform.

config.w32 defines the same macros as config.m4, which matters because
MMDB_UINT128_IS_BYTE_ARRAY decides the layout of the MMDB_entry_data_s union
that maxminddb.c and the vendored sources pass between each other.
HAVE_CONFIG_H is the one deliberate exception: config.m4 defines it only to
stop PHP's Unix CPPFLAGS from sending libmaxminddb after a config.h of its
own, and the Windows build never defines it, so defining it there would instead
make our own maxminddb.c include a config.h that is not present.

config.m4 writes the stub maxminddb_config.h from configure, which never
runs on Windows, so config.w32 writes the same stub itself rather than the file
being committed. Committing it would mean the Unix path overwriting a tracked
file on every build, and two mechanisms for one file. Both now write identical
text, which is why the config.m4 line is touched.

ws2_32.lib is asked for explicitly. php-src already has it in $(LIBS), but
MMDB_open() calls WSAStartup() and the dependency is ours now, which is also
why sapi/cli and sapi/cgi name it themselves.

MSVC cannot be run here, so this was desk-checked instead: every
confutils.js function called was read in php-src and confirmed to have the
signature used; the ADD_SOURCES call follows the idiom php-src's ext/uri and
ext/pcre and PECL's xdebug and php-memcached use for sources in a
subdirectory; ADD_SOURCES's object-path arithmetic was replayed to confirm the
objects land in $(BUILD_DIR)\libmaxminddb\src with no maxminddb.obj
collision, in both phpize and in-tree modes, and that ADD_SOURCES creates that
directory itself (there is no PHP_ADD_BUILD_DIR to forget); and the flag string
was replayed through ADD_FLAG, generate_makefile and MSVC's argv rules to
confirm PACKAGE_VERSION arrives as the string literal "1.13.3" and that the
Makefile line ends in no stray backslash. maxmind/MaxMind-DB-Reader-php-ext#2
switches that repository's Windows lane to the flag so the four Windows legs
exercise it, on the same submodule-tree condition its Linux and macOS lanes
already use.

Two things to know:

• PACKAGE_VERSION is passed on the command line in bundled mode, and
  MMDB_lib_version() returns it, so it has to be bumped whenever the
  submodule is. CI asserts it matches the submodule's configure.ac, and both
  config.m4 and config.w32 now carry the literal.
• Nothing in this repository's CI builds config.w32, so the Windows path is
  exercised only by STF-1287: Build and publish PIE precompiled binaries on tag MaxMind-DB-Reader-php-ext#2, and only once that
  repository's submodule points at a commit carrying ext/libmaxminddb.

package.xml is untouched, as PECL keeps using the system library.

.github/dependabot.yml gains a gitsubmodule stanza that ignores
ext/libmaxminddb. Dependabot moves submodules to the tracked branch's tip
when no newer tag exists, which would take the vendored copy off release tags.
#264 adds the same stanza without the ignore, so that tests/data gets
updates; the two stanzas are otherwise identical, so whichever lands second
just needs the ignore list kept.

---

Generated by Claude Code

[claude]

@coderabbitai review

---

Generated by Claude Code

[oschwald]

Claude here, on behalf of Greg.

Pushed 03ebcc4, which moves the inline self-containment checks in test-bundled.yml into dev-bin/gate-extension.sh so that this repo and maxmind/MaxMind-DB-Reader-php-ext#2 run one implementation instead of two.

The two copies had already drifted, in the direction of the weaker one. This workflow treated an unmeasurable glibc floor as an error; the extension repo's copy wrapped the whole measuring pipeline in || true and then skipped the assertion when the result came back empty, so a missing objdump would have certified the binary rather than failing it. Verified locally against a real shared object: with objdump off $PATH the old shape exits 0, the shared script exits non-zero.

MAX_GLIBC_VERSION is renamed to MAX_GLIBC and the limit stays at the call site — this job builds on the runner and measures 2.38, the extension repo builds in a pinned bookworm container and holds itself to 2.36. Both are right for how they build, so the script takes the number rather than hard-coding one.

file(1) is now non-fatal. Nothing asserts on its output, and it is a separate package from binutils, so it should not be able to fail the gate in a build image that lacks it.

Follow-up needed in maxmind/MaxMind-DB-Reader-php-ext#2: it should delete its own dev-bin/gate-extension.sh and call MaxMind-DB-Reader-php/dev-bin/gate-extension.sh through the submodule instead. That can only land once the submodule points at a commit carrying this script, so it is gated on this PR merging. Its gate-extension.ps1 has no second caller today and I have left it where it is.

[oschwald]

Claude here, on behalf of Greg. Pushed three fixups against 03ebcc4 addressing C1, C2, I5 and I6 from review. C1 is a fair hit on code I wrote — worth stating plainly, because the earlier review of the extension repo flagged this exact pattern and I then fixed only one of the four checks while the commit message claimed the gate was sound.

C1 + C2 — 8199bd7. set -e is suspended inside an if condition, so if some-tool "$so" | grep …; then fail; fi could not tell "found nothing" from "not installed". Only check 4 ran its tool in an assignment, which is why only check 4 failed closed. Every tool now runs in its own assignment and the greps read captured output. Reproduced before and after, against a real .so with readelf and nm each removed from $PATH: before 0, after 127.

