Phar Updater Laravel Package

Product Decisions This Supports

• Enables secure, automated updates for PHAR-based CLI applications without custom development, reducing time-to-market for self-updating tools.
• Supports "buy vs build" decision by providing a battle-tested solution (used in Laravel Zero) for a complex security-critical feature (secure updates), avoiding reinventing the wheel.
• Critical for product roadmaps involving distributed CLI tools where user experience requires seamless updates (e.g., internal enterprise tools, open-source utilities).
• Strengthens our security posture decision-making: v2.0.0 drops legacy OpenSSL signing and SHA-1, defaults to SHA-512 (aligned with Box), and adds GPG signature verification — giving us a modern, standards-based trust chain to put in front of security reviewers and enterprise customers.
• Reduces maintenance overhead by handling SSL verification, rollback, and multiple update strategies (SHA hashes, GitHub Releases, now GPG) out-of-the-box.
• Informs platform-support commitments: v2.0.0 drops PHP 8.2, so any decision to adopt or upgrade now sets a PHP 8.3+ floor for the affected CLI products.

When to Consider This Package

• Adopt when building a PHP PHAR-based command-line tool that requires secure, automatic updates for end-users.
• Ideal for projects where updates must be handled via a single executable file (e.g., Laravel Zero apps, standalone utilities).
• Prefer v2.0.0+ for new work: it gives us GPG signature verification and a SHA-512 default, which is the stronger story for regulated or security-reviewed distribution channels.
• Only pin to v1.x if we are locked to PHP 8.2 or still depend on the removed OpenSSL signing / SHA-1 strategies — both are legacy and should be treated as a scheduled migration, not a long-term state.
• Budget for upgrade effort if we maintain custom update strategies or subclasses: v2.0.0 adds strict types, so method signatures may need changes. Treat this as a known migration task, not a surprise.
• Avoid if your application is not distributed as a PHAR (e.g., web apps, containerized services) or if updates are managed via system package managers (apt, Homebrew).
• Do not use if your security requirements necessitate custom update logic beyond the provided strategies (though custom strategies are supported, the package is optimized for standard PHAR update patterns) or if you require signing mechanisms other than SHA-256/512 and GPG.

How to Pitch It (Stakeholders)

By adopting laravel-zero/phar-updater, we eliminate the need to build and maintain a custom self-update system for our PHAR-based CLI tools, reducing engineering effort by weeks and ensuring secure, reliable updates for users. The v2.0.0 release is a security-driven major version: it removes deprecated OpenSSL signing and SHA-1, defaults to SHA-512, and adds GPG signature verification — a clear win for security reviews and enterprise buyers, with no expected impact on standard Laravel Zero apps since the removed features were never supported there. The trade-offs are a PHP 8.2 support drop and a small migration task for any custom strategies due to strict typing; both should be scheduled rather than absorbed silently. Executives gain reduced support costs, a stronger security narrative, and faster feature delivery; engineers get a battle-tested solution with built-in rollback, modern hashing defaults, and multiple update strategies, avoiding complex security pitfalls.