Metapackage Installation Guide

Overview

The current repository contains modules that belong to Security Package functionality only. To provide the ability to develop the project locally we introduced a development workflow that can help external developers work with the project.

Development setup

Installation as a composer package

1. Clone the magento2 git repository and check out the 2.4-develop branch. You may also check out and use any 2.4 release tags.

   git clone git@github.com:magento/magento2.git magento2

2. Create an ext directory in the root of the magento2 project directory:

   cd magento2
   mkdir ext

3. Clone the security-package repository into the appropriate directory inside ext:

   git clone git@github.com:magento/security-package.git ext/magento/security-package

4. Update Composer settings for the project to allow a better development workflow:

   • minimum-stability for packages is updated to dev value. This allows installation of development modules:

       composer config minimum-stability dev
     

   • To be able to work with stable packages enable the prefer-stable property: prefer-stable: true. It should be included right above the minimum-stability setting.

   • Next we configure Composer so that it knows where to find new modules. The following command will configure any extension code inside the ext directory to be treated as a package and symlinked to the vendor directory:

       composer config repositories.ext path "./ext/*/*/*"
     

5. Finally, install the security-package metapackage:

   composer require magento/security-package

At this point, all of the security-package modules are symlinked inside the vendor directory, which allows both running a Magento installation with additional modules as well as doing development using the standard git workflow.

You may need to ensure that there are no security-package* modules are listed as disabled when you run bin/magento module:status. If they are, follow the docs on how to enable modules.

Setting up Git workflow

In order to improve the developer experience when working with this repository structure, a few additional items may be configured:

1. Exclude ext directories from root directory Git:

   echo ext >> ./.git/info/exclude

2. Skip root directory composer.* files to avoid committing them by mistake:

   git update-index --skip-worktree composer.json
   git update-index --skip-worktree composer.lock

   This operation is reversible, if needed:

   git update-index --no-skip-worktree composer.json
   git update-index --no-skip-worktree composer.lock