* master:
Add tests for edge cases of packages providing names which exist as real packages
Add another test verifying that a package may provide an incompatible version of sth that actually exists
Fix provider coexistence test, needs another requirement to install both
Fix test filename to end with .test extension so it gets run
Update config section to note required scope for GitLab tokens
Fix pre/post-package-install/update/uninstall events receiving a partial list of operations, fixes#9079
Also remove credentials from cache dirs in git/svn drivers, fixes#7439, refs #9155
AuthHelper: Allow fall-through GitLab-specific HTTP headers for auth
Sanitize repo URLs to mask HTTP auth passwords from cache directory
Util/Zip: fix strpos args order
Previously, `AuthHelper` consumed the authentication credentials for GitLab domains and added access tokens as GitLab-specific headers.
[Composer repositories now supported in GitLab](https://php.watch/articles/composer-gitlab-repositories) require standard Authorization headers with a personal access to function, which failed to work due to out GitLab-specific headers.
With this commit, AuthHelper checks if the password is an access token, and falls through to HTTP basic authentication even if the domain name is a GitLab domain name.
* master: (59 commits)
Update deps
Reuse repository manager and others directly from the Composer instance, refs #9057
Fix usage of create-project with local filesystem repos
Fix return value
Add support for multiple --repository additions in create-project, and make --add-repository delete the lock file, fixes#8853
Remove cygwin php handling in UAC elevation
Clean up a little to make impl less invasive and to handle replacers/providers
Supply event dispatcher in Create Project Command
Avoid attempting to use /etc/xdg as base config home, fixes#9053, refs #9045
Create an issue @ Docker repository on tag
Mark transaction classes internal, refs #8827
Prepare 1.10.9 release
Remove highest/lowest builds for 1.10 maintenance branch
Fix bitbucket detection of redirects to login page, fixes#9041
Fix doc comment
Fixed spelling mistake
Add Windows UAC elevation to self-update command
GitLab: clarify interactive auth prompt
Improve support for XDG and default to XDG config dir if both that and ~/.composer are available, fixes#9045Fix#9033 - inconsistent behavior with minor-only flag
...
* RemoteFilesystemTest: simplifying some mock expectations calls
- will($this->returnValue()) to willReturn()
- will($this->returnCallBack()) to willReturnCallback()
* RemoteFilesystemTest: extracting identical mocks for IOInterface into a separate getIOInterfaceMock() method
* RemoteFilesystemTest: converting protected helper methods to private.
* RemoteFilesystemTest: moving getConfigMock() private method after the public methods (with other private methods)
* adding RemoteFileSystemTest::testCopyWithRetryAuthFailureFalse() unit test.
* Allow optional injecting of AuthHelper into RemoteFilesystem constructor.
* adding RemoteFileSystemTest::testCopyWithSuccessOnRetry() unit test.
* using backward compatible @expectedException in RemoteFilesystemTest.php
* RemoteFilesystemTest: extracting RemoteFilesystem with mocked method creation into a separate method.
* RemoteFilesystemTest: extracting AuthHelper with mocked method creation into a separate method.
* Add AuthHelper::addAuthenticationHeader() test on missing authentication credentials.
* Add AuthHelper::addAuthenticationHeader() test on bearer password.
* Add AuthHelper::addAuthenticationHeader() test on Github token.
* Add AuthHelper::addAuthenticationHeader() test on Gitlab Oauth token.
* Add $authenticationDisplayMessage write expectation to AuthHelper::addAuthenticationHeader() tests.
* Add AuthHelper::addAuthenticationHeader() test on Gitlab private token.
* Add AuthHelper::addAuthenticationHeader() test on Bitbucket Oauth token.
* Add AuthHelper::addAuthenticationHeader() test on Bitbucket public urls.
* Add AuthHelper::addAuthenticationHeader() test on Basic Http Authentication.
* Add AuthHelper::isPublicBitBucketDownload() tests.
* Rename AuthHelperTest $credentials variable to $auth.
* Add AuthHelper::storeAuth() test for auto-store option.
* Add AuthHelper::storeAuth() test for user prompt and y(es) answer.
* Add AuthHelper::storeAuth() test for user prompt and n(o) answer.
* Add AuthHelper::storeAuth() test for user prompt with invalid answer.
