Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:80253 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 64231 invoked from network); 7 Jan 2015 18:05:45 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 7 Jan 2015 18:05:45 -0000 Authentication-Results: pb1.pair.com header.from=adam@adamharvey.name; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=adam@adamharvey.name; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.213.179 as permitted sender) X-PHP-List-Original-Sender: adam@adamharvey.name X-Host-Fingerprint: 209.85.213.179 mail-ig0-f179.google.com Received: from [209.85.213.179] ([209.85.213.179:63867] helo=mail-ig0-f179.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 0E/00-63240-8757DA45 for ; Wed, 07 Jan 2015 13:05:45 -0500 Received: by mail-ig0-f179.google.com with SMTP id r2so1732641igi.0 for ; Wed, 07 Jan 2015 10:05:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=adamharvey.name; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=lzgSC8geuLzQGqmiFHEdKLB65jv7/bJvQpeJLLjBuZI=; b=OgD9Mh6WBvyhCHvUIg9Q/Yle3LMRZWNR6dQs6LeNxxTt13vTHGm2d197TD6mEnAfWJ cUw4+7KAufMblDXTmZf8ad0lqsAiofBT7XprmspNvhE+rAbbh6cyQvxrhIneli5V9Y3E TYD8xLa6VKCdCVRJ3zAyYXasdCT0GsCNNEzTk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=lzgSC8geuLzQGqmiFHEdKLB65jv7/bJvQpeJLLjBuZI=; b=UGM6XRUqcd0n7beCi78rEkLjRLE0pLxmXrkIe5TvAPDHCsPEpoSZKAF6XsVCwVqKff evURvGjdCgejhDArcpASl/SWNJpGJVSY5M99jPcrxLQLhS+8NsHr0xO61rfDXQ6Nm9t1 G4N/JgZZl1e+emRQw4VMgfBknggEvvdjeSNc55an9cZ7BtVu0mb2pmd3nyW3bGd56Fxc b/7w4LtibpDup8WX/PqAvInhFKOboG4PKsc5g1U4qreJnpUDUvOM7kVzR0qY/qyBSom6 Q1IHjVpE0xGZswFl5Mm6axFeHtWIsDY4GNgDXRvAfX6LM3kfJA3HnIxMabSUFDPI2e2U nIrg== X-Gm-Message-State: ALoCoQnQnNUlSEA7fKi0cg2s+YukOF0hVYB6TmCyufdNSj9pLQaTcSfGkKtoub8hI39jGiD9ouav X-Received: by 10.42.235.80 with SMTP id kf16mr4248461icb.77.1420653942008; Wed, 07 Jan 2015 10:05:42 -0800 (PST) MIME-Version: 1.0 Sender: adam@adamharvey.name Received: by 10.43.112.9 with HTTP; Wed, 7 Jan 2015 10:05:21 -0800 (PST) In-Reply-To: References: Date: Wed, 7 Jan 2015 10:05:21 -0800 X-Google-Sender-Auth: 1VrRzy-GPCHeSW__9HcvJfn3nDY Message-ID: To: Scott Arciszewski Cc: "inter >> PHP internals" , php-webmaster ML Content-Type: text/plain; charset=UTF-8 Subject: Re: [PHP-DEV] Idea for PHP.net From: aharvey@php.net (Adam Harvey) (cross-posting to php-webmaster as well) On 7 January 2015 at 04:52, Scott Arciszewski wrote: > Would it be possible for php.net to publish a cryptographically signed > (e.g. openssl_sign() with a RSA private key kept offline) list in a > pre-defined location (e.g. /stable_versions.txt) so that scripts can be > written to read (and cache) the latest stable versions? My initial gut feeling is that, with at least three different sets of RMs at any given time, the process of co-ordinating when to update this file after a release day, who would own it, and just having it done in a timely fashion is probably beyond what we should commit to. I fear we'd be setting an expectation that, at some point, we'd fail to meet. I also don't think we should add to the already considerable load our RMs are under on release days. ("We" here means RMs and regular php-web committers, to be clear.) That said, if you're OK trusting HTTPS and can do without the manual signing step, we have an unadvertised JSON backend that can provide the stable release information you'd need: https://php.net/releases/active.php. This is used by the bug tracker in conjunction with pulling version information from qa.php.net, so it should be reliable. Adam