Magento2 Setup Commands Change $COMPOSER_HOME

[ktomk]

The COMPOSER_HOME environment variable is unnecessarily changed by Marketplace for local authentication storage.

Albeit local authentication storage is possible w/o changing the user-configured COMPOSER_HOME, the auth.json file must only be written next to the composer.json file.

It's not Magentos business to tamper with the users system-wide (global) composer configuration anyway.

[ktomk]

Some references:

• Report in Sample Data Installation issue #2523
• From reviewing a more severe PR fixing problematic file-access to auth.json: Fix direct file deletion by MarketplaceManager #3095
• Smaller cache-restoration fix PR that is superfluous when changes to COMPOSER_:HOME have been removed but should help already today to reduce the impact: Preserve Composer cache directory in MagentoComposerApplication composer#1
• Benefits of using the local auth.json file (and the tip to put it to .gitignore) are detailed in the Composer documentation about HTTP basic authentication.

[mazhalai]

@ktomk Thank you, we have created MAGETWO-48580 to investigate and fix.

[vancoz]

Hi @ktomk, I have commented and addressed your questions in #2523.
In case if you feel that this explanation is not enough or you have idea or approach how to implement it in better, I can reopen tickets and we can continue discussion.
Thank you!

[ktomk]

@vancoz: Thanks for explaining. I can see your arguments here: #2523 (comment) but I don't have the time for a full retraction right away. But for the (IMHO) most important point - authentication credentials - I miss to see how placing auth.json into the project directory isn't by far more superior in case then. As I already brought this up earlier, maybe you could elaborate on that a bit and how it won't work in favour of what has been explained about authentication?

[ktomk]

@vancoz: Could you write about the rationale why it's preferable to mangle the composer home environment variable instead of just having auth.json next to composer.json? I still miss to see it and it would be great if you could enlighten me on this one.

[vancoz]

HEllo @ktomk, because composer home directory contains not only auth.json. It also has composer cache and configuration for Magento web server user. Also we can not use make Magento root directory as composer home.

[ktomk]

@vancoz: Thanks for your feedback. Indeed, that sheds some light, because it shows an entire misunderstanding what I'm writing about - which I can see is my fault as I haven't made clear how my concerns shifted. I'm recently first of all concerned about the authentication file named auth.json. There is no need to place it into the composer home at all (nor making the project directory the new composer home - which would be crazy, wouldn't it?).

My suggestion is to put the auth.json just beside composer.json instead of inside the composer home directory. This is supported by composer. I'm curious why doing it this way is not the preferred way, so I was asking for that in my previous two comments.

So far the Magento code (and docs) suggests the auth.json should be placed into the global composer home. But this is just not necessary at all (and in the end somewhat problematic because the composer home is changed later). As I see all this and your feedback it looks like that when this feature integrated, nobody in charge was aware of that alternative auth.json location.

So I hope this is then good news to you all if you weren't aware of that feature. All I now want to know now is then if you still prefer the home dir over this project based workflow for composer authentication. Or if not, what the considerations would be as for the authentication I don't see any.

[ktomk]

@vancoz: I hope that seeing no feedback from your end is not a sign of preference. If possible it would be great if you could get some feedback especially to the last paragraph of my previous comment.

[airtonix]

@vancoz @magento-admin Two years later and no response. It would be good if at least someone at Magento responded.