fix(linux): reset the build log and stop mis-reading non-OpenSSL

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

linux/install.sh

@@ -6,7 +6,7 @@
 
 set -e
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_REPO="https://raw.githubusercontent.com/devhardiyanto/phpvm/main"
 

linux/phpvm.sh

@@ -10,7 +10,7 @@
 # phpvm use 8.3.0
 # ==============================================================================
 
-PHPVM_VERSION="1.13.1"
+PHPVM_VERSION="1.13.2"
 PHPVM_DIR="${PHPVM_DIR:-$HOME/.phpvm}"
 PHPVM_VERSIONS="$PHPVM_DIR/versions"
 PHPVM_CURRENT="$PHPVM_DIR/current"
@@ -238,9 +238,17 @@ _phpvm_detect_os() {
 # what configure consults, so ask it first; the `openssl` CLI is a fallback and
 # can disagree with the installed headers. Echoes "3.0.2"; non-zero if unknown.
 _phpvm_openssl_version() {
+ # LibreSSL and BoringSSL answer `openssl version` and ship an openssl.pc of
+ # their own, but their 3.x still defines RSA_SSLV23_PADDING — the premise of
+ # the guard below. Their numbering says nothing about it, so report the host
+ # as unknown rather than block a build that would have succeeded.
+ local banner=""
+ command -v openssl &>/dev/null && banner=$(openssl version 2>/dev/null)
+ [[ -n "$banner" && "$banner" != OpenSSL* ]] && return 1
+
  local v=""
  command -v pkg-config &>/dev/null && v=$(pkg-config --modversion openssl 2>/dev/null)
- [[ -z "$v" ]] && command -v openssl &>/dev/null && v=$(openssl version 2>/dev/null | awk '{print $2}')
+ [[ -z "$v" && -n "$banner" ]] && v=$(echo "$banner" | awk '{print $2}')
  # Strip a letter suffix: OpenSSL 1.1.1w -> 1.1.1
  v="${v%%[a-zA-Z]*}"
  [[ -n "$v" ]] || return 1
@@ -264,9 +272,13 @@ _phpvm_check_openssl_compat() {
  (( major > 8 )) && return 0
  (( major == 8 && minor >= 1 )) && return 0
 
- local ssl
+ local ssl ssl_major
  ssl=$(_phpvm_openssl_version) || return 0 # can't tell -> don't block
- [[ "${ssl%%.*}" -lt 3 ]] && return 0
+ ssl_major="${ssl%%.*}"
+ # A non-numeric major is something this probe doesn't model; `-lt` would
+ # error and fall through to blocking, so fail open here too.
+ [[ "$ssl_major" =~ ^[0-9]+$ ]] || return 0
+ (( ssl_major < 3 )) && return 0
 
  _err "PHP $ver cannot be built against OpenSSL $ssl."
  _dim "OpenSSL 3.0 removed RSA_SSLV23_PADDING; PHP's openssl extension only"
@@ -604,6 +616,12 @@ phpvm_install() {
  local cpus
  cpus=$(_phpvm_cpus)
 
+ # One install owns the log. Every step below appends, so without this the
+ # file accumulates across runs and _phpvm_show_build_error's `grep -m1`
+ # reports the first error of an *earlier* build — exactly the wrong line
+ # when someone is retrying the install they just watched fail.
+ : > "$PHPVM_LOG"
+
  # The whole build runs in a subshell so the `cd` cannot escape: phpvm.sh is
  # sourced, so a bare cd here would strand the user's own shell in the build
  # directory — which is then deleted, leaving them in a dangling cwd.

tests/linux/build_preflight.bats

@@ -22,6 +22,13 @@ _stub_openssl() {
  eval "_phpvm_openssl_version() { echo '$1'; }"
 }
 
+# Pin what `openssl version` reports, to exercise the probe itself. A function
+# satisfies `command -v openssl`, so the probe takes the same path it would on
+# a host that really ships this binary.
+_stub_openssl_cli() {
+ eval "openssl() { [ \"\$1\" = version ] && echo '$1'; }"
+}
+
 # ── OpenSSL compatibility guard ───────────────────────────────────────────────
 
 @test "openssl 3 blocks PHP 7.3" {
@@ -74,6 +81,34 @@ _stub_openssl() {
  [[ "$output" == *"PHPVM_SKIP_OPENSSL_CHECK=1"* ]]
 }
 
