Fix openssl missing cert bug for Linux & macOS (#581)

* Fix openssl missing cert bug for linux

* Fix openssl missing cert bug for macOS

.github/FUNDING.yml

@@ -1,9 +1,9 @@
 # These are supported funding model platforms
 
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+github: [crazywhalecc]# Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
 patreon: # Replace with a single Patreon username
 open_collective: # Replace with a single Open Collective username
-ko_fi: crazywhalecc # Replace with a single Ko-fi username
+# ko_fi: crazywhalecc # Replace with a single Ko-fi username
 tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
 community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
 liberapay: # Replace with a single Liberapay username

README.md

@@ -313,7 +313,7 @@ Now there is a [static-php](https://github.com/static-php) organization, which i
 
 ## Sponsor this project
 
-You can sponsor my project on [this page](https://github.com/crazywhalecc/crazywhalecc/blob/master/FUNDING.md). A portion of your donation will be used to maintain the **static-php.dev** server.
+You can sponsor me or my project from [GitHub Sponsor](https://github.com/crazywhalecc). A portion of your donation will be used to maintain the **static-php.dev** server.
 
 ## Open-Source License
 

config/ext.json

@@ -560,6 +560,19 @@
         "source": "rar",
         "cpp-extension": true
     },
+    "rdkafka": {
+        "support": {
+            "BSD": "wip",
+            "Windows": "wip"
+        },
+        "type": "external",
+        "source": "ext-rdkafka",
+        "arg-type": "custom",
+        "cpp-extension": true,
+        "lib-depends": [
+            "librdkafka"
+        ]
+    },
     "readline": {
         "support": {
             "Windows": "wip",
@@ -708,19 +721,6 @@
             "zlib"
         ]
     },
-    "rdkafka": {
-        "support": {
-            "BSD": "wip",
-            "Windows": "wip"
-        },
-        "type": "external",
-        "source": "ext-rdkafka",
-        "arg-type": "custom",
-        "cpp-extension": true,
-        "lib-depends": [
-            "librdkafka"
-        ]
-    },
     "swoole": {
         "support": {
             "Windows": "no",

config/lib.json

@@ -176,7 +176,8 @@
             "libjpeg",
             "libwebp",
             "freetype",
-            "libtiff"
+            "libtiff",
+            "libheif"
         ],
         "lib-suggests": [
             "zstd",
@@ -208,6 +209,13 @@
             "libsodium"
         ]
     },
+    "libaom": {
+        "source": "libaom",
+        "static-libs-unix": [
+            "libaom.a"
+        ],
+        "cpp-library": true
+    },
     "libargon2": {
         "source": "libargon2",
         "static-libs-unix": [
@@ -235,6 +243,13 @@
             "ares_rules.h"
         ]
     },
+    "libde265": {
+        "source": "libde265",
+        "static-libs-unix": [
+            "libde265.a"
+        ],
+        "cpp-library": true
+    },
     "libevent": {
         "source": "libevent",
         "static-libs-unix": [
@@ -276,6 +291,19 @@
             "fficonfig.h"
         ]
     },
+    "libheif": {
+        "source": "libheif",
+        "static-libs-unix": [
+            "libheif.a"
+        ],
+        "lib-depends": [
+            "libde265",
+            "libwebp",
+            "libaom",
+            "zlib",
+            "brotli"
+        ]
+    },
     "libiconv": {
         "source": "libiconv",
         "static-libs-unix": [
@@ -355,6 +383,18 @@
             "openssl"
         ]
     },
+    "librdkafka": {
+        "source": "librdkafka",
+        "static-libs-unix": [
+            "librdkafka.a",
+            "librdkafka++.a",
+            "librdkafka-static.a"
+        ],
+        "cpp-library": true,
+        "lib-suggests": [
+            "zstd"
+        ]
+    },
     "libsodium": {
         "source": "libsodium",
         "static-libs-unix": [
@@ -558,18 +598,6 @@
     "pkg-config": {
         "source": "pkg-config"
     },
-    "librdkafka": {
-        "source": "librdkafka",
-        "static-libs-unix": [
-            "librdkafka.a",
-            "librdkafka++.a",
-            "librdkafka-static.a"
-        ],
-        "cpp-library": true,
-        "lib-suggests": [
-            "zstd"
-        ]
-    },
     "postgresql": {
         "source": "postgresql",
         "static-libs-unix": [

