security: update Mentalnet R1 Ochatime

Update PHP to 8.3.36 for the php2shell CVEs. Remove eMudhra roots from the CA bundle. Update the kernel to 6.12.114 while keeping toolchain headers at 6.12.104. Refresh release and install documentation.
2026-10-22 12:40:08 -04:00 · 2026-10-22 12:40:08 -04:00 · a582ea332b
commit a582ea332b
parent 1223e9f5a4
7 changed files with 476 additions and 23 deletions
--- a/.config
+++ b/.config
@ -138,17 +138,18 @@ BR2_TOOLCHAIN_BUILDROOT_LIBC="glibc"
 #
 # Kernel Header Options
 #
-BR2_KERNEL_HEADERS_AS_KERNEL=y
+# BR2_KERNEL_HEADERS_AS_KERNEL is not set
 # BR2_KERNEL_HEADERS_5_4 is not set
 # BR2_KERNEL_HEADERS_5_10 is not set
 # BR2_KERNEL_HEADERS_5_15 is not set
 # BR2_KERNEL_HEADERS_6_1 is not set
 # BR2_KERNEL_HEADERS_6_6 is not set
-# BR2_KERNEL_HEADERS_6_12 is not set
+BR2_KERNEL_HEADERS_6_12=y
 # BR2_KERNEL_HEADERS_VERSION is not set
 # BR2_KERNEL_HEADERS_CUSTOM_TARBALL is not set
 # BR2_KERNEL_HEADERS_CUSTOM_GIT is not set
 BR2_KERNEL_HEADERS_LATEST=y
+BR2_DEFAULT_KERNEL_HEADERS="6.12.104"
 BR2_PACKAGE_HOST_LINUX_HEADERS_LICENSE_FILES="COPYING LICENSES/preferred/GPL-2.0 LICENSES/exceptions/Linux-syscall-note"
 BR2_PACKAGE_LINUX_HEADERS=y
 BR2_PACKAGE_MUSL_ARCH_SUPPORTS=y
@ -485,15 +486,16 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT_ARGS=""
 # Kernel
 #
 BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_LATEST_VERSION=y
+# BR2_LINUX_KERNEL_LATEST_VERSION is not set
 # BR2_LINUX_KERNEL_LATEST_CIP_VERSION is not set
 # BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION is not set
-# BR2_LINUX_KERNEL_CUSTOM_VERSION is not set
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 # BR2_LINUX_KERNEL_CUSTOM_TARBALL is not set
 # BR2_LINUX_KERNEL_CUSTOM_GIT is not set
 # BR2_LINUX_KERNEL_CUSTOM_HG is not set
 # BR2_LINUX_KERNEL_CUSTOM_SVN is not set
-BR2_LINUX_KERNEL_VERSION="6.12.104"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.114"
+BR2_LINUX_KERNEL_VERSION="6.12.114"
 BR2_LINUX_KERNEL_LICENSE_FILES="COPYING LICENSES/preferred/GPL-2.0 LICENSES/exceptions/Linux-syscall-note"
 BR2_LINUX_KERNEL_PATCH=""
 BR2_LINUX_KERNEL_USE_DEFCONFIG=y
@ -1262,7 +1264,7 @@ BR2_PACKAGE_QT6_ARCH_SUPPORTS=y
 # BR2_PACKAGE_BRLTTY is not set

 #
-# cc-tool needs a toolchain w/ C++, threads, wchar, gcc >= 4.9 
+# cc-tool needs a toolchain w/ C++, threads, wchar, gcc >= 4.9
 #
 # BR2_PACKAGE_CDRKIT is not set
 # BR2_PACKAGE_CRUCIBLE is not set
@ -4587,35 +4589,35 @@ BR2_PACKAGE_TRACEROUTE=y
 #