The NEEDED sed also required GNU's parenthesised (NEEDED); llvm-readelf prints it bare, so the extraction yielded nothing and the check passed on an object that did link libmaxminddb. Parens are now optional and an empty result is fatal. Verified with a shimmed readelf emitting llvm-style output naming libmaxminddb.so.0: exit 1, correct error.

The ldd check is dropped rather than converted — it duplicated the NEEDED check less reliably, and as the review notes it comes from libc-bin, not binutils. The "readelf, nm and objdump are genuinely required" comment was wrong and is corrected. Argument and file-existence checks added.

One thing worth recording: my first attempt at the RUNPATH pattern used \\{0,1\\} in a grep -E, where that is a literal brace rather than an interval — it would never have matched, i.e. another fail-open. Caught by testing the pattern rather than reading it. The sed is BRE and the same spelling is correct there, which is what made it easy to miss.

I5 — 05dd86c. at_most 11 11.0 reported that 11.0 exceeded 11. Harmless for glibc as spelled, but MACOSX_DEPLOYMENT_TARGET=11 against otool's minos 11.0 would have blocked a good release with "Requires macOS 11.0, above the documented maximum 11". Both operands are now padded to equal component counts.

I6 — 44e9fbe. All slices are measured and the assertion runs against the highest. Verified against synthetic fat output: x86_64 at 11.0 plus arm64 at 14.0 measured 11.0 before, 14.0 after. The unreadable-minos message now names LC_VERSION_MIN_MACOSX.

Not addressed, and all outside the gate: C3 (AC_C_BIGENDIAN's third argument mapping unknown to big-endian, and no action-if-universal), I1 (make test exiting 0 with zero tests), I2 (PHPUnit never running against the bundled build — the review is right that this is the best value per line, and it would give C3 real detection), I3/I4 ($srcdir vs $ext_srcdir, the unchecked stub write, the inert .gitignore line), I7 and I8. Those are all in config.m4/config.w32/test-bundled.yml rather than the shared script, so I have left them to you.

[oschwald]

Claude here, on behalf of Greg. Worked through the rest of the review — 11 more commits, covering C3 and I1–I8 plus the suggestions I judged worth taking.

C3 e54b543 — AC_C_BIGENDIAN now passes empty if-unknown and if-universal, so MMDB_LITTLE_ENDIAN is left undefined unless the answer is known and maxminddb.h derives it from __BYTE_ORDER__ instead. That derivation is per-architecture correct under a universal build, which no configure-time value can be.

I3 + I4 69b392c — stub moves to $ext_builddir, submodule-presence check added (config.w32 has had one since it was written), write failure is fatal, dead .gitignore line removed. Confirmed the line was inert: git check-ignore refuses outright with "is in submodule".

I7 5de5c78 — flags move to PHP_NEW_EXTENSION's extra-cflags argument. The debug -Werror block moves with them; it predates this branch, but -Werror across a whole php-src tree isn't ours to impose.

I2 2e95b0b — the two PHPUnit steps from test.yml, plus gmp so ReaderTest's uint128 boundary cases run instead of skipping. Agreed this is the best value per line: MMDB_UINT128_IS_BYTE_ARRAY=1 had never been executed by any test in this repo, and the suite is also the only thing in the job that reads a float or double.

I8 2b640fe, I1 3f80c90 — the pkg-config precondition now fails when pkg-config is absent rather than passing on 127; make test asserts its output, since the generated target echoes "Cannot run tests without CLI sapi" and returns 0.

I5/I6 gate coverage 043c2b9 — the debug build now runs the gate, and four negative cases are asserted. This one I'd flag as the most valuable of the batch: nothing anywhere observed the gate failing, and the ERE/BRE mix-up in my own earlier fix is exactly what that blind spot lets through.

Suggestions taken: fdefb95 adds dev-bin/check-libmaxminddb-version.sh and a lint.yml job, closing the gap where config.w32's PACKAGE_VERSION was checked by nothing (verified passing now and failing when set to 1.13.2); 21dbb7b makes check.php assert === 'London' and guards the empty-version sed; f919f80 corrects the "builds on the runner" claim (it's an unpinned container), the shadowing claim, and the config.h one, and names the #if/#ifdef asymmetry; 434bb7c merges the CHANGELOG bullets.

Deliberately not done. Dropping b969d83 and its revert needs a force-push that would discard whatever else is in flight — worth doing in your own final cleanup rather than by me. No Windows CI job: the extension repository already builds Windows from the bundled sources and gates the DLL, so a second one here would duplicate it — the static version lint covers what that job was mainly wanted for. No ASan lane for the bundled config; the review calls it regression coverage rather than a live defect and it's a bigger change. The actions/checkout "we use v1" comment rot is repo-wide and wants its own sweep.

I could not build the extension here, so config.m4 is verified by review and by CI, not locally. The shell and the version lint were both run. If --enable-maxminddb-debug trips on the extra-cflags move, that's the change to look at first.