Hash installer verifying error

[fdiasr]

Composer installer was updated, so using repository outdated code I had an error message : "Invalid installer". I checked base/Dockerfile validation use SHA hardcoded.

Is not a good idea using installer.sig for it ?

Something like:

RUN export COMPOSER_INSTALLER_SHA384=$(curl https://composer.github.io/installer.sig) \
  && php -r "readfile('https://getcomposer.org/installer');" > /tmp/composer-setup.php \
  && php -r "if (hash('SHA384', file_get_contents('/tmp/composer-setup.php')) !== '${COMPOSER_INSTALLER_SHA384}') { unlink('/tmp/composer-setup.php'); echo 'Invalid installer' . PHP_EOL; exit(1); }"

[RobLoach]

Didn't know https://composer.github.io/installer.sig existed! Good call.... I'll push up a PR. Mind taking a look once it's up?

[fdiasr]

👍