 #
-# Please note:                                           
+# Please note:
 #

 #
-# - Buildroot does *not* generate binary packages,       
+# - Buildroot does *not* generate binary packages,
 #

 #
-# - Buildroot does *not* install any package database.   
+# - Buildroot does *not* install any package database.
 #

 #
-# *                                                      
+# *
 #

 #
-# It is up to you to provide those by yourself if you    
+# It is up to you to provide those by yourself if you
 #

 #
-# want to use any of those package managers.             
+# want to use any of those package managers.
 #

 #
-# *                                                      
+# *
 #

 #
-# See the manual:                                        
+# See the manual:
 #

 #
@ -6149,3 +6151,5 @@ BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR=""
 # BR2_BINUTILS_VERSION_2_22 is not set
 # BR2_PACKAGE_GPU_VIV_BIN_MX6Q is not set
 # BR2_TARGET_UBOOT_NETWORK is not set
+
+
--- a/README.md
+++ b/README.md
@ -13,8 +13,7 @@ disk installer (`mentalnet-install`).

 ## Current release

-**R1 "StreamingHeart"** — named after DECO*27's *ストリーミングハート
-(Streaming Heart)*, feat. Hatsune Miku.
+**R1 "Ochatime"** — named after 23.exe's *Ochatime*.

 ## Versioning

@ -29,7 +28,8 @@ disk installer (`mentalnet-install`).
 | R1 | Mesmerizer | *Mesmerizer* — 32ki (Hatsune Miku & Kasane Teto) | Initial release |
 | R1 | FirstStorm | *Chūlán ~First Storm~ (初嵐～First Storm～)* — DECO*27 | Swap-free installer, true i586 support, terminal/input hardening, interrupt-storm fixes |
 | R1 | LovePara | *ラブパラ (Love Para)* — DECO*27 feat. Hatsune Miku | app-server stack (PHP/Ruby/Perl, php-fpm, lighttpd `/proxy/` → port 1337), tcc on-target C dev with glibc headers, socat, gesftpserver, SiS 900 / VIA Rhine / Tigon3 NICs, fastfetch, nano, en_US.UTF-8 locale |
-| R1 | **StreamingHeart** | *ストリーミングハート (Streaming Heart)* — DECO*27 feat. Hatsune Miku | **Current** — `runmain.o` for tcc (run C files like scripts without permanent compilation), tmux, custom bash prompt |
+| R1 | StreamingHeart | *ストリーミングハート (Streaming Heart)* — DECO*27 feat. Hatsune Miku | `runmain.o` for tcc (run C files like scripts without permanent compilation), tmux, custom bash prompt |
+| R1 | **Ochatime** | *Ochatime* — 23.exe | **Current** — Linux 6.12.114 (PwnEscape/CVE-2026-99999 fix), PHP 8.3.36 security update (*php2shell*, CVE-2026-109618 / CVE-2026-109619), eMudhra (emSign) root CAs purged from the trust store |

 ## Quick facts

@ -37,7 +37,7 @@ disk installer (`mentalnet-install`).
 |---|---|
 | Login | `root` / `mnlinux` |
 | Hostname | `mentalnet` |
-| Kernel | `6.12.104-mentalnet-intel32` |
+| Kernel | `6.12.114-mentalnet-intel32` |
 | Media | Live CD with built-in installer |
 | CPU | i586 (Pentium / Pentium MMX) or any newer x86 |
 | RAM | 128 MB minimum (64 MB usually works) |
@ -158,4 +158,3 @@ full fork.
 The OS image produced by the build is an aggregation of many
 components, each of which keeps its own license (the Linux kernel is
 GPL-2.0, BusyBox is GPL-2.0, and so on).
-
--- a/board/mentalnet/INSTALL-GUIDE.md
+++ b/board/mentalnet/INSTALL-GUIDE.md
@ -5,7 +5,7 @@ Pentium-class PCs, built with Buildroot 2025.02.17. The ISO is a live
 CD: the entire system runs from the CD with a read-only root, and the
 same CD carries a built-in hard disk installer (`mentalnet-install`).

