Composer in Docker with signature verification

Dockerfile

FROM php

RUN apt-get update

# Install Composer
# @see https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md
ARG COMPOSER_URL="https://raw.githubusercontent.com/composer/getcomposer.org/d3e09029468023aa4e9dcd165e9b6f43df0a9999/web/installer"
ARG COMPOSER_SIGNATURE="93b54496392c062774670ac18b134c3b3a95e5a5e5c8f1a9f115f203b75bf9a129d5daa8ba6a13e2cc8a1da0806388a8"
RUN php -r "copy(getenv('COMPOSER_URL'), 'composer-setup.php'); \
  if (hash_file('sha384', 'composer-setup.php') === getenv('COMPOSER_SIGNATURE')) { \
    include('composer-setup.php'); } else { throw new Exception('Composer corrupted'); }" \
  && php -r "unlink('composer-setup.php'); rename('composer.phar', '/usr/local/bin/composer');"