fix setup script again, add composer.lock