PHP Composer segfaults in gemnasium analyzer

Summary

The latest code to merge into main branch ran into an issue building the gemnasium fips image. The error was a segfault in php composer under the ubi8-minimal image.

The current fix for this issue is to do a revert back to old code using ubi8.

The segfault should be investigated and resolved so that the analyzer can continue using the ubi8-minimal image.

Here's an example crash: https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium/-/jobs/3244872107

Steps to reproduce

docker pull registry.access.redhat.com/ubi8-minimal:8.6-941
docker run -it --rm registry.access.redhat.com/ubi8-minimal:8.6-985

$ microdnf module enable php:8.0 && microdnf install php php-common php-zip php-json php-xml php-mbstring --nodocs
$ curl -o /usr/local/bin/composer https://getcomposer.org/download/2.4.1/composer.phar
$ chmod 755 /usr/local/bin/composer
$ /usr/local/bin/composer

Segmentation fault (core dumped)

What is the current bug behavior?

segfault occurs: https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium/-/jobs/3244872107

What is the expected correct behavior?

The image should build without errors.

Possible fixes

It's likely an upstream issue that will be resolved in the latest ubi8-minimal but resolution should also involve the root cause of the failure and documentation as to how to resolve such errors in the future (if not mitigate automatically).

Contributing factors

  • RedHat UBI images frequently prune dependencies that are thought to be unrequired. This can unexpectedely cause issues due to missing dependencies.
  • The timezone database was removed and marked as installed by micro-dnf which caused the PHP installation to segfault.
  • The PHP installation in the newest versions of the image did not gracefully handle exceptions.

Resolution

Getting more detailed information about what was causing the segfault proved to be difficult. The ubi8-minimal images do not allow the use of ulimit -c to allow the generation of core dump files. Adding verbosity to the composer commands did not provide any logging before the segfault occurred. What finally revealed the issue was the usage of php 7.4 instead of php 8.0. Instead of segfaulting, running composer output the following fatal error:

bash-4.4# composer --version
PHP Fatal error:  date_default_timezone_get(): Timezone database is corrupt - this should *never* happen! in phar:///usr/local/bin/composer.phar/src/Composer/Util/Silencer.php on line 67

Fatal error: date_default_timezone_get(): Timezone database is corrupt - this should *never* happen! in phar:///usr/local/bin/composer.phar/src/Composer/Util/Silencer.php on line 67

This led us to check the status of the timezone database which we confirmed was corrupt by verifying the existence of /usr/share/zoneinfo. The next question we had to answer was - "Why is the timezone database corrupt?". The answer is an optimization to save space by the ubi8 minimal image. The ubi8-minimal images purposefully remove timezone data in an effort to produce smaller images. The required tzdata package is installed, but the associated /usr/share/zoneinfo directory is recursively removed to save space and as a side effect cause other software that depends on this information to fail. After discovering this, a fix was put in place to reinstall the tzdata package which resulted in a successful image rebuild.

See gitlab-org/security-products/analyzers/gemnasium!431 (merged) for the fix implementation.

Follow-up tasks

  • Open up an issue inside the composer and php repositories so that an exception is always thrown
    • Opened an issue in the php repository.
Edited by Oscar Tovar