Phar Signing

PDepend Phar Signing

To set up signing of the PHPMD phar files, the following must be done.

1. Create PGP Key pair

   With a passphrase using GnuPG on Linux or "Kleopatra" from Gpg4Win on Windows

   • Name = "PDepend"
   • E-Mail = "pgp@pdepend.org"
   • Expires = never

2. Document private key, passphrase, public key and revocation certificate in PHPMD/PDepend's Passbolt

   Under "PDepend" => "PGP":

   • PGP PDepend Private Key
   • PGP PDepend Passphrase
   • PGP PDepend Public Key
   • PGP PDepend Revocation Certificate

3. Publish public key on key server

   1. Export public key file
   2. Upload public key file to https://keys.openpgp.org/upload
   3. Manage public key https://keys.openpgp.org/manage
   4. Check E-Mail account "pgp@pdepend.org" for E-Mails from key server (ask @ravage84)
   5. Verify E-mail associated with public key
   6. Check public key on key server https://keys.openpgp.org/search?q=pgp%40pdepend.org

4. Setup GitHub Actions Secrets

   Add the necessary GitHub action secrets under "Repository secrets" in the PDepend GitHub repo:

   • PASSPHRASE = (PGP PDepend Passphrase)
   • SECRET_KEY = (PGP PDepend Private Key)

   https://github.com/pdepend/pdepend/settings/secrets/actions

5. Setup Phar Signing in GitHub Action

   Set up signing in the GitHub action that generates the phar file:

   https://github.com/pdepend/pdepend/blob/master/.github/workflows/generate_phar.yml

   Using "pgp@pdepend.org" as signing e-mail address.

   PASSPHRASE: ${{ secrets.PASSPHRASE }}
   SECRET_KEY: ${{ secrets.SECRET_KEY }}
   

   echo "$SECRET_KEY" > keys.asc;
   echo "$PASSPHRASE" | gpg --batch --import keys.asc;
   sh -c "echo $PASSPHRASE | gpg --command-fd 0 --pinentry-mode loopback -u pgp@pdepend.org --batch --detach-sign --output pdepend.phar.asc pdepend.phar";
   

Some Useful Commands

gpg --refresh-keys
gpg --auto-key-locate hkps://keys.openpgp.org --locate-keys pgp@pdepend.org

phive install pdepend
phive install pdepend/pdepend