Installing NES for PHP

Supported Platforms

Pick your operating system and PHP version for the packages it gets, or explore every platform.

Windows Server (x64, and x86 for PHP 7.2) is installed from a zip: see Windows.

Current Releases

The current releases, and what php -v shows once one is installed:

Extensions

Each version keeps its PHP's extension API. An extension built for the same PHP version with the same thread-safety keeps loading without a rebuild. php -i shows the build's API version and thread-safety in its Extension Build line (API<PHP API version>,NTS for the standard builds).

Access

NES for PHP requires an access token for the NES registry. See Access for how to get one and where a release's files are.

Choose your PHP version

The steps below are the same for every PHP version. Two shell variables carry the difference: line, the PHP version you run, and tag, its current NES release (the tabs above have both). Set them once in the shell you install from:

line=7.4    # or 8.2, 8.1, 8.0, 7.3, 7.2, 7.1 or 5.6
case $line in
  8.2) tag=v8.2.35-nes-8.2.1 ;;
  8.1) tag=v8.1.34-nes-8.1.3 ;;
  8.0) tag=v8.0.30-nes-8.0.1 ;;
  7.4) tag=v7.4.33-nes-7.4.5 ;;
  7.3) tag=v7.3.33-nes-7.3.2 ;;
  7.2) tag=v7.2.34-nes-7.2.4 ;;
  7.1) tag=v7.1.33-nes-7.1.2 ;;
  5.6) tag=v5.6.40-nes-5.6.2 ;;
esac

Debian and Ubuntu

The packages keep the usual names (php<X.Y>-cli, php<X.Y>-fpm, libapache2-mod-php<X.Y> and the rest, with <X.Y> your PHP version, $line below), paths and configuration files, and replace the php<X.Y> packages a host already has. This section is for PHP 7 and PHP 5.6; PHP 8.0 and PHP 8.1 have steps of their own, see PHP 8.0 on Ubuntu 22.04 and PHP 8.1 on Ubuntu 18.04.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your distribution:

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.debian12.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.debian13.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 and 5.6 only (PHP 5.6 for amd64 only)
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu1604.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu1804.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4, 7.2 and 5.6 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu2204.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu2404.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu2604.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

Add the repository, then upgrade the PHP packages the host has:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.list /etc/apt/sources.list.d/nes-php.list
sudo apt update
sudo apt upgrade

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.list /etc/apt/sources.list.d/nes-php.list
sudo apt-get update
sudo apt-get upgrade

On a host without PHP, install the packages you need instead, for example sudo apt install php$line-cli php$line-fpm php$line-mysql (on PHP 5.6, sudo apt-get install php5.6-cli php5.6-fpm php5.6-mysql).

Check the installation:

php -v

Configure

Each PHP SAPI reads its own php.ini in /etc/php/<X.Y>/cli/, /etc/php/<X.Y>/fpm/ or /etc/php/<X.Y>/apache2/. php-fpm is the php<X.Y>-fpm service and listens on /run/php/php<X.Y>-fpm.sock:

sudo systemctl enable --now php$line-fpm

sudo systemctl enable php5.6-fpm
sudo systemctl start php5.6-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo apt update
sudo apt upgrade

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo apt-get update
sudo apt-get upgrade

Uninstall

Remove the NES packages, the ones whose version contains nes:

sudo apt purge $(dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' | awk '$1 ~ /^i/ && $3 ~ /[.+]nes[0-9]/ && $2 != "php-common" { print $2 }')
sudo rm /etc/apt/sources.list.d/nes-php.list
sudo rm -rf /opt/nes-php

sudo apt-get purge $(dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' | awk '$1 ~ /^i/ && $3 ~ /[.+]nes[0-9]/ && $2 != "php-common" { print $2 }')
sudo rm /etc/apt/sources.list.d/nes-php.list
sudo rm -rf /opt/nes-php

To go back to the PHP packages you used before instead, keep their repository configured and install their versions with sudo apt install --allow-downgrades <package>=<version> (on PHP 5.6, sudo apt-get install --allow-downgrades <package>=<version>).

PHP 8.0 on Ubuntu 22.04

NES for PHP 8 is for Ubuntu 22.04 on x86_64 (amd64). A release is one signed apt repository in one archive, which holds the release signing key and a repo/ directory with the packages and their signed index. The packages keep Ubuntu's names (php8.0-cli, php8.0-fpm, libapache2-mod-php8.0 and the rest) and paths: /usr/bin/php8.0, /etc/php/8.0/<sapi>/php.ini and /usr/lib/php/20200930/ for extensions.