config/source.json

@@ -69,23 +69,6 @@
             "path": "LICENSE"
         }
     },
-    "librdkafka": {
-        "type": "ghtar",
-        "repo": "confluentinc/librdkafka",
-        "license": {
-            "type": "file",
-            "path": "LICENSE"
-        }
-    },
-    "ext-rdkafka": {
-        "type": "ghtar",
-        "repo": "arnaud-lb/php-rdkafka",
-        "path": "php-src/ext/rdkafka",
-        "license": {
-            "type": "file",
-            "path": "LICENSE"
-        }
-    },
     "ext-event": {
         "type": "url",
         "url": "https://bitbucket.org/osmanov/pecl-event/get/3.0.8.tar.gz",
@@ -145,6 +128,15 @@
             "path": "LICENSE"
         }
     },
+    "ext-rdkafka": {
+        "type": "ghtar",
+        "repo": "arnaud-lb/php-rdkafka",
+        "path": "php-src/ext/rdkafka",
+        "license": {
+            "type": "file",
+            "path": "LICENSE"
+        }
+    },
     "ext-simdjson": {
         "type": "url",
         "url": "https://pecl.php.net/get/simdjson",
@@ -311,6 +303,16 @@
             "path": "LICENSE"
         }
     },
+    "libaom": {
+        "type": "git",
+        "rev": "main",
+        "url": "https://aomedia.googlesource.com/aom",
+        "provide-pre-built": true,
+        "license": {
+            "type": "file",
+            "path": "LICENSE"
+        }
+    },
     "libargon2": {
         "type": "git",
         "rev": "master",
@@ -346,6 +348,17 @@
             "path": "LICENSE.md"
         }
     },
+    "libde265": {
+        "type": "ghrel",
+        "repo": "strukturag/libde265",
+        "match": "libde265-.+\\.tar\\.gz",
+        "prefer-stable": true,
+        "provide-pre-built": true,
+        "license": {
+            "type": "file",
+            "path": "COPYING"
+        }
+    },
     "libevent": {
         "type": "ghrel",
         "repo": "libevent/libevent",
@@ -376,6 +389,17 @@
             "path": "LICENSE"
         }
     },
+    "libheif": {
+        "type": "ghrel",
+        "repo": "strukturag/libheif",
+        "match": "libheif-.+\\.tar\\.gz",
+        "prefer-stable": true,
+        "provide-pre-built": true,
+        "license": {
+            "type": "file",
+            "path": "COPYING"
+        }
+    },
     "libiconv": {
         "type": "filelist",
         "url": "https://ftp.gnu.org/gnu/libiconv/",
@@ -442,6 +466,14 @@
             "path": "LICENSE"
         }
     },
+    "librdkafka": {
+        "type": "ghtar",
+        "repo": "confluentinc/librdkafka",
+        "license": {
+            "type": "file",
+            "path": "LICENSE"
+        }
+    },
     "libsodium": {
         "type": "ghrel",
         "repo": "jedisct1/libsodium",
@@ -751,7 +783,7 @@
     },
     "sqlite": {
         "type": "url",
-        "url": "https://www.sqlite.org/2023/sqlite-autoconf-3430200.tar.gz",
+        "url": "https://www.sqlite.org/2024/sqlite-autoconf-3450200.tar.gz",
         "provide-pre-built": true,
         "license": {
             "type": "text",

