composer/composer — pull request #2814 by padraic (2014-03-16 11:01:20+00:00)
Title: [WIP] Developer Package Signing

This PR is a work in progress. Expect changes and check the TODO list. Review/testing is welcome.

This pull request is intended to add support for developer-level package signing to Composer using openssl. It includes a "create-keys" command to generate an RSA private and public keys (the private key should be encrypted using a passphrase), an "add-dev-key" command which imports a private key and extracts the public key for distribution in a package within keys.json, and a "sign" command which assembles a manifest of files, their checksums, and lengths, and signs the manifest using a private key within manifest.json. This PR does not address any form of package or metadata signing by Packagist which is also required for repository-level security. This PR does not depend on SSL/TLS support.

TODO:
1. It's almost certain that add-dev-key will see keys.json signing split to a separate sign-dev-keys command.
2. The format of the output files keys.json and manifest.json may change (I am adopting the TUF format rather than creating something custom).
3. ADD support for Composer to cache keys.json data since it should only be populated on first encounter so that attacks to alter keys.json have a chance to be detected.
4. ADD support for Composer to verify package signatures as part of its install/update routines.
5. ADD verification status to install/update output.
6. ADD composer command options to reject unverified packages (I'll make it optional but it's strongly suggested that this become enabled by default in time).
7. As the manifest assembly requirements reflect those of building archives, the following PR needs to be merged: https://github.com/composer/composer/pull/2769 to fix issues #2739 and #1755 so I can rely on ArchivableFilesFinder.

You can currently test sign packages using the following commands:

````
php composer.phar create-keys --prefix=myUniquePrefix --passphrase=somethingnotstupid

php composer.phar add-dev-key --passphrase=somethingnotstupid ./path/to/myUniquePrefix-private.pem

php composer.phar sign --passphrase=somethingnotstupid ./path/to/myUniquePrefix-private.pem
````
This should result in two new files: keys.json (used to distribute authorised public keys) and manifest.json (a signed listing of all package files, their SHA256 checksums and lengths).