Box does not work with Composer 2.2 (allowed-plugins) #580

maks-rafalko · 2021-12-22T22:15:51Z

Bug report

Question	Answer
Box version	3.14.0
PHP version	8.0
Github Repo	infection/infection#1623

Box fails compiling a prefixed PHAR with the brand new Composer 2.2 is used:

? Dumping the Composer autoloader

In ComposerOrchestrator.php line 92:
                                  
  Could not dump the autoloader.  
                                  

In ComposerOrchestrator.php line 92:
                                                                               
  The command "'/usr/local/bin/composer' 'dump-autoload' '--classmap-authorit  
  ative' '--no-dev'" failed.                                                   
                                                                               
  Exit Code: 1(General error)                                                  
                                                                               
  Working directory: /tmp/box/Box46412                                         
                                                                               
  Output:                                                                      
  ================                                                             
Error: require(/tmp/box/Box46412/vendor/phpstan/phpstan/bootstrap.php):   
  Failed to open stream: No such file or directory                             
                                                                               
                                                                               
  Error Output:                                                                
  ================                                                             
  For additional security you should declare the allow-plugins config with a   
  list of packages names that are allowed to run code. See https://getcompose  
  r.org/allow-plugins                                                          
  You have until July 2022 to add the setting. Composer will then switch the   
  default behavior to disallow all plugins.                                    
                                                                               
                                                                               
                                                                               
    [ErrorException]                                                           
                                                                               
    require(/tmp/box/Box46412/vendor/phpstan/phpstan/bootstrap.php): Failed t  
  o open stream: No such file or directory                                     
                                                                               
                                                                               
                                                                               
  dump-autoload [-o|--optimize] [-a|--classmap-authoritative] [--apcu] [--apc  
  u-prefix APCU-PREFIX] [--dev] [--no-dev] [--ignore-platform-req IGNORE-PLAT  
  FORM-REQ] [--ignore-platform-reqs]                                           
                                                                               

compile [-c|--config CONFIG] [--debug] [--no-parallel] [--no-restart] [--dev] [--no-config] [--with-docker] [-d|--working-dir WORKING-DIR]

make: *** [Makefile:253: build/infection.phar] Error 1

Note: Infection had issues with Composer 2.2 too, fixed by adding allowed-plugins configuration: infection/infection#1624

The text was updated successfully, but these errors were encountered:

ondrejmirtes · 2022-01-29T12:03:36Z

I've reproduced this problem in a minimal repo: https://github.com/ondrejmirtes/composer-issue/actions/runs/1765720462

I can offer some funds towards fixing this problem, so don't hesitate to reach out. Thanks.

theofidry · 2022-02-04T12:56:47Z

Should be fixed with 3.15!

maks-rafalko · 2022-03-07T11:58:40Z

@theofidry

I still reproduce it in Infection repository with 3.16.0 both with make compile (PHP 8.1, Composer 2.2) and with make compile-docker (PHP 7.4)

In ComposerOrchestrator.php line 175:
                                                                                                                                                                                                    
  The command "'/usr/local/bin/composer' 'dump-autoload' '--classmap-authoritative' '--no-dev' '--ansi'" failed.                                                                                    
                                                                                                                                                                                                    
  Exit Code: 1(General error)                                                                                                                                                                       
                                                                                                                                                                                                    
  Working directory: /tmp/box/Box39427                                                                                                                                                              
                                                                                                                                                                                                    
  Output:                                                                                                                                                                                           
  ================                                                                                                                                                                                  
                                                                                                                                                                                                    
                                                                                                                                                                                                    
  Error Output:                                                                                                                                                                                     
  ================                                                                                                                                                                                  
                                                                                                                                                                                                    
                                                                                                                                                                                      
    [ErrorException]                                                                                                                                                                  
    require(/tmp/box/Box39427/vendor/phpstan/phpstan/bootstrap.php): Failed to open stream: No such file or directory                                                                 
                                                                                                                                                                                      
                                                                                                                                                                                                    
  dump-autoload [-o|--optimize] [-a|--classmap-authoritative] [--apcu] [--apcu-prefix APCU-PREFIX] [--dev] [--no-dev] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs]

ondrejmirtes · 2022-04-20T11:31:05Z

I agree. This isn't related to allow-plugins. It still doesn't work with latest Box and Composer.

theofidry · 2023-02-13T10:14:44Z

Ok finally found the issue.

The problem is that dump-autoload does not really care about the --dev|--no-dev flag. It looks like it only cares about it for the actual dumped autoload, but before that, i.e. when autoloading the code, it does not and instead just loads everything that is registered in installed.json|installed.php.

