15

Throughout internet, I've only found references to add ondrej/php repository in order to upgrade to PHP-8 (on Ubuntu, if that matters). I am not familiar, either who is ondrej (sorry for that, maybe he is like "Linus in PHP world", but I am not veteran dev and don't know) and wanted to know, is that safe way to install PHP 8 and is that official repository?

2
  • 5
    If you are not sure, then don't do it and accept whatever version of php is available for the version of Ubuntu you are using. The PPA you're talking about says fairly explicitly that there are no guarantees of timely updates. This is the cost of deviating from the standard packages. Alternatively, you can download PHP from the source and learn how to install it for yourself. That's the safest option if you really need version 8. – Ray Apr 22 at 16:46
  • What version of ubuntu do you have installed? – Michal Przybylowicz Apr 22 at 16:47
12

For the sake of completeness, I'll expand my comment into an answer and let you decide.

A PPA is a Personal Package Archive. Someone has taken source code from another source and packaged it so that Ubuntu users can install them easily.

Your question of "trust" comes down to what are you worried about? The fact is, any one can create an a PPA and have create a glowing homepage that looks perfect. One thing to keep in mind is that whoever makes a PPA is usually a volunteer, much like those of us who read AskUbuntu. So, there are no guarantees. In fact, the one you mentioned is described in these installation instructions, which then refer to this PPA. At this PPA, they have honestly said:

Disclaimer: there's no guarantee of timely updates in case of security 
problems or other issues. If you want to use them in a security-or-
otherwise-critical environment (say, on a production server), you do 
so at your own risk.

Does something like this pass or fail your definition of trust? It seems everyone will have different definitions of trust. In fact, what if I said "yes, you can trust that PPA!" -- but for what reason should you trust me?

My rule of thumb whether it is an Ubuntu PPA or some installation executable for Microsoft Windows is if I am concerned, I shouldn't download it. In your case, your current version of PHP should be sufficient and I wonder if you "need" features in PHP-8 or do you just want the latest version for no reason?

If you still need PHP-8, then you can just download it and install it yourself. This is the site where PHP resides. Installation instructions for this source is available here. This is the most trustworthy as you can get...

4
  • 1
    State-of-the-art answer ;) – T.Todua Apr 23 at 13:54
  • I'd argue that at this point in time pretty much nobody needs PHP8 as it's a very recent release. – Shadur Apr 25 at 8:42
  • 1
    "Disclaimer: there's no guarantee of timely updates [...]" "Does something like this pass or fail your definition of trust?" — That's tending towards earning my trust because here is a person who a) has recognised preemptively that timely updates are important for security b) knows their limits and don't try to promise (and plan) something that would expectably overstrain them c) recognizes that you, the user would want to know this d) is transparent enough to straight up tell you about this. — And then goes ahead and does impeccable work for years. – Levente Apr 25 at 22:12
  • "you just want the latest version for no reason?" — In professional php development context quite a few people tend to get pushed into a situation where they have to rely on the ondrej/php PPA, because the Symfony Framework, including its omni-potent, omni-present components tends to depend on pretty recent php versions. So if the devs on Ubuntu don't want to fall behind (their team) and develop with an inferior Symfony version, lacking in fixes and features, they need to obtain the corresponding recent php. – Levente Apr 25 at 22:28
19

It is safe to install php from ondrej/php ppa.

WHO AM I?

I am a Debian Developer since year 2000, and I have been packaging PHP for Debian since PHP 5. That means the official packages in Debian and Ubuntu are either my work or they are based on my work. The PHP packages in my Ubuntu PPA and Debian DPA matches the official packages in Debian. Basically I am saying that you can’t get any closer than that.

Askubuntu : @oerdnj

I am a Director of DNS Engineering at ISC, Debian Developer since 2000, Ubuntu Member since 2005, founding member of Ubuntu Česká Republika since 2004.

I (co-)maintain Apache2, PHP, MariaDB, Cyrus SASL, Cyrus IMAP, Berkeley DB and all things DNS in Debian and also have semi-official PPAs for those packages (PHP). I have been member of Debian GNOME GTK+ packaging team. (In other words I've seen things you people wouldn't believe. :-))

I am author of two apache modules (mod-vhost-ldap and mod-log-spread2) and I am co-author of Knot DNS, a fast authoritative-only DNS server, and now I work on BIND, the most used DNS server on the Internet.

I have expertise in routing, DNS, DNSSEC, Debian packaging and much more to list here :).

The developer is preparing a newcomer package debsuryorg-archive-keyring to automatically update the PGP key.

The apt-key list should print:

pub   rsa1024 2009-01-26 [SC]
      14AA 40EC 0831 7567 56D7  F66C 4F4E A0AA E526 7A6C
uid           [ unknown] Launchpad PPA for Ondřej Surý

twitter: Ondřej Surý

github: Ondřej Surý

Installation instructions:

sudo apt install software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt update
sudo apt install php8.0
1
  • 7
    I would mention the fact that there is a PGP key that could be used to check that the PPA actually belongs to Ondřej Surý. Just because his name is on it, that doesn't mean it's him. – Federico Poloni Apr 23 at 12:06
7

Coming from a CentOS background...

Official repos of Ubuntu 20.04, for instance, have PHP 7.4.3 (with backported fixes). If you want anything higher than that, someone needs to compile it for you into a package. I tend to look for how well known the builder is. In the RHEL/CentOS world, that person is Remi Collet (a PHP contributor) who has a repo for his builds.

In the same way ondrej has a website. Not only does he seem well known, he works with other Ubuntu packagers and he seems to be this GitHub contributor.

TL;DR is it safe?

The fact that it's well known means it's less likely you're getting some corner build with either build problems or malicious code. There's no guarantees of course, but no company can guarantee you no malicious intrustion, but with a better known repo, it's less likely it will go unnoticed.

2
4

As ray points out, "any one can create an a PPA and have create a glowing homepage that looks perfect".

So lets try to validate the claims.

We can see who the maintainers of the Debian php packages are by looking at Debian's website. Ondřej Surý is indeed listed as one of the maintainers of the php packages in Debian. https://tracker.debian.org/pkg/php-defaults

Ondřej Surý is listed as a Debian Developer with gpg key 30B9 33D8 0FCE 3D98 1A2D 38FB 0C99 B70E F4FC BB07 on https://nm.debian.org/person/ondrej/

So the question becomes whether the Ondřej Surý who maintains the php packages in Debian is the same person who runs deb.sury.org.

One thing we can look at is the e-mail addresses associated with the GPG key. The primary email address on the gpg key mentioned above is "ondrej@sury.org", this to me is a strong indication that the sury.org domain is controlled by ondrej sury or at least his family.

The launchpad account and the sury.org domain have also been around a long time. The domain was registered in 2002, the launchpad account was created in 2005. The username on the launchpad account matches Ondřej Surý's Debian username.

In sumary I have a high level of confidence that the person behind that PPA is the same person who is maintaining the php packages in Debian.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.