From b31c4cbec3bf7e4845ac4d9a43ff75a449d533ec Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 5 Oct 2026 17:10:54 +0000
Subject: [PATCH] Sign the Phar with SHA-512 instead of SHA-256

PHP verifies the Phar signature over the whole archive every time
WP-CLI starts. SHA-512 is noticeably faster to compute than the SHA-256
default on 64-bit CPUs, which shaves a fixed cost off every invocation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D26yjkN2BiqCXT6p6o1WqS
---
 features/make-phar.feature | 11 +++++++++++
 utils/make-phar.php        |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/features/make-phar.feature b/features/make-phar.feature
index a38407078..d93b1566d 100644
--- a/features/make-phar.feature
+++ b/features/make-phar.feature
@@ -55,3 +55,14 @@ Feature: Check `utils/make-phar.php` output
       Error: Couldn't find plugin-status.mustache
       """
     And the return code should be 0
+
+  Scenario: Phar is signed with SHA-512
+    Given an empty directory
+    And a new Phar with the same version
+
+    When I run `cp {PHAR_PATH} signed.phar`
+    And I run `php -r 'echo (new Phar( "signed.phar" ))->getSignature()["hash_type"];'`
+    Then STDOUT should be:
+      """
+      SHA-512
+      """
diff --git a/utils/make-phar.php b/utils/make-phar.php
index 8aee6a586..2bfca7904 100644
--- a/utils/make-phar.php
+++ b/utils/make-phar.php
@@ -326,6 +326,10 @@ function get_composer_versions( $current_version ) {
 EOB
 );
 
+// PHP verifies the signature over the whole archive on every invocation, and
+// SHA-512 is noticeably faster to compute than the SHA-256 default on 64-bit CPUs.
+$phar->setSignatureAlgorithm( Phar::SHA512 );
+
 $phar->stopBuffering();
 
 chmod( DEST_PATH, 0755 ); // Make executable.