Skip to content

Commit

Permalink
Removed PHAR builds support
Browse files Browse the repository at this point in the history
This also removes all tooling around PHAR builds.

While PHARs have some use for some community members, PHARs:

 * do not come with a runtime/environment
 * are inherently unsafe, because (even if signed) you are relying on packages downloaded
   and installed by maintainer who created the `.phar` file
 * do not match your system requirements, which may be misaligned with bundled libraries,
   since you are relying on the maintainer's ( @Roave / @Ocramius ) selected set of
   dependencies

There are various ways to install PHP tools that are way better than PHAR, and
that are to be endorsed instead.

## `nix` flake

See https://nixos.wiki/wiki/flakes

Nix flakes are completely immutable, stable, fully reproducible, customizable,
and come with a full supply chain traceability of all dependencies.

For maximum stability in your builds, use a nix flake. Patches are welcome to
turn this package into a nix flake in itself.

## `composer.json`, `composer.lock` and `composer install`

If you have an environment, and you want to install this package into it, generate
a `composer.json` and `composer.lock` at a specific location:

```sh
cd path/to/tools
composer require roave/backward-compatibility-check
git add composer.json
git add composer.lock
git commit -m "Managing own locked version of \`roave/backward-compatibility-check\`"
```

You can then `composer install` from that directory at any time, and
run `./path/to/tools/vendor/bin/roave-backward-compatibility-check`.

`composer install` will verify that your environment is suited for installation.

## use a `Dockerfile`

This approach comes with the same downsides of `.phar` files, but:

* tooling to scan for vulnerabilities inside docker images exist, and is
  very much growing
* a docker image comes with the runtime to execute `roave/backward-compatibility-check`,
  and you can even run the full test suite before baking the image and calling
  it "compatible"
  • Loading branch information
Ocramius committed May 22, 2024
1 parent b671a71 commit 53a1cb5
Show file tree
Hide file tree
Showing 6 changed files with 0 additions and 531 deletions.
1 change: 0 additions & 1 deletion .gitattributes
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
/.github/ export-ignore
/.gitignore export-ignore
/box.json.dist export-ignore
/build-phar.sh export-ignore
/infection.json.dist export-ignore
/phpcs.xml.dist export-ignore
/phpunit.xml.dist export-ignore
Expand Down
35 changes: 0 additions & 35 deletions .github/workflows/release-phar.yml

This file was deleted.

1 change: 0 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
/vendor
/infection-log.txt
/box.json
/box.phar
/dist
phpstan.neon
phpunit.xml
Expand Down
17 changes: 0 additions & 17 deletions box.json.dist

This file was deleted.

Loading

0 comments on commit 53a1cb5

Please sign in to comment.