+@test "a non-numeric openssl major does not block the build" {
+ _stub_openssl "unknown"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "libressl reports as unknown rather than blocking" {
+ _stub_openssl_cli "LibreSSL 3.3.6"
+ run _phpvm_openssl_version
+ [ "$status" -eq 1 ]
+ # LibreSSL 3.x still defines RSA_SSLV23_PADDING, so PHP 7.3 must build.
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "boringssl reports as unknown rather than blocking" {
+ _stub_openssl_cli "BoringSSL 3.0.0"
+ run _phpvm_check_openssl_compat 7.3.33
+ [ "$status" -eq 0 ]
+}
+
+@test "a genuine OpenSSL banner still yields a version" {
+ _stub_openssl_cli "OpenSSL 3.0.13 30 Jan 2024"
+ run _phpvm_openssl_version
+ [ "$status" -eq 0 ]
+ [[ "$output" =~ ^[0-9]+(\.[0-9]+)*$ ]]
+}
+
 @test "openssl version probe strips a letter suffix" {
  # Only meaningful when the host actually has one of the probes.
  if ! command -v pkg-config &>/dev/null && ! command -v openssl &>/dev/null; then
@@ -123,3 +158,20 @@ LOG
  [ "$status" -eq 0 ]
  [ -z "$output" ]
 }
+
+# Every build step appends, so one install must start the log from empty or
+# `grep -m1` above surfaces the first error of a *previous* run. Driving a real
+# install here would mean a compiler and ten minutes, so assert the ordering in
+# phpvm_install's own body instead.
+@test "install truncates the build log before anything appends to it" {
+ local src="$BATS_TEST_DIRNAME/../../linux/phpvm.sh"
+ local body trunc append
+ body=$(awk '/^phpvm_install\(\)/{f=1} f{print} f&&/^}$/{exit}' "$src")
+
+ trunc=$(printf '%s\n' "$body" | grep -n ': > "\$PHPVM_LOG"' | head -1 | cut -d: -f1)
+ append=$(printf '%s\n' "$body" | grep -n '>>"\?\$PHPVM_LOG"\?' | head -1 | cut -d: -f1)
+
+ [ -n "$trunc" ]
+ [ -n "$append" ]
+ [ "$trunc" -lt "$append" ]
+}

tests/linux/zsh-smoke.zsh

@@ -65,6 +65,24 @@ print "8.3" > "$tmp/proj/.phpvmrc"
 out=$(cd "$tmp/proj" && _phpvm_read_rc "$tmp/proj/.phpvmrc" 2>&1)
 check "reads a .phpvmrc version" "8.3" "$out"
 
+print -r -- "-- openssl guard (pattern and regex matching) --"
+# The guard leans on [[ != OpenSSL* ]] globbing and [[ =~ ]] regex, both of
+# which zsh parses on its own terms. bats only ever sees the bash reading.
+# Probe first, while the real _phpvm_openssl_version is still in place.
+openssl() { [[ "$1" == version ]] && print "LibreSSL 3.3.6" }
+_phpvm_openssl_version >/dev/null 2>&1
+check "libressl reports as unknown" "1" "$?"
+unset -f openssl
+
+_phpvm_openssl_version() { print 3.0.2 }
+out=$(_phpvm_check_openssl_compat 7.3.33 2>&1)
+check "openssl 3 blocks PHP 7.3" "cannot be built against OpenSSL 3.0.2" "$out"
+_phpvm_check_openssl_compat 8.1.0 >/dev/null 2>&1
+check "openssl 3 allows PHP 8.1" "0" "$?"
+_phpvm_openssl_version() { print unknown }
+_phpvm_check_openssl_compat 7.3.33 >/dev/null 2>&1
+check "non-numeric openssl major fails open" "0" "$?"
+
 print -r -- "-- older-patch hint --"
 mkdir -p "$PHPVM_DIR/versions/8.5.1" "$PHPVM_DIR/versions/8.5.2" "$PHPVM_DIR/versions/8.5.8"
 out=$(_phpvm_older_patch_hint 8.5.8 2>&1)

version.txt

@@ -1 +1 @@
-1.13.1
+1.13.2

windows/install.ps1

@@ -8,7 +8,7 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $PHPVM_BIN = "$PHPVM_DIR\bin"
 

windows/phpvm.ps1

@@ -23,7 +23,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"

windows/src/00-header.ps1

@@ -15,7 +15,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 
 # -- Constants -----------------------------------------------------------------
-$PHPVM_VERSION = "1.13.1"
+$PHPVM_VERSION = "1.13.2"
 $PHPVM_DIR = if ($env:PHPVM_DIR) { $env:PHPVM_DIR } else { "$env:USERPROFILE\.phpvm" }
 $VERSIONS_DIR = "$PHPVM_DIR\versions"
 $CURRENT_LINK = "$PHPVM_DIR\current"