src/SPC/ConsoleApplication.php

@@ -31,7 +31,7 @@ use Symfony\Component\Console\Application;
  */
 final class ConsoleApplication extends Application
 {
-    public const VERSION = '2.4.2';
+    public const VERSION = '2.4.3';
 
     public function __construct()
     {

src/SPC/builder/linux/library/libaom.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\linux\library;
+
+class libaom extends LinuxLibraryBase
+{
+    use \SPC\builder\unix\library\libaom;
+
+    public const NAME = 'libaom';
+}

src/SPC/builder/linux/library/libde265.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\linux\library;
+
+class libde265 extends LinuxLibraryBase
+{
+    use \SPC\builder\unix\library\libde265;
+
+    public const NAME = 'libde265';
+}

src/SPC/builder/linux/library/libheif.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\linux\library;
+
+class libheif extends LinuxLibraryBase
+{
+    use \SPC\builder\unix\library\libheif;
+
+    public const NAME = 'libheif';
+}

src/SPC/builder/linux/library/openssl.php

@@ -69,6 +69,7 @@ class openssl extends LinuxLibraryBase
                 "{$env} ./Configure no-shared {$extra} " .
                 '--prefix=/ ' .
                 '--libdir=lib ' .
+                '--openssldir=/etc/ssl ' .
                 '-static ' .
                 "{$zlib_extra}" .
                 'no-legacy ' .

src/SPC/builder/macos/library/libaom.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\macos\library;
+
+class libaom extends MacOSLibraryBase
+{
+    use \SPC\builder\unix\library\libaom;
+
+    public const NAME = 'libaom';
+}

src/SPC/builder/macos/library/libde265.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\macos\library;
+
+class libde265 extends MacOSLibraryBase
+{
+    use \SPC\builder\unix\library\libde265;
+
+    public const NAME = 'libde265';
+}

src/SPC/builder/macos/library/libheif.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\macos\library;
+
+use SPC\store\FileSystem;
+
+class libheif extends MacOSLibraryBase
+{
+    use \SPC\builder\unix\library\libheif;
+
+    public const NAME = 'libheif';
+
+    public function patchBeforeBuild(): bool
+    {
+        if (!str_contains(file_get_contents($this->source_dir . '/CMakeLists.txt'), 'libbrotlienc')) {
+            FileSystem::replaceFileStr(
+                $this->source_dir . '/CMakeLists.txt',
+                'list(APPEND REQUIRES_PRIVATE "libbrotlidec")',
+                'list(APPEND REQUIRES_PRIVATE "libbrotlidec")' . "\n" . '        list(APPEND REQUIRES_PRIVATE "libbrotlienc")'
+            );
+            return true;
+        }
+        return false;
+    }
+}

src/SPC/builder/macos/library/openssl.php

@@ -54,7 +54,7 @@ class openssl extends MacOSLibraryBase
                 "./Configure no-shared {$extra} " .
                 '--prefix=/ ' . // use prefix=/
                 "--libdir={$lib} " .
-                '--openssldir=/System/Library/OpenSSL ' .
+                '--openssldir=/etc/ssl ' .
                 "darwin64-{$this->builder->getOption('arch')}-cc"
             )
             ->exec('make clean')

src/SPC/builder/unix/library/libaom.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\unix\library;
+
+use SPC\exception\FileSystemException;
+use SPC\exception\RuntimeException;
+use SPC\store\FileSystem;
+
+trait libaom
+{
+    /**
+     * @throws RuntimeException
+     * @throws FileSystemException
+     */
+    protected function build(): void
+    {
+        // CMake needs a clean build directory
+        FileSystem::resetDir($this->source_dir . '/builddir');
+        // Start build
+        shell()->cd($this->source_dir . '/builddir')
+            ->exec(
+                'cmake ' .
+                '-DCMAKE_INSTALL_PREFIX=' . BUILD_ROOT_PATH . ' ' .
+                "-DCMAKE_TOOLCHAIN_FILE={$this->builder->cmake_toolchain_file} " .
+                '-DCMAKE_BUILD_TYPE=Release ' .
+                '-DBUILD_SHARED_LIBS=OFF ' .
+                '-DAOM_TARGET_CPU=generic ' .
+                '..'
+            )
+            ->exec("cmake --build . -j {$this->builder->concurrency}")
+            ->exec('make install');
+        $this->patchPkgconfPrefix(['aom.pc']);
+    }
+}