- Kernel: `6.12.104-mentalnet-intel32` (slimmed i386 config)
+- Kernel: `6.12.114-mentalnet-intel32` (slimmed i386 config)
 - Login: `root` / `mnlinux`
 - Hostname: `mentalnet`
 - Live CD size: ~100 MB
--- a/board/mentalnet/post-build.sh
+++ b/board/mentalnet/post-build.sh
@ -3,6 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # post-build.sh - stamp the Mentalnet root filesystem with a build id
+#                  and scrub compromised CAs from the trust store
 #
 # Invoked by Buildroot (BR2_ROOTFS_POST_BUILD_SCRIPT) with the target
 # directory as first argument. The same stamp is recorded in
@ -18,9 +19,9 @@ set -e
 TARGET_DIR="${1}"
 #STAMP="$(date +%Y%m%d-%H%M%S)"
 RELEASE="R1"
-CODENAME="StreamingHeart"
-STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 ${CODENAME}
-STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-GhostRule
+CODENAME="Ochatime"
+STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 Ochatime
+STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-Ochatime
 IMAGES_DIR="$(dirname "${TARGET_DIR}")/images"

 # record the stamp for post-image.sh
@ -43,3 +44,37 @@ EOF
 ISSUE="${TARGET_DIR}/etc/issue"
 sed -i '/^Mentalnet GNU\/Linux build /d' "${ISSUE}"
 printf 'Mentalnet GNU/Linux build %s\n' "${STAMP}" >> "${ISSUE}"
+
+# Remove the eMudhra (emSign) root CAs and rebuild the trust store.
+#
+# Background: R1 Ochatime security response (October 2026) - eight
+# eMudhra intermediate CA keys were compromised (EM DV/OV/EV TLS and
+# EM OV/OV CS code-signing authorities, e.g. CVE-2026-111943). The
+# Debian/Mozilla trust store in this build does not ship intermediates,
+# but it does trust the four eMudhra emSign roots below; drop them so
+# nothing chaining under eMudhra can validate here.
+#
+# This must run in a post-build script because the ca-certificates
+# bundle (/etc/ssl/certs/ca-certificates.crt) is generated during
+# package finalize hooks, which execute *before* post-build scripts.
+# Rebuild it here the same way CA_CERTIFICATES_GEN_BUNDLE does.
+#
+# Drop this once Debian ships a ca-certificates release (bump
+# CA_CERTIFICATES_VERSION in package/ca-certificates/ca-certificates.mk)
+# that already removed the eMudhra anchors.
+EM_SIGN_ROOTS="emSign_Root_CA_-_G1 emSign_Root_CA_-_C1 emSign_ECC_Root_CA_-_G3 emSign_ECC_Root_CA_-_C3"
+CERTS_DIR="${TARGET_DIR}/etc/ssl/certs"
+for root in ${EM_SIGN_ROOTS}; do
+  rm -f "${TARGET_DIR}/usr/share/ca-certificates/mozilla/${root}.crt"
+done
+
+# Regenerate /etc/ssl/certs: hash-symlink cleanup, per-name links,
+# bundle, and rehash (mirrors CA_CERTIFICATES_GEN_BUNDLE)
+rm -f "${CERTS_DIR}"/*
+: > "${CERTS_DIR}/ca-certificates.crt"
+cd "${TARGET_DIR}" || exit 1
+for i in $(find usr/share/ca-certificates -name '*.crt' | LC_COLLATE=C sort); do
+  ln -sf "../../../${i}" "etc/ssl/certs/$(basename "${i}" .crt).pem"
+  cat "${i}"
+done >> "${CERTS_DIR}/ca-certificates.crt"
+"${HOST_DIR}/bin/c_rehash" "${CERTS_DIR}" > /dev/null
--- a/linux/linux.hash
+++ b/linux/linux.hash
@ -0,0 +1,17 @@
+# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
+sha256  7a8589912bd7a8adb07fed074283652cf482a35facef8954554654f0154b4af3  linux-6.12.114.tar.xz
+sha256  949d166a1263bd0cf0c5aab44eeb57869615099e7c48bf88d0e4adb77379b999  linux-6.12.104.tar.xz
+sha256  778b058c63da849d0b74006b23509255b2bed57c62a5151e9dd7a62e2cdd70d6  linux-6.6.152.tar.xz
+sha256  362d07fe4938c415ce651aefee063a5c4151109b39c97be039bbaa8312ffc0e2  linux-6.1.183.tar.xz