Download and verify

In an empty directory, download the signing key, the checksums and the repository, then verify them:

tag=v8.0.30-nes-8.0.1
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu2204.amd64.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done
gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

On a host without PHP 8.0, extract the archive to /opt/nes-php and add it as an apt source. apt reads an armored key only when its file name ends in .asc, so the key goes to /usr/share/keyrings/nes-php.asc. Then install php-common and the packages you need:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.ubuntu2204.amd64.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/RPM-GPG-KEY-php-nes /usr/share/keyrings/nes-php.asc
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/nes-php.asc] file:/opt/nes-php/repo ./' | sudo tee /etc/apt/sources.list.d/nes-php.list
sudo apt-get update
sudo apt-get install --no-remove --no-install-recommends php-common php8.0-cli php8.0-fpm
php8.0 -v

Other PHP versions on the host, such as Ubuntu's own PHP 8.1, keep working, and the php command keeps pointing where it did. Run php8.0, or point php at it with sudo update-alternatives --set php /usr/bin/php8.0.

Upgrade from other PHP 8.0 packages

Ubuntu 22.04 has no PHP 8.0 of its own. A host that has PHP 8.0.30 packages from another repository can upgrade to these: the NES versions sort above the other builds of 8.0.30. First keep the packages you have, so you can roll back. Their versions must still be in their repository:

mkdir -p ~/php-8.0-rollback && cd ~/php-8.0-rollback
apt-get download $(dpkg-query -W -f '${db:Status-Abbrev} ${Package}=${Version}\n' | awk '$1 ~ /^i/ && $2 ~ /^(php8\.0|libapache2-mod-php8\.0|libphp8\.0-embed)/ { print $2 }')

Then add the NES repository as above, without the install line, and upgrade:

sudo apt-get install --no-remove --no-install-recommends $(dpkg-query -W -f '${db:Status-Abbrev} ${Package}\n' | awk '$1 ~ /^i/ && $2 ~ /^(php8\.0|libapache2-mod-php8\.0|libphp8\.0-embed)/ { print $2 }')
sudo service php8.0-fpm restart
sudo service apache2 restart

With --no-remove, apt stops instead of removing a package. Extension packages from the other repository that NES does not ship are not part of the upgrade: remove them first, and build the extension against php8.0-dev instead (phpize8.0 and php-config8.0).

To roll back, install the packages you kept, then take the NES source out, so that apt does not upgrade again:

cd ~/php-8.0-rollback
sudo apt-get install --allow-downgrades --no-remove --no-install-recommends ./*.deb
sudo rm /etc/apt/sources.list.d/nes-php.list
sudo apt-get update
sudo service php8.0-fpm restart
sudo service apache2 restart

Configure

php-fpm is the php8.0-fpm service (sudo service php8.0-fpm start) and listens on /run/php/php8.0-fpm.sock, owned by www-data. Apache runs PHP through libapache2-mod-php8.0 with the prefork MPM:

sudo a2dismod mpm_event
sudo a2enmod mpm_prefork php8.0
sudo apache2ctl -t
sudo service apache2 restart

Turn an extension on or off with phpenmod -v 8.0 and phpdismod -v 8.0.

PHP 8.2 on RHEL 8

NES for PHP 8 provides PHP 8.2.35 for RHEL 8, AlmaLinux 8, Rocky Linux 8 and UBI 8, on x86_64 and aarch64. A release is one signed dnf repository archive per architecture, php-<release>.el8.<arch>.repo.tar.xz. Each archive holds the release signing key, a nes-php.repo repository file, a repo/ directory with the signed RPMs and the module metadata, and the signed source RPM in src/. The release also has the PHP source tarball, php-<release>.tar.xz. PHP 8.2 has no packages for other distributions, no container images and no Windows zip.

The packages are the php:nes-8.2 module stream. They keep Red Hat's names (php, php-cli, php-fpm, php-mysqlnd and the rest), paths and configuration files: /etc/php.ini, /etc/php.d/, /etc/php-fpm.d/ and /usr/lib64/php/modules/ for extensions. The extension API is PHP 8.2's (PHP API 20220829), so an extension built for PHP 8.2 loads without a rebuild. Every package's Release is <N>.nes82.el8, with <N> the release's number: in 8.2.1, for example, php-cli-8.2.35-1.nes82.el8.x86_64. No Epoch is raised, and php-pear keeps Red Hat's Epoch 1 (php-pear-1:1.10.18-1.nes82.el8).

The stream has the packages of Red Hat's php:8.2 stream, less php-pecl-xdebug3 and php-pecl-rrd, plus php-sodium. Like Red Hat's, it has no imap, pdo_firebird, pdo_dblib, tidy or pspell extension.

