composer / getcomposer.org

getcomposer.org sources

Home Page:http://getcomposer.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Composer Download page haven't updated checksum.

mekanixdk opened this issue · comments

My composer.json:

N/A

Output of composer diagnose:

N/A

When I run this command:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === 'c5b9b6d368201a9db6f74e2611495f369991b72d9c8cbd3ffbc63edff210eb73d46ffbfce88669ad33695ef77dc76976') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"

I get the following output:

Installer corrupt

And I expected this to happen:

Composer installed. I looks like the checksum haven't been updated here https://getcomposer.org/download/ after the latest release.

Website is outdated.

If using https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md

set -x
EXPECTED_CHECKSUM="$(wget -q -O - https://composer.github.io/installer.sig)"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
++ wget -q -O - https://composer.github.io/installer.sig
+ >EXPECTED_CHECKSUM=e0012edf3e80b6978849f5eff0d4b4e4c79ff1609dd1e613307e16318854d24ae64f26d17af3ef0bf7cfb710ca74755a
+ php -r 'copy('\''https://getcomposer.org/installer'\'', '\''composer-setup.php'\'');'
++ php -r 'echo hash_file('\''sha384'\'', '\''composer-setup.php'\'');'
+ >ACTUAL_CHECKSUM=e0012edf3e80b6978849f5eff0d4b4e4c79ff1609dd1e613307e16318854d24ae64f26d17af3ef0bf7cfb710ca74755a

Give different result compared to https://getcomposer.org/download/ hash:

php -r "if (hash_file('sha384', 'composer-setup.php') === 'c5b9b6d368201a9db6f74e2611495f369991b72d9c8cbd3ffbc63edff210eb73d46ffbfce88669ad33695ef77dc76976') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"

So website should have:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === 'e0012edf3e80b6978849f5eff0d4b4e4c79ff1609dd1e613307e16318854d24ae64f26d17af3ef0bf7cfb710ca74755a') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"
commented

Duplicate of #148

Fixed now sorry about that.