(chore) Adapt recommended composer install script into our setup to remove the...

(chore) Adapt recommended composer install script into our setup to remove the static hash comparison - Fixes #815

tools/setup.sh

@@ -4,10 +4,23 @@
 rm -rf ../vendor
 
 # Setup composer
+EXPECTED_SIGNATURE="$(wget -q -O - https://composer.github.io/installer.sig)"
 php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
-php -r "if (hash_file('SHA384', 'composer-setup.php') === '48e3236262b34d30969dca3c37281b3b4bbe3221bda826ac6a9a62d6444cdb0dcd0615698a5cbe587c3f0fe57a54d8f5') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
-php composer-setup.php
-php -r "unlink('composer-setup.php');"
+ACTUAL_SIGNATURE="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
 
-# Grab dependencies
-php composer.phar install --ignore-platform-reqs
+if [ "$EXPECTED_SIGNATURE" != "$ACTUAL_SIGNATURE" ]
+then
+ >&2 echo 'ERROR: Invalid installer signature'
+ rm composer-setup.php
+ exit 1
+fi
+
+php composer-setup.php --quiet
+RESULT=$?
+rm composer-setup.php
+if [ $RESULT -eq 0 ]
+then
+ php composer.phar install --ignore-platform-reqs
+else
+ >&2 echo 'ERROR: composer-setup.php failed'
+fi