Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80251
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.181 as permitted sender)
MIME-Version: 1.0
Date: Wed, 7 Jan 2015 07:52:55 -0500
Message-ID: <CAPKwhwvhCvRD_-fFgwZO3SB0hCu=+6sj3NbnkCih1-w+X-qNRA@mail.gmail.com>
To: "inter >> PHP internals" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b87501cf7be68050c0f66e4
Subject: Idea for PHP.net
From: kobrasrealm@gmail.com (Scott Arciszewski)

--047d7b87501cf7be68050c0f66e4
Content-Type: text/plain; charset=UTF-8

Hello,

Would it be possible for php.net to publish a cryptographically signed
(e.g. openssl_sign() with a RSA private key kept offline) list in a
pre-defined location (e.g. /stable_versions.txt) so that scripts can be
written to read (and cache) the latest stable versions?

I'm going to write a killswitch module that can be included in any PHP
project that basically does this:

1. fetch stable_versions.txt
2. verify RSA signature
3. check phpversion() and the stable versions listed
4. are we running a stable PHP version?
    4-yes: cache result for 24 hours to prevent redundant lookups.
    4-no: kill script termination, explaining that PHP is out of date and
needs to be updated

The idea is to remind and motivate the sysadmin to keep their software up
to date to prevent known security vulnerabilities from being exploited.

If you are not okay with this, I'm going to write/publish the killswitch
configured to look at my own server. :)

Scott

--047d7b87501cf7be68050c0f66e4--