diff --git a/.gitignore b/.gitignore
index 2d0575c..087d255 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,7 @@
-test/unit/File/big-generated-file
+*~
+/test/unit/File/big-generated-file
+/composer.lock
+/vendor
+defuse-crypto.phar
+composer.phar
+box.phar
diff --git a/composer.json b/composer.json
index 62d4f88..eafe87d 100644
--- a/composer.json
+++ b/composer.json
@@ -11,11 +11,12 @@
         }
     ],
     "autoload": {
-        "files": ["autoload.php"]
+        "classmap": ["src"]
     },
     "require": {
-        "php":  ">=5.4.0",
-        "ext-openssl": "*"
+        "paragonie/random_compat": "~2.0",
+        "ext-openssl": "*",
+        "php":  ">=5.4.0"
     },
     "require-dev": {
         "nikic/php-parser": "^2.0"
diff --git a/dist/Makefile b/dist/Makefile
new file mode 100644
index 0000000..01dd2c1
--- /dev/null
+++ b/dist/Makefile
@@ -0,0 +1,38 @@
+TARGETS := defuse-crypto.phar
+
+define install_tool
+	@echo 'Required tool \"$1\" not installed, see docs/InstallingAndVerifying.md'; false
+endef
+define which
+	$(shell PATH=$$PATH:. which $1.phar 2>/dev/null || which $1 2>/dev/null || { echo "$(call install_tool,$(1))"; })
+endef
+define find_tool
+	$(call which,$1)
+endef
+
+box := $(call find_tool,box)
+composer := $(call find_tool,composer)
+php := $(call find_tool,php)
+
+all: dist-phar
+
+phar: $(TARGETS)
+
+composer.lock:
+	$(composer) install --no-dev
+
+%.phar: dist/Makefile dist/box.json composer.lock
+	cp dist/box.json .
+	$(php) -d phar.readonly=0 $(box) build -c box.json -v
+
+# ensure we run in clean tree. export git tree and run there.
+dist-phar:
+	rm -rf worktree
+	install -d worktree
+	(cd $(CURDIR)/..; git archive HEAD) | tar -x -C worktree
+	$(MAKE) -f $(CURDIR)/Makefile -C worktree phar
+	mv worktree/*.phar .
+	rm -rf worktree
+
+clean:
+	rm -vf $(TARGETS)
diff --git a/dist/box.json b/dist/box.json
new file mode 100644
index 0000000..9acd514
--- /dev/null
+++ b/dist/box.json
@@ -0,0 +1,27 @@
+{
+    "chmod": "0755",
+    "finder": [
+        {
+            "in": "src",
+            "name": "*.php",
+            "exclude": "random_compat"
+        },
+        {
+            "in": "vendor/composer",
+            "name": "*.php",
+            "exclude": "other"
+        },
+        {
+            "in": "vendor/paragonie",
+            "name": "*.php",
+            "exclude": "other"
+        }
+    ],
+    "compactors": [
+        "Herrera\\Box\\Compactor\\Php"
+    ],
+    "compression": "GZ",
+    "main": "vendor/autoload.php",
+    "output": "defuse-crypto.phar",
+    "stub": true
+}