(this is a result of being nerdsniped a couple of evenings ago, so very well might not be valid at all)
To help with things like T423562: Migrate PHP extensions from PECL to PIE, it might make sense to add some CI jobs which test that our PHP extensions which [will] use PIE actually build correctly.
I noodled on an idea at https://gerrit.wikimedia.org/r/c/integration/config/+/1284791 (I am not familiar with how our jobs work though, so it could well be wrong too..) which has docker images for PHP 8.2 - 8.5, installs PIE per
# Install PIE
# SHA256 from release attestation: https://github.com/php/pie/attestations/25462151/download
RUN curl -fsSL https://github.com/php/pie/releases/download/1.4.2/pie.phar \
-o /usr/local/bin/pie \
&& echo "2333b79a39c31b66b832e938b4a73a5682dace5d98d3745053debbe05d39439f /usr/local/bin/pie" | sha256sum -c - \
&& chmod +x /usr/local/bin/pie(checking its hash as I have no idea how acceptable getting something from github via curl is) and then has an entrypoint script with
#!/usr/bin/env bash set -euxo pipefail umask 002 cd src/ pie --version PACKAGE=$(php -r "echo json_decode(file_get_contents('composer.json'))->name;") if [[ -z "$PACKAGE" ]]; then echo "Error: could not read package name from composer.json" >&2 exit 1 fi pie --no-interaction repository:add path . pie build --no-interaction "${PACKAGE}:*@dev" \ --with-php-config /usr/bin/php-config8.4 \ --with-phpize-path /usr/bin/phpize8.4
The PHP extensions which will use PIE are likely:
- wikidiff2
- excimer
- luasandbox
and these tests could be useful as soon as patches like https://gerrit.wikimedia.org/r/c/mediawiki/php/wikidiff2/+/1281926 are merged