koto / phar-util

PharUtil - Security-oriented utilities for Phar archives
http://blog.kotowicz.net/2010/08/hardening-php-how-to-securely-include.html
MIT License
131 stars 20 forks source link

Can't create self-executable phar. #17

Closed hopeseekr closed 5 years ago

hopeseekr commented 12 years ago

Hi!

I have a great need to create self-executable Phars...

I need the ability to add the following to the very top of the generated phars:

#!/bin/env php
<?php

Can you please add this support via a command line argument to phar-util?

Thanks!

katanacrimson commented 12 years ago

@hopeseekr tried adding the shebang within the stub file?

hopeseekr commented 12 years ago

Where is the stub file?

katanacrimson commented 12 years ago

try: phar-build --help

You're looking for the -S flag (long form: --stub $stub).

For more information on stub files:

http://us3.php.net/manual/en/phar.setstub.php http://us3.php.net/manual/en/phar.fileformat.stub.php

hopeseekr commented 12 years ago

What I did was

  1. Make a phar via phar-build.
  2. Copy the phar file to stub.php.
  3. Edit stub.php and remove everything below __HALT_COMPILER();
  4. Add #!/bin/env php to the top of stub.php.
  5. Rebuild the phar with the new stub.
  6. chmod 0755 myapp.phar
  7. mv myapp.phar myapp
  8. mv myapp.phar.pubkey myapp.pubkey

I have fortunately incorporated this into a Makefile. Unfortunately, 8 steps seems like way too much.

Also, how would you go about tar'ing or zipping up the phar?

katanacrimson commented 12 years ago

Unless you're looking to keep using the default PHP stub file, you don't need to do anything weird like building a phar and then rebuilding it afterwards.

As far as tarballing or zipping, you can't have them compressed in a deployed state - php needs to include it directly, uncompressed, and if you wanted to use phar's internal compression methods, you lose OpenSSL signing (it's a bug within phar itself, as when you use compression it silently falls back to one of the sha checksums - I believe @koto noted this in one of his blog posts about phar).

Like you, I ended up setting up a makefile to handle phar creation, anyways. You can probably get away with something similar:

#
# sierra makefile
#
PROJECT = sierra
RELEASE_DIR = .
PRIVKEY = ./cert/priv.pem
PUBKEY = ./cert/pub.pem

# target: all - default target, does nothing
all :
    +@echo "no target specified, try 'make help'"

# target: deploy - prepares a deployable build
deploy: groups version core twig-phar mail-phar pack-all

# target: core - builds main phar
core:
    echo "<?php __HALT_COMPILER();" > stub.php; \
    phar-build --phar $(PROJECT).phar -s ./includes/ -x "\.txt$$ \.xml.*$$ \.markdown$$ \.md$$ stub\.php \.json$$ \.rst$$ \.test$$ ~$$ README\.* CHANGE(LOG|S)\.* AUTHORS.\* LICENSE\.* \.gitignore" -X "/\.git/ /\.svn/ /test/ /bin/ /doc/ /swiftmailer/ /Twig/" -S stub.php -p $(PRIVKEY) -P $(PUBKEY) --strip-files ".php$$"; \
    mv $(PROJECT).phar* lib/; \
    echo "built core phar"; \
    rm stub.php

(note: I've omitted what isn't relevant from my own makefile - adapt this to your own needs)

I imagine you can modify the line that creates stub.php to use something a bit different, have it include a shebang.

hopeseekr commented 12 years ago

When the empty stub method, no code gets executed... I need the index.php to get executed.

katanacrimson commented 12 years ago

So, wait, are you renaming the phar file to something like index.php, and trying to run it like that?

hopeseekr commented 12 years ago

Nah nothing like that. Code just doesn't run when I use the empty stub you provided...

katanacrimson commented 12 years ago

...Are you providing it anything in the stub? Are you including the __HALT_COMPILER() call? This might be the phar erroring out for some reason - be sure that you've got error_reporting cranked all the way up.

hopeseekr commented 5 years ago

This was the first issue I ever created on GitHub. And I have no idea hwat I was trying to accomplish :o