Regression: openssl_pkey_derive Reflection arity 0 — Zend public_key/private_key/key_length→string|false; named args rejected (ext/openssl/openssl.stub.php)

[PurHur]

Category

bug · php-src-strict · Reflection / openssl

Problem

openssl_pkey_derive is callable positionally and matches Zend ECDH output length, but Reflection advertises arity 0 / no return type, so named arguments are rejected.

Repro	Zend 8.2.32	VM (2026-08-05 @ b0b02b0ba)
ReflectionFunction arity / return	3 / string|false ($public_key, $private_key, ?int $key_length)	0 / none
openssl_pkey_derive($pub, $priv) (EC P-256)	ok:32	ok:32
openssl_pkey_derive(public_key: $pub, private_key: $priv)	ok:32	Error: Unknown named parameter $public_key

php-src reference

• php/php-src ext/openssl/openssl.stub.php — openssl_pkey_derive
• php/php-src ext/openssl/openssl.c — PHP_FUNCTION(openssl_pkey_derive)

PHP implementation target

• ext/openssl/ stubs + Reflection metadata for param names/string|false return
• Keep positional ECDH path; enable named args via real arity — no new runtime/*.c logic

Repro

./script/docker-exec.sh -- bash -lc 'cat > /tmp/derive_refl.php <<'"'"'PHP'"'"'
<?php
$r = new ReflectionFunction("openssl_pkey_derive");
echo "arity=", $r->getNumberOfParameters(), " ret=", $r->hasReturnType() ? (string)$r->getReturnType() : "none", "\n";
foreach ($r->getParameters() as $p) {
  echo "p=$", $p->getName(), "\n";
}
$a = openssl_pkey_new(["curve_name" => "prime256v1", "private_key_type" => OPENSSL_KEYTYPE_EC]);
$b = openssl_pkey_new(["curve_name" => "prime256v1", "private_key_type" => OPENSSL_KEYTYPE_EC]);
$pub = openssl_pkey_get_public(openssl_pkey_get_details($b)["key"]);
$s = openssl_pkey_derive($pub, $a);
echo "pos=", is_string($s) ? ("ok:".strlen($s)) : var_export($s, true), "\n";
try {
  $s2 = openssl_pkey_derive(public_key: $pub, private_key: $a);
  echo "named=", is_string($s2) ? ("ok:".strlen($s2)) : var_export($s2, true), "\n";
} catch (Throwable $e) {
  echo "named=", get_class($e), ":", $e->getMessage(), "\n";
}
PHP
php bin/vm.php /tmp/derive_refl.php
php /tmp/derive_refl.php'

Done when

• Reflection arity/params/return match Zend stub (string|false, optional key_length)
• Named public_key / private_key / key_length accepted and match positional ECDH
• Compliance / unit guard; php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler Ext — I/O & Crypto — starting this run

Gate snapshot (mandatory, 2026-08-05):

• bootstrap-inventory --check: OK 7056/7056
• release-readiness --json: user_release_ready: no
• First fail: north-star5-fast — gen-0 manifest/driver mismatch (Self-host M5: bootstrap-inventory argv driver size floor — grow beyond 451KB stub #8713); gen-0 seed stale (4 lowering commits since 7edd0b4a6)
• vm-driver-probe / inventory / spine: ok
• Not fixing gen-0 this run (bootstrap ownership); proceeding with P0 openssl Reflection Regression: openssl_pkey_derive Reflection arity 0 — Zend public_key/private_key/key_length→string|false; named args rejected (ext/openssl/openssl.stub.php) #27852

[PurHur]

Already fixed on master — duplicate of #27685 (merged via #27846 earlier today).

Re-verified 2026-08-05 (this run):

./script/docker-exec.sh -- bash -lc 'php bin/vm.php /tmp/derive_refl.php'

VM matches Zend: arity=3 ret=string|false, params public_key/private_key/key_length:int, positional + named ECDH ok:32.

Compliance case test/compliance/cases/openssl/openssl_pkey_derive_reflection.phpt present. Closing as done.