src/SPC/builder/unix/library/libde265.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\unix\library;
+
+use SPC\exception\FileSystemException;
+use SPC\exception\RuntimeException;
+use SPC\store\FileSystem;
+
+trait libde265
+{
+    /**
+     * @throws RuntimeException
+     * @throws FileSystemException
+     */
+    protected function build(): void
+    {
+        // CMake needs a clean build directory
+        FileSystem::resetDir($this->source_dir . '/build');
+        // Start build
+        shell()->cd($this->source_dir . '/build')
+            ->exec(
+                'cmake ' .
+                '-DCMAKE_INSTALL_PREFIX=' . BUILD_ROOT_PATH . ' ' .
+                "-DCMAKE_TOOLCHAIN_FILE={$this->builder->cmake_toolchain_file} " .
+                '-DCMAKE_BUILD_TYPE=Release ' .
+                '-DBUILD_SHARED_LIBS=OFF ' .
+                '-DENABLE_SDL=OFF ' . // Disable SDL, currently not supported
+                '..'
+            )
+            ->exec("cmake --build . -j {$this->builder->concurrency}")
+            ->exec('make install');
+        $this->patchPkgconfPrefix(['libde265.pc']);
+    }
+}

src/SPC/builder/unix/library/libheif.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SPC\builder\unix\library;
+
+use SPC\exception\FileSystemException;
+use SPC\exception\RuntimeException;
+use SPC\store\FileSystem;
+
+trait libheif
+{
+    /**
+     * @throws RuntimeException
+     * @throws FileSystemException
+     */
+    protected function build(): void
+    {
+        // CMake needs a clean build directory
+        FileSystem::resetDir($this->source_dir . '/build');
+        // Start build
+        shell()->cd($this->source_dir . '/build')
+            ->exec(
+                'cmake ' .
+                '--preset=release ' .
+                '-DCMAKE_INSTALL_PREFIX=' . BUILD_ROOT_PATH . ' ' .
+                "-DCMAKE_TOOLCHAIN_FILE={$this->builder->cmake_toolchain_file} " .
+                '-DCMAKE_BUILD_TYPE=Release ' .
+                '-DBUILD_SHARED_LIBS=OFF ' .
+                '-DWITH_EXAMPLES=OFF ' .
+                '-DWITH_GDK_PIXBUF=OFF ' .
+                '-DBUILD_TESTING=OFF ' .
+                '-DWITH_LIBSHARPYUV=ON ' . // optional: libwebp
+                '-DENABLE_PLUGIN_LOADING=OFF ' .
+                '..'
+            )
+            ->exec("cmake --build . -j {$this->builder->concurrency}")
+            ->exec('make install');
+        $this->patchPkgconfPrefix(['libheif.pc']);
+    }
+}

src/SPC/store/SourcePatcher.php

@@ -6,6 +6,7 @@ namespace SPC\store;
 
 use SPC\builder\BuilderBase;
 use SPC\builder\linux\LinuxBuilder;
+use SPC\builder\linux\SystemUtil;
 use SPC\builder\unix\UnixBuilderBase;
 use SPC\exception\FileSystemException;
 use SPC\exception\RuntimeException;
@@ -27,6 +28,7 @@ class SourcePatcher
         FileSystem::addSourceExtractHook('libyaml', [SourcePatcher::class, 'patchLibYaml']);
         FileSystem::addSourceExtractHook('php-src', [SourcePatcher::class, 'patchImapLicense']);
         FileSystem::addSourceExtractHook('ext-imagick', [SourcePatcher::class, 'patchImagickWith84']);
+        FileSystem::addSourceExtractHook('libaom', [SourcePatcher::class, 'patchLibaomForAlpine']);
     }
 
