We already patch CryptoKeys in the RPM and DEB package, so we might as well directly point them to the real location instead of the symlinked location.

• RPM: https://git.sr.ht/~fkooman/php-saml-sp.rpm/tree/v2/item/SOURCES/php-saml-sp-autoload.patch#L75
• DEB: https://git.sr.ht/~fkooman/php-saml-sp.deb/tree/v2/item/debian/patches/autoload.patch#L85

Example:

ERROR: [RuntimeException] unable to read key file "/usr/share/php-saml-sp/keys/signing.crt"

Done for Fedora/EL: https://git.sr.ht/~fkooman/php-saml-sp.rpm/tree/v2-dev/item/SOURCES/php-saml-sp-keys-path.patch

Guess we can also remove the keys symlink under /usr/share/php-saml-sp...

Done for Debian / Ubuntu:

ERROR: [RuntimeException] unable to read key file "/etc/ssl/php-saml-sp/signing.crt"

What we need is production repository builds, it is available in testing now (v2-dev).

We could have also used realpath

$ php -r 'echo realpath("/usr/share/php-saml-sp/keys");'
/etc/ssl/php-saml-sp

One little issue:

$ php -r 'var_dump(realpath("/usr/share/php-saml-sp/keys/signing.crt"));'
bool(false)
$ sudo php -r 'var_dump(realpath("/usr/share/php-saml-sp/keys/signing.crt"));'
string(32) "/etc/ssl/php-saml-sp/signing.crt"

So, if there is no permission to access the file, it will return false, which doesn't help us! :(

So perhaps the DEB/RPM patches are still the best (most clear for admin) solution.