Which method verifies restored vendor tree matches original after Composer backup?

Answer

The reliable way to confirm that a restored vendor tree is bit‑for‑bit identical to the original is to compare a recursive checksum (or a directory diff) taken before backup with the same value after restoration.

Confirmed facts

• Composer has no built‑in command that checks whether the files in vendor match composer.lock; composer validate only verifies JSON syntax and lock consistency.
• Running composer install (or composer update --lock) with an unchanged composer.lock will reinstall the exact versions recorded in the lock, producing a vendor tree that is identical when the same platform, PHP version, and --prefer-dist/--prefer-source settings are used.

Likely explanation

Because Composer cannot assert file‑level equality, you must create an independent fingerprint of the vendor directory before you back it up. After restoring (or reinstalling) the dependencies, recompute the fingerprint and compare the two values. If they match, the vendor tree is unchanged; any difference indicates drift.

Steps for this case

1. Before backup: generate a checksum manifest of the current vendor directory, e.g.

   find vendor -type f -exec sha256sum {} + | sort | sha256sum > vendor.sha256

   Store vendor.sha256 alongside your backup (or in a secure location).
2. Restore: if you only have composer.lock, run composer install (add --no-dev if you omitted dev packages in the backup).
3. After restore: recompute the checksum the same way and compare:

   find vendor -type f -exec sha256sum {} + | sort | sha256sum > vendor.new.sha256
   cmp vendor.sha256 vendor.new.sha256 && echo 'Vendor tree matches' || echo 'Vendor tree differs'

4. If you also backed up the vendor directory itself, you can skip the checksum and use a direct diff:

   diff -r vendor vendor-backup   # or rsync --rcv --checksum vendor/ vendor-backup/

Missing diagnostic detail

To decide whether the checksum method or a direct diff is appropriate, I need to know: Do you have a backup of the vendor directory, or only composer.lock? This detail changes the recommendation because a vendor backup enables a simple diff, whereas a lock‑only backup requires the checksum approach.