From 98c9cd1f7277c69643d9f9c813b1c408cc657fb0 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 21 Oct 2026 10:23:07 +0200
Subject: [PATCH] Rebuild phpPgAdmin on hardened versioned PHP image

---
 .gitea/workflows/publish.yml | 15 +++++++++------
 Dockerfile                   |  2 +-
 README.md                    |  2 +-
 chart/Chart.yaml             |  2 +-
 chart/version.sh             | 12 ++++++++++++
 5 files changed, 24 insertions(+), 9 deletions(-)
 create mode 100755 chart/version.sh

diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 71034fe..094046e 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -60,6 +60,10 @@ jobs:
             --tag "${IMAGE}:${COMMIT_SHA}" .
           podman run --rm --entrypoint httpd "${IMAGE}:${COMMIT_SHA}" -t
           podman run --rm --entrypoint php "${IMAGE}:${COMMIT_SHA}" -r '
+            if (ini_get("session.upload_progress.enabled")) {
+                fwrite(STDERR, "PHP session upload progress must be disabled.\n");
+                exit(1);
+            }
             foreach (["pgsql", "pdo_pgsql", "mbstring", "Zend OPcache"] as $extension) {
                 if (!extension_loaded($extension)) { fwrite(STDERR, "Missing PHP extension: {$extension}\n"); exit(1); }
             }
@@ -79,7 +83,9 @@ jobs:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
-          podman push "${IMAGE}:${COMMIT_SHA}"
+          app_version=$(./chart/version.sh)
+          podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:${app_version}"
+          podman push "${IMAGE}:${app_version}"
           podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
           podman push "${IMAGE}:latest"
       - if: always()
@@ -112,10 +118,7 @@ jobs:
           set -euo pipefail
           git fetch --tags origin main
           test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
-          description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
-          case "$description" in *-dirty) echo 'Refusing dirty chart tree' >&2; exit 1 ;; esac
-          version=${description#v}
-          case "$version" in *-0-g*) version=${version%%-0-g*} ;; esac
+          version=$(./chart/version.sh)
           echo "version=${version}" >> "$GITHUB_OUTPUT"
       - name: Package and publish chart
         env:
@@ -128,7 +131,7 @@ jobs:
           test -n "$PACKAGE_USERNAME" && test -n "$PACKAGE_TOKEN"
           helm lint chart
           helm template phppgadmin chart --namespace default >/dev/null
-          helm package chart --version "$CHART_VERSION" --app-version "$COMMIT_SHA" --destination "$RUNNER_TEMP"
+          helm package chart --version "$CHART_VERSION" --app-version "$CHART_VERSION" --destination "$RUNNER_TEMP"
           curl --fail --silent --show-error \
             --user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
             --request POST --upload-file "${RUNNER_TEMP}/phppgadmin-${CHART_VERSION}.tgz" \
diff --git a/Dockerfile b/Dockerfile
index 43c9251..daeb24c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-ARG PHP_APACHE_TAG=2.4.69-8.5.11
+ARG PHP_APACHE_TAG=2.4.69-8.5.11-2-ga3134bb
 FROM registry.brunner.ninja/feedc0de/php-apache:${PHP_APACHE_TAG}
 
 ARG PHPPGADMIN_VERSION=7.14.7
diff --git a/README.md b/README.md
index 8f71d6a..6c5c17a 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ in Git or chart values.
 
 The Dockerfile installs phpPgAdmin 7.14.7 on the shared
 `registry.brunner.ninja/feedc0de/php-apache` image. Main-branch CI publishes an
-immutable commit-tagged image and a chart whose `appVersion` selects that exact
+immutable Git-describe-tagged image and a chart whose `appVersion` selects that exact
 image. The chart repository tag follows the bundled phpPgAdmin fork release:
 `v7.14.7-mod` publishes chart `7.14.7-mod`; later chart commits append the Git
 describe count and hash.
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 6c3e57f..334b78f 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -3,4 +3,4 @@ name: phppgadmin
 description: Helm chart for the phpPgAdmin container
 type: application
 version: 0.1.0
-appVersion: "4c29807abb362b9cf407762822113c5c75d442f3"
+appVersion: "7.14.7-mod"
diff --git a/chart/version.sh b/chart/version.sh
new file mode 100755
index 0000000..8acfa8f
--- /dev/null
+++ b/chart/version.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
+case "$description" in
+  *-dirty) echo 'Refusing to publish a dirty tree' >&2; exit 1 ;;
+esac
+version=${description#v}
+case "$version" in
+  *-0-g*) version=${version%%-0-g*} ;;
+esac
+printf '%s\n' "$version"