php.buildComposerProject: don't allow use without lockfile

pkgs/build-support/php/hooks/composer-install-hook.sh

@@ -23,12 +23,7 @@ composerInstallConfigureHook() {
 
     if [[ ! -f "composer.lock" ]]; then
         echo "No composer.lock file found, consider adding one to your repository to ensure reproducible builds."
-
-        if [[ -f "${composerRepository}/composer.lock" ]]; then
-            cp ${composerRepository}/composer.lock composer.lock
-        fi
-
-        echo "Using an autogenerated composer.lock file."
+        exit 1
     fi
 
     chmod +w composer.json composer.lock

pkgs/build-support/php/hooks/composer-repository-hook.sh

@@ -18,15 +18,7 @@ composerRepositoryConfigureHook() {
 
     if [[ ! -f "composer.lock" ]]; then
         echo "No composer.lock file found, consider adding one to your repository to ensure reproducible builds."
-        composer \
-            --no-ansi \
-            --no-install \
-            --no-interaction \
-            ${composerNoDev:+--no-dev} \
-            ${composerNoPlugins:+--no-plugins} \
-            ${composerNoScripts:+--no-scripts} \
-            update
-        echo "Using an autogenerated composer.lock file."
+        exit 1
     fi
 
     echo "Finished composerRepositoryConfigureHook"
@@ -61,8 +53,8 @@ composerRepositoryInstallHook() {
 
     cp -ar repository/. $out/
 
-    # Copy the composer.lock files to the output directory, in case it has been
-    # autogenerated.
+    # Copy the composer.lock files to the output directory, to be able to validate consistency with
+    # the src composer.lock file where this fixed-output derivation is used
     cp composer.lock $out/
 
     echo "Finished composerRepositoryInstallHook"