File composer.phar from getcomposer.org is different than file composer.phar from repository

[pmasior]

I downloaded file composer.phar from official website and from Releases in Composer GitHub repository, but these files are different.

I checked earlier versions. From version 2.0.0 to 2.0.8 corresponding versions of composer.phar from the website and GitHub repository are the same. From version 2.0.9 to version 2.0.11, corresponding versions downloaded from the website and GitHub repository are different. Is it expected? Below I paste sha256sums.

eabf2917072096a94679193762501319e621e2b369a4a1256b2c27f4e6984477  composer(2.0.11_www).phar
d6eee0d4637f4bd82bdae098fceda300dcb3ec35bf502604fbe7510933b8f952  composer(2.0.11_gitrel).phar
92cb8b75268b23d1275e6d72dd398b29244505bea6d1f247ba126fd45a990645  composer(2.0.10_www).phar
72a5a68d12f315d74d931462413f7e114cd77b4be1a6b9494141dda93410751a  composer(2.0.10_gitrel).phar
24faa5bc807e399f32e9a21a33fbb5b0686df9c8850efabe2c047c2ccfb9f9cc  composer(2.0.9_www).phar
8e91344a5ca2fc0fb583c50f195a1f36918908561c4ea3d6f01a4ef01c3b8560  composer(2.0.9_gitrel).phar

2021f0d52b446e0efe3c548cc058ab5671fa38cdbcf814e7911c7e9d71d61538  composer(2.0.8_www).phar
2021f0d52b446e0efe3c548cc058ab5671fa38cdbcf814e7911c7e9d71d61538  composer(2.0.8_gitrel).phar
0a060e8caf1d5cde55c4562fd68369b08cf231b8fd30da9c8f994b111557ebe9  composer(2.0.7_www).phar
0a060e8caf1d5cde55c4562fd68369b08cf231b8fd30da9c8f994b111557ebe9  composer(2.0.7_gitrel).phar
e5e39d8fa699ddb09844f6b4388280ff2c805fef0a7c26580c5bbc91ac35091b  composer(2.0.6_www).phar
e5e39d8fa699ddb09844f6b4388280ff2c805fef0a7c26580c5bbc91ac35091b  composer(2.0.6_gitrel).phar
e786d1d997efc1eb463d7447394b6ad17a144afcf8e505a3ce3cb0f60c3302f9  composer(2.0.5_www).phar
e786d1d997efc1eb463d7447394b6ad17a144afcf8e505a3ce3cb0f60c3302f9  composer(2.0.5_gitrel).phar
c3b2bc477429c923c69f7f9b137e06b2a93c6a1e192d40ffad1741ee5d54760d  composer(2.0.4_www).phar
c3b2bc477429c923c69f7f9b137e06b2a93c6a1e192d40ffad1741ee5d54760d  composer(2.0.4_gitrel).phar
5d377e9b504dc9f6c9228d81c321ba85290512cdb396a12d3708b0cd30d2e20c  composer(2.0.3_www).phar
5d377e9b504dc9f6c9228d81c321ba85290512cdb396a12d3708b0cd30d2e20c  composer(2.0.3_gitrel).phar
5e122edd0f2a4fb01172b6b1c156b3d252d9205105b4ad169a4b09913ba6a859  composer(2.0.2_www).phar
5e122edd0f2a4fb01172b6b1c156b3d252d9205105b4ad169a4b09913ba6a859  composer(2.0.2_gitrel).phar
4b4b118cc54662e4813ba86efb215fdb19c5b29944c5919b4f2803c915aa2234  composer(2.0.1_www).phar
4b4b118cc54662e4813ba86efb215fdb19c5b29944c5919b4f2803c915aa2234  composer(2.0.1_gitrel).phar
139657aa2b37867800292724145e3c4895f7755d845758b403dc329d17bdd285  composer(2.0.0_www).phar
139657aa2b37867800292724145e3c4895f7755d845758b403dc329d17bdd285  composer(2.0.0_gitrel).phar

Files downloaded from repository (version 2.0.4 and later) are signed with key 161D FBE3 4288 9F01 DDAC 4E61 CBB3 D576 F2A0 946F. I didn't found any actual information about signature files on the official website.

If my ticket is unfounded, I sorry about that.

[stof]

Looks like 44dc3c2 implemented signing for the phars in github releases, but that the same was not applied for the website...

[stof]

hmm, no. That commit only adds the GPG signature, but it does not impact the phar. That's likely something else.

[Seldaek]

Thanks for catching this @pmasior!

The issue was that I started building phars for getcomposer.org using PHP8 which results in slightly different whitespace in the phar file due to token_get_all() behavior variations.

I rebuilt the 2.0.9 / 10 / 11 phars with 7.4 to match github ones. Future versions will be built on PHP 8 on github as well.

[pmasior]

Thanks for explaining and solving the problem

[mnme]

This checksum change should probably be communicated on an official channel to make it clear that this is intended. I just encountered a hash mismatch in homebrew (see linked issue above), but this will probably impact other systems as well.

[Seldaek]

Right, sorry about that. I guess I shouldn't have updated them in retrospect, but now it's done it's probably best to leave it rather than cause even more mess.

[joseluisq]

This checksum change should probably be communicated on an official channel to make it clear that this is intended. I just encountered a hash mismatch in homebrew (see linked issue above), but this will probably impact other systems as well.

Yeah, also there is no announce in the website https://getcomposer.org/download/

In my case I have just realized today about the mismatch, d6eee0d4637f4bd82bdae098fceda300dcb3ec35bf502604fbe7510933b8f952 in favor of eabf2917072096a94679193762501319e621e2b369a4a1256b2c27f4e6984477 for the same 2.0.11 version when our CI pipeline just broke.

[Seldaek]

Just FYI, 2.0.12 was now released and I can confirm both my build and the automatic build on GH actions are exactly the same sha256 (82ea8c1537cfaceb7e56f6004c7ccdf99ddafce7237c07374d920e635730a631) so the fix looks good.