Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80252
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPKwhwvhCvRD_-fFgwZO3SB0hCu=+6sj3NbnkCih1-w+X-qNRA@mail.gmail.com>
References: <CAPKwhwvhCvRD_-fFgwZO3SB0hCu=+6sj3NbnkCih1-w+X-qNRA@mail.gmail.com>
Date: Wed, 7 Jan 2015 15:51:58 +0000
Message-ID: <CAPwsocHicqVnE_dFfuGhmkZx_VEAZtTBaU165OzU5-nL0cMgcw@mail.gmail.com>
To: Scott Arciszewski <kobrasrealm@gmail.com>
Cc: "inter >> PHP internals" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Idea for PHP.net
From: leight@gmail.com (Leigh)

On 7 January 2015 at 12:52, Scott Arciszewski <kobrasrealm@gmail.com> wrote:
> Hello,
>
> Would it be possible for php.net to publish a cryptographically signed
> (e.g. openssl_sign() with a RSA private key kept offline) list in a
> pre-defined location (e.g. /stable_versions.txt) so that scripts can be
> written to read (and cache) the latest stable versions?
>
> I'm going to write a killswitch module that can be included in any PHP
> project that basically does this:
>
> 1. fetch stable_versions.txt
> 2. verify RSA signature
> 3. check phpversion() and the stable versions listed
> 4. are we running a stable PHP version?
>     4-yes: cache result for 24 hours to prevent redundant lookups.
>     4-no: kill script termination, explaining that PHP is out of date and
> needs to be updated
>
> The idea is to remind and motivate the sysadmin to keep their software up
> to date to prevent known security vulnerabilities from being exploited.
>
> If you are not okay with this, I'm going to write/publish the killswitch
> configured to look at my own server. :)
>
> Scott

Hi Scott,

I already do something similar to this for some of my CI, ensuring
tests pass on new versions of PHP.

I use the following shell script snippet to check for new versions (If
there's a diff I parse the output with PHP to find _which_ new
version)

git ls-remote -t https://github.com/php/php-src | cut -d '/' -f3 |
grep -P '^php-5\.\d+\.\d+' | sort -V

Maybe you can use this too. You can add an end assertion to the regex
to omit RC/beta tags.

Regards,

Leigh.