The way Box works is:

copy the source code
remove dev deps
dump the autoload

This means that if you have a dev plugin, e.g. phpstan/extension-installer, when dumping the autoload, the plugin will be attempted to be loaded. This of course cannot work since it's a dev dep and Box removed it.

I think this could be solved in Composer, but I also cannot just wait for a fix there so I'll likely need to temper the content of installed.json & installed.php

jaapio · 2023-05-07T20:47:00Z

What if you add --no-plugins to the autoload command?

theofidry · 2023-05-08T14:10:56Z

@jaapio in which case this would break the bundling of any Symfony app which uses Flex. I'm not familiar enough with other frameworks, but this makes me believe there could be other affected too so it's not really the solution.

lkrms · 2023-08-07T23:55:51Z

Have just run into this here as well.

I've worked around it by:

creating a clean copy of the package (I'm using git clone, but any method where the package is duplicated without its vendor directory should work)
running composer install --no-dev in the clean copy
running box compile in the clean copy

Composer's behaviour here isn't unreasonable, though. I wouldn't expect a package manager to remain operational if critical files were deleted, and from the discussion here and a quick read of the documentation, it seems reasonable for composer commands to fail if an enabled plugin is removed from the filesystem.

Would it be feasible to use composer --no-dev install to create the initial state of a package instead of removing dev dependencies at the filesystem level?

theofidry · 2023-09-25T14:16:37Z

Would it be feasible to use composer --no-dev install to create the initial state of a package instead of removing dev dependencies at the filesystem level?

Yes and no.

Currently the whole process is:

load the Box config a first time
copy the whole project; excluding the unnecessary files, the copied files are processed by the compactors
dump the autoloader
ship the files to the PHAR

What the above entails would mean:

load the Box config a first time
copy the whole project
install the no-dev deps
reload the Box config and apply the compactors (which can include the scoping) and remove the unnecessary files
ship the files to the PHAR

So it's really not a trival amount of changes and probably a big performance hit too.

llaville · 2024-09-03T13:48:30Z

@theofidry While working on final version of BOX Manifest v4.0, I've encounter this problem too when I tried to use the -d|--working-dir option of BOX 4.6.2

I recommend to add a note on documentation like it was done for metadata setting (see https://box-project.github.io/box/configuration/#metadata-metadata), to alert users that they should disable the dump-autoload setting (as a workaround).

At least for me it worked !

BTW, I've also noticed that the BOX output did not display that we have effectivly changed directory. It may be cool to have such info.

For example with dump-autoload disabled, current dir is /shared/backups/bartlett/box-manifest (my clone copy of https://github.com/llaville/box-manifest/tree/4.x)

vendor/bin/box compile -c box.json.dist -vvv -d tests/fixtures/phario-manifest-2.0.x-dev/

Prints following output

[debug] Current memory limit: "512MB"
[debug] Checking BOX_ALLOW_XDEBUG
[debug] phar.readonly is enabled
[debug] The Xdebug extension is loaded (3.3.2) xdebug.mode=debug,develop
[debug] Configured `phar.readonly=0`
[debug] Process restarting (BOX_ALLOW_XDEBUG=internal|3.3.2|1|*|*)
[debug] Running: [/usr/local/bin/php, vendor/bin/box, compile, -c, box.json.dist, -vvv, -d, tests/fixtures/phario-manifest-2.0.x-dev/]
[debug] Current memory limit: "512MB"
[debug] Checking BOX_ALLOW_XDEBUG
[debug] Restarted (88 ms). The Xdebug extension is not loaded


 [INFO] Changed working directory to "tests/fixtures/phario-manifest-2.0.x-dev/"



    ____
   / __ )____  _  __
  / __  / __ \| |/_/
 / /_/ / /_/ />  <
/_____/\____/_/|_|


Box version 4.6.2@29c3585
 // Loading the configuration file "box.json.dist".

