Report vulnerabilities through GitHub private vulnerability reporting on this repository. Please do not open public issues for security problems.

This is an open-source project maintained by a small team. We read reports and respond as fast as we realistically can, but we do not promise a formal SLA.

• Weekly rebuilds (Mondays 03:00 UTC) pull the latest upstream PHP and Debian base layers, so OS and PHP security patches reach every rolling and release-channel tag automatically. docker pull weekly to receive them.
• Release-channel tags (8.5-bookworm-v1) receive the same weekly security rebuilds without ever crossing a tooling major — pin these in production.
• Immutable digests / SHA tags are never rebuilt and age by design.

• Cosign signature (keyless, GitHub OIDC) on the manifest list
• SLSA provenance attestation (BuildKit mode=max)
• SPDX SBOM attestation per platform

Retrieve the SBOM straight from any image — no registry login needed for public images:

# Full SPDX document for one platform
docker buildx imagetools inspect ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1 \
  --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom.spdx.json

# Provenance (SLSA)
docker buildx imagetools inspect ghcr.io/cboxdk/php-baseimages/php-fpm-nginx:8.5-bookworm-v1 \
  --format '{{ json .Provenance }}'

Each GitHub release also carries the SPDX SBOMs for the current default-PHP images as downloadable assets (<image>-<tag>-<arch>.spdx.json.gz). Signature verification: cosign verify ghcr.io/cboxdk/php-baseimages/<image>:<tag>.

Every build fails before any production tag moves if a fixable CRITICAL/HIGH CVE appears that is not in the repository's triaged .trivyignore baseline (each entry annotated with its fix path). Full unfiltered scan results are published to this repository's Security tab.

Images follow the upstream PHP lifecycle: versions receive weekly rebuilds until six months after their php.net security support end date. Current dates live in versions.json; the tagging and deprecation policy is documented in docs/reference/tagging-strategy.md.