Adds allow-plugins section to composer.json file for compatibility with Composer 2.2.x #34873

hostep · 2021-12-23T07:13:30Z

Description (*)

Composer 2.2 comes with a new security feature where you have to specify the plugins you trust in your composer.json file before they will be executed. At first the plugins will still get installed to ensure backwards compatibility, but according to the documentation around this new config option, this will change in July 2022 after which plugins will no longer be executed if they aren't specified in the composer.json file

Related Pull Requests

https://github.com/magento/partners-magento2ee/pull/675

Fixed Issues (if relevant)

Fixes Magento installation fails with composer 2.2.0 RC1 #34831

Manual testing scenarios (*)

Make sure you use composer 2.2.1 or higher
Run composer install
Expect no prompts à la: xxx contains a Composer plugin which is currently not in your allow-plugins config.

Questions or comments

The same changes should be made to the composer meta package that is used when you run composer create-project --repository-url=https://repo.magento.com/ magento/project-community-edition
Ideally before every new Magento release, all composer plugins being used should be found and added to the allow-plugins section and plugins that are no longer part of core Magento should be removed from that section.
@fascinosum

Would be great if this gets included in Magento 2.4.4 and 2.4.3-p2 and 2.3.7-p3 as it would be the only releases of Magento before July 2022

Contribution checklist (*)

Pull request has a meaningful description of its purpose
All commits are accompanied by meaningful commit messages
All new or changed code is covered with unit/integration tests (if applicable)
README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
All automated tests passed successfully (all builds are green)

m2-assistant · 2021-12-23T07:13:32Z

Hi @hostep. Thank you for your contribution
Here are some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

@magento give me test instance - deploy test instance based on PR changes
@magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names. Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE,
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests
Semantic Version Checker

You can find more information about the builds here

ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

For more details, review the Magento Contributor Guide documentation.

⚠️ According to the Magento Contribution requirements, all Pull Requests must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of Pull Requests happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

ihor-sviziev · 2021-12-23T09:25:00Z

@magento run all tests

@sidolov, I added P1 priority to this issue as it improves security for the composer.

@xmav @fascinosum @andrewbess , can this PR be added to the platform health project to deliver it faster and include to Magento 2.4.4?

magento-automated-testing · 2021-12-23T09:25:07Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

ihor-sviziev · 2021-12-23T11:00:14Z

@magento run Database Compare, Functional Tests B2B

magento-automated-testing · 2021-12-23T11:00:19Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

ihor-sviziev

✔ Approved.

Failing tests look not related to changes from this PR.

magento-engcom-team · 2021-12-23T11:02:31Z

Hi @ihor-sviziev, thank you for the review.
ENGCOM-9378 has been created to process this Pull Request

xmav · 2021-12-23T11:49:52Z

@magento run Database Compare

magento-automated-testing · 2021-12-23T11:49:59Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

xmav · 2021-12-23T12:18:44Z

@andrewbess Could you please assist with PR to commerce ?

magento-automated-testing · 2021-12-23T19:51:13Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

andrewbess

Hello @hostep
Thank you for your contribution
Approved from my side ✔️
Also, I added required fixes for Magento2 EE

andrewbess · 2021-12-23T20:37:12Z

@andrewbess Could you please assist with PR to commerce ?

Hello @xmav

The needed PR has been created

andrewbess · 2021-12-23T20:37:25Z

@magento run all tests

magento-engcom-team · 2021-12-23T20:37:29Z

Hi @andrewbess, thank you for the review.
ENGCOM-9378 has been created to process this Pull Request

hostep · 2022-01-12T16:29:28Z

@andrewbess: just for sake of moving this PR fowards I've implemented your suggestion.

But some small remarks:

the composer.json file from this github repo is not the same one that is generated by running the composer create-project command, so that file will need to be updated as well (but that's a job for the release team)
like mentioned before, I would really hope that Magento cuts down the amount of composer plugins instead of adding even more of them, because some plugins that are currently included by default have really no use (at least to me) and cause strange bugs and are sometimes incompatible with certain (patch) versions of composer

magento-engcom-team · 2022-01-12T16:29:31Z

Hi @torhoehn, thank you for the review.
ENGCOM-9378 has been created to process this Pull Request

andrewbess · 2022-01-13T09:19:53Z

@magento run all tests

magento-automated-testing · 2022-01-13T09:20:01Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-automated-testing · 2022-01-13T13:16:26Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-automated-testing · 2022-01-13T13:16:41Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-automated-testing · 2022-01-13T13:16:53Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-automated-testing · 2022-01-13T13:16:59Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

andrewbess

Approved from my side
Pending delivery magento-commerce/magento2ce#7397

magento-engcom-team · 2022-01-13T14:14:35Z

Hi @andrewbess, thank you for the review.
ENGCOM-9378 has been created to process this Pull Request

magento-automated-testing · 2022-01-13T15:36:06Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-automated-testing · 2022-01-13T18:30:27Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

engcom-Alfa · 2022-01-14T07:44:16Z

@magento run Functional Tests B2B

magento-automated-testing · 2022-01-14T07:44:22Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

engcom-Alfa · 2022-01-14T10:02:07Z

@magento run Functional Tests B2B

magento-automated-testing · 2022-01-14T10:02:14Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

engcom-Alfa · 2022-01-14T11:54:37Z

Retested since there were updates as per above comments. Hence the result is below.

✔️ QA Passed

Preconditions:

Make sure you use composer 2.2.1 or higher

Manual testing scenario:

git clone Magento repository in your system
Run composer install command

Before: ✖️ Used to get a warning à la: xxx contains a Composer plugin which is currently not in your allow-plugins config as shown in below screenshot

After: ✔️ No warnings are noticed, installation takes place successfully.

