[PurHur]

Summary

• JIT openssl_csr_export() / openssl_csr_export_to_file() still threw LogicException citing Stdlib: openssl_csr_new/sign/export/get_*() — CSR lifecycle API missing (ext/openssl/xp.c) #6421 while VM already exported via VmOpensslCsrNative::normalizeCsrPem.
• Thin-standalone AOT has no PHP FFI, so bake the PEM in the compiler process (same as openssl_x509_export / Stdlib: openssl_x509_export() JIT/AOT lowering missing — VM path only (ext/openssl/openssl.c) #32557). CSR PEM and no_text must be compile-time literals. No new runtime/*.c.

php-src: ext/openssl/xp.c PHP_FUNCTION(openssl_csr_export) / PHP_FUNCTION(openssl_csr_export_to_file) / PEM_write_bio_X509_REQ.

Closes #32697

Test plan

• ./script/aot-smoke.sh — 8 passed, 0 failed
• vendor/bin/phpunit --filter 'OpensslCsrExportAotTest|OpensslCsrExportToFileAotTest|OpensslX509RuntimeShrinkTest' — OK (8 tests, 44 assertions)
• AOT fixtures test/fixtures/aot/cases/openssl_csr_export.phpt and openssl_csr_export_to_file.phpt

Did not run ci-fast.sh, full AotTest, or north-star5-verify --strict. Capability matrix rows for these two builtins were patched by hand; a full capability-matrix.php run in this container omits optional extensions (curl/intl) that committed docs still list.

Made with Cursor