Not that I disagree, but it works for me on a 5.5.15 built on Ubuntu 12.04 on Aug 5th:

PHP Version => 5.5.15

Configure Command =>  './configure'  '--prefix=/usr/local/stow/php-5.5.15' '--with-config-file-path=/etc/php5/5.5.15' '--enable-fpm' '--with-fpm-user=www-data' '--with-fpm-group=www-data' '--with-gd' '--enable-zip' '--with-mysqli=mysqlnd' '--with-pdo-mysql=mysqlnd' '--with-mysql=mysqlnd' '--enable-mbstring' '--with-curl' '--with-freetype-dir=/usr/include/freetype2' '--enable-gd-native-ttf'

Hashing Engines => md2 md4 md5 sha1 sha224 sha256 sha384 sha512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost adler32 crc32 crc32b fnv132 fnv164 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5

$ /usr/local/stow/php-5.5.15/bin/php -r 'echo CRYPT_SHA256.PHP_EOL;'
1
$ /usr/local/stow/php-5.5.15/bin/php -r 'echo CRYPT_SHA512.PHP_EOL;'
1

This happens because of this check found in /ext/standard/config.m4:

dnl
dnl If one of them is missing, use our own implementation, portable code is then possible
dnl
if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || test "$ac_cv_crypt_ext_des" = "no" || test "x$php_crypt_r" = "x0"; then

   # enables bundled crypt_r/des/blowfish/ext_des/md5/sha256/sha512

else

   # hits the buggy codepath in question.
   # I assume the intention was to enable system provided hashing algos
   # but what actually happens is that they gets disabled.

fi


It is also interesting that the above test does not test for sha256/512 at all.

So currently what happens:

On systems that lacks one of blowfish/crypt_r/des/ext_des, php will use the bundled hashing algos for everything. I believe this happens on most systems and I believe this is why CRYPT_512 is 1 on centos/ubuntu/archlinux and openbsd (the systems I have checked)

On systems that supports all of blowfish/crypt_r/des/ext_des, but lacks sha256/sha512, php will not use bundled hashing algos for anything, but instead disable sha256/sha512.

On systems that supports all of blowfish/crypt_r/des/ext_des, *and* sha256/512, php will not use bundled hashing algos for anything, and hit the buggy codepath in question (with the uppercase/lowercase typo that my patch fixes) and disable sha256/512. This is what happens with musl libc and Alpine Linux.

Now the question is, why not only use bundled algos for the things system lacks and use system crypt(3) for the alogos it supports?

If bundled algos are preferred, why not always use bundled?

Why is test for md5/sha256/sha512 excluded in the above test?

After studying the code i think it would be better to s/ac_cv_crypt_SHA/ac_cv_crypt_sha/g, eg. use the lowecase variant instead of my proposed patch. This seems to be more consistent with the other algos which are all in lowecase.

this bug affects sabotage linux as well.

$ php -r 'echo CRYPT_SHA256.PHP_EOL;'
0