search

CircleCI-Public / php-orb

A PHP Orb for CircleCI
https://circleci.com/orbs/registry/orb/circleci/php
MIT License
4 stars 17 forks source link

Task install-composer: unnecessary dependency, reduced functionality #32

Open Sweetchuck opened 2 years ago

Sweetchuck commented 2 years ago

CURL dependency

Currently the install-composer task uses the curl SHELL command to download the Composer installer. https://github.com/CircleCI-Public/php-orb/blob/87336d5b26372040c6c6500cb332003bdb0846b7/src/commands/install-composer.yml#L19

I think this is an unnecessary dependency and it is not available in minimalist Docker image. The next command is sudo php ..., it means a working PHP has to be available, which is quite understandable in light of the fact we want to use the Composer.

The official install script is:

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === '55ce33d7678c5a611085589f1f3ddf8b3c52d662cd01d4ba75c0ee0459970c2200a51f492d557530c71c15d8dba01eae') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"

PHP \copy() function could be used to download a remote file instead of SHELL curl.

Leftover composer-setup.php file

Orb does not delete the composer-setup.php file after it was used.

Checksum validation is skipped

The integrity of the downloaded composer-setup.php is not checked. I know, it is a bit tricky, because the hash is changing time to time.

configurable filename

composer-setup.php has a --filename CLI option. Orb has no such a parameter. This is problem because I can't (easily) download two different version of composer. For example 1.x and 2.x, because the destination file always be the same

How to install Composer programmatically