From fe7d4ca7535de7c2e472f5d4e810d1a480cbe66a Mon Sep 17 00:00:00 2001 From: Liraz Siri Date: Wed, 2 Sep 2026 10:05:27 +0000 Subject: [PATCH] Pin Symfony 7.4.18 for release builds Composer now resolves the Symfony 7.4 LTS component set to 7.4.18, while the appliance still required FrameworkBundle and the runtime kernel to remain at 7.4.17. This made the canonical cloud ISO build fail its provenance assertion. Update the exact FrameworkBundle version and official tag commit so the pinned package agrees with the resolved component set. Keep the historical Wave 2 record intact while documenting the release pin used by current builds. --- changelog | 2 +- conf.d/main | 4 ++-- docs/v19.0-testing.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/changelog b/changelog index 729e7cd..104a4d1 100644 --- a/changelog +++ b/changelog @@ -3,7 +3,7 @@ turnkey-symfony-19.0 (1) turnkey; urgency=low * Rebase the appliance on Debian 13/Trixie. * Install the official Symfony 7.4 LTS skeleton and pin FrameworkBundle - v7.4.17 with verified source provenance. + v7.4.18 with verified source provenance. * Replace the vendor welcome patch with a small sample application that exercises framework routing and MariaDB through Doctrine DBAL. diff --git a/conf.d/main b/conf.d/main index 069b79c..1981689 100755 --- a/conf.d/main +++ b/conf.d/main @@ -7,8 +7,8 @@ WEBROOT=/var/www/symfony SKELETON_VERSION=7.4.99 SKELETON_COMMIT=bf1abda299403468285fd4fa0514d916991c9120 SKELETON_SHA256=9dae378ef8e120b2763dd4879c9bb6ecae44592b3be156f3e130c72cc05a266d -FRAMEWORK_VERSION=7.4.17 -FRAMEWORK_COMMIT=c7f3c14c51fccba466761e8c0e7dafe4335acc16 +FRAMEWORK_VERSION=7.4.18 +FRAMEWORK_COMMIT=45d6d66b6ea1ef7a3c4193dfe606370f0f80c9bf SKELETON_URL="https://github.com/symfony/skeleton/archive/$SKELETON_COMMIT.tar.gz" PHP_INI="/etc/php/?.?/apache2/php.ini /etc/php/?.?/cli/php.ini" diff --git a/docs/v19.0-testing.md b/docs/v19.0-testing.md index d95cba6..5e62b9b 100644 --- a/docs/v19.0-testing.md +++ b/docs/v19.0-testing.md @@ -5,7 +5,7 @@ | Criterion | Implementation boundary | Acceptance evidence | | --- | --- | --- | | Trixie appliance | The appliance inherits the v19 LAMP base and uses only Debian PHP, Composer, MariaDB, Apache, and Git packages. | The exact Wave 2 appliance run must complete with a Trixie APT policy and verified cleanup. | -| Pinned official upstream | Symfony skeleton v7.4.99 is fetched by exact official commit and archive SHA256. FrameworkBundle v7.4.17 is pinned to its official split-package tag commit and recorded with the Composer lock digest. | `tests/v19.sh` compares runtime version, Composer lock source commit, lock digest, and the installed source record. | +| Pinned official upstream | Symfony skeleton v7.4.99 is fetched by exact official commit and archive SHA256. FrameworkBundle v7.4.18 is pinned to its official split-package tag commit and recorded with the Composer lock digest. | `tests/v19.sh` compares runtime version, Composer lock source commit, lock digest, and the installed source record. | | Sample application | A small Symfony route renders the runtime version and a database-backed status value. | The runtime test requests `/` through Apache and requires all page markers. | | Database connectivity | Doctrine DBAL uses the generated MariaDB account in `.env.local`; the sample query reads `turnkey_status`. | The runtime test checks the same row through the Symfony DBAL console command, direct MariaDB, and HTTP. | | Framework console | `turnkey-symfony` invokes `bin/console` as `www-data` without shell interpolation. | The runtime test checks `about` in the production environment and runs a DBAL query. |