I'm starting to suspect that they actually got the notice the same time we did, because if they got the patches there should be no reason it wasn't already built and ready to go (unless they're scared that "our build servers are public and everyone will know" so they literally held everything off until the release which seems so counterproductive as to be ... well, open-source silliness).
If you mean docker official images, it's just the "community" maintaining it, eg "some dudes". By no means should you consider it a mechanism to get timely security updates, I've seen horrible lag on that before.
Most of docker is like this. Images provided by volunteers, and not related to the project. Using docker images you don't maintain yourself, and at least don't upgrade yourself, is not the best recipe for security.
There are different approaches and it all comes down to who you trust. I don't think there's universal answer. If you have money, find image provider who's serious about security and hopefully they'll provide patches images quickly. Otherwise using Debian packages is a good default I think.
Honestly I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories.
And if you're using a docker package it's often JUST BECAUSE the host Debian/Ubuntu server is out of date for things you need, and Docker's the easiest way to "patch" that.
The builds are there: https://launchpad.net/ubuntu/+source/php8.5/8.5.9-0ubuntu2.1
https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.2...
https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.2...
but nothing shipped yet by their mirrors, unlike debian.
even the security.ubuntu.com mirror doesn't have it yet
Now they have finally shipped it.
Ubuntu probably started working on a rust based replacement instead: rphp.
Why are they so slow. My Archlinux is already updated, but I still have to wait because of this.
curl -fsSL https://packages.sury.org/php/README.txt | bash
This adds Ondřej Surý's PPA to your system so you can upgrade the packages.
Just make sure to have the ca-certificates fixes already...
if it makes you feel any better, the official dockerhub images aren't ready yet either.
They had almost a full day to prepare for this...
I'm starting to suspect that they actually got the notice the same time we did, because if they got the patches there should be no reason it wasn't already built and ready to go (unless they're scared that "our build servers are public and everyone will know" so they literally held everything off until the release which seems so counterproductive as to be ... well, open-source silliness).
If you mean docker official images, it's just the "community" maintaining it, eg "some dudes". By no means should you consider it a mechanism to get timely security updates, I've seen horrible lag on that before.
Most of docker is like this. Images provided by volunteers, and not related to the project. Using docker images you don't maintain yourself, and at least don't upgrade yourself, is not the best recipe for security.
(It's pretty trivial to build your own)
> If you mean docker official images, it's just the "community" maintaining it, eg "some dudes".
This is false. The Docker Official Images team (i.e. the folks with write access to the docker-library/* organization) are Docker employees.
I wasn't aware of that. So I guess it's generally better to just use plain debian images and just install the required packages with apt.
There are different approaches and it all comes down to who you trust. I don't think there's universal answer. If you have money, find image provider who's serious about security and hopefully they'll provide patches images quickly. Otherwise using Debian packages is a good default I think.
Honestly I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories.
> I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories
Because Debian uses older relases and a lot of custom patches. One example: Nodejs still doesn't have Typescript support in the Debian packages.
Distribution packages vs. official build from source has both pros and cons.
And if you're using a docker package it's often JUST BECAUSE the host Debian/Ubuntu server is out of date for things you need, and Docker's the easiest way to "patch" that.
welp, I guess I should have done my research into what "docker official images" actually means.
Debian has had the patch for days, as have other main distros, and tested and prepared the release. That's why it was instant.
Unclear why Ubuntu is lagging.
Why do people still use Ubuntu?
They gave away CDs 20 years ago for free. Cooool.
Fedora is best for desktop.
Debian for servers that never need updates (but I even use Fedora for server now adays)
Desktops don't need updates either ;)
Debian on the desktop is the best computer decision I ever made