PHP repositories

Fixed versions

The exact package that each release receives, read from the signed repository metadata. "Rebuild" = built by Clouding.io from Surý's or Remi's sources; "unchanged" = their own package, mirrored as is.

Generated from the repository metadata on Oct 24, 2026.

Verify before you install

You are about to trust a new signing key and run a script as root. Check the key first: every repository index and every RPM package is signed with it.

1. Download the APT key and check its SHA-256:

   curl -fsSLO https://php-repos.clouding.io/php-repos.clouding.io.gpg
   sha256sum php-repos.clouding.io.gpg

   Expected SHA-256: 413049d7c25964872da303370f493faf9bb59053144e65ead21556a5e76fbd47

2. Check the key's fingerprint:

   gpg --show-keys --with-fingerprint php-repos.clouding.io.gpg

   Expected fingerprint: 2E0F FA98 94EC DFB9 AEB4 5942 7132 DE39 9FE3 B85A

3. Check that a repository index is signed by that key (use your release instead of noble):

   curl -fsSLO https://php-repos.clouding.io/ubuntu/dists/noble/InRelease
   gpgv --keyring ./php-repos.clouding.io.gpg InRelease

4. On RPM systems the same key is published in RPM format:

   curl -fsSLO https://php-repos.clouding.io/el/RPM-GPG-KEY-php-repos-clouding
   sha256sum RPM-GPG-KEY-php-repos-clouding
   gpg --show-keys --with-fingerprint RPM-GPG-KEY-php-repos-clouding

   Expected SHA-256: 98c17d90eb12f79a4771a5b2d065b7899d682cecf860a5e5b7ea15dff61057c8

5. RPM packages are individually signed (check one with rpm -K). APT packages are verified through the signed index, which lists the SHA-256 of every package; apt checks it on every download. dnf/yum check both (gpgcheck=1, repo_gpgcheck=1):

   dnf download php84-php-cli && rpm -K php84-php-cli-*.rpm
   apt-get download php8.4-cli && sha256sum php8.4-cli_*.deb   # = the SHA256 listed for it in the signed index

The upgrade script is shown in full above: read it before running it. It only upgrades PHP packages that are already installed, simulates first and stops on any removal or downgrade.

Sources and build changes

Source packages are published next to the binaries for everything Clouding.io builds.

Debian / Ubuntu

deb-src [signed-by=/usr/share/keyrings/php-repos.clouding.io.gpg] https://php-repos.clouding.io/ubuntu <release> php8.4 deps
apt-get source php8.4

Enterprise Linux / Fedora

https://php-repos.clouding.io/el/<release>/SRPMS/
rpm -q --changelog php74-php-cli

Packages mirrored unchanged from Ondřej Surý and Remi Collet are not duplicated here: their sources remain in their own repositories.

• launchpad.net/~ondrej/+archive/ubuntu/php · packages.sury.org/php
• rpms.remirepo.net/SRPMS

What Clouding.io changes

• A version suffix (+cldnN / .cldnN) and a changelog entry on every package it builds.
• Enterprise Linux PHP 5.6–7.3: Ondřej Surý's php2shell backport ("Avoid state corruption via bailout") added as a patch to Remi Collet's packaging.
• Enterprise Linux 9/10 PHP 5.6–7.3: Ondřej Surý's "minimal OpenSSL 3.0" patch, taken from his Ubuntu 24.04 builds.
• Older releases: build-environment adaptations only (newer compilers, dependency libraries rebuilt from Remi's, Surý's or the distribution's own sources, private copies of libraries under /opt/remi on EL7). Each one is named in the package changelog.
• No other source changes.

Every change is recorded in the package changelog: rpm -q --changelog php74-php-cli, or zcat /usr/share/doc/php7.4-cli/changelog.Debian.gz.

Files

About this repository

This repository is run by Clouding.io. It is not affiliated with, and not endorsed by, Ondřej Surý or Remi Collet.

Where they still publish fixed packages for your system, you can use their repositories directly (the packages offered here for those systems are exactly theirs):

• Ubuntu 22.04 / 24.04 and Debian 11–13: Ondřej Surý, deb.sury.org
• Enterprise Linux 8–10 (PHP 7.4 and newer) and Fedora: Remi Collet, rpms.remirepo.net

Owner

Cloudi NextGen S.L. (Clouding.io), Barcelona

Security contact

soporte@clouding.io

Maintenance

Unsupported. Clouding.io updates these packages only when a new major security issue affects them; there is no SLA.