Installing NES for PHP

How to install NES for PHP on Debian, Ubuntu, RHEL, Amazon Linux 2 and Amazon Linux 2023

Supported Platforms

Platform	PHP 7.4	PHP 7.3	PHP 7.2	PHP 5.6
Debian 12	x86_64, aarch64	—	x86_64, aarch64	—
Debian 13	x86_64, aarch64	—	—	—
Ubuntu 16.04	—	—	—	x86_64
Ubuntu 22.04	x86_64, aarch64	—	x86_64, aarch64	x86_64
Ubuntu 24.04	x86_64, aarch64	—	x86_64, aarch64	—
Ubuntu 26.04	x86_64, aarch64	—	—	—
RHEL 6 (CentOS 6, Oracle Linux 6)	—	—	—	x86_64
RHEL 7 (CentOS 7, Oracle Linux 7)	—	—	—	x86_64
RHEL 8 (AlmaLinux 8, Rocky Linux 8)	x86_64, aarch64	—	x86_64, aarch64	—
RHEL 9 (AlmaLinux 9, Rocky Linux 9)	x86_64, aarch64	—	x86_64, aarch64	—
RHEL 10 (AlmaLinux 10, Rocky Linux 10)	x86_64, aarch64	—	—	—
Amazon Linux 2	x86_64, aarch64	—	x86_64, aarch64	—
Amazon Linux 2023	x86_64, aarch64	x86_64, aarch64	—	—
Windows Server (zip)	x64	—	x64	x64

The current releases, and what php -v shows once one is installed:

Component	PHP 7.4	PHP 7.3	PHP 7.2	PHP 5.6
NES release	`v7.4.33-nes-7.4.4`	`v7.3.33-nes-7.3.1`	`v7.2.34-nes-7.2.2`	`v5.6.40-nes-5.6.2`
PHP (`php -v`)	`7.4.33-nes`	`7.3.33-nes`	`7.2.34-nes`	`5.6.40-nes`
Debian and Ubuntu package names	`php7.4-*`	—	`php7.2-*`	`php5.6-*`
Debian and Ubuntu package version	`1:7.4.33+nes7.4.4-1~<distribution>`	—	`7.2.34+nes7.2.2-1~<distribution>`	`5.6.40+nes5.6.2-1~ubuntu<release>`
RHEL module stream	`php:nes-7.4`	—	`php:nes-7.2`	—
RHEL package version	`7.4.33-4.nes.el<RHEL version>`	—	`7.2.34-2.nes.el<RHEL version>`	`5.6.40-2.nes.el<RHEL version>`
Amazon Linux 2 package version	`7.4.33-4.nes.amzn2`	—	`7.2.34-2.nes.amzn2`	—
Amazon Linux 2023 package names	`php7.4-*`	`php7.3-*`	—	—
Amazon Linux 2023 package version	`7.4.33-4.nes.amzn2023`	`7.3.33-1.nes.amzn2023`	—	—
Container images	`7.4.33-nes-7.4.4-<variant>-<base>`	—	`7.2.34-nes-7.2.2-<variant>-<base>`	—
Windows zip	`php-v7.4.33-nes-7.4.4.windows.x64.ts.zip`	—	`php-v7.2.34-nes-7.2.2.windows.x64.ts.zip`	`php-v5.6.40-nes-5.6.2.windows.x64.ts.zip`

Windows Server (x64) is installed from a zip: see Windows.

Each version keeps its PHP's extension API. An extension built for the same PHP version with the same thread-safety keeps loading without a rebuild. php -i shows the build's API version and thread-safety in its Extension Build line (API<PHP API version>,NTS for the standard builds).

Component	PHP 7.4	PHP 7.3	PHP 7.2
PHP API version	20190902	20180731	20170718
Zend extension API version	320190902	320180731	320170718

Access

NES for PHP requires an access token for the NES registry. See Access for how to get one and where a release's files are.

