Kevin Herrera

I'm afraid I don't know what else I can do on my end. I believe that this is a problem with the phar extension itself, which may not be closing...

@lserni Thanks for the additional info! I'll see if I can write a small code example to trigger this issue.

Found an [open bug](https://bugs.php.net/bug.php?id=53467) on PHP's bug tracker which pretty much describes what we're experiencing. Here's a snippet that will reproduce the issue: ``` php

Unfortunately I'm not experienced enough in C, and even then it could be a while before we see anything become of the fix. From what I recall, the PHP extension...

Hi @tomzx, are you using a custom vendor directory location in your `composer.json` file?

I'm leaning towards no on this issue because I feel like this will give users a false sense of security GitHub does become compromised.

Would it be reasonable to assume that if any of the release files are tampered with, that the files used in the `gh-pages` branch could also be tampered with? I...

Adding a note to myself, this can be done using `Phar::copy()`.

I'm not sure how this would work for running Box from installations that are not in the current working directory path.

When you run `box build`, the entire archive is rebuilt from scratch. Unfortunately, incremental building isn't supported in this version of box, but it is planned for the next version...