Before you install

• OpenSSL. php-common requires openssl-libs >= 1:1.1.1k-12, the RHEL 8 OpenSSL with implicit rejection for RSA PKCS#1 v1.5 decryption. This is the fix for the Marvin attack on openssl_private_decrypt() (CVE-2024-2408). Updated RHEL 8.9 hosts and later have it. On a host with an older build, update it first with sudo dnf upgrade openssl-libs. The RHEL 8.6 and 8.8 Extended Update Support builds of the same version are not verified to carry the fix: on those hosts, pass OPENSSL_PKCS1_OAEP_PADDING to openssl_public_encrypt() and openssl_private_decrypt() in place of the default PKCS#1 v1.5 padding.
• EPEL. php-sodium needs libsodium from EPEL 8. Enable EPEL before you install it (Getting started with EPEL). php recommends php-sodium, so with EPEL enabled, dnf installs it with php.

Download and verify

Set tag to the PHP 8.2 release, v8.2.35-nes-8.2.1. In an empty directory, download the signing key, the checksums and the repository for your architecture, then verify them:

tag=v8.2.35-nes-8.2.1
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el8.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done
gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Add the repository

Extract the archive to /opt/nes-php and add its repository file. tar needs xz to extract it:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el8.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

dnf checks every package's signature against the release signing key (gpgcheck=1). The repository needs no priority: once php:nes-8.2 is enabled, dnf hides the packages of every other php stream, so dnf upgrade never takes Red Hat's builds back.

Install

On a host with no php stream enabled, enable the stream and install the packages you need:

sudo dnf module enable php:nes-8.2
sudo dnf install php-cli php-fpm php-mysqlnd
php -v

php -v shows PHP 8.2.35-nes. On a host where another php stream is enabled, dnf module enable refuses: use dnf module switch-to php:nes-8.2, below, instead.

Switch from Red Hat's PHP

On a host with Red Hat's php:8.2 stream, or another of its php streams, add the repository as above, then switch:

sudo dnf module switch-to php:nes-8.2
php -v

The switch moves every installed package that the stream has to its NES build, Red Hat's apcu-panel, php-pecl-apcu, php-pecl-zip, php-pear and libzip included. Your edits to /etc/php.ini, /etc/php-fpm.conf and /etc/php-fpm.d/*.conf are kept. With EPEL enabled, the switch also installs php-sodium on a host that has php. Then restart php-fpm, and Apache httpd if it loads PHP's module, so they run NES's build: sudo systemctl restart php-fpm.

• Red Hat's php:8.2 builds of php-pecl-xdebug3 and php-pecl-rrd are not part of the stream. They stay installed across the switch and load into NES's PHP, which has the same extension API as Red Hat's PHP 8.2. While php:nes-8.2 is enabled, they cannot be newly installed.
• The switch stops, and changes nothing, while an installed package has no counterpart in the stream and requires its own PHP build: for example php-xmlrpc from a PHP 7 stream, or a PECL extension built for another PHP version. Remove that package first.

Switch from NES's PHP 7.4 or PHP 7.2

On a host with NES's php:nes-7.4 or php:nes-7.2 stream, remove php-xmlrpc first: PHP 8 has no xmlrpc extension, and the switch stops while it is installed. Then add the PHP 8.2 repository as above, which replaces the PHP 7 one in /opt/nes-php, and switch:

sudo dnf remove php-xmlrpc
sudo dnf module switch-to php:nes-8.2
php -v

Restart php-fpm, and Apache httpd if it loads PHP's module, as above. php-json is part of PHP 8 and goes with the switch. Use switch-to, not dnf module enable and dnf upgrade: some PHP 8.2 builds sort below the PHP 7 builds of the same version (APCu and PEAR), and only switch-to moves them.

Roll back to Red Hat's PHP 8.2

Remove the NES repository, then switch back to Red Hat's php:8.2 stream:

sudo rm /etc/yum.repos.d/nes-php.repo
sudo dnf module switch-to php:8.2 --allowerasing
sudo rm -rf /opt/nes-php

Every package returns to Red Hat's build. --allowerasing lets dnf remove php-sodium, which Red Hat does not build: without it, the switch stops on that package. On a host without php-sodium, it is not needed.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service, with Red Hat's defaults: the www pool runs as apache, listens on /run/php-fpm/www.sock (which the apache and nginx users may use), uses pm = dynamic with 50 children at most, and logs errors to /var/log/php-fpm/www-error.log.

sudo systemctl enable --now php-fpm

php-pear is PEAR 1.10.18. With php-devel and a compiler, pecl install builds an extension for NES's PHP 8.2.

