[rmcdaniel]

Fixes #677, following its 2026-11-11 triage plan.

Change

• kubernetes-validation.yml: kind v0.23.0 and kubectl v1.29.9 are checked against the projects' published SHA-256 sums (1d86e306… and 7b0de246…), with --proto =https --tlsv1.2. I confirmed both sums against the downloaded bytes.
• native-image-corpus.sh: the dw.phar download uses --proto =https --proto-redir =https. Its digest was already checked, and fetch-parity-cli.sh already restricted protocols.
• Removes the PHP-only Octane perf experiments (FrankenPHP, Swoole, OpenSwoole), because their pecl install / install-php-extensions downloads bypassed the checked CA stores. The PHP Server they measured is retired. Removed with them: the three Dockerfiles, their compose overlays and isolation probes, the soak http_variant options and branches, the prebuilt FrankenPHP image transfer in run-vultr-soak.sh, and their 6 Composer sink inventory rows. The Apache, nginx-fpm and apache-event-fpm variants are unchanged. Perf docs now note the removal.

Tests

• server_soak_test.py (28) and vultr_soak_cleanup_test.py (11) pass. The Vultr tests run the soak script, so I ran them inside bwrap with no network, no Docker socket and a tripwire over /usr/bin/docker. A removed variant is refused before any provider request.
• composer_trust_test.py (23) and NativeImageCorpusTest.mjs (9) pass. bash -n passes on both soak scripts.

🤖 Generated with Claude Code

[rmcdaniel]

Security review: PASS (head 93d1e011). Merge after green CI.

• Hashes verified independently against the projects' own published sums: kind v0.23.0 linux-amd64 1d86e306…4a68c (kubernetes-sigs/kind release .sha256sum) and kubectl v1.29.9 linux/amd64 7b0de246…329e2 (dl.k8s.io/.../kubectl.sha256). Both match. --proto =https --tlsv1.2 and sha256sum --check --strict before use are correct.
• Deleting the PHP-only Octane perf experiments removes download paths (pecl / install-php-extensions / the prebuilt FrankenPHP transfer) that bypassed the checked stores. That closes the GHSA-6q48 remainder rather than wrapping it. The Apache and FPM perf variants are unchanged.
• Recommended, small: the corpus dw.phar is now HTTPS-only, including redirects, but still not hash-checked, and CI runs it. GitHub publishes the asset digest: cli release 2.2.0 dw.phar = sha256:fce532e6a49737aef9cb8a137fd66219928b2595764462be33b12a0fdf5abc7c. Add echo "fce532e6… parity-consumers/dw.phar" | sha256sum --check --strict after the download so the corpus can't change under you if the release is edited (cli doesn't use immutable releases yet).

[rmcdaniel]

On the dw.phar recommendation: both fetchers already check that digest before anything runs it. native-image-corpus.sh checks with sha256sum -c against visibility.cli.phar_sha256 in tests/Fixtures/ServerParity/visibility-current-runs.json (fce532e6a49737aef9cb8a137fd66219928b2595764462be33b12a0fdf5abc7c, the same value), on the line after the curl. fetch-parity-cli.sh takes the SHA-256 and size as required arguments. No change needed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud