14

I'm using PHP 5.3 and need to remain on PHP 5.3 for the foreseeable future. Please don't suggest upgrading -- for my setup, it's simply not possible at this stage.

I'm currently evaluating which OS to choose for my new server. I'd prefer to use Debian Wheezy (on which I'd leverage apt's pinning system to pull PHP 5.3 packages from Squeeze), but the latest Ubuntu LTS includes PHP 5.3 and is supported until 2017.

Here's what I'm wondering: PHP 5.3 goes EOL in less than a year. When it's abandoned, will Canonical abandon it as well, or will they backport security fixes from PHP 5.4+ (where applicable) until 2017?

Improve this question
1
  • It's version frozen at 5.3. Backports and security repos exist for a reason. I'm guessing LTS is what you want, but I don't know what policy is... I've also seen things that get simply "filed upstream" and closed as won't fix stay as unfixed. I'm just telling you what I've seen.
    – RobotHumans
    Jul 10, 2013 at 1:04

1 Answer 1

Reset to default
12

PHP is in the main repository.

$ apt-cache policy php5
php5:
  Installed: (none)
  Candidate: 5.3.10-1ubuntu3.6
  Version table:
     5.3.10-1ubuntu3.6 0
        500 http://nl.archive.ubuntu.com/ubuntu/ precise-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ precise-security/main amd64 Packages
     5.3.10-1ubuntu3 0
        500 http://nl.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages

and supported for 5 years:

$ apt-cache show php5 | grep ^Supported
Supported: 5y

Canonical's definition for software in this repository is:

Main

The main component contains applications that are free software, can be freely redistributed and are fully supported by the Ubuntu team. This includes the most popular and most reliable open-source applications available, many of which are included by default when you install Ubuntu. Software in main includes a hand-selected list of applications that the Ubuntu developers, community and users feel are most important, and that the Ubuntu security and distribution team are willing to support. When you install software from the main component, you are assured that the software will come with security updates and that commercial technical support is available from Canonical.

So, yes, the policy is to provide security updates to PHP for five years, independently of what PHP is doing. This is not unique to Canonical, but also Red Hat, Debian and other distributions backport security patches for newer versions.

I don't think that point releases of Ubuntu LTS will upgrade to PHP 5.4 - it may be available as a separate package though. See also What are point releases in LTS versions?

Improve this answer
1
  • 2
    Just to double-confirm this for myself, I checked the Hardy repository for PHP 5.2 (which went EOL in 2011), and the most recent release occurred on 2013-03-13, fixing a bug in PHP 5.3 reported on 2013-02-10. Looks like I'll be going with Precise over Wheezy.
    – blackwind
    Jul 10, 2013 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .