php · dunglas · Feb 5, 2026 · Feb 4, 2026 · Feb 4, 2026 · Feb 5, 2026
diff --git a/scripts/ci/compute-fingerprint.sh → ...ub/scripts/docker-compute-fingerprints.sh b/scripts/ci/compute-fingerprint.sh → ...ub/scripts/docker-compute-fingerprints.sh
@@ -2,19 +2,19 @@
 set -euo pipefail
 
 write_output() {
-  if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-    echo "$1" >> "${GITHUB_OUTPUT}"
-  else
-    echo "$1"
-  fi
+	if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+		echo "$1" >>"${GITHUB_OUTPUT}"
+	else
+		echo "$1"
+	fi
 }
 
 get_php_version() {
-  local version="$1"
-  skopeo inspect "docker://docker.io/library/php:${version}" \
-    --override-os linux \
-    --override-arch amd64 |
-    jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")'
+	local version="$1"
+	skopeo inspect "docker://docker.io/library/php:${version}" \
+		--override-os linux \
+		--override-arch amd64 |
+		jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")'
 }
 
 PHP_82_LATEST="$(get_php_version 8.2)"
@@ -30,55 +30,55 @@ write_output "php84_version=${PHP_84_LATEST//./-}"
 write_output "php85_version=${PHP_85_LATEST//./-}"
 
 if [[ "${GITHUB_EVENT_NAME:-}" == "schedule" ]]; then
-  FRANKENPHP_LATEST_TAG="$(gh release view --repo php/frankenphp --json tagName --jq '.tagName')"
-  git checkout "${FRANKENPHP_LATEST_TAG}"
+	FRANKENPHP_LATEST_TAG="$(gh release view --repo php/frankenphp --json tagName --jq '.tagName')"
+	git checkout "${FRANKENPHP_LATEST_TAG}"
 fi
 
 METADATA="$(PHP_VERSION="${PHP_VERSION}" docker buildx bake --print | jq -c)"
 
 BASE_IMAGES=()
 while IFS= read -r image; do
-  BASE_IMAGES+=("${image}")
+	BASE_IMAGES+=("${image}")
 done < <(jq -r '
-  .target[]?.contexts? | to_entries[]?
-  | select(.value | startswith("docker-image://"))
-  | .value
-  | sub("^docker-image://"; "")
-' <<< "${METADATA}" | sort -u)
+	.target[]?.contexts? | to_entries[]?
+	| select(.value | startswith("docker-image://"))
+	| .value
+	| sub("^docker-image://"; "")
+' <<<"${METADATA}" | sort -u)
 
 BASE_IMAGE_DIGESTS=()
 for image in "${BASE_IMAGES[@]}"; do
-  if [[ "${image}" == */* ]]; then
-    ref="docker://docker.io/${image}"
-  else
-    ref="docker://docker.io/library/${image}"
-  fi
-  digest="$(skopeo inspect "${ref}" \
-    --override-os linux \
-    --override-arch amd64 \
-    --format '{{.Digest}}')"
-  BASE_IMAGE_DIGESTS+=("${image}@${digest}")
+	if [[ "${image}" == */* ]]; then
+		ref="docker://docker.io/${image}"
+	else
+		ref="docker://docker.io/library/${image}"
+	fi
+	digest="$(skopeo inspect "${ref}" \
+		--override-os linux \
+		--override-arch amd64 \
+		--format '{{.Digest}}')"
+	BASE_IMAGE_DIGESTS+=("${image}@${digest}")
 done
 
 BASE_FINGERPRINT="$(printf '%s\n' "${BASE_IMAGE_DIGESTS[@]}" | sort | sha256sum | awk '{print $1}')"
 write_output "base_fingerprint=${BASE_FINGERPRINT}"
 
 if [[ "${GITHUB_EVENT_NAME:-}" != "schedule" ]]; then
-  write_output "skip=false"
-  exit 0
+	write_output "skip=false"
+	exit 0
 fi
 
 FRANKENPHP_LATEST_TAG_NO_PREFIX="${FRANKENPHP_LATEST_TAG#v}"
 EXISTING_FINGERPRINT=$(
-  skopeo inspect "docker://docker.io/dunglas/frankenphp:${FRANKENPHP_LATEST_TAG_NO_PREFIX}" \
-    --override-os linux \
-    --override-arch amd64 |
-    jq -r '.Labels["dev.frankenphp.base.fingerprint"] // empty'
+	skopeo inspect "docker://docker.io/dunglas/frankenphp:${FRANKENPHP_LATEST_TAG_NO_PREFIX}" \
+		--override-os linux \
+		--override-arch amd64 |
+		jq -r '.Labels["dev.frankenphp.base.fingerprint"] // empty'
 )
 
 if [[ -n "${EXISTING_FINGERPRINT}" ]] && [[ "${EXISTING_FINGERPRINT}" == "${BASE_FINGERPRINT}" ]]; then
-  write_output "skip=true"
-  exit 0
+	write_output "skip=true"
+	exit 0
 fi
 
 write_output "ref=${FRANKENPHP_LATEST_TAG}"

diff --git a/.github/scripts/docker-verify-fingerprints.sh b/.github/scripts/docker-verify-fingerprints.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PHP_VERSION="${PHP_VERSION:-}"
+GO_VERSION="${GO_VERSION:-}"
+USE_LATEST_PHP="${USE_LATEST_PHP:-0}"
+
+if [[ -z "${GO_VERSION}" ]]; then
+	GO_VERSION="$(awk -F'"' '/variable "GO_VERSION"/ {f=1} f && /default/ {print $2; exit}' docker-bake.hcl)"
+	GO_VERSION="${GO_VERSION:-1.25}"
+fi
+
+if [[ -z "${PHP_VERSION}" ]]; then
+	PHP_VERSION="$(awk -F'"' '/variable "PHP_VERSION"/ {f=1} f && /default/ {print $2; exit}' docker-bake.hcl)"
+	PHP_VERSION="${PHP_VERSION:-8.2,8.3,8.4,8.5}"
+fi
+
+if [[ "${USE_LATEST_PHP}" == "1" ]]; then
+	PHP_82_LATEST=$(skopeo inspect docker://docker.io/library/php:8.2 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
+	PHP_83_LATEST=$(skopeo inspect docker://docker.io/library/php:8.3 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
+	PHP_84_LATEST=$(skopeo inspect docker://docker.io/library/php:8.4 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
+	PHP_85_LATEST=$(skopeo inspect docker://docker.io/library/php:8.5 --override-os linux --override-arch amd64 | jq -r '.Env[] | select(test("^PHP_VERSION=")) | sub("^PHP_VERSION="; "")')
+	PHP_VERSION="${PHP_82_LATEST},${PHP_83_LATEST},${PHP_84_LATEST},${PHP_85_LATEST}"
+fi
+
+OS_LIST=()
+while IFS= read -r os; do
+	OS_LIST+=("${os}")
+done < <(
+	python3 - <<'PY'
+import re
+
+with open("docker-bake.hcl", "r", encoding="utf-8") as f:
+	data = f.read()
+
+# Find the first "os = [ ... ]" block and extract quoted values
+m = re.search(r'os\s*=\s*\[(.*?)\]', data, re.S)
+if not m:
+	raise SystemExit(1)
+
+vals = re.findall(r'"([^"]+)"', m.group(1))
+for v in vals:
+	print(v)
+PY
+)
+
+IFS=',' read -r -a PHP_VERSIONS <<<"${PHP_VERSION}"
+
+BASE_IMAGES=()
+for os in "${OS_LIST[@]}"; do
+	BASE_IMAGES+=("golang:${GO_VERSION}-${os}")
+	for pv in "${PHP_VERSIONS[@]}"; do
+		BASE_IMAGES+=("php:${pv}-zts-${os}")
+	done
+done
+
+mapfile -t BASE_IMAGES < <(printf '%s\n' "${BASE_IMAGES[@]}" | sort -u)
+
+BASE_IMAGE_DIGESTS=()
+for image in "${BASE_IMAGES[@]}"; do
+	if [[ "${image}" == */* ]]; then
+		ref="docker://docker.io/${image}"
+	else
+		ref="docker://docker.io/library/${image}"
+	fi
+	digest="$(skopeo inspect "${ref}" --override-os linux --override-arch amd64 --format '{{.Digest}}')"
+	BASE_IMAGE_DIGESTS+=("${image}@${digest}")
+done
+
+hash_cmd="sha256sum"
+if ! command -v "${hash_cmd}" >/dev/null 2>&1; then
+	hash_cmd="shasum -a 256"
+fi
+
+fingerprint="$(printf '%s\n' "${BASE_IMAGE_DIGESTS[@]}" | sort | ${hash_cmd} | awk '{print $1}')"
+
+echo "PHP_VERSION=${PHP_VERSION}"
+echo "GO_VERSION=${GO_VERSION}"
+echo "OS_LIST=${OS_LIST[*]}"
+echo "Base images:"
+printf '  %s\n' "${BASE_IMAGES[@]}"
+echo "Fingerprint: ${fingerprint}"
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -62,7 +62,7 @@ jobs:
         id: check
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./scripts/ci/compute-fingerprint.sh
+        run: ./.github/scripts/docker-compute-fingerprints.sh
       - name: Create variants matrix
         if: ${{ !fromJson(steps.check.outputs.skip) }}
         id: matrix

diff --git a/frankenphp.c b/frankenphp.c
@@ -226,13 +226,15 @@ static void frankenphp_snapshot_ini(void) {
   if (EG(modified_ini_directives) == NULL) {
     /* Allocate empty table to mark as snapshotted */
     ALLOC_HASHTABLE(worker_ini_snapshot);
-    zend_hash_init(worker_ini_snapshot, 0, NULL, frankenphp_ini_snapshot_dtor, 0);
+    zend_hash_init(worker_ini_snapshot, 0, NULL, frankenphp_ini_snapshot_dtor,
+                   0);
     return;
   }
 
   uint32_t num_modified = zend_hash_num_elements(EG(modified_ini_directives));
   ALLOC_HASHTABLE(worker_ini_snapshot);
-  zend_hash_init(worker_ini_snapshot, num_modified, NULL, frankenphp_ini_snapshot_dtor, 0);
+  zend_hash_init(worker_ini_snapshot, num_modified, NULL,
+                 frankenphp_ini_snapshot_dtor, 0);
 
   zend_ini_entry *ini_entry;
   ZEND_HASH_FOREACH_PTR(EG(modified_ini_directives), ini_entry) {

diff --git a/scripts/ci/verify_image_tags.sh b/scripts/ci/verify_image_tags.sh