Behaviour changes

• php -v and PHP_VERSION report 8.2.35-nes, so version_compare(PHP_VERSION, '8.2.35', '>=') is false. PHP_VERSION_ID stays 80235: use it to check the PHP version.
• Session upload progress is off: /etc/php.ini sets session.upload_progress.enabled = Off, its compiled default is Off, and setting it to On has no effect. This mitigates CVE-2026-115560, which needs session upload progress and has no upstream fix yet; the fix will follow in a later release.
• mysqlnd (mysqli and PDO MySQL) no longer sends a password in clear text with the mysql_clear_password authentication plugin over a connection that is neither TLS nor a Unix socket: a server, or anyone between PHP and the server, could ask for that plugin and read the password. Such a connection now fails with error 2059 ("Authentication plugin 'mysql_clear_password' cannot be loaded: ..."). Connect accounts that use the plugin (PAM or LDAP authentication) over TLS or a Unix socket. Any TLS connection is accepted, so verify the server's certificate to keep the password from a man in the middle. To allow the plugin over plain TCP as before, set the environment variable LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 for the PHP process: under php-fpm, env[LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN] = 1 in the pool configuration; for Apache's PHP module, the web server's own environment (SetEnv does not reach it).
• A server that switches a sha256_password login to a scramble shorter than 20 bytes, or to none, is now refused with error 2027 ("The server sent wrong length for scramble") instead of crashing the client.
• php-pecl-zip is PECL zip 1.22.8 (Red Hat's is 1.22.3), on the stream's own libzip 1.7.3 build. The stream's libzip keys its entry-name hashing, so a crafted archive cannot make zip_open() take quadratic time (GHSA-m3wq-j48p-jxwh). Its ValueError messages say "must not be empty" where 1.22.3 said "cannot be empty". Reflection lists a #[\Deprecated] attribute on zip_open() and the other procedural zip_*() functions, which PHP 8.2 cannot instantiate; the functions behave as before.
• php-gd is built on PHP's bundled libgd, not on RHEL 8's gd 2.2.5, and no longer requires the gd package. JPEG, PNG, WebP, FreeType and XPM are supported, as before.
• php-pecl-apcu, php-pecl-apcu-devel and apcu-panel are APCu 5.1.28 (Red Hat's is 5.1.23).

See the PHP 8.2 release notes for the security fixes.

Upgrade to a later release

Set tag to the new release, download and verify its archive as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el8.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

Remove the NES packages, reset the module and remove the repository:

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes82\./ { print $1 }')
sudo dnf module reset php
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Red Hat's PHP 8.2 instead, see Roll back to Red Hat's PHP 8.2.

RHEL 8, 9 and 10, AlmaLinux and Rocky Linux

The packages are the php:nes-<X.Y> module stream (php:nes-$line below), with the usual package names (php-cli, php-fpm, php-mysqlnd and the rest), paths and configuration files. This section is for PHP 7.4, PHP 7.3 and PHP 7.2; PHP 8.2 has steps of its own, see PHP 8.2 on RHEL 8. PHP 7.4 and 7.2 packages have the Release <N>.nes.el<RHEL version>; PHP 7.3's, published for RHEL 8 only, have <N>.nes73.el8 (for example php-cli-7.3.33-2.nes73.el8.x86_64).

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your RHEL version:

# Published for PHP 7.4, 7.3 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el8.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el9.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

# Published for PHP 7.4 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el10.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

Add the repository:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

Then enable the php:nes-$line module stream. A host that has PHP from another stream switches to it; a host without PHP enables it and installs the packages you need:

sudo dnf module switch-to php:nes-$line

sudo dnf module enable php:nes-$line
sudo dnf install php-cli php-fpm php-mysqlnd

Check the installation:

php -v

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service and listens on /run/php-fpm/www.sock:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

Remove the NES packages, reset the module and remove the repository:

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes[0-9]*\./ { print $1 }')
sudo dnf module reset php
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to the distribution's PHP instead, enable the stream you want after the reset and install its packages (dnf module list php lists them), for example sudo dnf module switch-to php:<stream>.

PHP 7.2: RHEL 8 has a php:7.2 stream, RHEL 9 has none for PHP 7.2. PHP 7.3: RHEL 8 has a php:7.3 stream.

RHEL 7

NES for PHP 7 provides PHP 7.4.33 for RHEL 7 and CentOS 7, on x86_64 and aarch64. The packages have the names of Remi's php74 packages for el7 (php, php-cli, php-fpm, php-mysqlnd and the rest, and libzip5), which they replace, and the usual paths and configuration files. RHEL 7's yum has no module streams: the archive holds a plain yum repository at priority 5, which needs yum-plugin-priorities. This section is for PHP 7.4; for PHP 5.6 on RHEL 7, see RHEL 6 and 7, CentOS and Oracle Linux.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your architecture (tar needs xz: sudo yum install xz):

base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el7.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads. RHEL 7's GnuPG 2.0 has no --show-keys and its sha256sum has no --ignore-missing:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

php-mbstring and php-sodium need oniguruma and libsodium from EPEL 7, as Remi's packages do. EPEL 7 reached its end of life with RHEL 7 and is archived: a host that installs either package needs a repository for EPEL 7's archive. Install yum-plugin-priorities, then add the repository:

sudo yum install yum-plugin-priorities
sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el7.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

