From 122a892a1fb272ba374cb11be11fdfe3aba400fb Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:17:29 +0000
Subject: [PATCH] Pin Linux PHAR upgrade checks to official PHP container

---
 .github/workflows/release-rust.yml       | 32 ++++++++++++++++--------
 scripts/ci/test-release-rust-workflow.py |  9 ++++++-
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release-rust.yml b/.github/workflows/release-rust.yml
index a51da27..9c6e22b 100644
--- a/.github/workflows/release-rust.yml
+++ b/.github/workflows/release-rust.yml
@@ -500,18 +500,9 @@ jobs:
     env:
       LEGACY_VERSION: 2.3.5
       LEGACY_PHAR_SHA256: 67538671d44709312dd0ce77ec890094daf5c70d1e15eaa777c22231627d05a5
+      # Pinned official PHP index, including native amd64 and arm64 images.
+      LEGACY_PHP_IMAGE: php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe
     steps:
-      - name: Disable APT download retries (CVE-2026-109518)
-        if: runner.os == 'Linux'
-        run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
-      - name: Set up PHP for the PHAR install
-        if: matrix.install == 'phar' && runner.os == 'Linux'
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
-        with:
-          php-version: '8.4'
-          tools: none
-          coverage: none
-
       # setup-php could not install PHP on macos-15 for 2.5.0-rc.3 (twice,
       # ~29 minutes each), so macOS takes PHP 8.4 from Homebrew core, as
       # release.yml's macOS qualification does.
@@ -541,6 +532,25 @@ jobs:
           base="https://github.com/${GITHUB_REPOSITORY}/releases/download"
           work="$(mktemp -d)"
           export HOME="$work" DW_CONFIG_HOME="$work/config"
+          if [ "$INSTALL" = "phar" ] && [ "$RUNNER_OS" = "Linux" ]; then
+            case "$ASSET" in
+              dw-linux-x86_64) php_platform=linux/amd64 ;;
+              dw-linux-aarch64) php_platform=linux/arm64 ;;
+              *) echo "::error::No PHP platform for $ASSET"; exit 1 ;;
+            esac
+            # Mount only the downloaded test files. No checkout, token or
+            # host configuration is exposed to the PHP process (#297).
+            php() {
+              docker run --rm --name cli-legacy-phar-upgrade --init \
+                --platform "$php_platform" --cpus=2 --memory=512m --pids-limit=128 \
+                --read-only --tmpfs /tmp:rw,size=64m --cap-drop=ALL \
+                --security-opt=no-new-privileges --user "$(id -u):$(id -g)" \
+                --mount "type=bind,src=$work,dst=$work" \
+                --env "HOME=$work" --env "DW_CONFIG_HOME=$work/config" \
+                "$LEGACY_PHP_IMAGE" php "$@"
+            }
+            php -r 'printf("Legacy PHAR toolchain: PHP %s, %s\n", PHP_VERSION, php_uname("m"));'
+          fi
           curl --proto '=https' --tlsv1.2 -fsSL --retry 3 --retry-all-errors -o "$work/SHA256SUMS" "$base/$RELEASE_TAG/SHA256SUMS"
           expected="$(awk -v a="$ASSET" '$2 == a {print $1}' "$work/SHA256SUMS")"
           [ -n "$expected" ] || { echo "::error::$ASSET missing from $RELEASE_TAG SHA256SUMS"; exit 1; }
diff --git a/scripts/ci/test-release-rust-workflow.py b/scripts/ci/test-release-rust-workflow.py
index 65942d9..455b7eb 100644
--- a/scripts/ci/test-release-rust-workflow.py
+++ b/scripts/ci/test-release-rust-workflow.py
@@ -65,7 +65,7 @@
         "bundle": {"actions/download-artifact", "actions/upload-artifact"},
         "publish": {"actions/checkout", "actions/download-artifact", "actions/attest-build-provenance"},
         "verify-release": {"actions/checkout"},
-        "upgrade-from-2x": {"shivammathur/setup-php"},
+        "upgrade-from-2x": set(),
     },
     "build": {
         "build": {
@@ -168,6 +168,13 @@ def test_only_publish_writes_attests_or_mints_tokens(self):
             if name != "publish":
                 self.assertNotIn("environment", job, name)
 
+    def test_legacy_php_container_is_bound_to_an_exact_official_image(self):
+        image = self.jobs["upgrade-from-2x"]["env"]["LEGACY_PHP_IMAGE"]
+        self.assertRegex(image, r"^php:[0-9]+\.[0-9]+\.[0-9]+-cli-bookworm@sha256:[0-9a-f]{64}$")
+        run = "\n".join(step.get("run", "") for step in self.steps("upgrade-from-2x"))
+        self.assertIn('"$LEGACY_PHP_IMAGE" php "$@"', run)
+        self.assertNotIn("sudo", run)
+
     def test_no_secrets_anywhere(self):
         for path in (RUST, BUILD, DRY_RUN):
             self.assertNotRegex(path.read_text(encoding="utf-8"), r"secrets\.", path.name)