Pharaoh - PHAR Comparison Tool

[Scott Arciszewski <scott () paragonie com>]

Hi everyone,

We developed a tool to compare executable PHP Archives (.phar files), which
you may find at https://github.com/paragonie/pharaoh

Previously, there wasn't a tool available that specifically worked with
.phar files, which differ from just a .zip or .tar in that they have an
executable stub which allows you to do something like this:

    <?php
    include "vendor/acme/deliverable.phar";
    $foo = \Acme\Deliverable\Foo();
    $bar->process($foo);

Pharaoh is useful for open source projects that distribute a .phar
(phpunit, composer, etc.). Since many of these projects do not sign their
.phar, if their server gets hacked it would be trivial to slip in a bit of
extra code in the stub (add a public key to ~/.ssh/authorized_keys, etc).

The idea is that someone can download the .phar from their website, build
the same one from source, then use Pharaoh to compare them and detect this
malicious tampering. (And then, hopefully, blow the whistle to disrupt the
campaign.)

We hope that someone finds this useful.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>