#microformats 2026-10-08

2026-10-08 UTC
jeremy, trwnh, Danyone, Billy1, Billy2, IWSlackGateway and [jeremycherfas] joined the channel
#
Zegnat I also added support for the new HTMLDocument to my link extractor not too long ago. I was surprised how little of a change it was to support both. https://github.com/Zegnat/php-linkextractor/pull/12
#
Zegnat I skipped the whole thing of namespaces in the selectors and instead made the XPaths depend on local-name(), which you can think of as the element name minus any potential prefix. That XPath works for both DOM implementations.
#
GWG Zegnat: So you agree it make sense to offer it over an external library where available?
#
Zegnat Yes
#
Zegnat Did we ever make the external library required in the PHP mf2 parser? I vaguely remember it being an optional step that a user could choose to make use of
#
GWG Optional.
#
GWG But this would be a newer built in parser with a fallback for older versions, meaning most people would get HTML5 without a library
#
Zegnat I might be able to have a look tonight, and see if I can make a PR similar to the one I did there to my own library.
[social], Saige_Leah, bubblefemmes[d], strugee, Saphire, kal_jan, [tantek], barnaby, [aciccarello] and [pfefferle] joined the channel
#
[pfefferle] I am just checking the compatibility of the Webmention Plugin for WordPress with the next version 7.2 and I stumbled upon some PHP-MF2 (deprecation) issues
#
[pfefferle] are there any objections to merging https://github.com/microformats/php-mf2/pull/264
#
Loqi [preview] [jrfnl] #264 Fix PHP 8.4 compatibility / drop support for PHP < 7.1
#
[pfefferle] or even deprecate up to 7.4? https://github.com/microformats/php-mf2/pull/269
#
Loqi [preview] [jtojnar] #269 Remove implicit nullability deprecated in PHP 8.4
#
gRegor This is the current plan, we're still awaiting someone with GPG signing to release the last version that supports PHP56, then immediately after, one with those updates: https://github.com/microformats/php-mf2/issues/277
#
Loqi [preview] [gRegorLove] #277 Final updates before next release
#
aaronpk Oh, I can resurrect my PGP setup
#
aaronpk My 10 year key expired finally lol
[snarfed] joined the channel
#
[snarfed] congratu...dolences?
#
[pfefferle] Can we maybe also allow [gRegorLove] to sign releases?
#
gRegor I need to get set up with GPG
#
gRegor More specifically, the milestones https://github.com/microformats/php-mf2/milestone/5 and https://github.com/microformats/php-mf2/milestone/7
#
gRegor How necessary is the whole strict setup for GPG, like the "use an airgapped computer" etc?
#
gRegor Last time I set it up (also about 10 years), I used Tails
#
[pfefferle] ☺️
[capjamesg] joined the channel
#
aaronpk I did my whole setup on an airgapped computer but mostly for funsies
#
[snarfed] wow, ambitious!
#
aaronpk It was... inconvenient
#
aaronpk I want to see if there's a way to use a yubikey for the parent key and sign sub keys with it that live on my computer. That would make it a lot faster to regenerate the sub keys yearly or every other year, and would have similar security properties as an airgapped computer. But this is way off topic for this channel now lol
#
[snarfed] feels like work aaronpk creeping into personal aaronpk
#
[snarfed] like, what's the high stakes IdP opsec equivalent of a homelab 😆
[artlung] and slovak joined the channel
#
[tantek] any discussion of airgapping security measures welcome, perhaps more in #indieweb-dev though? especially with the "indie" nature of setting up / maintaining your own keys etc.
#
[tantek] [snarfed] I won't be worried until he starts telling us about his homemade faraday cage with chicken wire
[Leo] joined the channel
#
gRegor XD
#
Zegnat Is GPG signing still the norm at all? I haven’t done PHP releases in a while. I have seen a lot of node packaging slowly move to attestations instead: ie. Microsoft/GitHub signs that the contents of the release match the contents of the repository so you ensure that the code you see is the code you end up with. Which feels about as trustworthy as a GPG key from an open-source contributor that I also have a hard time verifying anyway.
#
gRegor Good question
#
[tantek] when will GWG signing become the norm though? He is good at shipping PHP releases.
#
aaronpk I haven't kept up tbh. If there's a better way I'm happy to switch
#
gRegor Found https://docs.npmjs.com/generating-provenance-statements
#
Zegnat Correct, that is what I meant :)
#
Zegnat It looks like Sigstore and provenance has not landed in composer yet. Or at least not yet as of May. It was still planned as a future thing https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
#
Zegnat So maybe not an option for us right now. Good to know they are working on it