doc: Add a doc entry for downloading the PHAR from GitHub (#885)

README.md

@@ -30,8 +30,8 @@ potentially very difficult to debug due to dissimilar or unsupported package ver
 
 - [Installation](docs/installation.md#installation)
     - [Phive](docs/installation.md#phive)
-    - [PHAR](docs/installation.md#phar)
     - [Composer](docs/installation.md#composer)
+    - [GitHub](docs/installation.md#github)
 - [Usage](#usage)
 - [Configuration](docs/configuration.md#configuration)
     - [Prefix](docs/configuration.md#prefix)

docs/installation.md

@@ -45,14 +45,35 @@ $ composer bin php-scoper require --dev humbug/php-scoper
 $ vendor/bin/php-scoper
 ```
 
+## GitHub
+
+You may download the Box PHAR directly from the [GitHub release][releases] directly.
+You should however beware that it is not as secure as downloading it from the other mediums.
+Hence, it is recommended to check the signature when doing so:
+
+```shell
+# Do adjust the URL based on the latest release
+wget -O box.phar "https://github.com/humbug/php-scoper/releases/download/0.18.4/php-scoper.phar"
+wget -O box.phar.asc "https://github.com/humbug/php-scoper/releases/download/0.18.4/php-scoper.phar.asc"
+
+# Check that the signature matches
+gpg --verify php-scoper.phar.asc php-scoper.phar
+
+# Check the issuer (the ID can also be found from the previous command)
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 74A754C9778AA03AA451D1C1A000F927D67184EE
+
+rm php-scoper.phar.asc
+chmod +x php-scoper.phar
+```
+
 
 <br />
 <hr />
 
 « [Table of Contents](../README.md#table-of-contents) • [Configuration](configuration.md#configuration) »
 
 
-[releases]: https://github.com/humbug/php-scoper/releases
 [composer]: https://getcomposer.org
 [bamarni/composer-bin-plugin]: https://github.com/bamarni/composer-bin-plugin
 [phive]: https://github.com/phar-io/phive
+[releases]: https://github.com/humbug/php-scoper/releases