Weave Code
Phar Update Laravel Package
herrera-io/phar-update
Self-update library for PHP applications distributed as PHAR files. Loads a remote manifest, checks available versions, and upgrades to the next compatible release. Modular design lets you customize the update workflow for your PHAR app.
A library for self-updating Phars.
Frequently asked questions about Phar Update
- Can I use this package to self-update a Laravel Artisan command packaged as a Phar?
- Yes, this library is ideal for self-updating Phar-based Laravel Artisan commands or CLI tools. You’d package your command as a Phar, host a remote manifest (JSON), and use the `Manager` class to check for updates and upgrade automatically. Ensure your Phar’s bootstrap script includes the update logic.
- What Laravel versions does this package support?
- This package doesn’t directly integrate with Laravel but works with any PHP 5.6+ application, including Laravel CLI tools or standalone Phar-based scripts. For Laravel projects, use it only for external tools (e.g., custom Artisan commands) packaged as Phars, not for core Laravel updates.
- How do I configure the manifest for a Laravel Phar tool?
- Create a `manifest.json` file with update rules, including version numbers, Phar URLs, and checksums. Host it securely (e.g., S3 or CDN) and load it in your Phar’s bootstrap using `Manifest::loadFile()`. Example: `{'version': '1.0.0', 'updates': [{'version': '1.0.1', 'url': 'https://cdn.example.com/tool.phar', 'checksum': 'sha256:abc123'}]}`.
- Is this package actively maintained? Should I use it in production?
- The repository is archived, so no new updates are expected. Use it cautiously in production, especially if you rely on long-term support. Consider forking or evaluating alternatives like `box-project/phar-updater` if maintenance is a concern. Always test updates in staging first.
- How do I secure updates to prevent tampering or malicious Phar downloads?
- Sign your manifests with HMAC or GPG and verify signatures in your Phar’s bootstrap. Use `phar.signature` to sign Phar files and validate checksums from the manifest. Avoid HTTP-only updates; prefer HTTPS with pinned certificates. Combine with local backup Phars for rollback safety.
- Can I force an update only if a new version is available, or does it always check remotely?
- The `update()` method checks remotely by default, but you can cache the manifest locally to reduce network calls. Use `Manager::update('current_version', true)` to enforce a check, or implement custom logic (e.g., time-based checks) by extending the `Manager` class.
- What’s the best way to test Phar updates before deploying to production?
- Test updates in a staging environment by simulating the update process. Use a local manifest pointing to test Phars, then verify the update logic with `Manager::update()`. Log update attempts and failures for debugging. For Laravel tools, test with `php artisan` commands wrapped in your Phar.
- Will this work with Laravel’s built-in scheduler for automated updates?
- No, this package isn’t Laravel-specific, so it won’t integrate directly with Laravel’s scheduler. Instead, trigger updates via a custom Artisan command or cron job calling your Phar’s update logic. Example: `php your-tool.phar update --check`.
- Are there alternatives to this package for self-updating Phars in Laravel?
- Yes, consider `box-project/phar-updater` (more modern, supports PHP 8+) or `phive` for Phar management. For Laravel-specific needs, use Composer’s `self-update` or `composer require` for traditional updates. If you need Phar-specific features, this package remains a lightweight option despite its archived status.
- How do I handle failed updates or roll back to a previous Phar version?
- Implement rollback logic by keeping a backup of the previous Phar version. Use the `Manager`’s `update()` return value to detect failures, then restore the backup Phar manually or via a script. For Laravel tools, wrap the update process in a try-catch block and log errors to storage/logs.
Weaver
How can I help you explore Laravel packages today?