🔨  Building the PHAR "/shared/backups/bartlett/box-manifest/tests/fixtures/phario-manifest-2.0.x-dev/test.phar"

? Removing the existing PHAR "/shared/backups/bartlett/box-manifest/tests/fixtures/phario-manifest-2.0.x-dev/test.phar"
[debug] Increased the maximum number of open file descriptors from ("1024", "524288") to ("2176", "unlimited")
? Skipping the Composer compatibility check: the autoloader is not dumped
? No compactor to register
? Mapping paths
  - console-table.txt > .box.manifests/console-table.txt
  - plain.txt > .box.manifests/plain.txt
  - manifest.txt > .box.manifests/manifest.txt
  - sbom.json > .box.manifests/sbom.json
  - sbom.cdx.json > .box.manifests/sbom.cdx.json
  - sbom.xml > .box.manifests/sbom.xml
  - sbom.cdx.xml > .box.manifests/sbom.cdx.xml
  - console-style.txt > .box.manifests/console-style.txt
? No main script path configured
? Adding requirements checker
? Adding binary files
    > 9 file(s)
? Auto-discover files? Yes
? Exclude dev files? No
? Adding files
    > 27 file(s)
? Using stub file: /shared/backups/bartlett/box-manifest/tests/fixtures/phario-manifest-2.0.x-dev/stub.php
? Skipping dumping the Composer autoloader
? Removing the Composer dump artefacts
? No compression
[debug] Restored the maximum number of open file descriptors
? Setting file permissions to 0755
* Done.

No recommendation found.
No warning found.

 // PHAR: 68 files (178.01KB)
 // You can inspect the generated PHAR with the "info" command.

 // Memory usage: 12.81MB (peak: 12.90MB), time: <1sec

[debug] Restarted process exited 0

Note

Line [INFO] Changed working directory to "tests/fixtures/phario-manifest-2.0.x-dev/" in output is not official.
I've put code
$io->info(\sprintf('Changed working directory to "%s"', $workingDir));
at end of \KevinGH\Box\Console\Command\ChangeWorkingDirOption::changeWorkingDirectory for demo/test purpose only

…toload setting : see issue box-project/box#580)

maks-rafalko mentioned this issue Dec 22, 2021

Allow phpstan and infection composer plugins to be executed (Composer 2.2) infection/infection#1624

Merged

theofidry closed this as completed Feb 4, 2022

theofidry reopened this Apr 20, 2022

theofidry added the bug label Apr 20, 2022

theofidry added this to the Box4.3 milestone Feb 3, 2023

This was referenced Feb 13, 2023

fix: Fix compilation of projects using dev composer plugins #879

Open

Cannot declare class because the name is already in use #859

Closed

danepowell mentioned this issue Feb 16, 2023

CLI-936: Upgrade Box acquia/cli#1364

Merged

lkrms mentioned this issue Aug 8, 2023

Box produces error related to PHPStan #1006

Closed

theofidry mentioned this issue Oct 13, 2023

Why don't you choose to introduce BC breaks with BOX 4.4.0 #1065

Closed

theofidry modified the milestones: Box4.3, Box5 Oct 14, 2023

theofidry mentioned this issue Nov 12, 2023

Upgrade to Box 4.5.1 infection/infection#1766

Merged

llaville added a commit to llaville/box-manifest that referenced this issue Sep 4, 2024

upgrade BOX final config file (with pretty print, and disable dump-au…

6d23668

…toload setting : see issue box-project/box#580)

llaville added a commit to llaville/box-manifest that referenced this issue Sep 4, 2024

add warning about BOX issue box-project/box#580

2156c67

llaville mentioned this issue Sep 7, 2024

force-autodiscovery (enabled) and dump-autoload (disabled) are incompatible #1409

Open

llaville mentioned this issue Oct 3, 2024

[v4.0.0-rc.1] does not support correctly the BOX dump-autoload setting llaville/box-manifest#13

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Box does not work with Composer 2.2 (allowed-plugins) #580

Box does not work with Composer 2.2 (allowed-plugins) #580

maks-rafalko commented Dec 22, 2021

ondrejmirtes commented Jan 29, 2022

theofidry commented Feb 4, 2022

maks-rafalko commented Mar 7, 2022

ondrejmirtes commented Apr 20, 2022

theofidry commented Feb 13, 2023

jaapio commented May 7, 2023

theofidry commented May 8, 2023

lkrms commented Aug 7, 2023

theofidry commented Sep 25, 2023

llaville commented Sep 3, 2024

Box does not work with Composer 2.2 (allowed-plugins) #580

Box does not work with Composer 2.2 (allowed-plugins) #580

Comments

maks-rafalko commented Dec 22, 2021

Bug report

ondrejmirtes commented Jan 29, 2022

theofidry commented Feb 4, 2022

maks-rafalko commented Mar 7, 2022

ondrejmirtes commented Apr 20, 2022

theofidry commented Feb 13, 2023

jaapio commented May 7, 2023

theofidry commented May 8, 2023

lkrms commented Aug 7, 2023

theofidry commented Sep 25, 2023

llaville commented Sep 3, 2024