Book Image

The PEAR Installer Manifesto

By : Gregory Beaver
Book Image

The PEAR Installer Manifesto

By: Gregory Beaver

Overview of this book

PEAR stands for PHP Extension and Application Repository, and its primary purpose is to support code re-use. PEAR provides both an advanced installer and a code repository at http://pear.php.net. PEAR code is organized into discrete re-usable components called packages. A package consists of a group of files and a descriptor file called package.xml that contains metadata about the package's contents, such as the package version, any special dependencies, and textual information such as the package description and authors. The software that transforms a package from an inert grouping of files into a dynamic software package is called the PEAR Installer and is itself a PEAR package. In other words, the PEAR Installer can be used to upgrade itself. It truly is a very powerful application. In short, the PEAR Installer is one of the most effective tools for managing a high-quality software library, high-quality applications, or high-quality websites. This book will show you a new way of organizing your PHP development, by leveraging the full power of the PEAR Installer. In a sense, the PEAR Installer is a step above a software design pattern, a meta-development pattern that can be used to systematically organize all of your PHP development. You will learn how to organize your code into packages using the package.xml format. You will learn about the revolutionary new PEAR Channel concept, and how to safely and reliably depend on external PHP libraries from sources such as pear.php.net and other PEAR channels. You will learn about the PEAR_PackageFileManager package, and how to customize individual installations of your PHP code through file roles, file tasks, and post-installation scripts. In addition, you will learn how to use the power of PEAR to manage your web projects with the PEAR installer to bring the power of versioning and rollbacks to your live website. The synergy of the PEAR Installer and a revision control system like CVS or Subversion is also explored in depth. Next, you will learn how to set up your own PEAR Channel for distributing PHP applications, both open-source and proprietary closed-source PHP applications that can be secured using technology already built into the PEAR Installer. Finally, you will learn how to embed the PEAR Installer inside your own web application in order to manage plug-ins from a remote server. The book covers in detail designing a custom plug-in system for a fictitious blog application. The plug-in system is used to manage templates, and the PEAR Installer is used to manage the details of querying the remote server for templates, handling dependencies between versioning, and doing the actual installation process as well.
Table of Contents (11 chapters)
The PEAR Installer Manifesto
Credits
About the Author
About the Reviewers
Preface

Security Issues Inherent in Remote Installation


As evidenced by the advent of internet worms taking advantage of vulnerabilities in phpBB, MySpace.com, and XML_RPC, security holes are no laughing matter, and it is critical that you are aware of the potential risks involved in installing software you have not written yourself.

Fortunately, the PEAR-installer model provides both ease of upgrading to obtain needed security fixes and intrinsic security to ensure you won't become a victim of malicious hackers just by using the PEAR installer.

Although the PEAR developers have taken every step to ensure the safety of your code without restricting its usefulness, it is still very important that you understand some basics of security, as PEAR will not be able to protect you from yourself, should you choose to use or write insecure code. There are several excellent references written recently on PHP security and on internet security in general. Both Ilia Alshanetsky's php|architect's Guide to PHP...