On a host without PHP, install the packages you need:

sudo yum install php-cli php-fpm php-mysqlnd
php -v

Move from Remi's PHP 7.4

Remi's builds of PHP 7.4.33 sort above NES's, so yum update does not move a host from his packages. Add the repository as above. Then remove his packages that NES does not build (php-imap, php-tidy, php-pdo-dblib, php-pdo-firebird and php-litespeed), and move every PHP package, and libzip5, to NES's builds with yum distro-sync:

sudo yum remove php-imap php-tidy php-pdo-dblib php-pdo-firebird php-litespeed    # those installed
sudo yum distro-sync 'php*' libzip5
php -v

The repository's priority 5 makes yum take these packages from it. NES's libzip5 is libzip 1.6.1 with a fix that Remi's newer build does not need, and NES's php-pecl-zip requires it. Remi's php-pecl-igbinary stays installed and keeps loading.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service, and its pool listens on 127.0.0.1:9000, as Remi's does. The Apache module, for httpd's prefork MPM, is loaded by /etc/httpd/conf.d/php.conf; restart httpd after you install or upgrade.

sudo systemctl enable php-fpm
sudo systemctl start php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el7.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum clean metadata
sudo yum update 'php*' libzip5

Uninstall

Remove the NES packages and the repository:

sudo yum remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Remi's packages instead, remove the repository file and /opt/nes-php, then run sudo yum distro-sync 'php*' libzip5 with his repositories enabled.

RHEL 6 and 7, CentOS and Oracle Linux

The PHP 5.6 packages are for RHEL 6 and RHEL 7, and also serve CentOS 6, Oracle Linux 6, CentOS 7 and Oracle Linux 7. They have the standard names (php, php-cli, php-fpm, php-mysqlnd and the rest), paths and configuration files, and replace the PHP 5.6 packages a host already has.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your RHEL version:

base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el6.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el7.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

Add the repository, then upgrade the PHP packages the host has (tar needs xz: sudo yum install xz):

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum update 'php*'

On a host without PHP, install the packages you need instead, for example sudo yum install php-cli php-fpm php-mysqlnd.

Check the installation:

php -v

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service. The Apache module is loaded by /etc/httpd/conf.d/php.conf; restart httpd after you install or upgrade.

sudo systemctl enable php-fpm
sudo systemctl start php-fpm

sudo chkconfig php-fpm on
sudo service php-fpm start

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo yum clean metadata
sudo yum update 'php*'

Uninstall

Remove the NES packages and the repository:

sudo yum remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to the PHP 5.6 packages you used before, install them again from their repository.

RHEL 6

NES for PHP 7 provides PHP 7.1.33 for RHEL 6, on x86_64 only. The packages serve CentOS 6 as well. They replace Remi's PHP 7.1 packages for el6 (remi-php71) under the same names (php, php-cli, php-fpm and the rest, php-pear, php-pecl-apcu and php-pecl-zip), with the same paths and configuration files. Their Release, 11.<N>.nes.el6, is newer than Remi's 10.el6.remi, so yum update moves a host from Remi's packages to NES's. This section is for PHP 7.1; for PHP 5.6 on RHEL 6, see RHEL 6 and 7, CentOS and Oracle Linux.

Download and verify

In an empty directory, download the signing key, the checksums and the repository (tar needs xz: sudo yum install xz):

base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el6.x86_64.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads. RHEL 6's GnuPG 2.0 has no --show-keys and its sha256sum has no --ignore-missing, so this checks the files you downloaded:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

php-mcrypt, php-pdo-dblib and php-gd need EPEL 6 (for libmcrypt, freetds and libwebp); no other package needs it. EPEL 6 is archived: a host that installs one of these packages needs a repository for EPEL 6's archive.

Add the repository:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el6.x86_64.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

On a host with Remi's PHP 7.1 packages, remove apcu-panel, php-interbase and php-litespeed if they are installed: NES builds none of them, and Remi's require his exact php-common (apcu-panel his exact php-pecl-apcu). Then upgrade:

sudo yum remove apcu-panel php-interbase php-litespeed    # those installed
sudo yum update 'php*'
php -v

Remi's other PECL packages stay installed and keep loading, as they need only PHP's API and ABI versions (php-pecl-igbinary is tested; one built against Remi's APCu 5.1.19, such as php-pecl-apcu-bc, is not). NES's php-pecl-apcu is APCu 5.1.28, and a host with Remi's newer php-pecl-zip keeps it.

