why do you need to update a whole operating system to get updated php version? (debian)

Question

I am mostly a windows guy. I have a debian 9 VM with OMV and wanted to update the php version. I read and realised that you need to update the whole os to get the latest php version? Why do you need to update a whole OS just to get the latest php version; I assume this is true for other software too?.

Answer 1

Why?

This is well explained in the official documentation on Choosing a Debian distribution. Debian has chosen to value stability over new features. That's why some of its software is quite old. I'd recommend also reading Advice For New Users On Not Breaking Their Debian System, especially:

Don't suffer from Shiny New Stuff Syndrome

The reason that Debian Stable is so reliable is because software is extensively tested and bug-fixed before being included. This means that the most recent version of software is often not available in the Stable repositories. But it doesn't mean that the software is too old to be useful!

Don't blindly follow bad advice

Unfortunately there's a lot of bad advice on the Internet. Tutorials found on blogs, forums and other sites often include instructions that will break your system in subtle ways. Don't simply follow the first advice you find, or the tutorial that seems the easiest. Spend some time reading the documentation and compare the difference between tutorials.

It's better to take the time to figure out the correct way to do something first than spending even more time fixing a broken system later.

You don't need to upgrade whole Debian...

Once you have acknowledged the warnings from the previous section, it actually is possible to upgrade PHP without upgrading whole Debian. The most Debian way of doing this without using the official repositories is probably adding DEB.SURY.ORG's Debian DPA repository to your APT sources.

The tutorial on Ryan Erwin's answer seems quite reasonable, but keep in mind (from the same DontBreakDebian article) that...

Blog and forum posts don't expire. Instructions that might have been safe a couple of years ago might not be safe to follow any more. When in doubt keep researching and read your version's documentation.

This is true for any answer on a Q/A site, too. What's written here may work differently with future releases.

Answer 2

I read and realized that you need to update the whole os to get the latest php version?

Updating the whole OS is one option, and it's a good one. Debian 10 is now stable, and will bring lots of enhancements and security updates to your entire system.

Why do you need to update a whole OS just to get the latest php version; I assume this is true for other software too?

What is a Linux Distribution to begin with? What has to change for it to be a new version? Perhaps you've read of the Ship of Theseus... If you replace every part a piece at a time, is the original thing now a new thing? :-)

So when you upgrade you Debian 9 to Debian 10, you're not upgrading only PHP, you're upgrading everything that's tested with the system... However, even then you won't have the latest version of many programs because new versions of something come out everyday. If you upgrade to Debian 10, you'll just get a relatively new version of PHP (and everything else).

So if you really want to get the very latest version of PHP, you need to build it yourself from source, or find a place that's already done that, preferably a place that will keep the binary updated so that you can automatically grab the security updates.

Here's a good guide to building PHP on Debian 9, based on the DEB.SURY.ORG packages:

Install PHP 7.4 on Debian 10 / Debian 9

Follow the steps covered below to install PHP 7.4 on Debian 10 & Debian 9 Linux distribution. The latest builds of PHP for Debian are available on SURY PHP PPA repository. We’ll add the repository as prerequisite then install PHP 7.4 on Debian 10 / Debian 9 from it.

Step 1: Update system

Ensure your system is updated:

sudo apt update
sudo apt upgrade -y && sudo reboot

Step 2: Add SURY PHP PPA repository

Download and store PPA repository in a file on your Debian Server/Desktop. But first, download GPG key.

sudo apt -y install lsb-release apt-transport-https ca-certificates 
sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg

Then add repository.

echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list

Step 3: Install PHP 7.4 on Debian 10 / Debian 9

The last step is to Install PHP 7.4 on Debian 10 / Debian 9. Before installation, update system package list on added repositories.

sudo apt update

Then install PHP 7.4 on Debian 10 / Debian 9:

sudo apt -y install php7.4

Answer yes when prompted to complete installation of PHP 7.4 on Debian 10 / Debian 9 Linux system.