Choose your PHP version

The steps below are the same for every PHP version. Two shell variables carry the difference: line, the PHP version you run, and tag, its current NES release (the table above has both). Set them once in the shell you install from:

line=7.4    # or 7.3, 7.2 or 5.6
case $line in
  7.4) tag=v7.4.33-nes-7.4.4 ;;
  7.3) tag=v7.3.33-nes-7.3.1 ;;
  7.2) tag=v7.2.34-nes-7.2.2 ;;
  5.6) tag=v5.6.40-nes-5.6.2 ;;
esac

Debian and Ubuntu

The packages keep the usual names (php<X.Y>-cli, php<X.Y>-fpm, libapache2-mod-php<X.Y> and the rest, with <X.Y> your PHP version, $line below), paths and configuration files, and replace the php<X.Y> packages a host already has.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your distribution:

Debian 12

Debian 13

Ubuntu 16.04

Ubuntu 22.04

Ubuntu 24.04

Ubuntu 26.04

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(dpkg --print-architecture)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.debian12.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

PHP 7

PHP 5.6

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

Add the repository, then upgrade the PHP packages the host has:

PHP 7

PHP 5.6

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.list /etc/apt/sources.list.d/nes-php.list
sudo apt update
sudo apt upgrade

On a host without PHP, install the packages you need instead, for example sudo apt install php$line-cli php$line-fpm php$line-mysql (on PHP 5.6, sudo apt-get install php5.6-cli php5.6-fpm php5.6-mysql).

PHP 7.4 on Debian 13 has no php7.4-imap. Remove it (sudo apt-get remove php7.4-imap) before you upgrade a host that has it.

Check the installation:

php -v

Configure

Each PHP SAPI reads its own php.ini in /etc/php/<X.Y>/cli/, /etc/php/<X.Y>/fpm/ or /etc/php/<X.Y>/apache2/. php-fpm is the php<X.Y>-fpm service and listens on /run/php/php<X.Y>-fpm.sock:

PHP 7

PHP 5.6

sudo systemctl enable --now php$line-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

PHP 7

PHP 5.6

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo apt update
sudo apt upgrade

Uninstall

Remove the NES packages, the ones whose version contains nes:

PHP 7

PHP 5.6

sudo apt purge $(dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' | awk '$1 ~ /^i/ && $3 ~ /[.+]nes[0-9]/ && $2 != "php-common" { print $2 }')
sudo rm /etc/apt/sources.list.d/nes-php.list
sudo rm -rf /opt/nes-php

To go back to the PHP packages you used before instead, keep their repository configured and install their versions with sudo apt install --allow-downgrades <package>=<version> (on PHP 5.6, sudo apt-get install --allow-downgrades <package>=<version>).

RHEL 8, 9 and 10, AlmaLinux and Rocky Linux

The packages are the php:nes-<X.Y> module stream (php:nes-$line below), with the usual package names (php-cli, php-fpm, php-mysqlnd and the rest), paths and configuration files.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your RHEL version:

RHEL 8

RHEL 9

RHEL 10

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el8.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

Add the repository:

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo

Then enable the php:nes-$line module stream. A host that has PHP from another stream switches to it; a host without PHP enables it and installs the packages you need:

Switch

New host

sudo dnf module switch-to php:nes-$line

php-sodium needs libsodium from EPEL. Remove packages the stream does not have before switching: while one is installed, the switch stops and changes nothing.

PHP 7.4 has no php-imap, php-pdo-dblib, php-pdo-firebird, php-tidy, php-litespeed or php-oci8, and on RHEL 8 no apcu-panel.
PHP 7.2 has no php-imap, php-interbase, php-pdo-dblib or php-tidy, and on RHEL 8 no php-recode.

PHP 7.2: the stream has no Argon2 password hashing, because the operating system has no libargon2, and its php-pecl-zip is the version PHP 7.2 ships. A host that moves from a third-party PHP 7.2 stream on RHEL 9 may lose both.

Check the installation:

php -v

On a ubi-minimal host, run microdnf reinstall tzdata after installing, or PHP's date functions fail with "Timezone database is corrupt".

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service and listens on /run/php-fpm/www.sock:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

Remove the NES packages, reset the module and remove the repository:

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo dnf module reset php
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to the distribution's PHP instead, enable the stream you want after the reset and install its packages (dnf module list php lists them), for example sudo dnf module switch-to php:<stream>.

PHP 7.2: RHEL 8 has a php:7.2 stream, RHEL 9 has none for PHP 7.2.

RHEL 6 and 7, CentOS and Oracle Linux

The PHP 5.6 packages are for RHEL 6 and RHEL 7, and also serve CentOS 6, Oracle Linux 6, CentOS 7 and Oracle Linux 7. They have the standard names (php, php-cli, php-fpm, php-mysqlnd and the rest), paths and configuration files, and replace the PHP 5.6 packages a host already has.

Download and verify

In an empty directory, download the signing key, the checksums and the repository for your RHEL version:

RHEL 6

RHEL 7

base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.el6.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

The NES packages do not include php-oci8. If the host has it from its previous repository, remove it first (sudo yum remove php-oci8): while one is installed, yum update stops on its dependencies and changes nothing.