* Add AuthHelper::promptAuthIfNeeded() test for Github authentication failure.
- add GitHub hard dependency mock (new GitHub(...) mock)
* Run AuthHelper::promptAuthIfNeeded() tests only with PHP > 5.3
* Run AuthHelper::promptAuthIfNeeded() tests only with PHP >= 5.4
* Run AuthHelper::promptAuthIfNeeded() tests only with PHP 5.4
* Exclude PHPStan analyses of '../tests/Composer/Test/Util/Mocks/*'
* Exclude AuthHelper::promptAuthIfNeeded() tests from current pull request.
* Extract repetitive AuthHelperTest authentication expectation into a method.
PackageSorter weighs the importance of a package
by counting how many times it is required by other packages.
This works by calculating the weight for each package name.
However currently the package index of the package array
is currently passed the weigh function, which basically
disables package sorting.
The reason for that is, that a package repository previously
returned the package list as associative array with package name as keys,
but currently just as an array with integer keys.
Therefore we must extract the package name from the package
before passing it to the weigh function.
The only automatic conflict we have results from packages using the same name
either by literally having the same name and being different versions or they
replace the same name, so
- removed all types of obsolete rules
- simplified rule generation significantly
- got rid of provide filtering in the pool
- fixed some language in error handling
Prevent aliases to be duplicated: no need to apply root aliases from
composer.json on packages currently locked, they should have their
aliases in the lock file, otherwise request an update.
This is necessary to allow the requiring of new packages which replace
packages currently locked without requiring explicitly listing them as
an argument, so simplifies the composer require command
This reduces code complexity while making partial updates more
predictable. This also allows composer require to successfully run a
partial update for a new package with transitive dependency updates.
You can specify a list of funding options each with a type and URL. The
type is used to specify the kind of funding or the platform through
which funding is possible.
The "composer install" can create the vendor/dir folders and be used as a script item on composer.json. Having another script running after it that relies on vendor/bir binaries (such as phpunit) will cause it to not find the binary. This fix addresses the issue by trying to append the path on each script iteration.
The only type of request job remaining was "install" which is really a
root requirement. The only other kind of input for the solver is now a
set of fixed packages.
Rules have been updated to account for only two kinds of former job
reason: FIXED or ROOT_REQUIRE. The job property has always been
redundant and has been removed, since reasonData suffices.
Problem reasons are always rules, so the unnecessary wrapping in an
array has been removed.
We now only ever generate a single rule per root require or fixed
package, so there is no need for the solver to special handle disabling
"jobs" anymore, the rule can just be disabled as usual.
For consistency special handling of rules for jobs in problems has been
integrated into the rule class like all other rule reasons. As part of
this change the error message for root requirements has been improved a
bit to make it clearer where the package installation request came from.
The word job has also been removed from operations, which are called
operations, not jobs.
Currently, preferred-install accepts the hash of patterns as the value in the composer.json. I've followed the same approach as used in extra and platform for letting the user define install preferences through CLI in the format: `composer config preferred-install my-organization/stable-package.dist`.
This includes two breaking changes:
- the hostname is not resolved in the case of an IP address.
- a hostname with a trailing period (FQDN) is not matched.
This brings the basic implementation in line with curl behaviour, with
the addition of full IP address and range matching (curl does not
differentiate between IP addresses host names).
The NO_PROXY environment variable can be set to either a comma-separated
list of host names that should not use a proxy, or single asterisk `*`
to match all hosts.
- Port numbers can be included by prefixing the port with a colon `:`.
- IP addresses can be used, but must be enclosed in square brackets
`[...]` if they include a port number.
- IP address ranges can specified in CIDR notation, separating the IP
address and prefix-length with a forward slash `/`.