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  apache2 apache2-bin apache2-data apache2-utils libapache2-mod-php7.4 libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libbrotli1
  libcurl4 libgdbm-compat4 libgdbm6 libjansson4 libldap-2.4-2 libldap-common liblua5.2-0 libnghttp2-14 libpcre2-8-0 libperl5.28 librtmp1
  libsasl2-2 libsasl2-modules libsasl2-modules-db libsodium23 libssh2-1 perl perl-modules-5.28 php-common php7.4-cli php7.4-common php7.4-json
  php7.4-opcache php7.4-readline psmisc ssl-cert
Suggested packages:
  apache2-doc apache2-suexec-pristine | apache2-suexec-custom www-browser php-pear libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
  libsasl2-modules-ldap libsasl2-modules-otp libsasl2-modules-sql perl-doc libterm-readline-gnu-perl | libterm-readline-perl-perl make
  libb-debug-perl liblocale-codes-perl openssl-blacklist
The following NEW packages will be installed:
  apache2 apache2-bin apache2-data apache2-utils libapache2-mod-php7.4 libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libbrotli1
  libcurl4 libgdbm-compat4 libgdbm6 libjansson4 libldap-2.4-2 libldap-common liblua5.2-0 libnghttp2-14 libperl5.28 librtmp1 libsasl2-2
  libsasl2-modules libsasl2-modules-db libsodium23 libssh2-1 perl perl-modules-5.28 php-common php7.4 php7.4-cli php7.4-common php7.4-json
  php7.4-opcache php7.4-readline psmisc ssl-cert
The following packages will be upgraded:
  libpcre2-8-0
1 upgraded, 36 newly installed, 0 to remove and 7 not upgraded.
Need to get 15.0 MB of archives.
After this operation, 76.9 MB of additional disk space will be used.
Do you want to continue? [Y/n] y

Use the next command to install additional packages:

sudo apt-get install php7.4-xxx

Example:

sudo apt-get install php7.4-{bcmath,bz2,intl,gd,mbstring,mysql,zip}

PHP configurations related to Apache is stored in /etc/php/7.4/apache2/php.ini

Using PHP with Nginx:

The installation of php on Debian configures Apache. For users interested in running Nginx and PHP, you need to stop and disable Apache service.

sudo systemctl disable --now apache2

Then install fpm extension and nginx packages.

sudo apt-get install nginx php7.4-fpm

PHP FPM configuration files are located in the directory: /etc/php/7.4/fpm/

The nginx and php-fpm services should be running.

$ systemctl status php7.4-fpm nginx
● php7.4-fpm.service - The PHP 7.4 FastCGI Process Manager
   Loaded: loaded (/lib/systemd/system/php7.4-fpm.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2019-09-19 17:32:26 UTC; 14s ago
     Docs: man:php-fpm7.4(8)
 Main PID: 12151 (php-fpm7.4)
   Status: "Processes active: 0, idle: 2, Requests: 0, slow: 0, Traffic: 0req/sec"
    Tasks: 3 (limit: 2377)
   Memory: 14.7M
   CGroup: /system.slice/php7.4-fpm.service
           ├─12151 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
           ├─12152 php-fpm: pool www
           └─12153 php-fpm: pool www

Sep 19 17:32:26 deb10 systemd[1]: Starting The PHP 7.4 FastCGI Process Manager...
Sep 19 17:32:26 deb10 systemd[1]: Started The PHP 7.4 FastCGI Process Manager.

● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2019-09-19 17:32:27 UTC; 12s ago
     Docs: man:nginx(8)
 Main PID: 12362 (nginx)
    Tasks: 2 (limit: 2377)
   Memory: 3.2M
   CGroup: /system.slice/nginx.service
           ├─12362 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
           └─12363 nginx: worker process

Sep 19 17:32:27 deb10 systemd[1]: Starting A high performance web server and a reverse proxy server...
Sep 19 17:32:27 deb10 systemd[1]: nginx.service: Failed to parse PID from file /run/nginx.pid: Invalid argument
Sep 19 17:32:27 deb10 systemd[1]: Started A high performance web server and a reverse proxy server.

Enjoy your websites and Web Applications development with PHP 7.4 on Debian 9 Linux system

Answer 3

Packages in a particular OS version (stretch, buster) stay at a particular version for the life of the OS version. Security updates will typically be backported, even after the upstream maintainers have stopped supporting a PHP version to ensure still supported versions of Debian aren't security nightmares.

This ensures that you can deploy a site with a version of PHP and even if features or functions are deprecated and removed in later versions, your site stays up and working. It is only when you decide to jump to a new version of the OS that you risk breaking your site because of features removed from your platform stack.

That said, you don't have to upgrade everything. You can install a few packages from the next release or even the pre-release "testing" repository or the not-ready-for-production "unstable" repository. (Pro tip: test them in a staging environment before you install in prod. I wish I didn't have to say that out loud.)

There is an excellent ServerFault answer explaining how to do this:

How can I run Debian stable but install some packages from testing?

If you're wondering what versions of a particular package are available for any OS release or pre-release, mosy over to https://packages.debian.org/ or https://packages.ubuntu.com/.