Deployer: Provide deployer.phar as release asset on github

[dnaber-de]

As already mentioned in #940 supporting phive as installer would be a nice thing. Since phive comes now with the --force-accept-unsigned flag it can install pretty much any tool that provides a phar file as release asset on Github. For example it's possible to install composer via phive right away with:

phive install --force-accept-unsigned composer/composer

as composer uploads a phar file to each release: https://github.com/composer/composer/releases/tag/1.10.1

[ThomasNegeli]

We tried out phive in our company.
It is a good way to install dependencies that you do not want to have in your composer.json.
But we decided not to go this way.
The problem with phive is, that it relies on keyservers to check download integrity.
This is a good and secure way, and phive also added more keyservers some month ago.
But the problem with this is, that the keyservers need to be up and available each time a developer wants to install software.
This also happens during deployment.
And keyservers are not very stable.
Our customers would love me when they hear the sentence: "no, I can't deploy now, because a keyserver is down".

There already is a dist distribution without dependencies that you can integrate in your project: https://packagist.org/packages/deployer/dist
This is a far more stable way then relying on phive.

[dnaber-de]

As I wrote in the ticket, Phive provides a flag that bypasses key verification and just downloads a .phar assigned to a Github release.

[antonmedv]

I think now the deployer release process complicated enough. First, it should be simplified.

[szepeviktor]

We have a lot of misunderstandings here.

1. the keyservers are needed 1× at the very beginning to get the public part of the signing GPG key, the key is then saved to ~/.phive
2. Composer is designed to distribute/manage PHP source code not PHAR files
3. Phive is the tool to distribute PHAR files
4. it is much more difficult to have deployer/dist than uploading a PHAR file and a signature to this very repo's releases as assets

[antonmedv]

1. the keyservers are needed 1× at the very beginning to get the public part of the signing GPG key, the key is then saved to ~/.phive

Good to know.

1. Composer is designed to distribute/manage PHP source code not PHAR files

This is try, but it can distribute phar files as well. See deployer/dist.

1. Phive is the tool to distribute PHAR files.

This is a fact.

1. it is much more difficult to have deployer/dist than uploading a PHAR file and a signature to this very repo's releases as assets

It is not much more difficult. It's a little bit more complicated, but it’s already implemented and working.

Again, my point is what I don't want to rush into new release process/tool. Let’s wait to see how it will be adopted by the community.

[szepeviktor]

how it will be adopted by the community.

I'm working on making phive popular!