[rmcdaniel]

Released standalone binaries use inconsistent OpenSSL 3.6 patches, and that line reaches its support end on November 1. Rebuilding with the existing prebuilt preference does not select a maintained source reproducibly.

Pin OpenSSL 3.5.9 LTS and its official SHA-256 in one source policy. Force that library to source on all four targets, verify the actual SPC download lock/archive before compilation, and bind the policy and verifier digests into the existing phpmicro cache identity. Other eligible libraries retain their existing prebuilt path.

Extend the produced-runtime check after cold builds and cache restores: require the exact OpenSSL pin, libcurl 8.23.0+ using that same OpenSSL backend on Unix, and the existing Windows streams policy. Preserve PHP 8.4.27, extension checks, source/toolchain guards and publication permissions. Publish per-target dependency inventories through the ordinary required-asset, checksum and attestation path; keep 2.3.1 immutable.

Validation:

• All 38 Node release-contract tests pass, including tampered/stale/prebuilt/archive redirection, cache-policy identity, stale-runtime and mismatched-curl-backend controls.
• Full PHP suite: 921 tests / 17,396 assertions pass, with 11 existing PHPUnit deprecations and one skipped case. Probe syntax passes.
• Both changed workflow YAML documents parse.

The actual pinned SPC 2.8.5 tool (verified against the committed toolchain SHA-256) fetched OpenSSL from the custom source URL with prebuilt preference enabled. The new guard accepts its real archive and lock at the official SHA-256. The runtime probe distinguishes the loaded OpenSSL library from compilation headers, and mismatch controls cover every platform.

Reviewed head 0a5bbef3e4c3ee60a3805b1707ac54d315138a27 passes all 16 hosted checks, including PHP 8.2–8.5, reproducible PHAR, CodeQL and Sonar. Nine initial analyzer findings were corrected in code; current analysis has zero new issues, zero accepted issues and zero hotspots, with no gate or rule changes. The affected PHP release-contract selection passes 15 tests / 384 assertions; the full PHP result above remains valid for the unchanged application source.

Source qualification is complete. Merging enables the existing main-branch warmer to qualify the four native targets. Native cold/warm acceptance and normal patch publication remain in #67, including public assets, inventories, checksums, attestations, installers and outbound HTTPS. No new binary or release is published by this source PR.

Refs #67.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud