(chore) Adapt recommended composer install script into our setup to remove the static hash comparison
Request to merge 815-composer-setup into master
The source branch is 4 commits behind the target branch
0/1 thread resolved
changed milestone to %sprint: Modest Monkey
added Priority::2 - Normal Squad::Blue Status::InProgress Type::Chore scoped labels
approved this merge request
approved this merge request
added 3 commits
- d01c821b...14f32dc5 - 2 commits from branch
master - bc2f027b - Merge branch 'master' into 815-composer-setup
- d01c821b...14f32dc5 - 2 commits from branch
approved this merge request
Last updated by Guy Thouret4 4 rm -rf ../vendor 5 5 6 6 # Setup composer 7 EXPECTED_SIGNATURE="$(wget -q -O - https://composer.github.io/installer.sig)" - Owner
Should installer.sig not be saved to our repo or CI? If composer repo is compromised then we could be vulnerable to installing a bad version.
DeveloperDepends on how likely a supply chain attack is?
The hash/keys for verification look to be hosted separately to the installer itself... https://composer.github.io/pubkeys.html
- Developer
In reality we'll probably just update the hash and continue on with our day as was the case with the most recent hash change. This just cuts out that step.
added MR::Requires Changes scoped label
