fetch-deps fails for vs17 series

[cmb69]

The vs17 series files contain many entries for vs16 dependency builds. However, fetch-deps.ps1 can't handle this, since it always tries to fetch a vs17 dependency. For instance, a library should be build against PHP 8.4, x64, staging, and requires zlib. fetch-deps.ps1 would read the respective series file, finds that it needs to fetch zlib-1.3.1, but would then try to download zlib-1.3.1-vs17-x64.zip, which doesn't exist. For a couple of builds, I've worked around with a hack. Note that phpsdk_deps doesn't have this problem, since it just downloads what is specified; however, phpsdk_deps doesn't handle PECL dependency libs at all, while there is some basic support in fetch-deps.ps1.

Background: until a few years ago, we rebuilt all dependencies for every new major VS version. We even needed to rebuild a couple of extensions for some minor VS versions, because especially PGO builds have been very picky about static libraries. Then somebody came up with the (undocumented) /d2:-AllowCompatibleILVersions option to cl.exe, and that works great (at least I haven't noticed any issues).

Now the question is whether fetch-deps.ps1 should be fixed to fetch the proper dependency builds, or whether we want to roll out new builds of the core dependencies for PHP 8.4 (and up). I'm on the fence here: while I would prefer rolling out new builds (seems "cleaner", and might be better optimized), I understand that this requires quite some time (which is rare).

@shivammathur, what do you think? If you prefer to (mostly) stick with the vs16 builds, I can provide a PR to fix fetch-deps.ps1 (I think I can; although I would prefer to have a fetch-deps.php).

[shivammathur]

@cmb69
Lets do vs17 builds, Since you already updated the workflows it should be easy.

[cmb69]

Okay, I'll do builds and testing. :)

[cmb69]

First couple of vs17 builds (did some updates; local testing showed no issues; no need to rename, since all have been build against tags):

• libbzip2-1.0.8-1
• liblmdb-0.9.33
• liblzma-5.6.3
• nghttp2-1.63.0
• openssl-3.0.15.pl1
• zlib-1.3.1

Could you please roll these out for PHP 8.4 and up, @shivammathur?

[cmb69]

Next bunch of builds (analogous to above):

• ICU-75.1
• libargon2
• libiconv-1.17-1
• libonig-6.9.9
• libqdbm-1.8.78
• libsodium-1.0.20
• libtidy-5.6.0-1
• sqlite3-3.46.0
• WinEditLine-2.206 (rename to lower case)

[shivammathur]

@cmb69 Thanks. I have uploaded these and updated the series files

[cmb69]

Next bunch of builds (analogous to above):

• freetype-2.13.3
• libavif-1.1.1
• libjpeg-turbo-3.0.3
• libpng-1.6.43
• libssh2-1.11.1
• libwebp-1.3.2
• libxml2-2.11.9
• libxpm-3.5.12pl1-1

[shivammathur]

Uploaded

[cmb69]

Penultimate bunch of builds (analogous to above):

• libcurl-8.10.1
• libffi-3.3pl1
• libintl-0.18.3-9
• libsasl-2.1.27-3
• libxslt-1.1.39
• libzip-1.11.1
• mpir-3.0.0-1
• net-snmp-5.9.4

[shivammathur]

Uploaded

[cmb69]

Next couple of builds (analogous to above):

• glib-2.53.3-1
• libpq-16.4
• openldap-2.4.47-1

Sorry, I've overlooked that enchant depends on glib, so this will take another round.

[shivammathur]

Uploaded

[cmb69]

So here is enchant:

• libenchant2-2.2.8-1

I would also suggest to roll out libzip 1.11.2 which claims to fix a performance regression in 1.11.0:

• libzip-1.11.2

Now only apache is left, and that should have been the simplest update, since we just fetch the latest builds from apacheloung.com and repackage. However, I stumbled upon php/php-src#16682; without patching the headers, that won't even build. Maybe it's best to just rename apache-2.4.43-vs16-*.zip to apache-2.4.43-vs17-*.zip, and be done for now.

[shivammathur]

Done, I have also copied over the apache builds.

[matsuo]

Would you please upgrade to OpenLDAP 2.5.18?
Because OpenLDAP 2.4.47 was released about 6 years ago and contains multiple vulnerabilities.

The upgrading for security fixes seems to be needed in the following libraries.
There may be others, but here are I noticed.

• openldap-2.4.47-1 -> 2.5.18
• libxpm-3.5.12pl1-1 -> 3.5.17
• libsasl-2.1.27-3 -> 2.1.28

Thank you.

[cmb69]

@matsuo, there is already winlibs/openldap#6, and now I filed winlibs/cyrus-sasl#3. Regarding libxpm, see winlibs/libxpm#3.

[matsuo]

@cmb69
I see. If there is anything else, I will try to response in each issue.

Thank you so much.