Different way of uploading releases

[defuse]

See this comment: #226 (comment)

(I wasn't aware that GitHub let you upload your own files for releases.)

[defuse]

@glensc If you would like to see this happen and have spare cycles to donate, it would be awesome if you could take a shot at adding random_compat as a composer dependency and modifying the .phar building script to pull random_compat down using compser.

[glensc]

the PR should be against v2.0 branch right?

[defuse]

@glensc Yep!

[glensc]

and you're sure you are against using box.phar to build?

i've been using it and feel comfortable that can define phar contents with json

• eventum-scm - box.json
• eventum-cli - box.json

[defuse]

I'm not opposed to box.phar since I don't know what it is yet, but hopefully it will be easy to look at it and make sure it's generating a .phar that accurately represents the source code. Using it is an extra window for a backdoor / vulnerability to get inserted.

[defuse]

Done in #264

[paragonie-scott]

#264 is closed, so I'm closing this too.