Let OpenSslCipherMethodsProvider contribute its own result cache meta

The provider builds its list of supported ciphers by asking openssl_get_cipher_methods() and then probing every algorithm with openssl_cipher_iv_length(), and the inferred type follows it: openssl_cipher_iv_length() is int for a supported algorithm and false for an unsupported one. That list is a property of the PHP build rather than of the PHP version, so two hosts on the same PHP_VERSION_ID disagree. Measured across CI runners and docker images: PHP 8.4.25, ubuntu-latest, OpenSSL 3.0.13 -> 212 ciphers PHP 8.4.25, macos-latest, OpenSSL 3.6.3 -> 208 ciphers The four missing on macOS are aes-128-cbc-hmac-sha1, aes-128-cbc-hmac-sha256, aes-256-cbc-hmac-sha1 and aes-256-cbc-hmac-sha256, so openssl_cipher_iv_length() for one of them is int on the first and false on the second. phpExtensions records extension names only, so the metadata is identical and the cache is reused across the difference. Implementing ResultCacheMetaExtension on the provider puts the fingerprint where the knowledge already lives, and it costs nothing for projects that never touch openssl, since the list is only computed when something asks for it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
staabm · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026 · c5bb9e41ed50acc1a4e5d3ab1d56682520f3d9f5
commit c5bb9e41ed50acc1a4e5d3ab1d56682520f3d9f5
diff --git a/src/Type/Php/OpenSslCipherMethodsProvider.php b/src/Type/Php/OpenSslCipherMethodsProvider.php
@@ -2,22 +2,34 @@
 
 namespace PHPStan\Type\Php;
 
+use PHPStan\Analyser\ResultCache\ResultCacheMetaExtension;
 use PHPStan\DependencyInjection\AutowiredService;
 use function array_filter;
 use function array_map;
 use function array_values;
 use function function_exists;
+use function implode;
 use function in_array;
 use function openssl_cipher_iv_length;
 use function openssl_get_cipher_methods;
+use function sha1;
+use function sort;
 use function strtolower;
 
 #[AutowiredService]
-final class OpenSslCipherMethodsProvider
+final class OpenSslCipherMethodsProvider implements ResultCacheMetaExtension
 {
 
-	/** @var list<string>|null */
-	private ?array $supportedCipherMethods = null;
+	/**
+	 * @param list<string>|null $supportedCipherMethods Overridable so tests do not depend on the
+	 *                                                  OpenSSL the suite happens to run against;
+	 *                                                  null means read it from the runtime.
+	 */
+	public function __construct(
+		private ?array $supportedCipherMethods = null,
+	)
+	{
+	}
 
 	/**
 	 * Returns supported cipher methods in lowercase.
@@ -27,7 +39,7 @@ final class OpenSslCipherMethodsProvider
 	 *
 	 * @return list<string>
 	 */
-	public function getSupportedCipherMethods(): array
+	private function getSupportedCipherMethods(): array
 	{
 		if ($this->supportedCipherMethods !== null) {
 			return $this->supportedCipherMethods;
@@ -54,4 +66,23 @@ public function isSupportedCipherMethod(string $method): bool
 		return in_array(strtolower($method), $this->getSupportedCipherMethods(), true);
 	}
 
+	public function getKey(): string
+	{
+		return 'openSslCipherMethods';
+	}
+
+	/**
+	 * The supported ciphers are read out of the runtime, and the inferred type of
+	 * openssl_cipher_iv_length() and friends follows them, so a host offering a different set has to
+	 * invalidate the cache. The set is a property of the PHP build rather than of the PHP version:
+	 * PHP 8.4.25 reports 212 methods on ubuntu-latest and 208 on macos-latest.
+	 */
+	public function getHash(): string
+	{
+		$methods = $this->getSupportedCipherMethods();
+		sort($methods);
+
+		return sha1(implode(',', $methods));
+	}
+
 }
diff --git a/tests/PHPStan/Type/Php/OpenSslCipherMethodsProviderTest.php b/tests/PHPStan/Type/Php/OpenSslCipherMethodsProviderTest.php
@@ -0,0 +1,39 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Type\Php;
+
+use PHPStan\Testing\PHPStanTestCase;
+
+class OpenSslCipherMethodsProviderTest extends PHPStanTestCase
+{
+
+	public function testHashFollowsTheSupportedCiphers(): void
+	{
+		$one = $this->createProvider(['aes-128-cbc', 'aes-256-cbc'])->getHash();
+		$fewer = $this->createProvider(['aes-128-cbc'])->getHash();
+
+		$this->assertNotSame(
+			$one,
+			$fewer,
+			'A host offering a different set of ciphers must not reuse the cache: openssl_cipher_iv_length() is int for a supported algorithm and false for an unsupported one.',
+		);
+	}
+
+	public function testHashIgnoresTheOrderTheCiphersAreReportedIn(): void
+	{
+		$this->assertSame(
+			$this->createProvider(['aes-128-cbc', 'aes-256-cbc'])->getHash(),
+			$this->createProvider(['aes-256-cbc', 'aes-128-cbc'])->getHash(),
+			'Enumeration order is not analysis-relevant and must not invalidate the cache.',
+		);
+	}
+
+	/**
+	 * @param list<string> $supportedCipherMethods
+	 */
+	private function createProvider(array $supportedCipherMethods): OpenSslCipherMethodsProvider
+	{
+		return new OpenSslCipherMethodsProvider($supportedCipherMethods);
+	}
+
+}