blob: a00d9a078dcf1ad1e4d6daf7f5abdc7203276921 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
#!/bin/sh
# Fetches the external plugin the E2E test runs against, into the git-ignored ext/
# directory. The plugin is pinned to an immutable upstream commit and the extracted
# files are verified by hash, so the test stays deterministic without the third-party
# source ever entering this repository. Requires network once; the E2E test skips
# itself while ext/ is absent.
set -eu
# composer/installers v2.3.0
commit=12fb2dfe5e16183de69e784a7b84046c43d97e8e
# GitHub archives are content-addressed by the commit, but the archive encoding is not
# guaranteed stable; the extracted files are what the test consumes, so they are what
# gets pinned. This tree holds a hundred installer classes, so the pin is one digest over
# the sorted per-file digests rather than a line per file.
expected=2f9bb837ed1374985909cf33eb1e6e33d0dc3bf1eb0c55599c7326a886bf4f50
ext="$(dirname "$0")/ext"
dir="$ext/composer-installers-2.3.0"
if [ -f "$dir/src/Composer/Installers/Installer.php" ]; then
echo "already fetched: $dir"
exit 0
fi
# Staged next to the destination and only moved into place once verified, so a mismatched
# tree is never observable under the name the test looks for.
staging="$ext/.staging-$commit"
mkdir -p "$staging"
# The CI workflows are not part of the installed package and would only add noise to the
# digest.
curl -fsSL "https://codeload.github.com/composer/installers/tar.gz/$commit" \
| tar -xz -C "$staging" --strip-components=1 --exclude='.github'
actual=$(cd "$staging" && find . -type f | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
if [ "$actual" != "$expected" ]; then
echo "hash mismatch: expected $expected, got $actual" >&2
echo "the fetched tree was left in $staging for inspection; delete it before retrying" >&2
exit 1
fi
mv "$staging" "$dir"
echo "fetched: $dir"
|
