@@ -55,3 +55,14 @@ Feature: Check `utils/make-phar.php` output
       Error: Couldn't find plugin-status.mustache
       """
     And the return code should be 0
+
+  Scenario: Phar is signed with SHA-512
+    Given an empty directory
+    And a new Phar with the same version
+
+    When I run `cp {PHAR_PATH} signed.phar`
+    And I run `php -r 'echo (new Phar( "signed.phar" ))->getSignature()["hash_type"];'`
+    Then STDOUT should be:
+      """
+      SHA-512
+      """
@@ -326,6 +326,10 @@ function get_composer_versions( $current_version ) {
 EOB
 );
 
+// PHP verifies the signature over the whole archive on every invocation, and
+// SHA-512 is noticeably faster to compute than the SHA-256 default on 64-bit CPUs.
+$phar->setSignatureAlgorithm( Phar::SHA512 );
+
 $phar->stopBuffering();
 
 chmod( DEST_PATH, 0755 ); // Make executable.