[Bug 1220083] New: php-composer2: composer has a broken signature
https://bugzilla.suse.com/show_bug.cgi?id=1220083 Bug ID: 1220083 Summary: php-composer2: composer has a broken signature Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs@suse.de Reporter: glaser@b1-systems.de QA Contact: qa-bugs@suse.de Target Milestone: --- Found By: --- Blocker: --- Composer 2.7.1 as it is currently available in Tumbleweed crashes due to a broken signature and is unsuable. Steps to reproduce: - launch a container based on docker.io/opensuse/tumbleweed:latest - install the package `php-composer2` - run `composer --version` Expected result: composer prints on shell: `Composer version 2.7.1 2024-02-09 15:26:28` Actual result: composer crashes with: ``` PHP Fatal error: Uncaught PharException: phar "/usr/bin/composer2" has a broken signature in /usr/bin/composer2:28 Stack trace: #0 /usr/bin/composer2(28): Phar::mapPhar() #1 {main} thrown in /usr/bin/composer2 on line 28 ``` Affected version: composer 2.7.1-1.1 Additional Information: A diffoscope comparison between the composer 2.7.1 executable from upstream (getcomposer.org) and `/usr/bin/composer2` from openSUSE's package reveals that `/usr/bin/composer2` differs only by an additional, superfluous `0xa0` at the end. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1220083 https://bugzilla.suse.com/show_bug.cgi?id=1220083#c1 --- Comment #1 from Felix Glaser <glaser@b1-systems.de> --- I've noticed a typo in my report, the superfluous byte at the end of `/usr/bin/composer2` is in fact `0x0a` - something in openSUSE's packaging workflow seems to add a trailing newline in the composer executable. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1220083 https://bugzilla.suse.com/show_bug.cgi?id=1220083#c2 Bernd Ritter <comrad@posteo.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |comrad@posteo.de --- Comment #2 from Bernd Ritter <comrad@posteo.de> --- The sha256 of the composer.phar in OSC is different than the original composer.phar from the upstream project: composer.phar from OSC: 5f3d57c8cf61916bee35d1ffa567652e6ced4d7aca02749ff30e0e7efc38bfd3 composer.phar composer.phar from upstream (https://getcomposer.org/download/2.7.1/composer.phar.sha256sum): 1ffd0be3f27e237b1ae47f9e8f29f96ac7f50a0bd9eef4f88cdbe94dd04bfff0 composer.phar -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1220083 https://bugzilla.suse.com/show_bug.cgi?id=1220083#c3 --- Comment #3 from Bernd Ritter <comrad@posteo.de> --- (In reply to Bernd Ritter from comment #2)
The sha256 of the composer.phar in OSC is different than the original composer.phar from the upstream project:
composer.phar from OSC: 5f3d57c8cf61916bee35d1ffa567652e6ced4d7aca02749ff30e0e7efc38bfd3 composer.phar
composer.phar from upstream (https://getcomposer.org/download/2.7.1/composer.phar.sha256sum): 1ffd0be3f27e237b1ae47f9e8f29f96ac7f50a0bd9eef4f88cdbe94dd04bfff0 composer.phar
I've sent a submit request to the package maintainers with a fix. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1220083 https://bugzilla.suse.com/show_bug.cgi?id=1220083#c4 Bernd Ritter <comrad@posteo.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #4 from Bernd Ritter <comrad@posteo.de> --- The package's phar file now matches the SHA256 from the upstream project. The problem should be fixed now. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1220083 https://bugzilla.suse.com/show_bug.cgi?id=1220083#c5 --- Comment #5 from Felix Glaser <glaser@b1-systems.de> --- I can confirm that the issue is fixed. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com