Verify Composer's signature instead of pinning its version and checksum

The turbo container legs downloaded a pinned Composer (COMPOSER_VERSION and
COMPOSER_PHAR_SHA256), which had fallen behind (2.9.2 while 2.10.3 is out)
and needed a manual bump with a new checksum each time.

download-composer.sh takes the newest Composer 2 release and verifies it
the way `composer self-update` does: the release's composer.phar.sig must
verify against Composer's "Tags" public key, committed as composer-tags.pub
from https://composer.github.io/pubkeys.html, which is hosted apart from
getcomposer.org. A compromised getcomposer.org still cannot supply a phar
that passes, and there is nothing left to bump. A phar that fails the
check is deleted instead of being left where the step would run it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017h1GfB7vfJPgwcTHD9Fth6

Author: ondrejmirtes

.github/scripts/composer-tags.pub

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0Vi/2K6apCVj76nCnCl2
+MQUPdK+A9eqkYBacXo2wQBYmyVlXm2/n/ZsX6pCLYPQTHyr5jXbkQzBw8SKqPdlh
+vA7NpbMeNCz7wP/AobvUXM8xQuXKbMDTY2uZ4O7sM+PfGbptKPBGLe8Z8d2sUnTO
+bXtX6Lrj13wkRto7st/w/Yp33RHe9SlqkiiS4MsH1jBkcIkEHsRaveZzedUaxY0M
+mba0uPhGUInpPzEHwrYqBBEtWvP97t2vtfx8I5qv28kh0Y6t+jnjL1Urid2iuQZf
+noCMFIOu4vksK5HxJxxrN0GOmGmwVQjOOtxkwikNiotZGPR4KsVj8NnBrLX7oGuM
+nQvGciiu+KoC2r3HDBrpDeBVdOWxDzT5R4iI0KoLzFh2pKqwbY+obNPS2bj+2dgJ
+rV3V5Jjry42QOCBN3c88wU1PKftOLj2ECpewY6vnE478IipiEu7EAdK8Zwj2LmTr
+RKQUSa9k7ggBkYZWAeO/2Ag0ey3g2bg7eqk+sHEq5ynIXd5lhv6tC5PBdHlWipDK
+tl2IxiEnejnOmAzGVivE1YGduYBjN+mjxDVy8KGBrjnz1JPgAvgdwJ2dYw4Rsc/e
+TzCFWGk/HM6a4f0IzBWbJ5ot0PIi4amk07IotBXDWwqDiQTwyuGCym5EqWQ2BD95
+RGv89BPD+2DLnJysngsvVaUCAwEAAQ==
+-----END PUBLIC KEY-----

.github/scripts/download-composer.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+# Downloads the newest Composer 2 release into ./composer.phar and verifies
+# it the way `composer self-update` does: the release's signature
+# (composer.phar.sig, RSA over SHA-384) must verify against Composer's "Tags"
+# public key, committed next to this script (composer-tags.pub, from
+# https://composer.github.io/pubkeys.html — hosted apart from
+# getcomposer.org). A compromised or impersonated getcomposer.org cannot
+# supply a phar that passes, and there is no version or checksum to bump.
+#
+# POSIX sh: it also runs in the Alpine build containers. Needs curl and a PHP
+# with the openssl extension, which Composer requires anyway.
+set -eu
+
+KEY="$(dirname "$0")/composer-tags.pub"
+# the download path of the newest 2.x release, e.g. /download/2.10.3/composer.phar
+# shellcheck disable=SC2016 # PHP code, not shell expansions
+RELEASE=$(curl -fsSL --retry 3 https://getcomposer.org/versions | php -r '
+	$path = json_decode(stream_get_contents(STDIN), true, 512, JSON_THROW_ON_ERROR)["2"][0]["path"] ?? "";
+	if (preg_match("~^/download/2\.[0-9]+\.[0-9]+/composer\.phar$~", $path) !== 1) {
+		fwrite(STDERR, "unexpected Composer 2 download path: $path\n");
+		exit(1);
+	}
+	echo $path;
+')
+# verified under another name first, so a phar that fails is never left
+# where the caller runs it
+curl -fsSLo composer.phar.unverified --retry 3 "https://getcomposer.org$RELEASE"
+curl -fsSLo composer.phar.sig --retry 3 "https://getcomposer.org$RELEASE.sig"
+# shellcheck disable=SC2016 # PHP code, not shell expansions
+php -r '
+	$signature = json_decode(file_get_contents("composer.phar.sig"), true, 512, JSON_THROW_ON_ERROR)["sha384"] ?? null;
+	$decoded = is_string($signature) ? base64_decode($signature, true) : false;
+	if ($decoded === false || openssl_verify(file_get_contents("composer.phar.unverified"), $decoded, file_get_contents($argv[1]), OPENSSL_ALGO_SHA384) !== 1) {
+		fwrite(STDERR, "the Composer download does not match its signature\n");
+		unlink("composer.phar.unverified");
+		exit(1);
+	}
+' "$KEY"
+rm composer.phar.sig
+mv composer.phar.unverified composer.phar
+echo "Composer $(php composer.phar --version --no-ansi 2>/dev/null | sed -n 's/^Composer version \([^ ]*\).*/\1/p'), signature verified"

.github/scripts/find-turbo-origins.sh

@@ -47,6 +47,8 @@ BUILD_INPUT_PATHS=(
 	turbo-ext/bin/pgo-train.sh
 	.github/turbo-build
 	.github/scripts/install-alpine-php.sh
+	.github/scripts/download-composer.sh
+	.github/scripts/composer-tags.pub
 	.github/scripts/install-php86-windows.sh
 	.github/scripts/download-php-windows-devel.sh
 	turbo-ext/bin/shared-core

