fix(linux): reset the build log and stop mis-reading non-OpenSSL by devhardiyanto · Pull Request #30 · devhardiyanto/phpvm

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto · 2026-07-26T22:42:18Z

What

Tiga perbaikan di jalur build gagal phpvm install (Linux/macOS), lanjutan dari #28.

Why

Sebuah build log PHP 7.3 masih memperlihatkan RSA_SSLV23_PADDING undeclared walau guard OpenSSL sudah ada di v1.13.1 — mesinnya ternyata belum di-upgrade. Tapi menelusuri log itu memunculkan tiga defect nyata di kode yang sekarang:

$PHPVM_LOG hanya pernah di-append, tidak pernah di-reset. Pada install ulang, _phpvm_show_build_error (grep -m1) menampilkan error pertama dari build sebelumnya — persis baris yang paling menyesatkan saat orang sedang retry.
_phpvm_openssl_version membaca openssl version tanpa cek vendor. LibreSSL/BoringSSL juga menjawab perintah itu, dan 3.x mereka masih punya RSA_SSLV23_PADDING. Host macOS/OpenBSD jadi ditolak build PHP 7.x yang sebenarnya sukses.
Perbandingan major pakai [[ ... -lt 3 ]], yang error kalau major non-numerik lalu jatuh ke memblokir — kebalikan dari kontrak fail-open guard ini.

How

Truncate log sekali di awal phpvm_install, sebelum step mana pun menulis.
Veto vendor: banner openssl version yang tidak diawali OpenSSL dianggap "unknown" → build jalan.
Guard [[ =~ ^[0-9]+$ ]] sebelum membandingkan major.

Windows tidak tersentuh: pakai zip prebuilt, tidak compile.

Changes

linux/phpvm.sh — : > "$PHPVM_LOG" di phpvm_install; vendor check + fail-open numerik di _phpvm_openssl_version / _phpvm_check_openssl_compat
tests/linux/build_preflight.bats — +5 case (LibreSSL, BoringSSL, banner OpenSSL asli, major non-numerik, ordering truncate-sebelum-append)
tests/linux/zsh-smoke.zsh — guard sekarang bergantung pada globbing [[ != OpenSSL* ]] dan regex [[ =~ ]]; bats cuma melihat pembacaan bash
Bump versi 1.13.1 → 1.13.2

Testing Done

bats tests/linux/ — 82/82 lewat (bats 1.14.0)
bash -n linux/phpvm.sh
zsh tests/linux/zsh-smoke.zsh — zsh tidak tersedia di mesin dev; diverifikasi oleh job zsh di CI

Three defects, all in the path a failed build takes. $PHPVM_LOG was only ever appended to, never reset. On a retry the log still held the previous run, so _phpvm_show_build_error's `grep -m1` reported the first error of the *earlier* build - the one line most likely to send someone chasing a problem they had already fixed. Truncate it once at the top of phpvm_install, before any step writes. _phpvm_openssl_version read `openssl version` without checking the vendor. LibreSSL and BoringSSL answer that command too, and their 3.x still defines RSA_SSLV23_PADDING, so a macOS or OpenBSD host would be refused a PHP 7.x build that would have compiled. Treat a non-OpenSSL banner as "unknown" and let the build proceed. The major-version comparison used `[[ ... -lt 3 ]]`, which errors on a non-numeric major and falls through to blocking - the opposite of this guard's fail-open contract. Check for digits first. Cover all three in bats, plus a zsh smoke for the guard: it now leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, and bats only ever sees the bash reading of both. devhardiyanto

devhardiyanto

devhardiyanto added 2 commits July 27, 2026 05:37