VulnMart WAS package 4.3.1 validation
Build date: 2026-08-04

Fix
- Replaced the invalid hash-prefixed PHP-FPM pool comment with an INI semicolon comment.
- Set opcache.validate_timestamps through explicit php_admin_value = 1 syntax.
- Added an installer guard against hash-prefixed FPM pool lines.
- Added repair_php_fpm.sh for a host where v4.3.0 stopped at php-fpm -t.
- Remi is not required; distribution PHP packages remain the supported path.

Retained design
- No Rocky release/version validation.
- No DBMS connectivity or HTTP test during WAS installation.
- Only db_host, db_user and db_pass are edited in /etc/vulnmart/database.php.
- No MariaDB server, Composer, Python application, Node.js or Docker on the WAS.
- No VulnMart-specific systemd service.
- No Nginx client-IP allow/deny restriction.

Checks
- Bash syntax: PASS
- PHP syntax: PASS
- FPM pool hash-comment absence: PASS
- FPM semicolon comment presence: PASS
- Explicit OPcache values: PASS
- Internal SHA-256 manifest: PASS

Limitation
- The build host is not a fresh Rocky Linux 9.7 VM; destructive dnf/systemd/SELinux activation was not run here.
