osTicket/core-plugins — pull request #19 by greezybacon (2014-03-28 03:31:06+00:00)
Title: Add signature output for compiled PHARs

This will help verify the content, integrity, oversight, and origin of plugins, language packs and other modules distributed for osTicket.

This idea is that the signature of the PHAR file will be registered in DNS, for instance, `7afc8bf80b0555bed88823306744258d6030f0d9.updates.osticket.com`, for a PHAR file with a SHA1 signature of `7afc8bf80b0555bed88823306744258d6030f0d9 `, which will resolve to a string like the following:
```
"v=1; i=storage:s3; s=MEUCIFw6A489eX4Oq17BflxCZ8+MH6miNjtcpScUoKDjmblsAiEAjiBo9FzYtV3WQtW6sbhPlJXcoPpDfYyQB+BFVBMps4c=; V=0.1;"
```
Which is a simple semicolon separated key-value pair string with the following keys

| Key | Description |
|:----|:----------|
| v | Algorithm version |
| i | Plugin 'id' registered in plugin.php['id'] |
| V | Plugin 'version' registered in plugin.php['version'] |
| s | OpenSSL signature of the PHAR SHA1 signature using a private key (specified on the command line) |

The public key, which will be distributed with osTicket, can be used to verify the signature of the PHAR file from the data received from DNS.

The PHAR signature can be retrieved at runtime like so
```php
$phar = new Phar("/path/to/plugin.phar");
$s = $phar->getSignature();
echo $s['hash'];
```
And the verification data, once retrieved from DNS can be verified like so
```php
$pub = openssl_pkey_get_public("/path/to/osticket-phars.pubkey");
openssl_verify($dns_data['s'], $s['hash'], $pub, OPENSSL_ALGO_SHA1);
```