Upgrade to attestation 0.0.8 #725

Activity

1. asgrim

   added this to the 1.5.0 milestone on Sep 4, 2026
2. asgrim

   self-assigned this

   on Sep 4, 2026
3. asgrim

   added the

   Feature

   issue type on Sep 4, 2026
4. asgrim

   added

   enhancementNew feature or requestNew feature or request

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   phpPull requests that update Php codePull requests that update Php code

   on Sep 4, 2026
5. asgrim commented on Sep 4, 2026

   

   asgrim

   on Sep 4, 2026

   Last edited by asgrim

   ContributorAuthor

   More actions

   Fetching/verifying are separate now:

   // before
   $this->verifyAttestation->verify(
       FilenameWithChecksum::fromFilenameAndChecksum($pharFilename->filePath, $pharFilename->checksum),
       self::ORGANISATION,
       self::ARTIFACT_FILENAME,
       $expectedExtensions,
   );
   
   // after
   $file = FilenameWithChecksum::fromFilenameAndChecksum($pharFilename->filePath, $pharFilename->checksum);
   $bundles = DownloadGitHubBundle::factory(self::ORGANISATION)->getBundles($file);
   $this->verifyBundle->verify($bundles, $file);

   Verification rules/setup is moved to construction now instead of ->verify() params

   // before
   private const ATTESTATION_CERTIFICATE_EXPECTED_EXTENSION_VALUES = [
       FulcioSigstoreOidExtensions::ISSUER_V2 => 'https://token.actions.githubusercontent.com',
       FulcioSigstoreOidExtensions::SOURCE_REPOSITORY_URI => 'https://github.com/php/pie',
       FulcioSigstoreOidExtensions::SOURCE_REPOSITORY_OWNER_URI => 'https://github.com/php',
   ];
   // ...
   $expectedExtensions[self::BUILD_SIGNER_URI] = '...@refs/heads/...'; // or SOURCE_REPOSITORY_REF for tags
   
   // after
   private const ATTESTATION_CERTIFICATE_EXPECTED_EXTENSION_VALUES = [
       FulcioSigstoreOidExtensions::SOURCE_REPOSITORY_URI => 'https://github.com/php/pie',
       FulcioSigstoreOidExtensions::SOURCE_REPOSITORY_OWNER_URI => 'https://github.com/php',
   ];
   private const OIDC_ISSUER = 'https://token.actions.githubusercontent.com'; // used to be `ISSUER_V2` extension, now is first class citizen
   // ...
   $expectedCertificateIdentity = '.../build-assets.yml@refs/heads/...'; // or @refs/tags/<tag>
   
   VerifyBundleWithOpenSsl::factory(
       self::ATTESTATION_CERTIFICATE_EXPECTED_EXTENSION_VALUES,
       $expectedCertificateIdentity,
       self::OIDC_ISSUER,
   );

   Note: the verifier now therefore varies per release (as identity is ingrained) so construction should be inline not injected (although, a factory could be injected, and release-specific params can be passed to that factory fn?)

   Check if exceptions have moved/updated

   Some exceptions might've moved, check them. There is also new exceptions (e.g. NoSodium, NoGmpOrBcmath etc) to potentially handle (if we don't globally handle them, can't remember off my head)
6. asgrim

   closed this as completedin #733on Sep 13, 2026