Issue #3117558 by alexpott, xjm, longwave: 9.0.x core's hash in composer.lock is wrong

composer.lock

@@ -457,7 +457,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "f8e50d64acdddb816b10f83ca307712bd2cd65e5"
+                "reference": "1135d82ca80e22e7f25b1bd9a8613cae5ae06372"
             },
             "require": {
                 "asm89/stack-cors": "^1.1",

core/tests/Drupal/Tests/ComposerIntegrationTest.php

@@ -21,6 +21,17 @@ public function testComposerLockHash() {
     $content_hash = self::getContentHash(file_get_contents($this->root . '/composer.json'));
     $lock = json_decode(file_get_contents($this->root . '/composer.lock'), TRUE);
     $this->assertSame($content_hash, $lock['content-hash']);
+
+    // @see \Composer\Repository\PathRepository::initialize()
+    $core_content_hash = sha1(file_get_contents($this->root . '/core/composer.json') . serialize([]));
+    $core_lock_file_hash = '';
+    foreach ($lock['packages'] as $package) {
+      if ($package['name'] === 'drupal/core') {
+        $core_lock_file_hash = $package['dist']['reference'];
+        break;
+      }
+    }
+    $this->assertSame($core_content_hash, $core_lock_file_hash);
   }
 
   /**