Is it possible to validate vendor folder integrity in composer?

Question

I just inherited a composer project in a very bad shape. They sent me a zip file with the vendor directory in it and I suspect that the previous developer has edited files directly inside vendor.

Is there a way to "validate" the vendor folder to ensure that the files inside are unmodified?

Answer 1

1. Change the name of the old vendor to something else.

2. Execute composer install again.

3. Run diff to compare both directories.

E.g. for a sample project where I intentionally modified a single file inside vendor.

$ mv vendor vendor_old
$ composer install

### install output...

$ diff -rq vendor vendor_old

Files vendor/autoload.php and vendor_old/autoload.php differ
Files vendor/composer/autoload_files.php and vendor_old/composer/autoload_files.php differ
Files vendor/composer/autoload_real.php and vendor_old/composer/autoload_real.php differ
Files vendor/composer/autoload_static.php and vendor_old/composer/autoload_static.php differ
Files vendor/symfony/console/Terminal.php and vendor_old/symfony/console/Terminal.php differ

You can mostly ignore the changes to the autoload* files, but with this listing you can concentrate in those other files that report differences (and run a more exhaustive diff from them).

In the example, only vendor/symfony/console/Terminal.php was actually modified.

Answer 2

Copy the project into some other folder, and delete the vendor directory. Run composer install and compare two vendor files.