+# From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
+sha256  09affb2005aea3f44eec3f3eab4c1944e00707355ea7ca7fa2ba6b34a82605ed  linux-5.15.216.tar.xz
+sha256  d10cb9169e49da3d5f7154a01e450012486565fa9442e23d660b0581a3f92645  linux-5.10.265.tar.xz
+sha256  ae6a3207f12aa4d6cfb0fa793ec9da4a6fcdfdcb57d869d63d6b77e3a8c1423d  linux-5.4.302.tar.xz
+# Locally computed
+sha256  93408e0c5d70ff0ab63dcf9edec6fda2b8524281d611a88e56590436bda43914  linux-cip-5.10.246-cip66.tar.gz
+sha256  b3454708b98016f02604433e41060be2c1feb595c2bddeb25292596f047f0915  linux-cip-5.10.246-cip66-rt29.tar.gz
+
+# Licenses hashes
+sha256  fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0  COPYING
+sha256  f6b78c087c3ebdf0f3c13415070dd480a3f35d8fc76f3d02180a407c1c812f79  LICENSES/preferred/GPL-2.0
+sha256  8e378ab93586eb55135d3bc119cce787f7324f48394777d00c34fa3d0be3303f  LICENSES/exceptions/Linux-syscall-note
--- a/package/php/php.hash
+++ b/package/php/php.hash
@ -0,0 +1,5 @@
+# From https://www.php.net/downloads.php
+sha256  dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd  php-8.3.36.tar.xz
+
+# License file
+sha256  b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a  LICENSE
--- a/package/php/php.mk
+++ b/package/php/php.mk
@ -0,0 +1,393 @@
+################################################################################
+#
+# php
+#
+################################################################################
+
+PHP_VERSION = 8.3.36
+PHP_SITE = https://www.php.net/distributions
+PHP_SOURCE = php-$(PHP_VERSION).tar.xz
+PHP_INSTALL_STAGING = YES
+PHP_INSTALL_STAGING_OPTS = INSTALL_ROOT=$(STAGING_DIR) install
+PHP_INSTALL_TARGET_OPTS = INSTALL_ROOT=$(TARGET_DIR) install
+PHP_DEPENDENCIES = host-pkgconf pcre2
+PHP_LICENSE = PHP-3.01
+PHP_LICENSE_FILES = LICENSE
+PHP_CPE_ID_VENDOR = php
+
+# Only affects the Windows operating system
+PHP_IGNORE_CVES += CVE-2024-3566
+
+PHP_CONF_OPTS = \
+	--mandir=/usr/share/man \
+	--infodir=/usr/share/info \
+	--with-config-file-scan-dir=/etc/php.d \
+	--disable-all \
+	--with-external-pcre \
+	--without-pear \
+	--with-config-file-path=/etc \
+	--disable-phpdbg \
+	--disable-rpath
+PHP_CONF_ENV = \
+	EXTRA_LIBS="$(PHP_EXTRA_LIBS)"
+
+ifeq ($(BR2_STATIC_LIBS),y)
+PHP_CONF_ENV += LIBS="$(PHP_STATIC_LIBS)"
+endif
+
+ifeq ($(BR2_STATIC_LIBS)$(BR2_TOOLCHAIN_HAS_THREADS),yy)
+PHP_STATIC_LIBS += -lpthread
+endif
+
+ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
+PHP_EXTRA_LIBS += -latomic
+endif
+
+ifeq ($(BR2_PACKAGE_LIBUCONTEXT),y)
+PHP_DEPENDENCIES += libucontext
+PHP_EXTRA_LIBS += -lucontext
+endif
+
+ifeq ($(call qstrip,$(BR2_TARGET_LOCALTIME)),)
+PHP_LOCALTIME = UTC
+else
+# Not q-stripping this value, as we need quotes in the php.ini file
+PHP_LOCALTIME = $(BR2_TARGET_LOCALTIME)
+endif
+
+# PHP can't be AUTORECONFed the standard way unfortunately
+PHP_DEPENDENCIES += host-autoconf host-automake host-libtool
+define PHP_BUILDCONF
+	cd $(@D) ; $(TARGET_MAKE_ENV) ./buildconf --force
+endef
+PHP_PRE_CONFIGURE_HOOKS += PHP_BUILDCONF
+
+ifeq ($(BR2_ENDIAN),"BIG")
+PHP_CONF_ENV += ac_cv_c_bigendian_php=yes
+else
+PHP_CONF_ENV += ac_cv_c_bigendian_php=no
+endif
+PHP_CONFIG_SCRIPTS = php-config
+
+PHP_CFLAGS = $(TARGET_CFLAGS)
+PHP_CXXFLAGS = $(TARGET_CXXFLAGS)
+
+# The OPcache extension isn't cross-compile friendly
+# Throw some defines here to avoid patching heavily
+ifeq ($(BR2_PACKAGE_PHP_EXT_OPCACHE),y)
+PHP_CONF_OPTS += --enable-opcache --disable-opcache-jit