A host with RHEL 6's own PHP 5.3 removes it, and the extensions built for it, first. That move is not tested. Then, as on a host without PHP, install the packages you need:

sudo yum remove 'php*'    # RHEL 6's own PHP 5.3 only
sudo yum install php-cli php-fpm
php -v

Configure

PHP reads /etc/php.ini and /etc/php.d/. As on Remi's el6 packages, php-fpm is a SysV service, php-fpm, that listens on 127.0.0.1:9000:

sudo chkconfig php-fpm on
sudo service php-fpm start

The httpd and nginx configurations for php-fpm are documentation in /usr/share/doc/php-fpm-7.1.33/.

httpd 2.2 runs PHP through mod_php, loaded by /etc/httpd/conf.d/php.conf; restart httpd after you install or upgrade. mod_php works with httpd's prefork MPM, RHEL 6's default, only: there is no ZTS build (zts-php, libphp7-zts.so), and under the worker MPM php.conf refuses PHP files rather than serve their source. A host on httpd.worker moves to prefork or to php-fpm first.

APCu's apc.mmap_hugepage_size has no effect: RHEL 6's kernel headers lack the hugepage size flags.

Build an extension with pecl

pecl install of a recent PECL release (APCu 5.1.24 and later, for one) needs Autoconf 2.64 or later, and RHEL 6's is 2.63. With php-devel installed, install EPEL 6's autoconf268 and point pecl at it:

sudo yum install autoconf268
sudo PHP_AUTOCONF=autoconf268 PHP_AUTOHEADER=autoheader268 pecl install <package>

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.el6.x86_64.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum clean metadata
sudo yum update 'php*'

Uninstall

Remove the NES packages and the repository:

sudo yum remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Remi's packages instead, with remi-php71 enabled, run sudo yum --disablerepo=nes-php distro-sync 'php*', then remove the repository file and /opt/nes-php.

Amazon Linux 2

The packages replace the php<X.Y> amazon-linux-extras topic's packages under the same names.

Download and verify

In an empty directory, download the signing key, the checksums and the repository:

# Published for PHP 7.4, 7.2 and 7.1 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux2.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum update

On a host without PHP, install the packages you need instead, for example sudo yum install php-cli php-fpm php-mysqlnd.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum clean metadata
sudo yum update

Uninstall

Return to the php<X.Y> topic's packages and remove the repository:

sudo yum --disablerepo=nes-php distro-sync 'php*'
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

Amazon Linux 1

NES for PHP 7 provides PHP 7.1.33 for Amazon Linux 1 (Amazon Linux AMI 2018.03) on x86_64. The packages replace Amazon's php71 packages under the same names (php71, php71-cli, php71-fpm and the rest, and php7-pear), and install beside Amazon's other PHP versions, as Amazon's do.

Download and verify

In an empty directory, download the signing key, the checksums and the repository:

# Published for PHP 7.1 only, x86_64 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux1.x86_64.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

The repository has priority 5 (yum-plugin-priorities, which the Amazon Linux AMI installs), so its packages take the place of the packages of the same name in Amazon's repositories. Their Release, 44.<N>.nes.amzn1, is also newer than Amazon's own 1.43.amzn1, so yum update moves a host from Amazon's php71 packages to NES's:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum update

On a host without PHP, install the packages you need instead, for example sudo yum install php71-cli php71-fpm php71-mysqlnd.

php7-pear. NES's php7-pear is PEAR 1.10.18, with Amazon's pear7 and pecl7 commands. Amazon Linux 1 has one php7-pear for all its PHP 7 versions, PEAR 1.10.12. With the NES repository, yum update replaces it with NES's, also on a host that runs another PHP 7 version. With php71-devel and a compiler, pecl7 install builds an extension for NES's PHP 7.1.

Configure

PHP reads /etc/php-7.1.ini and /etc/php-7.1.d/ (/etc/php.ini and /etc/php.d point to them while PHP 7.1 is the selected alternative). php-fpm is the php-fpm-7.1 service, with its pools in /etc/php-fpm-7.1.d/:

sudo chkconfig php-fpm-7.1 on
sudo service php-fpm-7.1 start

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum clean metadata
sudo yum update

Uninstall

Return to Amazon's php71 packages and remove the repository:

sudo yum --disablerepo=nes-php distro-sync 'php71*' php7-pear
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

Amazon Linux 2023

The packages follow Amazon Linux's names for a PHP version: php<X.Y>, php<X.Y>-cli, php<X.Y>-fpm and the rest. One PHP version is installed at a time. This section is for PHP 7.4 and PHP 7.3; PHP 8.1 has steps of its own, see PHP 8.1 on Amazon Linux 2023.

