{"action":"created","issue":{"url":"https://api.github.com/repos/composer/getcomposer.org/issues/77","labels_url":"https://api.github.com/repos/composer/getcomposer.org/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/composer/getcomposer.org/issues/77/comments","events_url":"https://api.github.com/repos/composer/getcomposer.org/issues/77/events","html_url":"https://github.com/composer/getcomposer.org/issues/77","id":47055239,"number":77,"title":"Installer needs to verify the Phar","user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-10-28T17:24:22Z","updated_at":"2015-03-01T01:06:37Z","closed_at":null,"body":"Blocked by #76 and a separate issue entirely.\r\n\r\nThis can be accomplished with `openssl_verify()` and a pinned (read: hard-coded) RSA public key. Assuming the installer's signature was successfully verified with PGP, we can trust the pinned public key to be valid and therefore transitively assure the security of the `.phar`"},"comment":{"url":"https://api.github.com/repos/composer/getcomposer.org/issues/comments/76562063","html_url":"https://github.com/composer/getcomposer.org/issues/77#issuecomment-76562063","issue_url":"https://api.github.com/repos/composer/getcomposer.org/issues/77","id":76562063,"user":{"login":"padraic","id":19780,"avatar_url":"https://avatars.githubusercontent.com/u/19780?v=3","gravatar_id":"","url":"https://api.github.com/users/padraic","html_url":"https://github.com/padraic","followers_url":"https://api.github.com/users/padraic/followers","following_url":"https://api.github.com/users/padraic/following{/other_user}","gists_url":"https://api.github.com/users/padraic/gists{/gist_id}","starred_url":"https://api.github.com/users/padraic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/padraic/subscriptions","organizations_url":"https://api.github.com/users/padraic/orgs","repos_url":"https://api.github.com/users/padraic/repos","events_url":"https://api.github.com/users/padraic/events{/privacy}","received_events_url":"https://api.github.com/users/padraic/received_events","type":"User","site_admin":false},"created_at":"2015-03-01T01:06:37Z","updated_at":"2015-03-01T01:06:37Z","body":"Basic approach:\r\n\r\n0. Implement TLS verification for Composer.\r\n1. Create signature for installer (GPG).\r\n2. User verifies signature of installer (it's optional - they may not do it).\r\n3. User runs installer.\r\n4. Download composer.phar (openssl signed).\r\n5. Download composer.phar.pubkey (public key).\r\n6. Use pubkey to verify all self-updates.\r\n7. Examine if instructions can make the installer optional.\r\n\r\nI've written most of the pieces, inspired in part from Composer's self-update and borrowing liberally from all the work we previously did on the TLS support for the installer:\r\nhttps://github.com/padraic/phar-updater\r\nhttps://github.com/padraic/file_get_contents\r\n\r\nThese push all the changes to Composer into two dependencies and out of the core code which should be significantly simpler. Currently wrapping these two up for Humbug self updates. They can alternatively be ported into Composer, but...the duplication of effort on my part is preferably avoidable.\r\n\r\nNote: The very first requests are not verifiable, i.e. you cannot verify that the GPG and openssl public keys are themselves valid. This is basically the first-encounter approach that ssh uses. You get these once, accept them, keep them permanently, and reuse them constantly, and never accept updates to them without a really really good reason."}}