+PHP_CONF_ENV += ac_cv_func_mprotect=yes
+PHP_CFLAGS += \
+	-DHAVE_SHM_IPC \
+	-DHAVE_SHM_MMAP_ANON \
+	-DHAVE_SHM_MMAP_ZERO \
+	-DHAVE_SHM_MMAP_POSIX \
+	-DHAVE_SHM_MMAP_FILE
+endif
+
+# We need to force dl "detection"
+ifeq ($(BR2_STATIC_LIBS),)
+PHP_CONF_ENV += ac_cv_func_dlopen=yes ac_cv_lib_dl_dlopen=yes
+PHP_EXTRA_LIBS += -ldl
+else
+PHP_CONF_ENV += ac_cv_func_dlopen=no ac_cv_lib_dl_dlopen=no
+endif
+
+# php has some assembly function that is not present in Thumb mode:
+# Error: selected processor does not support `umlal r2,r1,r0,r3' in Thumb mode
+# so, we deactivate Thumb mode
+ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
+PHP_CFLAGS += -marm
+endif
+
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_CLI),--enable-cli,--disable-cli)
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_CGI),--enable-cgi,--disable-cgi)
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_FPM),--enable-fpm,--disable-fpm)
+
+ifeq ($(BR2_PACKAGE_PHP_SAPI_APACHE),y)
+PHP_DEPENDENCIES += apache
+PHP_CONF_OPTS += --with-apxs2=$(STAGING_DIR)/usr/bin/apxs
+
+# Enable thread safety option if Apache MPM is event or worker
+ifeq ($(BR2_PACKAGE_APACHE_MPM_EVENT)$(BR2_PACKAGE_APACHE_MPM_WORKER),y)
+PHP_CONF_OPTS += --enable-zts
+endif
+endif
+
+### Extensions
+PHP_CONF_OPTS += \
+	$(if $(BR2_PACKAGE_PHP_EXT_SOCKETS),--enable-sockets) \
+	$(if $(BR2_PACKAGE_PHP_EXT_POSIX),--enable-posix) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SESSION),--enable-session) \
+	$(if $(BR2_PACKAGE_PHP_EXT_DOM),--enable-dom) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SIMPLEXML),--enable-simplexml) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SOAP),--enable-soap) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XML),--enable-xml) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XMLREADER),--enable-xmlreader) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XMLWRITER),--enable-xmlwriter) \
+	$(if $(BR2_PACKAGE_PHP_EXT_EXIF),--enable-exif) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FTP),--enable-ftp) \
+	$(if $(BR2_PACKAGE_PHP_EXT_TOKENIZER),--enable-tokenizer) \
+	$(if $(BR2_PACKAGE_PHP_EXT_PCNTL),--enable-pcntl) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SHMOP),--enable-shmop) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVMSG),--enable-sysvmsg) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVSEM),--enable-sysvsem) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVSHM),--enable-sysvshm) \
+	$(if $(BR2_PACKAGE_PHP_EXT_ZIP),--with-zip) \
+	$(if $(BR2_PACKAGE_PHP_EXT_CTYPE),--enable-ctype) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FILTER),--enable-filter) \
+	$(if $(BR2_PACKAGE_PHP_EXT_CALENDAR),--enable-calendar) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FILEINFO),--enable-fileinfo) \
+	$(if $(BR2_PACKAGE_PHP_EXT_BCMATH),--enable-bcmath) \
+	$(if $(BR2_PACKAGE_PHP_EXT_PHAR),--enable-phar)
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBARGON2),y)
+PHP_CONF_OPTS += --with-password-argon2=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libargon2
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBSODIUM),y)
+PHP_CONF_OPTS += --with-sodium=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libsodium
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_MBSTRING),y)
+PHP_CONF_OPTS += --enable-mbstring
+PHP_DEPENDENCIES += oniguruma
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_OPENSSL),y)
