feat: Deprecate OpenSSL signing

Closes #878.
box-project · Oct 21, 2023 · f170cd1 · f170cd1
1 parent b7472c2
commit f170cd1
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 4 deletions.
diff --git a/src/Configuration/Configuration.php b/src/Configuration/Configuration.php
@@ -2292,6 +2292,13 @@ private static function retrieveSigningAlgorithm(stdClass $raw, ConfigurationLog
             self::addRecommendationForDefaultValue($logger, self::ALGORITHM_KEY);
         }
 
+        if (Phar::OPENSSL === $algorithm) {
+            $logger->addWarning(
+                'Using an OpenSSL signature is deprecated and will be removed in 5.0.0. Please check '
+                .'https://github.com/box-project/box/blob/main/doc/phar-signing.md for alternatives.',
+            );
+        }
+
         return $algorithm;
     }
 

diff --git a/tests/Configuration/ConfigurationSigningTest.php b/tests/Configuration/ConfigurationSigningTest.php
@@ -245,7 +245,12 @@ public function test_the_key_can_be_configured(): void
         self::assertFalse($this->config->promptForPrivateKey());
 
         self::assertSame([], $this->config->getRecommendations());
-        self::assertSame([], $this->config->getWarnings());
+        self::assertSame(
+            [
+                'Using an OpenSSL signature is deprecated and will be removed in 5.0.0. Please check https://github.com/box-project/box/blob/main/doc/phar-signing.md for alternatives.',
+            ],
+            $this->config->getWarnings(),
+        );
     }
 
     public function test_the_key_pass_can_be_configured(): void
@@ -263,7 +268,12 @@ public function test_the_key_pass_can_be_configured(): void
         self::assertTrue($this->config->promptForPrivateKey());
 
         self::assertSame([], $this->config->getRecommendations());
-        self::assertSame([], $this->config->getWarnings());
+        self::assertSame(
+            [
+                'Using an OpenSSL signature is deprecated and will be removed in 5.0.0. Please check https://github.com/box-project/box/blob/main/doc/phar-signing.md for alternatives.',
+            ],
+            $this->config->getWarnings(),
+        );
 
         foreach ([false, null] as $keyPass) {
             $this->setConfig([
@@ -283,7 +293,12 @@ public function test_the_key_pass_can_be_configured(): void
                 );
             }
 
-            self::assertSame([], $this->config->getWarnings());
+            self::assertSame(
+                [
+                    'Using an OpenSSL signature is deprecated and will be removed in 5.0.0. Please check https://github.com/box-project/box/blob/main/doc/phar-signing.md for alternatives.',
+                ],
+                $this->config->getWarnings(),
+            );
         }
 
         $this->setConfig([
@@ -297,7 +312,12 @@ public function test_the_key_pass_can_be_configured(): void
         self::assertFalse($this->config->promptForPrivateKey());
 
         self::assertSame([], $this->config->getRecommendations());
-        self::assertSame([], $this->config->getWarnings());
+        self::assertSame(
+            [
+                'Using an OpenSSL signature is deprecated and will be removed in 5.0.0. Please check https://github.com/box-project/box/blob/main/doc/phar-signing.md for alternatives.',
+            ],
+            $this->config->getWarnings(),
+        );
     }
 
     public static function passFileFreeSigningAlgorithmProvider(): iterable