     /**
@@ -393,6 +395,15 @@ class SourcePatcher
         return true;
     }
 
+    public static function patchLibaomForAlpine(): bool
+    {
+        if (PHP_OS_FAMILY === 'Linux' && SystemUtil::isMuslDist()) {
+            SourcePatcher::patchFile('libaom_posix_implict.patch', SOURCE_PATH . '/libaom');
+            return true;
+        }
+        return false;
+    }
+
     /**
      * Patch cli SAPI Makefile for Windows.
      *

src/globals/ext-tests/imagick.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+assert(class_exists('Imagick'));
+assert(Imagick::queryFormats('AVIF') !== []);
+assert(Imagick::queryFormats('HEIF') !== []);
+assert(Imagick::queryFormats('HEIC') !== []);
+assert(Imagick::queryFormats('WEBP') !== []);
+assert(Imagick::queryFormats('JPEG') !== []);
+assert(Imagick::queryFormats('PNG') !== []);
+assert(Imagick::queryFormats('TIFF') !== []);

src/globals/ext-tests/openssl.php

@@ -4,3 +4,4 @@ declare(strict_types=1);
 
 assert(function_exists('openssl_digest'));
 assert(openssl_digest('123456', 'md5') === 'e10adc3949ba59abbe56e057f20f883e');
+assert(file_get_contents('https://example.com/') !== false);

src/globals/patch/libaom_posix_implict.patch

@@ -0,0 +1,13 @@
+https://bugs.gentoo.org/869419
+
+POSIX_C_SOURCE is needed for ftello.
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -269,6 +269,7 @@ add_library(aom_rtcd OBJECT ${AOM_RTCD_SOURCES})
+ add_dependencies(aom_rtcd aom_version)
+
+ if(ENABLE_EXAMPLES)
++  add_definitions(-D_POSIX_C_SOURCE=200112L)
+   add_library(aom_encoder_stats OBJECT ${AOM_ENCODER_STATS_SOURCES})
+   set(AOM_LIB_TARGETS ${AOM_LIB_TARGETS} aom_encoder_stats)
+ endif()

src/globals/test-extensions.php

@@ -21,9 +21,9 @@ $test_php_version = [
 
 // test os (macos-13, macos-14, ubuntu-latest, windows-latest are available)
 $test_os = [
-    // 'macos-14',
+    'macos-14',
-    'macos-13',
+    // 'macos-13',
-    // 'ubuntu-latest',
+    'ubuntu-latest',
 ];
 
 // whether enable thread safe
@@ -35,12 +35,12 @@ $no_strip = false;
 $upx = false;
 
 // prefer downloading pre-built packages to speed up the build process
-$prefer_pre_built = true;
+$prefer_pre_built = false;
 
 // If you want to test your added extensions and libs, add below (comma separated, example `bcmath,openssl`).
 $extensions = match (PHP_OS_FAMILY) {
-    'Linux', 'Darwin' => 'rdkafka',
+    'Linux', 'Darwin' => 'openssl',
-    'Windows' => 'zlib',
+    'Windows' => 'openssl',
 };
 
 // If you want to test lib-suggests feature with extension, add them below (comma separated, example `libwebp,libavif`).
@@ -53,7 +53,7 @@ $with_libs = match (PHP_OS_FAMILY) {
 // You can use `common`, `bulk`, `minimal` or `none`.
 // note: combination is only available for *nix platform. Windows must use `none` combination
 $base_combination = match (PHP_OS_FAMILY) {
-    'Linux', 'Darwin' => 'bulk',
+    'Linux', 'Darwin' => 'minimal',
     'Windows' => 'none',
 };