+PHP_CONF_OPTS += --with-openssl=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += openssl
+# openssl needs zlib, but the configure script forgets to link against
+# it causing detection failures with static linking
+PHP_STATIC_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl`
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBXML2),y)
+PHP_CONF_ENV += php_cv_libxml_build_works=yes
+PHP_CONF_OPTS += --with-libxml
+PHP_DEPENDENCIES += libxml2
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_ZIP),y)
+PHP_DEPENDENCIES += libzip
+endif
+
+ifneq ($(BR2_PACKAGE_PHP_EXT_ZLIB)$(BR2_PACKAGE_PHP_EXT_ZIP),)
+PHP_CONF_OPTS += --with-zlib=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += zlib
+else
+PHP_CONF_OPTS += --disable-mysqlnd_compression_support
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GETTEXT),y)
+PHP_CONF_OPTS += --with-gettext=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += $(TARGET_NLS_DEPENDENCIES)
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_ICONV),y)
+ifeq ($(BR2_PACKAGE_LIBICONV),y)
+PHP_CONF_OPTS += --with-iconv=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libiconv
+else
+PHP_CONF_OPTS += --with-iconv
+endif
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_INTL),y)
+PHP_CONF_OPTS += --enable-intl
+PHP_DEPENDENCIES += icu
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GMP),y)
+PHP_CONF_OPTS += --with-gmp=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += gmp
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_READLINE),y)
+PHP_CONF_OPTS += --with-readline=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += readline
+endif
+
+### Native SQL extensions
+ifeq ($(BR2_PACKAGE_PHP_EXT_MYSQLI),y)
+PHP_CONF_OPTS += --with-mysqli
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_PGSQL),y)
+PHP_CONF_OPTS += --with-pgsql=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += postgresql
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_SQLITE),y)
+PHP_CONF_OPTS += --with-sqlite3=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += sqlite
+PHP_STATIC_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs sqlite3`
+endif
+
+### PDO
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO),y)
+PHP_CONF_OPTS += --enable-pdo
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_SQLITE),y)
+PHP_CONF_OPTS += --with-pdo-sqlite=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += sqlite
+PHP_CFLAGS += -DSQLITE_OMIT_LOAD_EXTENSION
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_MYSQL),y)
+PHP_CONF_OPTS += --with-pdo-mysql
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_POSTGRESQL),y)
+PHP_CONF_OPTS += --with-pdo-pgsql=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += postgresql
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_UNIXODBC),y)
+PHP_CONF_OPTS += --with-pdo-odbc=unixODBC,$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += unixodbc
+endif
+endif
+
+ifneq ($(BR2_PACKAGE_PHP_EXT_MYSQLI)$(BR2_PACKAGE_PHP_EXT_PDO_MYSQL),)
+# Set default MySQL unix socket to what the MySQL server is using by default
+PHP_CONF_OPTS += --with-mysql-sock=$(MYSQL_SOCKET)
+endif
+
+define PHP_DISABLE_VALGRIND
+	$(SED) '/^#define HAVE_VALGRIND/d' $(@D)/main/php_config.h
+endef
+PHP_POST_CONFIGURE_HOOKS += PHP_DISABLE_VALGRIND
+
+ifeq ($(BR2_PACKAGE_PCRE2_JIT),y)
+PHP_CONF_OPTS += --with-pcre-jit=yes
+PHP_CONF_ENV += ac_cv_have_pcre2_jit=yes
+else
+PHP_CONF_OPTS += --with-pcre-jit=no
+PHP_CONF_ENV += ac_cv_have_pcre2_jit=no
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_CURL),y)
