In T249461#6030625, @Legoktm wrote:

In T249461#6030592, @bd808 wrote:

I honestly am not sure why we don't just use the upstream PHAR file, but I won't try to readjudicate that decision at this time.

Storing binary files in git isn't the greatest, and at the time we were using git to deploy composer to the various CI instances. But since we use docker now we can just keep the sha256sum in the repo and download the phar during the image build process and verify it then. 👍 from me.

The only thing I know of that would need to change in parallel for this is the way that we provision Composer in Toolforge. Right now we are cloning the integration/composer repo via Puppet for use on the bastions and grid engine exec nodes. We are also using it in our PHP Docker images. Both should be possible to fix up to follow the CI changes.

Bots don't seem to be working...

https://gerrit.wikimedia.org/r/#/c/integration/config/+/586154/

Change 586154 had a related patch set uploaded (by Reedy; owner: Reedy):
[integration/config@master] Replace integration/composer repo with composer.phar

https://gerrit.wikimedia.org/r/586154

Change 586155 had a related patch set uploaded (by Reedy; owner: Reedy):
[integration/config@master] dockerfiles: [composer-php70] Update composer to v1.10.1

https://gerrit.wikimedia.org/r/586155

I'd like us to have the ability to reproducibly build composer phars before we start using upstream's binary files. I tried doing it just now and it seems like there's some very minor binary change:

(python3) user@dev ~/g/l/t/r/composer> diffoscope upstream.phar composer.phar
2020-04-05 18:57:22 W: diffoscope.main: Fuzzy-matching is currently disabled as the "tlsh" module is unavailable.
--- upstream.phar
+++ composer.phar
@@ -62,2407 +62,2407 @@
 000003d0: 0a0a 5f5f 4841 4c54 5f43 4f4d 5049 4c45  ..__HALT_COMPILE
 000003e0: 5228 293b 203f 3e0d 0ae8 9500 00f9 0100  R(); ?>.........
 000003f0: 0011 0000 0001 000d 0000 0063 6f6d 706f  ...........compo
 00000400: 7365 722e 7068 6172 0000 0000 2b00 0000  ser.phar....+...
 00000410: 7372 632f 436f 6d70 6f73 6572 2f41 7574  src/Composer/Aut
 00000420: 6f6c 6f61 642f 4175 746f 6c6f 6164 4765  oload/AutoloadGe
 00000430: 6e65 7261 746f 722e 7068 7051 6900 0035  nerator.phpQi..5
-00000440: 9167 5e51 6900 0010 24f8 e8b6 0100 0000  .g^Qi...$.......
+00000440: 9167 5e51 6900 0010 24f8 e8a4 0100 0000  .g^Qi...$.......

(repeat for nearly every included file)

601 vs 401.

Is it a composer repo bug or a php bug causing non reproducible builds?

Change 586155 abandoned by Reedy:
dockerfiles: [composer-php70] Update composer to v1.10.1

https://gerrit.wikimedia.org/r/586155

In T249464#6030702, @Legoktm wrote:

I'd like us to have the ability to reproducibly build composer phars before we start using upstream's binary files. I tried doing it just now and it seems like there's some very minor binary change:

(python3) user@dev ~/g/l/t/r/composer> diffoscope upstream.phar composer.phar
2020-04-05 18:57:22 W: diffoscope.main: Fuzzy-matching is currently disabled as the "tlsh" module is unavailable.
--- upstream.phar
+++ composer.phar
@@ -62,2407 +62,2407 @@
 000003d0: 0a0a 5f5f 4841 4c54 5f43 4f4d 5049 4c45  ..__HALT_COMPILE
 000003e0: 5228 293b 203f 3e0d 0ae8 9500 00f9 0100  R(); ?>.........
 000003f0: 0011 0000 0001 000d 0000 0063 6f6d 706f  ...........compo
 00000400: 7365 722e 7068 6172 0000 0000 2b00 0000  ser.phar....+...
 00000410: 7372 632f 436f 6d70 6f73 6572 2f41 7574  src/Composer/Aut
 00000420: 6f6c 6f61 642f 4175 746f 6c6f 6164 4765  oload/AutoloadGe
 00000430: 6e65 7261 746f 722e 7068 7051 6900 0035  nerator.phpQi..5
-00000440: 9167 5e51 6900 0010 24f8 e8b6 0100 0000  .g^Qi...$.......
+00000440: 9167 5e51 6900 0010 24f8 e8a4 0100 0000  .g^Qi...$.......

(repeat for nearly every included file)

601 vs 401.

Do you want to file an issue Upstream with composer?

In T249464#6030702, @Legoktm wrote:

I'd like us to have the ability to reproducibly build composer phars before we start using upstream's binary files. I tried doing it just now and it seems like there's some very minor binary change:

(python3) user@dev ~/g/l/t/r/composer> diffoscope upstream.phar composer.phar
2020-04-05 18:57:22 W: diffoscope.main: Fuzzy-matching is currently disabled as the "tlsh" module is unavailable.
--- upstream.phar
+++ composer.phar
@@ -62,2407 +62,2407 @@
 000003d0: 0a0a 5f5f 4841 4c54 5f43 4f4d 5049 4c45  ..__HALT_COMPILE
 000003e0: 5228 293b 203f 3e0d 0ae8 9500 00f9 0100  R(); ?>.........
 000003f0: 0011 0000 0001 000d 0000 0063 6f6d 706f  ...........compo
 00000400: 7365 722e 7068 6172 0000 0000 2b00 0000  ser.phar....+...
 00000410: 7372 632f 436f 6d70 6f73 6572 2f41 7574  src/Composer/Aut
 00000420: 6f6c 6f61 642f 4175 746f 6c6f 6164 4765  oload/AutoloadGe
 00000430: 6e65 7261 746f 722e 7068 7051 6900 0035  nerator.phpQi..5
-00000440: 9167 5e51 6900 0010 24f8 e8b6 0100 0000  .g^Qi...$.......
+00000440: 9167 5e51 6900 0010 24f8 e8a4 0100 0000  .g^Qi...$.......

(repeat for nearly every included file)

601 vs 401.

I can't actually reproduce

git clone https://github.com/composer/composer.git
cd composer
git checkout 1.10.5
composer install
bin/compile
wget https://github.com/composer/composer/releases/download/1.10.5/composer.phar -O upstream.phar
diffoscope upstream.phar composer.phar

Output:

$ diffoscope upstream.phar composer.phar 
2020-04-10 18:38:34 W: diffoscope.main: Fuzzy-matching is currently disabled as the "tlsh" module is unavailable.
$ sha256sum *.phar
a1f79ebd0cdc6980ad0fe11fef5b1b02c96c1dbec383d81b750a214c5a79ded0  composer.phar
a1f79ebd0cdc6980ad0fe11fef5b1b02c96c1dbec383d81b750a214c5a79ded0  upstream.phar

Change 586154 merged by jenkins-bot:
[integration/config@master] dockerfiles: [composer-php70] Replace integration/composer repo with phar

https://gerrit.wikimedia.org/r/586154

Change 588032 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[integration/config@master] jjb: Move images to ones based on composer 1.10.5 phar not 1.6.5 local repo

https://gerrit.wikimedia.org/r/588032

Change 588032 merged by jenkins-bot:
[integration/config@master] jjb: Move to images based on composer 1.10.5 phar, not 1.6.5 local repo

https://gerrit.wikimedia.org/r/588032