Add the repository, then upgrade the PHP packages the host has (tar needs xz: sudo yum install xz):

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum update 'php*'

On a host without PHP, install the packages you need instead, for example sudo yum install php-cli php-fpm php-mysqlnd.

The packages are signed with the release signing key's signing subkey. The rpm of RHEL 6 and 7 reads only a key's primary key, so the repository gives yum that subkey as a key of its own, RPM-GPG-KEY-php-nes-subkey. When yum asks to import it, check that its fingerprint is 3A4BDF48590EBCC891C2133CD75FFA42A9EAF7B9.

Check the installation:

php -v

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service. The Apache module is loaded by /etc/httpd/conf.d/php.conf; restart httpd after you install or upgrade.

RHEL 7

RHEL 6

sudo systemctl enable php-fpm
sudo systemctl start php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo yum clean metadata
sudo yum update 'php*'

Uninstall

Remove the NES packages and the repository:

sudo yum remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to the PHP 5.6 packages you used before, install them again from their repository.

Amazon Linux 2

The packages replace the php<X.Y> amazon-linux-extras topic's packages under the same names.

AWS ended standard support for Amazon Linux 2 on 2026-06-30. NES for PHP 7 patches PHP, not the operating system's own packages, such as OpenSSL or libcurl.

Download and verify

In an empty directory, download the signing key, the checksums and the repository:

Amazon Linux 2

# Published for PHP 7.4 and 7.2 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux2.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --with-fingerprint RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
ls | awk 'NR == FNR { have[$0]; next } $2 in have' - SHASUMS256.txt | sha256sum -c -

Install

sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum update

On a host without PHP, install the packages you need instead, for example sudo yum install php-cli php-fpm php-mysqlnd.

Remove apcu-panel first (sudo yum remove apcu-panel) if it is installed. The steps are for a host without PHP or with the php<X.Y> topic of your PHP version; do not use them on a host with a PHP 8 topic.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo yum clean metadata
sudo yum update

Uninstall

Return to the php<X.Y> topic's packages and remove the repository:

sudo yum --disablerepo=nes-php distro-sync 'php*'
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

Amazon Linux 2023

The packages follow Amazon Linux's names for a PHP version: php<X.Y>, php<X.Y>-cli, php<X.Y>-fpm and the rest. One PHP version is installed at a time.

Download and verify

In an empty directory, download the signing key, the checksums and the repository:

Amazon Linux 2023

# Published for PHP 7.4 and 7.3 only
base=https://registry.nes.herodevs.com/bin/nes/php/$tag
auth="<your-contact-email>:<your-nes-access-token>"
arch=$(uname -m)
for f in RPM-GPG-KEY-php-nes SHASUMS256.txt SHASUMS256.txt.asc "php-$tag.amazonlinux2023.$arch.repo.tar.xz"; do
  curl -fSLO -u "$auth" "$base/$f"
done

Then verify the downloads:

gpg --show-keys RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-php-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install

Bring the host to the latest Amazon Linux 2023 release, add the repository, then install the packages you need:

sudo dnf upgrade --releasever=latest
sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf install php$line-cli php$line-fpm php$line-mysqlnd

On a host with Amazon Linux's PHP 8, add --allowerasing and name the php$line package for each PHP 8 package you have (for example php$line-cli for php8.4-cli): dnf then replaces PHP 8.

Configure

PHP reads /etc/php.ini and /etc/php.d/. php-fpm is the php-fpm service:

sudo systemctl enable --now php-fpm

Upgrade

Set tag to the new release, download and verify its repository as above, then:

sudo rm -rf /opt/nes-php && sudo mkdir -p /opt/nes-php
sudo tar -xJf php-$tag.*.repo.tar.xz -C /opt/nes-php --strip-components=1
sudo cp /opt/nes-php/nes-php.repo /etc/yum.repos.d/nes-php.repo
sudo dnf upgrade --refresh

Uninstall

sudo dnf remove $(rpm -qa --qf '%{NAME} %{RELEASE}\n' | awk '$2 ~ /\.nes\./ { print $1 }')
sudo rm /etc/yum.repos.d/nes-php.repo
sudo rm -rf /opt/nes-php

To go back to Amazon Linux's PHP 8 instead, install its packages with --allowerasing, for example sudo dnf install --allowerasing php8.4-cli php8.4-fpm.

Verify Downloads

To verify the signing key, the checksum file and the downloaded files, see Verify Downloads.