We now output an update when only a source or dist ref changes even if
it's a stable version so in these cases the output needs to contain the
ref to make it clear to users what changed
This also changes the PRE/POST_PACKAGE_INSTALL/UPDATE/UNINSTALL events to have less information available on them, repositorySet, request and policy are gone
* github-composer/2.0: (63 commits)
Fix PSR warnings for optimized autoloader, refs #8397, refs #8403
Prepare 1.9.1 changelog
Output a hint that maybe you are not in the right directory, fixes#8404
Fix PSR warnings for optimized autoloader, refs #8397, refs #8403
Fix tests for PSR-fix in optimized autoloader, refs #8397
Fix tests for PSR-fix in optimized autoloader, refs #8397
Change PSR-fix for optimized autoloader to only warn for now, refs #8397
Fix output of dump-autoload command to avoid interfering with warnings, refs #8397
Remove credentials from git remotes in cache and vendor dirs
Avoid overwriting credentials with existing ones from git repos, refs #8293
Fix github auth to try https with pwd also, fixes#8356
Fix gitlab support for basic-auth fallback from ssh URLs
Avoid clearing the error output during removeDirectory execution, losing git error output, fixes#8351
Move test file parsing into try/catch block to avoid phpunit swallowing errors
make optimized autoloader respect PSR standards
Validate composer show with --tree and --path options set (#8390)
Don't show root warning for docker containers
Added phpdoc for ComposerAutoloaderInit$SHA1::getLoader() (#8393)
Validate schema name, type and version
Fix require command to allow working on network mounts, fixes#8231
...
The solver now only calculates a lock file transaction which does not
need to be sorted in order of dependencies. This is only necessary for
the local repo transaction generated without the solver during install
The pool builder tries to be minimal so it's fine for present/locked
packages not be assigned a solver/pool id. Adding a test to verify
correct creation of uninstall jobs
These special commands no longer (ab)use the partial update mechanism
but rather create a special install request for all current lock file
contents and later override any modified code references to the
originals. This leads to up to date remote metadata but no other
changes.
Commit: 149250ab92
ProcessExecutor::escape handled a false value inconsistently across
platforms, returning an emtpy string on Windows, otherwise `''`. This
is fixed to return `""` on Windows.
The GitDownloaderTest code has been appropriately updated.
This only removes the credentials if they are managed by composer auth.json or equivalent, if the credentials were present in the package URL to begin with they might remain
Refs #8293Fixes#3644Closes#3608
Particularly the test
tests/Composer/Test/Fixtures/installer/partial-update-downgrades-non-whitelisted-unstable.test
is interesting because it verifies that an older version will be
installed on update if the new one is only present in the installed repo
or vendor dir. This was the cause of a lot of weird edge cases and
unreliable update behavior in Composer v1
As a result some lock file packages are no longer in the pool, so the
former installed map, now present map cannot use package ids anymore
Need to revisit some more code later to simplify this, todo notes left
Ensures packages get loaded from locked repo correctly. We may not want
to support this particular use-case at all, but for now it fixes the
existing test, so we may want to revisit this later.
New approach is to use only the solved set of packages as input and then
to resolve with only the non-dev requirements and to mark everything as
dev that is not part of the result set, rather than transitioning a
temporary local repo state by uninstalling dev packages.
* github-composer/2.0: (48 commits)
Fix missing use/undefined var
Split up steps on VCS downloaders to allow doing network operations before touching the filesystem on GitDownloader, fixes#7903
Fix use statement
Deduplicate findHeaderValue code
Add install-path to the installed.json for every package, fixes#2174, closes#2424
Remove unnecessary config from phpstan
Make sure the directory exists and will not block installation later when downloading
Avoid wiping the whole target package if download of the new one fails, refs #7929
Only empty dir before actually installing packages, fixes#7929
Improve output when installing packages
Show best possible version in diagnose command
Remove extra arg
Allow path repos to point to their own source dir as install target, resulting in noop, fixes#8254
Fix use of decodeJson
Fix update mirrors to also update transport-options, fixes#7672
Fix updating or URLs to include dist type and shasum, fixes#8216
Fix origin computation
Improve handling of non-standard ports for GitLab and GitHub installs, fixes#8173
Load packages from the lock file for check-platform-reqs if no dependencies have been installed yet, fixes#8058
Fix error_handler return type declaration
...
* 2.0: (101 commits)
SVN: hide passwords for debug output
Free $solver asap
fixes#8179
[minor] Fixed a typo in the CHANGELOG.md.
Update deps
Update changelog
Revert "Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET" Revert "Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151"
Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151
Fix display of HHVM warning appearing when HHVM is not in use, fixes#8138
Read classmap-authoritative and apcu-autoloader from project config when installing via create-project, fixes#8155
Use possessive quantifiers
Update xdebug-handler to 1.3.3
fixes#8159
Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET
flag should come before script name
use full command name, not abbreviated/alias
modify text
Document the alternatives to disable the default script timeout
Anchor pattern
Fix URL resolution for Composer repositories
...
