Reference

Verify downloads

Confirm the integrity of downloaded release assets with the published SHA-256 checksums.

Every release publishes its assets with a SHA256SUMS file. If you download the schema, manifest, notes, or notices directly rather than through Composer, verify them before using them.

GitHub's tagged release is the canonical source. The website does not copy or mirror release assets.

Asset locations

Assets are attached to the release tag on GitHub. For a release <version>:

  • Release page: https://github.com/atatusoft-ltd/ppphp-src/releases/tag/<version>
  • Schema: https://github.com/atatusoft-ltd/ppphp-src/releases/download/<version>/ppphp.schema.json
  • Manifest: https://github.com/atatusoft-ltd/ppphp-src/releases/download/<version>/ppphp-release.json
  • Checksums: https://github.com/atatusoft-ltd/ppphp-src/releases/download/<version>/SHA256SUMS

The release also contains RELEASE_NOTES.md and THIRD_PARTY_NOTICES.md. Use only files attached to the exact release you installed; the release notes list every version in this train with its links.

Download and verify

Download the checksum file and the assets you intend to use into an empty directory, substituting the version you installed:

V=$(vendor/bin/ppphp --version | awk '{print $2}')
curl -fLO "https://github.com/atatusoft-ltd/ppphp-src/releases/download/$V/SHA256SUMS"
curl -fLO "https://github.com/atatusoft-ltd/ppphp-src/releases/download/$V/ppphp.schema.json"
curl -fLO "https://github.com/atatusoft-ltd/ppphp-src/releases/download/$V/ppphp-release.json"

-f makes curl fail when a filename is wrong or the asset cannot be reached, so an HTML error page is never mistaken for an asset.

Check the checksums

On macOS:

shasum -a 256 -c SHA256SUMS

On Linux:

sha256sum -c SHA256SUMS

Run the command from the directory containing the downloaded assets. A successful result names each file and reports OK. A missing file may be reported separately if you downloaded only part of the asset set. A mismatch means the file must not be used: delete it and download it again from the tagged release.

A matching checksum confirms that your file matches the one recorded for that release. Download both the assets and SHA256SUMS from the official release page. A checksum supplied by an unrelated mirror does not prove that its files came from the ++PHP project.

Check the release identity

Open ppphp-release.json and confirm that its version, tag, and channel fields describe the release you downloaded. Compare its schema URL with the $schema property written by ppphp init in your ppphp.json. Matching URLs tell you that your editor is using the schema for that compiler release. Normal checks and builds use bundled validation rules and do not fetch the URL.