Manage box, composer, and phpDocumentor via mise

The release script previously downloaded box.phar 4.6.10 and
phpDocumentor.phar 3.8.1 with wget, verifying hardcoded sha256 hashes,
and used a local composer.phar kept current via self-update. Install
all three via mise's github backend instead, upgrading to box 4.7.0
and phpDocumentor 3.10.0. Integrity pinning moves to mise.lock, which
records per-platform checksums, and mise additionally verifies SLSA
provenance or GitHub artifact attestations at install time.

Box 4.7.0 and phpDocumentor 3.10.0 were verified against this project:
box compiles a working geoip2.phar (phar-test passes) and phpDocumentor
generates the API docs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: oschwald

.gitignore

@@ -8,11 +8,8 @@ docs/public/
 .phpunit.cache/
 .phpunit.result.cache
 GeoLite2-City.mmdb
-box.phar
 build
 composer.lock
-composer.phar
-/phpDocumentor.phar
 phpunit.xml
 geoip2.phar
 geoip2-php.sublime-*

dev-bin/release.sh

@@ -32,7 +32,12 @@ fi
 
 check_command perl
 check_command php
-check_command wget
+
+# box.phar, composer.phar, and phpDocumentor.phar are managed by mise (see
+# mise.toml)
+check_command box.phar
+check_command composer.phar
+check_command phpDocumentor.phar
 
 # Check that we're not on the main branch
 current_branch=$(git branch --show-current)
@@ -89,21 +94,12 @@ fi
 
 rm -fr vendor
 
-php composer.phar self-update
-php composer.phar update --no-dev
+composer.phar update --no-dev
 
 perl -pi -e "s/(?<=const VERSION = ').+?(?=';)/$tag/g" src/WebService/Client.php
 perl -pi -e "s{(?<=php composer\.phar require geoip2/geoip2:).+}{^$version}g" README.md
 
-box_phar_hash='f98cf885a7c07c84df66e33888f1d93f063298598e0a5f41ca322aeb9683179b  box.phar'
-
-if ! echo "$box_phar_hash" | sha256sum -c; then
-    wget -O box.phar "https://github.com/box-project/box/releases/download/4.6.10/box.phar"
-fi
-
-echo "$box_phar_hash" | sha256sum -c
-
-php box.phar compile
+box.phar compile
 
 phar_test=$(./dev-bin/phar-test.php)
 if [[ -n $phar_test ]]; then
@@ -112,7 +108,7 @@ if [[ -n $phar_test ]]; then
 fi
 
 # Download test deps
-php composer.phar update
+composer.phar update
 
 ./vendor/bin/phpunit
 
@@ -141,20 +137,11 @@ if [ -n "$(git status --porcelain)" ]; then
     exit 1
 fi
 
-# Using Composer is possible, but they don't recommend it.
-phpdocumentor_phar_hash='aa00973d88b278fe59fd8dce826d8d5419df589cb7563ac379856ec305d6b938  phpDocumentor.phar'
-
-if ! echo "$phpdocumentor_phar_hash" | sha256sum -c; then
-    wget -O phpDocumentor.phar https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.8.1/phpDocumentor.phar
-fi
-
-echo "$phpdocumentor_phar_hash" | sha256sum -c
-
 # Use cache dir in /tmp as otherwise cache files get into the output directory.
 cachedir="/tmp/phpdoc-$$-$RANDOM"
 rm -rf "$cachedir"
 
-php phpDocumentor.phar \
+phpDocumentor.phar \
     --visibility=public \
     --cache-folder="$cachedir" \
     --title="GeoIP PHP API $tag" \

mise.lock

@@ -6,6 +6,9 @@ disable_backends = [
 ]
 
 [tools]
+"github:box-project/box" = "latest"
+"github:composer/composer" = "latest"
+"github:phpDocumentor/phpDocumentor" = "latest"
 hugo = "latest"
 lychee = "latest"