+PHP_CONF_OPTS += --with-curl
+PHP_DEPENDENCIES += libcurl
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_XSL),y)
+PHP_CONF_OPTS += --with-xsl=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libxslt
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_BZIP2),y)
+PHP_CONF_OPTS += --with-bz2=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += bzip2
+endif
+
+### DBA
+ifeq ($(BR2_PACKAGE_PHP_EXT_DBA),y)
+PHP_CONF_OPTS += --enable-dba
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_CDB),y)
+PHP_CONF_OPTS += --without-cdb
+endif
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_FLAT),y)
+PHP_CONF_OPTS += --without-flatfile
+endif
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_INI),y)
+PHP_CONF_OPTS += --without-inifile
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_DBA_DB4),y)
+PHP_CONF_OPTS += --with-db4=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += berkeleydb
+endif
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y)
+PHP_CONF_OPTS += --with-snmp=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += netsnmp
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GD),y)
+PHP_CONF_OPTS += \
+	--enable-gd \
+	--with-jpeg \
+	--with-freetype
+PHP_DEPENDENCIES += jpeg libpng freetype zlib
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_FFI),y)
+PHP_CONF_OPTS += --with-ffi
+PHP_DEPENDENCIES += libffi
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_SAPI_FPM),y)
+define PHP_INSTALL_INIT_SYSV
+	$(INSTALL) -D -m 0755 $(@D)/sapi/fpm/init.d.php-fpm \
+		$(TARGET_DIR)/etc/init.d/S49php-fpm
+endef
+
+define PHP_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m 0644 $(@D)/sapi/fpm/php-fpm.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/php-fpm.service
+endef
+
+define PHP_INSTALL_FPM_CONF
+	$(INSTALL) -D -m 0644 package/php/php-fpm.conf \
+		$(TARGET_DIR)/etc/php-fpm.conf
+	rm -f $(TARGET_DIR)/etc/php-fpm.d/www.conf.default
+	# remove unused sample status page /usr/php/php/fpm/status.html
+	rm -rf $(TARGET_DIR)/usr/php
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_INSTALL_FPM_CONF
+endif
+
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_EXTENSIONS_FIXUP
+
+define PHP_INSTALL_FIXUP
+	rm -rf $(TARGET_DIR)/usr/lib/php/build
+	rm -f $(TARGET_DIR)/usr/bin/phpize
+	$(INSTALL) -D -m 0755 $(PHP_DIR)/php.ini-production \
+		$(TARGET_DIR)/etc/php.ini
+	$(SED) 's%;date.timezone =.*%date.timezone = $(PHP_LOCALTIME)%' \
+		$(TARGET_DIR)/etc/php.ini
+	$(if $(BR2_PACKAGE_PHP_EXT_OPCACHE),
+		$(SED) '/;extension=php_xsl.dll/azend_extension=opcache.so' \
+		$(TARGET_DIR)/etc/php.ini)
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_INSTALL_FIXUP
+
+PHP_CONF_ENV += CFLAGS="$(PHP_CFLAGS)" CXXFLAGS="$(PHP_CXXFLAGS)"
+
+HOST_PHP_CONF_OPTS = \
+	--disable-all \
+	--without-pear \
+	--with-config-file-path=$(HOST_DIR)/etc \
+	--disable-phpdbg \
+	--with-external-pcre \
+	--enable-phar \
+	--enable-json \
+	--enable-filter \
+	--enable-mbstring \
+	--enable-tokenizer \
+	--with-openssl=$(HOST_DIR)
+
+HOST_PHP_DEPENDENCIES = \
+	host-oniguruma \
+	host-openssl \
+	host-pcre2 \
+	host-pkgconf
+
+# PHP can't be AUTORECONFed the standard way unfortunately
+HOST_PHP_DEPENDENCIES += host-autoconf host-automake host-libtool
+define HOST_PHP_BUILDCONF
+	cd $(@D) ; $(HOST_MAKE_ENV) ./buildconf --force
+endef
+HOST_PHP_PRE_CONFIGURE_HOOKS += HOST_PHP_BUILDCONF
+
+$(eval $(autotools-package))
+$(eval $(host-autotools-package))