[Bug]: Windows Smart App Control blocks Herd PHP 8.4/8.5 unsigned DLLs

已关闭
  • 哪里不对？
#1,757 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
30/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
php
领域
operating-systems, security

调研方向

Start by reproducing the failure with Smart App Control enabled and inspect Windows Event Viewer’s CodeIntegrity Operational log, especially Event ID 3077. Check the Herd PHP executable and extension DLLs under .config\herd\bin\php84 and the corresponding PHP 8.5 path; done means the reported extensions load without requiring Smart App Control to be disabled.

由索引模型根据 Issue 内容生成。

描述

windows
Platform

Windows

Operating system version

Windows 11 25H2

System architecture

Windows

Herd Version

1.30.0

PHP Version

No response

Bug description

When Windows 11 Smart App Control is enabled, PHP installed through Laravel Herd fails to load its extensions because Windows Code Integrity blocks the PHP DLLs.

This affects both PHP 8.4 and PHP 8.5, so it does not appear to be specific to PHP 8.5.

Environment
Windows 11 25H2
Laravel Herd for Windows
PHP 8.4 and PHP 8.5
Smart App Control: Enabled
Symptoms

Running PHP produces errors such as:

PHP Warning: PHP Startup: Unable to load dynamic library 'gd'
(tried: ext\gd (The specified module could not be found),
ext\php_gd.dll (An Application Control policy has blocked this file))

The same occurs with multiple extensions, including:

php_bz2.dll
php_fileinfo.dll
php_gd.dll
php_intl.dll
php_mbstring.dll
php_mysqli.dll
php_openssl.dll
php_pgsql.dll
php_soap.dll
php_sockets.dll

The PHP executable itself starts successfully and reports the expected PHP version.

Disabling Windows Smart App Control immediately resolves the problem.

Code Integrity evidence

Windows Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational reports Event ID 3077.

For example:

Code Integrity determined that a process
(\Device\HarddiskVolume3\Users...\ .config\herd\bin\php84\php-cgi.exe)
attempted to load
\Device\HarddiskVolume3\Users...\ .config\herd\bin\php84\ext\php_gmp.dll
that did not meet the Enterprise signing level requirements
or violated code integrity policy
(Policy ID:{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}).

The same policy blocks multiple other PHP extensions, including php_mbstring.dll, php_fileinfo.dll, php_ffi.dll, php_opcache.dll, php_zip.dll, php_sqlite3.dll, php_sodium.dll, php_soap.dll, and php_pgsql.dll.

The Herd PHP executable and extension DLLs are not Authenticode-signed.

Expected behavior

Herd's PHP installation should work with Windows Smart App Control enabled, without requiring users to disable a Windows security feature.

Additional information

The issue also occurs with PHP 8.4, not only PHP 8.5. This suggests that the problem may be related to the signing/reputation of Herd's PHP binaries and extensions rather than a PHP 8.5-specific issue.

Disabling Smart App Control allows PHP and all of the extensions to load normally.

Could you please investigate whether Herd's Windows PHP binaries/extensions can be signed or otherwise made compatible with Windows Smart App Control?

主要语言
没有语言数据
星标
125
派生
1
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

beyondcode/herd-community 的其他 Issue

查看 beyondcode/herd-community 的全部 Issue

相似的 Issue

更多 Operating Systems Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。