porro / php-core
Shared core for Porro connectors: site keys, signing, lock-file reading and sending reports.
Requires
- php: ^8.2
- composer-runtime-api: ^2.2
- paragonie/sodium_compat: ^1.21|^2.0
Requires (Dev)
- laravel/pint: ^1.18
- pestphp/pest: ^3.0|^4.0
Suggests
None
Provides
None
Conflicts
None
Replaces
None
README
Shared core for the Porro connectors: parsing site keys, signing reports, reading composer.lock and sending reports to Porro.
You don't install this directly. It comes with a connector:
| Connector | For |
|---|---|
porro/laravel-connector |
Laravel 11–13 |
porro/filament-connector |
Filament 3–5 |
porro/statamic-connector |
Statamic 5–6 |
How reports are signed
A site key looks like porro_{site id}_{seed}. The seed is the private half of an Ed25519 key pair; Porro stores only the public half. Each report is signed over:
{timestamp}\n{nonce}\n{sha256 of body}
and sent with X-Porro-Site, X-Porro-Timestamp, X-Porro-Nonce and X-Porro-Signature headers. Porro rejects a report outside a 5-minute window or if it has seen the nonce before. If ext-sodium isn't available, paragonie/sodium_compat provides it in pure PHP.
Developing
composer install
composer test
Security
Please email security@porro.dev rather than opening an issue. We reply within one working day.
License
MIT