Download and verify

In an empty directory, download the signing key, the checksums and the repository:

# Published for PHP 7.4, 7.3 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux2023.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

Bring the host to the latest Amazon Linux 2023 release, add the repository, then install the packages you need:

sudo dnf upgrade --releasever=latest
sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf install php$line-cli php$line-fpm php$line-mysqlnd

On a host with Amazon Linux's PHP 8, add --allowerasing and name the php$line package for each PHP 8 package you have (for example php$line-cli for php8.4-cli): dnf then replaces PHP 8.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Amazon Linux's PHP 8 instead, install its packages with --allowerasing, for example sudo dnf install --allowerasing php8.4-cli php8.4-fpm.

PHP 8.1 on Amazon Linux 2023

NES for PHP 8 provides PHP 8.1.34 for Amazon Linux 2023 on x86_64 and aarch64. A release is one signed dnf repository archive per architecture, php-<release>.amazonlinux2023.<arch>.repo.tar.xz. Each archive holds the release signing key, a nes-php.repo repository file, a repo/ directory with the signed RPMs and their metadata, and the signed source RPM in src/. The release also has the PHP source tarball, php-<release>.tar.xz.

The packages have Amazon Linux's own names for PHP 8.1 (php8.1, php8.1-cli, php8.1-fpm, php8.1-mysqlnd and the rest) and its paths and configuration files: /etc/php.ini, /etc/php.d/, /etc/php-fpm.d/ and /usr/lib64/php/modules/ for extensions. The extension API is PHP 8.1's (PHP API 20210902), so an extension built for PHP 8.1 loads without a rebuild.

Download and verify

Set tag to the PHP 8.1 release, v8.1.34-nes-8.1.3. In an empty directory, download the signing key, the checksums and the repository for your architecture, then verify them:

tag=v8.1.34-nes-8.1.3
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux2023.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done
gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Add the repository

The packages are built against the newest Amazon Linux 2023 release, so bring the host to it first. Then extract the archive to /opt/nes-php and add its repository file as it is:

sudo dnf upgrade --releasever=latest
sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.amazonlinux2023.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

Keep priority=5 in nes-php.repo. dnf takes a package name only from the repositories with the best priority that have it, whatever its version: at dnf's default priority (99), dnf would keep Amazon Linux's PHP 8.1 and never offer these packages. dnf checks every package's signature against the release signing key (gpgcheck=1).

Install

On a host without PHP, install the packages you need:

sudo dnf install php8.1-cli php8.1-fpm php8.1-mysqlnd
php -v

Upgrade from Amazon Linux's PHP 8.1

Amazon Linux 2023 has PHP 8.1 packages of its own, with the same names. On a host that runs them, add the repository as above, then upgrade:

sudo dnf upgrade --refresh
php -v

dnf replaces Amazon Linux's packages in place. Every NES package has Epoch 1 (php-pear has Epoch 2), so it sorts above every Amazon Linux build of the same package, later ones included, and no Amazon Linux update replaces it again. The upgrade keeps your edits to /etc/php.ini, /etc/php.d/ and /etc/php-fpm.d/, and php-fpm restarts on the new build by itself.

• Amazon Linux's PECL extensions that NES does not build (php8.1-pecl-igbinary, php8.1-pecl-msgpack, php8.1-pecl-memcached and php8.1-pecl-redis6) stay installed and load into NES's PHP 8.1, which has the same extension API.
• NES adds php8.1-sodium, which Amazon Linux's PHP 8.1 does not have; dnf installs it with php8.1.
• Amazon Linux's php8.1-* packages require their own PHP build, so a PHP 8.1 package that Amazon Linux adds later, and NES does not ship, does not install on a host with NES's PHP 8.1.

Roll back to Amazon Linux's PHP 8.1

Remove the NES repository, then let dnf return every PHP package to Amazon Linux's newest build:

sudo rm /etc/yum.repos.d/nes-php.repo && sudo dnf distro-sync --allowerasing
sudo rm -rf /opt/nes-php

--allowerasing lets dnf remove php8.1-sodium, which only NES ships: without it, distro-sync stops on that package. Every other package, php-pear included, returns to Amazon Linux's build.

Move from another of Amazon Linux's PHP versions

One PHP version is installed at a time. On a host with another of Amazon Linux's PHP 8 versions, add the repository as above, then install the php8.1 counterpart of each of its packages with --allowerasing, which removes the other version's. For example, on a host with php8.4-cli and php8.4-fpm:

sudo dnf install --allowerasing php8.1-cli php8.1-fpm

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service; its pools are in /etc/php-fpm.d/, and the default pool listens on /run/php-fpm/www.sock. There is no Apache module: Apache httpd and nginx run PHP through php-fpm.

sudo systemctl enable --now php-fpm

Behaviour changes

Two mitigations change how PHP 8.1 behaves:

• A script that runs out of memory_limit now ends its process at once, with exit status 1: no error handler, shutdown function or destructor runs, and buffered output is not sent. PHP logs the fatal error (to error_log; with php-fpm, to the pool's error log), and php-fpm starts a new worker in its place. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
• Session upload progress is off: /etc/php.ini sets session.upload_progress.enabled = Off, its compiled default is Off, and setting it to On has no effect. This mitigates CVE-2026-115560, which needs session upload progress and has no upstream fix yet; the fix will follow in a later release.

