dynamic expected checksum for composer in php

https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md

Signed-off-by: Aidan Oldershaw <aoldershaw@pivotal.io>

pipelines/php-larvel-app-testing.yml

@@ -28,11 +28,16 @@ jobs:
                 apt-get update
                 apt-get install -y git unzip
 
+                EXPECTED_CHECKSUM="$(wget -q -O - https://composer.github.io/installer.sig)"
                 php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
-                php -r "if (hash_file('sha384', 'composer-setup.php') === 'a5c698ffe4b8e849a443b120cd5ba38043260d5c4023dbf93e1558871f1f07f58274fc6f4c93bcfd858c6bd0775cd8d1') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
-                php composer-setup.php --filename=composer --install-dir=/usr/bin
-                php -r "unlink('composer-setup.php');"
+                ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
 
+                if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
+                then
+                    >&2 echo 'ERROR: Invalid installer checksum'
+                    rm composer-setup.php
+                    exit 1
+                fi
                 cd larvel-websockets-git
 
                 composer install