Since it is relevant to installation and no impact functionally, no additional regression testing is required as such.

fiko · 2022-03-31T06:36:00Z

@magento give me 2.4-develop instance

magento-deployment-service · 2022-03-31T06:36:03Z

Hi @fiko. Thank you for your request. I'm working on Magento instance for you.

magento-deployment-service · 2022-03-31T06:40:02Z

Hi @fiko, here is your Magento Instance: https://0a96fbbf16f974d89b6ef39a0e9c6d7d.instances.magento-community.engineering
Admin access: https://0a96fbbf16f974d89b6ef39a0e9c6d7d.instances.magento-community.engineering/admin_824d
Login: 7e469851
Password: 02d834dd5535

myselfhimself · 2022-07-25T21:20:00Z

Could you please backport this to Magento <2.4.4 releases, such as 2.4.3-p2?
Here is a related issue within the docker-magento project.

magento-engcom-team added the Release Line: 2.4 label Dec 23, 2021

m2-community-project bot added this to Pending Review in Pull Requests Dashboard Dec 23, 2021

m2-community-project bot added the Progress: pending review label Dec 23, 2021

hostep force-pushed the add-allowed-plugins-for-compatibility-with-composer-2.2 branch from d242b33 to 14b5353 Compare December 23, 2021 07:25

ihor-sviziev added the Priority: P1 Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing. label Dec 23, 2021

m2-community-project bot added this to Pending Review in High Priority Pull Requests Dashboard Dec 23, 2021

m2-community-project bot removed this from Pending Review in Pull Requests Dashboard Dec 23, 2021

ihor-sviziev approved these changes Dec 23, 2021

View reviewed changes

m2-community-project bot assigned ihor-sviziev Dec 23, 2021

m2-community-project bot moved this from Pending Review to Ready for Testing in High Priority Pull Requests Dashboard Dec 23, 2021

m2-community-project bot added Progress: ready for testing and removed Progress: pending review labels Dec 23, 2021

ihor-sviziev added Auto-Tests: Covered All changes in Pull Request is covered by auto-tests Auto-Tests: Not Required Changes in Pull Request does not require coverage by auto-tests and removed Auto-Tests: Covered All changes in Pull Request is covered by auto-tests labels Dec 23, 2021

andrewbess self-assigned this Dec 23, 2021

andrewbess approved these changes Dec 23, 2021

View reviewed changes

andrewbess approved these changes Jan 13, 2022

View reviewed changes

engcom-Alfa moved this from Ready for Testing to Testing in Progress in High Priority Pull Requests Dashboard Jan 14, 2022

m2-community-project bot added Progress: testing in progress and removed Progress: ready for testing labels Jan 14, 2022

engcom-Alfa moved this from Testing in Progress to Merge in Progress in High Priority Pull Requests Dashboard Jan 14, 2022

m2-community-project bot added Progress: accept and removed Progress: testing in progress labels Jan 14, 2022

magento-devops-reposync-svc merged commit 60f5aed into magento:2.4-develop Jan 22, 2022

sidolov moved this from Merge in Progress to Recently Merged in High Priority Pull Requests Dashboard Feb 1, 2022

hostep mentioned this pull request Jul 7, 2022

Plugins fail on non-interactive composer create-project composer/composer#10928

Closed

Adds allow-plugins section to composer.json file for compatibility with Composer 2.2.x #34873

Adds allow-plugins section to composer.json file for compatibility with Composer 2.2.x #34873

Conversation

hostep commented Dec 23, 2021 • edited by andrewbess Loading

Description (*)

Related Pull Requests

Fixed Issues (if relevant)

Manual testing scenarios (*)

Questions or comments

Contribution checklist (*)

m2-assistant bot commented Dec 23, 2021

ihor-sviziev commented Dec 23, 2021 • edited Loading

magento-automated-testing bot commented Dec 23, 2021

ihor-sviziev commented Dec 23, 2021

magento-automated-testing bot commented Dec 23, 2021

ihor-sviziev left a comment

Choose a reason for hiding this comment

magento-engcom-team commented Dec 23, 2021

xmav commented Dec 23, 2021

magento-automated-testing bot commented Dec 23, 2021

xmav commented Dec 23, 2021

magento-automated-testing bot commented Dec 23, 2021

andrewbess left a comment

Choose a reason for hiding this comment

andrewbess commented Dec 23, 2021

andrewbess commented Dec 23, 2021

magento-engcom-team commented Dec 23, 2021

hostep commented Jan 12, 2022 • edited Loading

magento-engcom-team commented Jan 12, 2022

andrewbess commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

andrewbess left a comment

Choose a reason for hiding this comment

magento-engcom-team commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

magento-automated-testing bot commented Jan 13, 2022

engcom-Alfa commented Jan 14, 2022

magento-automated-testing bot commented Jan 14, 2022

engcom-Alfa commented Jan 14, 2022

magento-automated-testing bot commented Jan 14, 2022

engcom-Alfa commented Jan 14, 2022

fiko commented Mar 31, 2022

magento-deployment-service bot commented Mar 31, 2022

magento-deployment-service bot commented Mar 31, 2022

myselfhimself commented Jul 25, 2022

hostep commented Dec 23, 2021 •

edited by andrewbess

Loading

ihor-sviziev commented Dec 23, 2021 •

edited

Loading

hostep commented Jan 12, 2022 •

edited

Loading