The updates were not working for me.
It would create a directory in my project root and then copy the files there instead of overwriting my core files.
I figure out what happening is that \Drupal\automatic_updates\Services\InPlaceUpdate::getTempDirectory()
was returning /tmp/ but the "real" path was actually /private/tmp/ I am using a Mac and I think this is default behavior.
The extracting of the archive worked correctly but in \Drupal\automatic_updates\Services\InPlaceUpdate::processUpdate)_
there is
$file_real_path = $this->getFileRealPath($file);
$file_path = substr($file_real_path, strlen($this->getTempDirectory() . self::ARCHIVE_DIRECTORY));
$project_real_path = $this->getProjectRealPath($file_path, $project_root);
Since in the 2nd line we have $file_real_path, which is the "real" path and has "/private/", but $this->getTempDirectory() does not have /private/ then $file_path would be incorrect and also $project_real_path
In \Drupal\automatic_updates\Services\InPlaceUpdate::getTempDirectory() use \SplFileInfo::getRealPath() to return the "real path".
Patch
Postponed
1.0
Code
The issue is blocked on something in a non-Drupal project.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
See
#3319507-44: [upstream] Support more symlinks, document why certain symlinks are not supported →
— this is blocked on an upstream feature/bugfix in php-tuf/composer-stager.