phingofficial/phing — pull request #238 by fpoirotte (2013-09-14 18:38:46+00:00)
Title: Make OpenSSL signatures really work in PharPackageTask.

setSignatureAlgorithm() must be called last. If files are added to the phar package after it has been called, Phar will try to recompute the signature, but will fail because it does not remember the private key correctly.

Also, setSignatureAlgorithm()'s second argument does not accept OpenSSL resources. The private key must be passed in its text form, which is obtained by calling openssl_pkey_export().