* master: (48 commits)
SVN: hide passwords for debug output
Free $solver asap
fixes#8179
[minor] Fixed a typo in the CHANGELOG.md.
Update deps
Update changelog
Revert "Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET" Revert "Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151"
Add docs for COMPOSER_SELF_UPDATE_TARGET, refs #8151
Fix display of HHVM warning appearing when HHVM is not in use, fixes#8138
Read classmap-authoritative and apcu-autoloader from project config when installing via create-project, fixes#8155
Use possessive quantifiers
Update xdebug-handler to 1.3.3
fixes#8159
Allow overriding self-update target file with envvar COMPOSER_SELF_UPDATE_TARGET
flag should come before script name
use full command name, not abbreviated/alias
modify text
Document the alternatives to disable the default script timeout
Anchor pattern
Fix URL resolution for Composer repositories
...
Composer was unable canonicalize URLs in non-HTTP(S) Composer
repositories. For example it was not possible to use a `providers-url`
in a repository loaded via the `file://` scheme.
See also: #8115
- Introduce separate Lock and LocalRepo transactions, one for changes
to the lock file, one for changes to locally installed packages based
on lock file
- Remove various hacks to keep dev dependencies updated and
incorporated the functionality into the transaction classes
- Remove installed repo, there are now local repo, locked repo and
platform repo
- Remove access to local repo from solver, only supply locked packages
- Update can now be run to modify the lock file but not install packages
to local repo
* master:
Follow up to #7946 test: add solver flag to assert path execution
Fix tests
Make sure config command output is also output on --quiet so that warnings can be hidden, fixes#7963
Recognize composer-plugin-api as a platform package, fixes#7951
Quote wildcards to avoid issues in some shells, fixes#7960
Avoid dumping null values for dist reference/shasum and source reference, fixes#7955
Soften hard exit after revert of composer file
Make unixy proxy code POSIX compatible
Update aliases.md
Same but for Problem.php
Better error message for present but incompatible versions
Fix inconsistent casing
Don't do (new Foo())->bar() - not 5.3-compatible
Support identifying the HHVM version when not running with HHVM
* master:
Fix solver problem exceptions with unexpected contradictory "Conclusions"
Also load config into IO if not freshly created
Only load configuration into IO if IO is available
Fix defaultRepos fallback does not use auth config
Add warning/info msg when tweaking disable-tls setting to avoid confusion, fixes#7935
* 1.8:
Fix solver problem exceptions with unexpected contradictory "Conclusions"
Also load config into IO if not freshly created
Only load configuration into IO if IO is available
Fix defaultRepos fallback does not use auth config
This 5 character fix comes with a solver test as well as a functional
installer test essentially verifying the same thing. The solver test is
more useful when working on the solver. But the functional test is less
likely to be accidentally modified incorrectly during refactoring, as
every single package, version and link in the rather complex test
scenario is essential, and a modified version of the test may very well
still result in a successful installation but no longer verify the bug
described below.
Background:
In commit 451bab1c2c from May 19, 2012 I
refactored literals from complex objects into pure integers to reduce
memory consumption. The absolute value of an integer literal is the id
of the package it refers to in the package pool. The sign indicates
whether the package should be installed (positive) or removed (negative),
So a major part of the refactoring was swapping this call:
$literal->getPackageId()
For this:
abs($literal)
Unintentionally in line 554/523 I incorrectly applied this change to the
line:
$this->literalFromId(-$literal->getPackageId());
It was converted to:
-abs($literal);
The function literalFromId used to create a new literal object. By using
the abs() function this change essentially forces the resulting literal
to be negative, while the minus sign previously inverted the literal, so
positive into negative and vice versa.
This particular line is in a function meant to analyze a conflicting
decision during dependency resolution and to draw a conclusion from it,
then revert the state of the solver to an earlier position, and attempt
to solve the rest of the rules again with this new "learned" conclusion.
Because of this bug these conclusions could only ever occur in the
negative, e.g. "don't install package X". This is by far the most likely
scenario when the solver reaches this particular line, but there are
exceptions.
