[rmcdaniel]

One-time PHP security patch for Server 2.9

Merged and tagged: 471c8fad733a5ee89b66a9abfd897656c7fb4555 / whole 7595f32bb3e80a3beb005ce55c5fc3243e11559c, identical to the qualified candidate. Normal PHP/source, repository, Helm lint/kind and boundaries pass. New immutable 2.9.12 points to that merge. Protected Release 39655882328 is queued; actual image versions/digests and installed acceptance remain pending. The explicit maintenance Sonar limitation below remains, rather than a claimed analysis pass.

Exact source: 311bf1a / whole 7595f32bb3e80a3beb005ce55c5fc3243e11559c. Target is maintenance-only; this is not a PR to roll main back to 2.9. Its fresh PHP run 39649066218, Helm validation 39649066249 and boundaries qualify this exact tree independently. This head also includes #605's bounded 120-minute cold image-build step and four PHP compiler jobs. The preceding main publication failed at its 45-minute build limit, with no published digest; its failure is retained.

Part of #591. Target: maintenance/2.9-security, rooted at immutable Server 2.9.11. This is a compatible 2.9.12 image-only patch, separate from main's 2.10.1 / Helm 0.2.3 release. It does not establish a new LTS policy.

• Backport the exact signed PHP 8.3.36 Dockerfile, keyring and finite request/upload settings from merged Require patched PHP images and deliver selection cancellation #593. Runtime, application, package requirements/references, native/shared/runner/OpenAPI and frozen source remain unchanged from 2.9.11.
• Advance only generated Server identity and non-chart defaults to 2.9.12. Composer changes its product train and matching content hash; no package is resolved or updated. The source release record explicitly retains chart 0.2.1's Server 2.9.11 default.
• The maintenance tag's chart publication is disabled. The existing 0.2.1 package and current main chart/defaults remain immutable. Operators can select the exact image through the current chart's image override. The generated chart source here is not a republished chart package.
• Add a regression that proves the maintenance tag cannot publish the existing chart. Only the 2.9 image alias is eligible for promotion; global aliases remain on 2.10. The ordinary all-alias behavior stays unchanged when the maintenance scope is absent.

Qualification

The signed PHP build/runtime/transport component and main candidate checks remain attributed to #593, not carried as acceptance for this head. All three release-generation contracts, the Workflow package-authority regression and all 27 Helm publication contracts pass, including the new image-only tag guard. The exact Dockerfile, PHP INI and keyring match merged #593 byte for byte. Application, native, conformance and worker-contract source matches immutable 2.9.11; Composer differences are exactly the product-train string and content hash.

The first local invocation uses a minimal production tools image without Git or Docker CLI, so two metadata-copy checks and the image-context test fail before their intended operations. A second Node image lacks PHP and cannot complete the final metadata check. Both runner limitations remain recorded. A fresh unchanged-source invocation with the required Git/PHP tooling passes all three metadata contracts; no application source, deadline or assertion is changed. The Docker image-context test remains for normal hosted preflight.

Three maintenance-specific resolver, promotion-race and evidence controls fail against the original 5b13c63f4 scripts and pass after the scoped correction. The focused release suite passes 12 tests / 129 assertions, including the pre-existing default alias controls. An initial copied-script counterfactual lacks executable permissions and is runner-blocked; a fresh snapshot with the original modes produces the three actual semantic failures. Old floating-base assertions are corrected to require an immutable PHP foundation, preserving the extension and build-order checks.

Sonar baseline run 39639591713 uploads the maintenance analysis but fails with Organization is not allowed to access data from non main branches. The current plan supports main-target PRs only. This is not a passing gate or a source finding. Keep the existing main-only scan triggers, the failed attempt and unchanged quality thresholds; do not buy a new plan or change private project visibility for a one-time patch. The exact Dockerfile/INI/keyring are already analyzed on main; the maintenance-only publication diff is reviewed with its focused regressions. This explicit maintainer review supplements the unavailable maintenance scan and does not create a false Sonar pass.

Exact maintenance PHP/contracts/chart/boundary checks pass before merge. Published image versions/digests and actual installed acceptance remain required. Redundant optional memo/topology runs and superseded required-head runs are cancelled separately; they are not claimed as passes. No result is carried to a changed whole tree.

The preceding 3382dc74 chart validation fails its immutable-chart source check and remains failed. The corrected generator preserves every existing Helm consumer byte for byte while advancing the separate image release; the new preservation regression fails against the old generator. Four source-release tests and 28 chart/publication tests now pass, including default behavior and malformed override refusals. The actual committed-source immutability check reports No packaged Helm chart files changed. Fresh hosted chart qualification is still required; no old chart may be republished.

Never overwrite an existing image or chart version. No Cloud deployment, production exploit, native release or frozen-reference change is included.