Upgrade to a later release

Set tag to the new release, download and verify its archive as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.amazonlinux2023.$(uname -m).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

Remove the NES packages and the repository:

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Amazon Linux's PHP 8.1 instead, see Roll back to Amazon Linux's PHP 8.1.

PHP 8.1 on Ubuntu 18.04

NES for PHP 8 provides PHP 8.1.34 for Ubuntu 18.04 (Bionic) on amd64 and arm64. A release is one signed apt repository archive per architecture, php-<release>.ubuntu1804.<arch>.repo.tar.xz, with <arch> amd64 or arm64. Each archive holds the release signing key (nes-php.asc), an apt source (nes-php.list) and a repo/ directory with the debs and their signed index (InRelease).

The packages have Ondřej Surý's names for PHP 8.1 (php8.1, php8.1-cli, php8.1-fpm, libapache2-mod-php8.1 and the rest) and paths: /usr/bin/php8.1, /etc/php/8.1/<sapi>/php.ini and /usr/lib/php/20210902/ for extensions. They come with NES's own php-common and php-pear (PEAR 1.10.18). Every package has epoch 1, so it sorts above any other php8.1 build: dpkg-query -W php8.1-cli shows 1:8.1.34+nes8.1.3-1~ubuntu18.04.

Download and verify

Set tag to the PHP 8.1 release, v8.1.34-nes-8.1.3. In an empty directory, download the signing key, the checksums and the repository for your architecture, then verify them (gpg is in the gnupg package, tar needs xz-utils). Bionic's GnuPG 2.2.4 has no --show-keys, so --with-fingerprint shows the key:

tag=v8.1.34-nes-8.1.3
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.ubuntu1804.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done
gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Add the repository

Ubuntu 18.04 ships PHP 7.2, not PHP 8.1, so the NES php8.1 installs beside Ubuntu's PHP 7.2. Extract the archive to /opt/nes-php, add its apt source, then run apt-get --with-new-pkgs upgrade first:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.ubuntu1804.$(dpkg --print-architecture).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.list /etc/apt/sources.list.d/nes-php.list
sudo apt-get update
sudo apt-get --with-new-pkgs upgrade

php-common and php-pear become NES's. Ubuntu's PHP 7.2 and its PECL packages (php-apcu, php-redis and the others) keep working. apt checks every package through the repository's InRelease, signed with the release signing key.

Install

Then install the packages you need:

sudo apt-get install php8.1-cli php8.1-fpm
php8.1 -v

Installing php8.1-cli makes /usr/bin/php PHP 8.1, through the alternatives' priority. To keep PHP 7.2 there, run sudo update-alternatives --set php /usr/bin/php7.2.

Ubuntu's PECL packages are built for PHP 7.2 only. For PHP 8.1, build an extension with pecl install, with php8.1-dev and the NES php-pear installed.

Configure

Each PHP SAPI reads its own php.ini in /etc/php/8.1/cli/, /etc/php/8.1/fpm/ or /etc/php/8.1/apache2/. php-fpm is the php8.1-fpm service and listens on /run/php/php8.1-fpm.sock:

sudo systemctl enable --now php8.1-fpm

Turn an extension on or off with phpenmod -v 8.1 and phpdismod -v 8.1.

Upgrade to a later release

Set tag to the new release, download and verify its archive as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.ubuntu1804.$(dpkg --print-architecture).repo.tar.xz -C /opt/nes-php --strip-components=1
sudo apt-get update
sudo apt-get --with-new-pkgs upgrade

Uninstall

Remove the NES php8.1 packages and the repository:

sudo apt-get purge $(dpkg-query -W -f '${db:Status-Abbrev} ${Package}\n' | awk '$1 ~ /^i/ && $2 ~ /^(php8\.1|libapache2-mod-php8\.1|libphp8\.1-embed)/ { print $2 }')
sudo rm /etc/apt/sources.list.d/nes-php.list
sudo apt-get update
sudo rm -rf /opt/nes-php

php-common and php-pear stay NES's builds, which Ubuntu's PHP 7.2 keeps using. To return them to Ubuntu's, install Ubuntu's versions with sudo apt-get install --allow-downgrades php-common=<version> php-pear=<version> (apt-cache policy php-common php-pear lists them).

Verify Downloads

To verify the signing key, the checksum file and the downloaded files, see Verify Downloads.