If you experienced a solver problem description that contained a
statement like "Conclusion: don't install vendor/package 1.2.3" which
directly contradicted other statements listed as part of the problem,
this could likely have been the cause.
hhvm-nightly (and the next release) are no longer able to execute
Composer. Support executing Composer with PHP to install dependencies
for hack projects.
The goal is for this to be temporary, until Hack identifies a new
package manager, given that Composer does not aim to be a multi-language
package manager.
fixes#7734
The update command can receive a pattern like `vendor/prefix-*`
to update all matching packages.
This has not worked if multiple packages, depending on each other,
where matched to the given pattern. No package has been updated
in this case as only the first package matching the pattern was
added to the whitelist.
Pool construction depends on the install request now, so only required
packages get loaded, add some structure for future asynchronously
loading composer repositories
Breaking change for the plugin interface so bumping the version of
composer-plugin-api to 2.0.0
First step for a refactoring of the package metadata loading mechanism
Added a encapsulated group to the replacement parameter of the `preg_replace` for GitLab in `\Composer\Util\Url::updateDistReference()`. This fixes#6994.
Where systems use multiple ini files it is perhaps more useful to
suggest running `php --ini` to see their locations, rather than showing
the loaded php.ini (if one exists).
Some packages, e. g. `tm/tooly-composer-script`, are using the composer classes to e. g. create symlinks or perform other file operations. While there's only a `copyThenRemove()` method this commit introduces a new `copy()` method. `copy()` behaves the same as the copy part of `copyThenRemove()` did with one exception: it returns `true` on success and `false` on failure. Copying a directory may lead to a `false`, while the whole directory or some of its files couldn't been copied. To ensure backwards compatibility `copyThenRemove()` calls `copy()` now. This commit also adds the necessary tests.
When currently executing the `require` command for a package that is already listed in `require(-dev)`, one must use the exact same, case matching package name as written in `composer.json`. That is, if one changes the case of a character in the package name, the `require` command will add a new entry to `require(-dev)`, instead of updating the existing one.
This commit fixes the described behaviour to make it consistent with other commands like `update` that are already case insensitive.
A negative list of non-feature-branches names
is already supported - this patch adds a list of
branches names which *will* be considered as
feature branches.
Allows changing the currently hardcoded set of
expected feature branch names, from:
* master|trunk|default|develop
To any set of names or patterns that you desire.
Current versions of Git output the commit hash as detached HEAD instead
of FETCH_HEAD. The VersionGuesser should be able to handle commit hashes
as well as FETCH_HEAD to detect the correct branch of a commit.
It is known that composer update takes a lot of memory: #5915, #5902,
I am playing with a profiler (@blackfireio) to make a demo in my local
PHP meetup (@phpvigo) and I found out a way to use less memory. These
are my first tests:
* Private project using PHP 5.6:
* Memory: from 1.31GB to 1.07GB
* Wall Time: from 2min 8s to 1min 33s
* symfony-demo using PHP 7.1 in my old mac book:
* Memory: from 667MB to 523MB
* Wall Time: from 5min 29s to 5min 28s
Not use an array inside conflict rules is this improvement main idea:
```php
<?php
//Memory 38MB
gc_collect_cycles();
gc_disable();
class Rule
{
public $literals;
public function __construct(array $literals)
{
$this->literals = $literals;
}
}
$rules = array();
$i = 0;
while ($i<80000){ //
$i++;
$array = array(-$i, $i);
$rule = new Rule($array);
$rules[] = $rule;
}
```
```php
<?php
//Memory 11.1MB
gc_collect_cycles();
gc_disable();
class Rule2Literals
{
public $literal1;
public $literal2;
public function __construct($literal1, $literal2)
{
$this->literal1 = $literal1;
$this->literal2 = $literal2;
}
}
$rules = array();
$i = 0;
while ($i<80000){ //
$i++;
$rule = new ConflictRule(-$i, $i);
$rules[] = $rule;
}
```
More info https://github.com/composer/composer/pull/6168
The former implementation used the 'src' endpoint which returned some meta data as well.
This has been replaced with the 'raw' endpoint which does not return the meta data and does not need an extra JSON decode step.
Jordi Boggiano