Download the PHP package roave/composer-gpg-verify without Composer
On this page you can find all versions of the php package roave/composer-gpg-verify. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download roave/composer-gpg-verify
More information about roave/composer-gpg-verify
Files in roave/composer-gpg-verify
Package composer-gpg-verify
Short Description Composer plugin that verifies GPG signatures of downloaded dependencies, enforcing trusted GIT tags
License MIT
Informations about the package composer-gpg-verify
Composer GPG signature verification plugin
This package provides pluggable composer tag signature verification.
Specifically, all this package does is stop the installation process when an un-trusted package is encountered.
The aim of this package is to be a first reference implementation to be later used in composer itself to enforce good dependency checking hygiene.
Usage
This package provides no usable public API, but will only act during the composer installation setup:
Please note that the above may already fail if you have un-trusted
dependencies. In order to skip the checks provided by this package,
use the --no-scripts
flag if you didn't yet figure out your
un-trusted dependencies:
Trusted dependencies
This package extensively uses GPG
to
validate that all downloaded dependencies have a good and trusted
GIT tag or commit signature.
At this moment, the package will just use your local GPG trust database to determine which signatures are to be trusted or not, and will not mess with it other than reading from it.
In practice, this means that:
- every package you install must be a
git
repository (use--prefer-source
) - the
HEAD
(current state) of each repository must be either a signed tag or a signed commit - you must have a local copy of the public key corresponding to each tag/commit signature
- you must either have explicitly trusted, locally signed or signed each of the involved public keys
While this must sound like a useless complication to most users, as they just trust packagist to provide "good" dependencies, these may have been forged by an attacker that stole information from your favorite maintainers.
Good dependency hygiene is extremely important, and this package encourages maintainers to always sign their releases, and users to always check them.
Trusting someone's work
Assuming that you downloaded a signed package, you will likely get the following failure during the first installation:
This means that some-vendor/some-package
is not trusted.
That AABBCCDDEEFF1122
is the key you are missing. Let's download it:
Now the key is in your local DB, but it isn't yet trusted.
IMPORTANT: do not blindly trust or sign other people's GPG keys - only do so if you effectively know that the key is provided by them, and you know them at least marginally. Usually, contacting the key author is the best way to check authenticity.
To trust a key, you can edit it:
Alternatively, if you want to sign the gpg key, you can create a local signature:
If you really trust a key, you can create a generic signature that may be uploaded:
Once you did any of the above (signing or trusting), then you may resume your composer installation or upgrade process.
Examples
Please refer to the examples directory for running examples in your system. All examples are designed in a way that will leave your current GPG settings untouched.
Limitations
This package still has few serious limitations:
- it needs
gpg
2.x
to run - this means that you should probably be on Ubuntu 16.04 or equivalent. - it needs
gpg
2.x
- it can only verify signatures of downloaded GIT repositories: any non-git packages will cause the validation to fail
These limitations will eventually be softened as development of further versions of the library continues.
All versions of composer-gpg-verify with dependencies
composer-plugin-api Version ^1.0