ArrayLoader: handle none string values for version/version_normalized

[glaubinix]

Asserting that Package::getVersion/Package::getPrettyVersion always return a string. Currently this can return bool/int/float/string.

Additionally catching cases where version is not an array/object which currently throws a TypeError : trim(): Argument #1 ($string) must be of type string, array given

[stof]

I would even use is_string here. A valid package metadata contains a strict here, not other scalars (same for version_normalized)

[glaubinix]

Not sure this is a good idea. There are packages in popular repositories using int values as versions. This would essentially break those packages.

[stof]

which popular packages ?

Btw, for version_normalized, this should be doable: a normalized version cannot be represented as an int.

[glaubinix]

Not on any package on packagist.org but on wpackagist. Hard to say how common this is in other repositories.

Further limiting version_normalized could potentially break existing setups. For instance, the composer.json below successfully completes a composer update with the latest Composer release:

{
    "repositories": [
        {"type": "package", "package": {
            "name": "smarty/smarty",
            "version": "3",
            "version_normalized": 3,
            "dist": {
                "url": "https://www.smarty.net/files/Smarty-3.1.7.zip",
                "type": "zip"
            }
        }}
    ],
    "require": {
        "smarty/smarty": "*"
    }
}

[glaubinix]

Oh, but I think as long as we just overwrite version_normalized with a wrong type and not error then this should be ok.

[stof]

then wpackagist should really be fixed.

Providing a version_normalized that is not actually the normalized version as computed by Composer will break things when comparing versions (for inline packages, it is recommended to omit it and let composer compute it, but for composer repositories like packagist.org that have lots of packages, pre-computing the normalized version server-side helps with performance). And a valid normalized version cannot be casted as int, as it always have 4 segments (or starts with dev-).