Bug #71087 [Com]: Phar - cannot use OpenSSL signatures with custom stub

Edit report at https://bugs.php.net/bug.php?id=71087&edit=1 ID: 71087 Comment by: security at paragonie dot com Reported by: securtiy at paragonie dot com Summary: Phar - cannot use OpenSSL signatures with custom stub Status: Open Type: Bug Package: PHAR related Operating System: Debian 8.1 Jessie with Dotdeb PHP Version: 5.6.16 Block user comment: N Private report: N New Comment: In our use case, this resolved the problem... https://github.com/paragonie/php-encryption/commit/72418c9c9c4b244523da678a629227e16840de51 ...but that's a workaround, not a solution. Previous Comments: ------------------------------------------------------------------------ [2015-12-10 21:49:59] securtiy at paragonie dot com Description: ------------ Is there any reason why we can't use Phar::setSignatureAlgorithm() after Phar::setStub()? https://github.com/defuse/php-encryption/pull/139 If there's a reason this shouldn't allowed, could the documentation please be updated to reflect this decision? If this is a bug, it's breaking our ability to publish signed a .phar for defuse/php-encryption Test script: --------------- https://raw.githubusercontent.com/paragonie/php-encryption/29dc5e866bb08dac38fef721f3356f2e2fea76c3/other/build_phar.php Expected result: ---------------- Silent success, but if I do this: $phar = new \Phar(dirname(__DIR__).'/dist/defuse-crypto.phar'); $signature = $phar->getSignature(); var_dump($signature); ...it shouldn't say its "hash_type" is "SHA-1" Actual result: -------------- PHP Fatal error: Uncaught exception 'PharException' with message 'unable to copy stub of old phar to new phar "/var/www/defuse/php-encryption/dist/defuse-crypto.phar"' in /var/www/defuse/php-encryption/other/build_phar.php:37 Stack trace: #0 /var/www/defuse/php-encryption/other/build_phar.php(37): Phar->setSignatureAlgorithm(16, '-----BEGIN PRIV...') #1 {main} thrown in /var/www/defuse/php-encryption/other/build_phar.php on line 37 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71087&edit=1