.github/workflows/phar.yml

@@ -30,12 +30,6 @@ env:
   # The php-parser version whose grammar tables and semantic actions the
   # native parser engine (turbo-ext/src/parser/) was ported against.
   SUPPORTED_PHP_PARSER_VERSION: "v5.9.0"
-  # Composer for the turbo container legs, pinned by checksum. The distro
-  # composers are unusable there: jammy's 2.2.6 fatals under PHP 8.5, and
-  # Alpine's /usr/bin/composer is a shell wrapper hardwired to the
-  # distro-default PHP.
-  COMPOSER_VERSION: "2.9.2"
-  COMPOSER_PHAR_SHA256: "471f2d857abf0ec18af7b055e61472214d91adb24f9bdbbb864c1c64faad7dd6"
   # setup-php installs an 8.6 nightly, which has no matching Windows devel pack.
   PHP86_WINDOWS_VERSION: "8.6.0RC2"
 
@@ -520,14 +514,16 @@ jobs:
         with:
           ignore-cache: true
 
-      - name: "Install Composer dependencies (pinned composer)"
+      - name: "Install Composer dependencies (verified composer)"
         if: env.ORIGIN_RUN_ID == '' && matrix.target.family != 'macos'
-        # checksum-pinned composer, run under the matrix PHP so platform
-        # requirements are validated against the interpreter the build
-        # trains on
+        # signature-verified composer (.github/scripts/download-composer.sh;
+        # the distro composers are unusable here: jammy's 2.2.6 fatals under
+        # PHP 8.5, and Alpine's /usr/bin/composer is a shell wrapper
+        # hardwired to the distro-default PHP), run under the matrix PHP so
+        # platform requirements are validated against the interpreter the
+        # build trains on
         run: |
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           php composer.phar install --no-interaction --no-progress
           rm composer.phar
 
@@ -648,7 +644,7 @@ jobs:
         run: |
           docker run -d --name alpine-build \
             -v "$PWD:/work" -w /work \
-            -e PHP_MINOR -e PHP_ZTS -e COMPOSER_VERSION -e COMPOSER_PHAR_SHA256 \
+            -e PHP_MINOR -e PHP_ZTS \
             alpine:3.24 sleep 7200
 
       - name: "Install PHP and build tools"
@@ -663,12 +659,11 @@ jobs:
         run: docker exec alpine-build git config --global --add safe.directory /work
 
       # The training run of `make pgo` runs bin/phpstan on the checkout.
-      - name: "Install Composer dependencies (pinned composer)"
+      - name: "Install Composer dependencies (verified composer)"
         if: env.ORIGIN_RUN_ID == ''
         run: |
           docker exec -i alpine-build sh -e <<'EOF'
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           COMPOSER_HOME="$(mktemp -d)" php composer.phar install --no-interaction --no-progress
           rm composer.phar
           EOF
@@ -844,11 +839,10 @@ jobs:
         with:
           ignore-cache: true
 
-      - name: "Install Composer dependencies (pinned composer)"
+      - name: "Install Composer dependencies (verified composer)"
         if: matrix.variant == 'pie' && matrix.target.family != 'macos'
         run: |
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           php composer.phar install --no-interaction --no-progress
           rm composer.phar
 
@@ -961,7 +955,7 @@ jobs:
         run: |
           docker run -d --name alpine-build \
             -v "$PWD:/work" -w /work \
-            -e PHP_MINOR -e PHP_ZTS -e COMPOSER_VERSION -e COMPOSER_PHAR_SHA256 \
+            -e PHP_MINOR -e PHP_ZTS \
             "$ALPINE_IMAGE" sleep 7200
 
       - name: "Install PHP and build tools"
@@ -986,8 +980,7 @@ jobs:
         if: matrix.variant == 'pie'
         run: |
           docker exec -i -w /work alpine-build sh -e <<'EOF'
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           php composer.phar install --no-interaction --no-progress
           rm composer.phar
           cd turbo-ext
@@ -1874,11 +1867,10 @@ jobs:
         with:
           ignore-cache: true
 
-      - name: "Install Composer dependencies (pinned composer)"
+      - name: "Install Composer dependencies (verified composer)"
         if: ${{ matrix.container }}
         run: |
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           php composer.phar install --no-interaction --no-progress
           rm composer.phar
 
@@ -1988,7 +1980,7 @@ jobs:
         run: |
           docker run -d --name alpine-test \
             -v "$PWD:/work" -w /work \
-            -e PHP_MINOR -e PHP_ZTS -e COMPOSER_VERSION -e COMPOSER_PHAR_SHA256 \
+            -e PHP_MINOR -e PHP_ZTS \
             "$ALPINE_IMAGE" sleep 7200
 
       - name: "Install PHP and tools"
@@ -1997,11 +1989,10 @@ jobs:
       - name: "Trust the checkout despite the container/host uid mismatch"
         run: docker exec alpine-test git config --global --add safe.directory /work
 
-      - name: "Install Composer dependencies (pinned composer)"
+      - name: "Install Composer dependencies (verified composer)"
         run: |
           docker exec -i alpine-test sh -e <<'EOF'
-          curl -fsSLo composer.phar "https://getcomposer.org/download/$COMPOSER_VERSION/composer.phar"
-          echo "$COMPOSER_PHAR_SHA256  composer.phar" | sha256sum -c -
+          sh .github/scripts/download-composer.sh
           COMPOSER_HOME="$(mktemp -d)" php composer.phar install --no-interaction --no-progress
           rm composer.phar
           EOF