Generate hash_salt while install

[zviryatko]

If you have an active project based on this repo and someone has cloned it and running locally he gets php throwable error, because Drupal is required a hash salt. So is it secure to generate hash_salt in post-install script via this command? echo "\$settings['hash_salt'] = '$(php -r 'print bin2hex(openssl_random_pseudo_bytes(32, $cstrong = TRUE));')';" >> web/sites/default/settings.php

[greg-1-anderson]

openssl_random_pseudo_bytes is available in php 5.3 and later, so seems good to me.

Maybe we should first check to see if settings.php already defines 'hash_salt'?

[zviryatko]

We can put it into this check: if [ ! -f web/sites/default/settings.php ].

[FatherShawn]

The code that preps and copies settings.php in scripts/composer/ScriptHandler.php is in a conditional check for settings.php already existing. So why does running composer require wipe my salt value?