add installation instructions for RPM packages#558
Conversation
|
Amended for minor fix: Only EL-10 is supported (because EL-8 has PHP 7.4 and EL-9 has PHP 8.0 by default) |
| sudo dnf install pie | ||
|
|
||
| # If you have `gh`, you can verify PIE is authentic: | ||
| gh attestation verify --owner=php $(which pie) |
There was a problem hiding this comment.
This won't work for the RPM package, which is not the phar archive
It is signed by the build provider and can be verified using the rpm --verify command (always checked on install/update)
There was a problem hiding this comment.
This is not verifying the RPM, it is verifying the PHAR; which pie should return /usr/bin/pie in this case, which should be verifiable against the original owner (unless you have built the PHAR yourself, which I would not endorse)
There was a problem hiding this comment.
/usr/bin/pie is NOT the phar, so cannot be verified by the gh attestations
The package contains the "composer install" result tree (/usr/share/pie)
And the pie command is the one from this tree.
2 participants
Distribution packagessection in the usage pageOther distro may be added later by their maintainers