Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package php-composer2 for openSUSE:Factory checked in at 2026-08-01 18:33:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/php-composer2 (Old) and /work/SRC/openSUSE:Factory/.php-composer2.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php-composer2" Sat Aug 1 18:33:57 2026 rev:38 rq:1368848 version:2.10.2 Changes: -------- --- /work/SRC/openSUSE:Factory/php-composer2/php-composer2.changes 2026-07-17 01:44:19.334960728 +0200 +++ /work/SRC/openSUSE:Factory/.php-composer2.new.16738/php-composer2.changes 2026-08-01 18:37:08.211955509 +0200 @@ -1,0 +2,8 @@ +Fri Jul 31 12:16:36 UTC 2026 - Petr Gajdos <[email protected]> + +- fix a regression on s390x due last change [bsc#1271729] +- added patches + https://github.com/Seldaek/phar-utils/pull/13 + * php-composer2-little-endian-no-machine-order.patch + +------------------------------------------------------------------- New: ---- php-composer2-little-endian-no-machine-order.patch ----------(New B)---------- New: https://github.com/Seldaek/phar-utils/pull/13 * php-composer2-little-endian-no-machine-order.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php-composer2.spec ++++++ --- /var/tmp/diff_new_pack.FO4YWp/_old 2026-08-01 18:37:08.851977542 +0200 +++ /var/tmp/diff_new_pack.FO4YWp/_new 2026-08-01 18:37:08.855977680 +0200 @@ -29,6 +29,8 @@ # 161DFBE342889F01DDAC4E61CBB3D576F2A0946F Source3: %{name}.keyring Patch0: php-composer2-compiler-env.patch +# https://github.com/Seldaek/phar-utils/pull/13 +Patch1: php-composer2-little-endian-no-machine-order.patch BuildRequires: php-cli BuildRequires: php-phar Requires: php >= 7.2.5 ++++++ php-composer2-little-endian-no-machine-order.patch ++++++ >From d058888bd0345070272809fac50b7c07fd2483e6 Mon Sep 17 00:00:00 2001 From: Martin Pluskal <[email protected]> Date: Thu, 30 Jul 2026 15:36:54 +0200 Subject: [PATCH] Write phar fields little-endian, not in machine byte order The phar file format stores all multi-byte values little-endian. The reader was fixed in #3 (unpack('L') -> unpack('V')), but the two write sites still use pack('L'), which is machine byte order. On a big-endian host this writes every manifest entry timestamp and the signature-flags word byte-swapped. PHP's phar extension reads them back little-endian, so the signature type is unrecognised and the archive is rejected with "broken or unsupported signature" - the phar is unusable. It also breaks the reproducibility this class exists to provide, since the same input yields different output per architecture. pack('V') is the little-endian counterpart of pack('L') and matches the existing unpack('V') on the read side. --- src/Timestamps.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: composer-2.10.2/vendor/seld/phar-utils/src/Timestamps.php =================================================================== --- composer-2.10.2.orig/vendor/seld/phar-utils/src/Timestamps.php +++ composer-2.10.2/vendor/seld/phar-utils/src/Timestamps.php @@ -73,7 +73,7 @@ $pos += 4 + $filenameLength; $pos += 4; -$timeStampBytes = pack('L', $timestamp); +$timeStampBytes = pack('V', $timestamp); $this->contents[$pos + 0] = $timeStampBytes[0]; $this->contents[$pos + 1] = $timeStampBytes[1]; $this->contents[$pos + 2] = $timeStampBytes[2]; @@ -120,7 +120,7 @@ $algo = $algos[$signatureAlgo]; $signature = hash($algo, substr($this->contents, 0, $pos), true) -. pack('L', $signatureAlgo) +. pack('V', $signatureAlgo) . 'GBMB';
