compare references when using dists

src/Composer/Installer.php

@@ -388,7 +388,12 @@ class Installer
                         break;
                     }
                 }
-                if (isset($lockedReference) && $lockedReference !== $package->getSourceReference()) {
+                $sourceReference = $package->getSourceReference() ?: $package->getDistReference();
+                if (isset($lockedReference) && $lockedReference !== $sourceReference) {
+                    if (!$package->getSourceType() && $package->getDistType()) {
+                        throw new \RuntimeException(sprintf('Dist reference (%s) does not match locked reference (%s)', $sourceReference, $lockedReference));
+                    }
+
                     // changing the source ref to update to will be handled in the operations loop below
                     $operations[] = new UpdateOperation($package, clone $package);
                 }

src/Composer/Package/Locker.php

@@ -232,7 +232,7 @@ class Locker
             $spec = array('package' => $name, 'version' => $version);
 
             if ($package->isDev() && !$alias) {
-                $spec['source-reference'] = $package->getSourceReference();
+                $spec['source-reference'] = $package->getSourceReference() ?: $package->getDistReference();
                 if ('git' === $package->getSourceType() && $path = $this->installationManager->getInstallPath($package)) {
                     $process = new ProcessExecutor();
                     if (0 === $process->execute('git log -n1 --pretty=%ct '.escapeshellarg($package->getSourceReference()), $output, $path)) {