Full PHP 5.4.x compatibility

[stefanesser]

Just as a reminder that PHP 5.4.x is not yet supported.

Current tree compiles against it, without disabling features.

However some problems with the dropped variable statistics and the session module.

[FrancisVarga]

estimated time?

[calestyo]

Is the suhosin core patch also maintained in some git? Any estimates when that will be ready for 5.4.x? :)

[FrancisVarga]

yeah that would be great to know :)

[ncopa]

It would be great to know if there ever will be any suhosin for php-5.4.

Looks like last commit was in May 2012. I have a distro to release who uses suhosin. I have to decide to either keep php 5.3 with suhosin or ditch suhosin and go for php 5.4. We are not taking suhosin back once its kicked out so I would prefer keep php-5.3 suhosin and wait.

[Rewt0r]

I think it's clear that Suhosin is now dead as PHP 5.4.x has been available for a long time. Most repositories have added versions 5.4.x and removed Suhosin.

[drwxmrrs]

@Rewt0r so this extension is redundant in php 5.4.9?

[ghost]

@drewsymo it's not redundant (PHP 5.4.x does not contain Suhosin's functionality), it's simply unsupported (there is no such thing as a PHP5.4 + Suhosin, at least not at the time of this writing).

[stef157]

PHP 5.4.9 work with Suhosin

"PHP Version 5.4.9-1~dotdeb.0
This program makes use of the Zend Scripting Language Engine:
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
with Suhosin v0.9.34-dev, Copyright (c) 2007-2012, by SektionEins GmbH
"

Or, i'm wrong ? :-\

[rendhalver]

Awesome news.
I am guessing from the package name that is on Debian.
Will it work on CentOS, RHEL and Fedora as well?
I realise I will likely have to build an rpm myself but that's a small price to pay.

[blino]

I have a fix for sessions in #26

[oerdnj]

@stef157 @rendhalver JFTR I think it's quite wrong from dotdeb people to use development version of suhosin in their builds. @stefanesser himself asked to not use this patch, since there's no guarantee that the patch will catch all security properties of PHP 5.4, since many internals has changed. This would only lead to warm and wrong feeling of security, but not the real protection.

[ghost]

Hi,

AFAIK dotdeb have removed suhosin completly from their builds of PHP 5.4. At least they don't provide it at their repository:

http://packages.dotdeb.org/dists/wheezy/php5/binary-amd64/

[calestyo]

@RealRancor, since @oerdnj is the .deb maintainer he probably knows that ;-)

Should Suhosin come back (which I'd really hope) and should one see that it stays alive (i.e. getting constant maintenance again, also for new versions of PHP),... the Debian PHP maintainers will hopefully reconsider their decision and simply provide packages for both, with the Suhosin core patch and without, so that people can choose whether they prefer the "extra security" or performance.

[jani]

@calestyo
I think it's likely that a functional Suhosin could be packaged for Debian, just like it was before.

However, the current Debian stable ship left the dock a long time ago, and we're stuck in 1750, when we had no helicopters to fly out that new thing to their ship.

In other words: start focusing on keeping Suhosin in Debian unstable and testing, and hope it makes the next stable release.

[oerdnj]

@jani It's not even likely.

[jani]

@oerdnj

http://packages.debian.org/sid/php5-suhosin

[calestyo]

@jani Well that’s quite outdated… and the module is probably not the main problem… it’s the core patch, which the Debian PHP maintainers would need to accept again and/or build simply two version of all the core php packages, as I’d prefer it.
Anyway… as long as suhosin hasn’t been functionally ported to 5.5.. nothing is probably going to happen.

[jani]

@calestyo The point is that if you have something in there, and want to update it, that is somewhat easier than arguing for something that is not in there. :)

And yes, PHP 5.5 is also a challenge here.

There is, however, quite some time until the feature freeze for the next Debian stable (Jessie).

[oerdnj]

@jani As I said before - the suhosin patch for the PHP packages in Debian is not going to happen.
@calestyo I also already said that I am not going to package two versions of PHP just because of suhosin patch. It's not worth the trouble.

[jani]

@oerdnj Why?

If someone does make a 5.3-equivalent viable patch, why should that not "happen" for Debian?

What is your role in this?

[ghost]

Could you guys please stop discussing "Debian Suhosin" in this place?

Every open source developer is happy not to have to deal with broken Debian versions of his software.

Anyway if you want Debian Suhosin then discuss it in a different place.