Weave Code
Phar Updater Laravel Package
laravel-zero/phar-updater
Backend for the self-update command in Laravel Zero PHARs, forked from Humbug PHAR Updater. Supports SHA-1/256/512 and GitHub Releases strategies, SSL/TLS verification, OpenSSL signatures, and rollback.
A thing to make PHAR self-updating easy and secure.
Frequently asked questions about Phar Updater
- How do I install laravel-zero/phar-updater?
- Install it with Composer using composer require laravel-zero/phar-updater. It is the backend used by Laravel Zero's self-update component, so many Laravel Zero apps already receive it transitively. For v2.0.0, make sure your application runs PHP 8.3 or newer before adding the dependency.
- Does laravel-zero/phar-updater work with standard Laravel web applications?
- No. The package is purpose-built for PHAR-based CLI applications such as Laravel Zero and similar single-file tools. It adds no value to conventional HTTP-served Laravel applications, queue workers, or non-PHAR deployments.
- What PHP version does phar-updater v2.0.0 require?
- Version 2.0.0 requires PHP 8.3 or newer; PHP 8.2 support was dropped. You must reconcile your application's Composer constraints and runtime floor before upgrading. If you cannot move off PHP 8.2, check Packagist and the repository for a maintained 1.x branch rather than assuming one exists.
- Why was SHA-1 support removed and how do I migrate?
- The SHA-1 strategy was removed in v2.0.0 as an insecure legacy path. Migrate any pinned SHA-1 configuration to SHA-256 or SHA-512; SHA-512 is now the default and matches the Box PHAR builder's defaults. Update your signing configuration and re-run the self-update flow in staging after the change.
- Does GPG signature verification require a gpg binary on the server?
- GPG verification is new in v2.0.0 and raises supply-chain integrity, but it introduces an external runtime dependency. The host must have a gpg binary available and access to the required public keys, either via a reachable keyserver at update time or keys bundled into your deployment. Confirm this in your slim container or deployment image before committing.
- How does the GitHub Releases update strategy work?
- The GitHub Releases strategy fetches update assets from GitHub Releases rather than relying on a static hash file. It supports SSL/TLS verification for the download path and fits projects that publish PHAR binaries as release assets. Configure the repository and release asset details according to the package docs, then test against a real release.
- Does phar-updater support rolling back a failed update?
- Yes, rollback support is part of the documented feature set. The package exposes an updater surface that includes rollback behavior, so a failed self-update can restore the previous PHAR. Run a full update-and-rollback cycle in staging before relying on it in production.
- Will upgrading to v2.0.0 break my custom update strategy?
- Potentially. v2.0.0 uses strict types, so any application that subclasses the package or implements a custom update strategy should re-verify method signatures and return types. The removal of SHA-1 and OpenSSL signing also means configurations referencing those paths must be rewritten. Treat this as a planned major-version upgrade, not a patch.
- Is laravel-zero/phar-updater safe to use in production?
- The security posture improved in v2.0.0 with SHA-1 and OpenSSL signing removed and GPG verification added, but adoption remains very low and there is no enterprise support or SLA. The GPG path adds new failure surfaces such as key retrieval, keyserver availability, and binary presence in slim containers. Test the full self-update and rollback path end-to-end and pin your Composer version.
- What are the alternatives to laravel-zero/phar-updater for PHAR self-updates?
- The original Humbug PHAR Updater is the upstream project this package was forked from, and Laravel Zero's own self-update component wraps this package. Some teams write a custom update command tailored to their release process, while others rely on Box for building and a simple signed manifest for distribution. Evaluate based on whether you need GitHub Releases, hash strategies, GPG verification, and rollback out of the box.
Weaver
How can I help you explore Laravel packages today?