PHP applications and command-line tools are often distributed as .phar files. PHP supports native PHAR, ZIP, and TAR containers. ZIP- and TAR-based PHARs already open through content sniffing, while native PHAR files are rejected because they begin with a PHP stub rather than a ZIP or TAR signature.
For example:
f, _ := os.Open("composer.phar")
_, err := archives.Open("composer.phar", f)
// unsupported archive format: composer.pharThis reproduces on v0.5.1 and current main.
The native PHAR format contains a PHP stub, manifest, file contents, and an optional signature. Its manifest records paths, sizes, timestamps, CRC32 checksums, permissions, compression flags, and metadata. A dedicated reader could map these fields onto the existing FileInfo type and implement the current Reader interface.
Suggested scope:
- Route plain
.phar files by their underlying format so ZIP and TAR forms keep using the existing readers.
- Support native
.phar, .phar.gz, and .phar.bz2 files.
- Decompress per-file zlib and bzip2 entries.
- Validate lengths, CRC32 checksums, and hash signatures while enforcing
maxDecompressedSize.
- Skip serialized PHP metadata without deserializing it.
- Retain the original outer bytes for
Hash.
Extensionless native PHAR detection can remain unsupported because the PHP stub has arbitrary length and may extend beyond the current 512-byte sniff limit.
PHP applications and command-line tools are often distributed as
.pharfiles. PHP supports native PHAR, ZIP, and TAR containers. ZIP- and TAR-based PHARs already open through content sniffing, while native PHAR files are rejected because they begin with a PHP stub rather than a ZIP or TAR signature.For example:
This reproduces on v0.5.1 and current main.
The native PHAR format contains a PHP stub, manifest, file contents, and an optional signature. Its manifest records paths, sizes, timestamps, CRC32 checksums, permissions, compression flags, and metadata. A dedicated reader could map these fields onto the existing
FileInfotype and implement the currentReaderinterface.Suggested scope:
.pharfiles by their underlying format so ZIP and TAR forms keep using the existing readers..phar,.phar.gz, and.phar.bz2files.maxDecompressedSize.Hash.Extensionless native PHAR detection can remain unsupported because the PHP stub has arbitrary length and may extend beyond the current 512-byte sniff limit.