Validate PHP version to be used by the Composer process calls

Created on 17 February 2023, almost 2 years ago
Updated 7 July 2023, over 1 year ago

Problem/Motivation

Found on ๐Ÿ› Automatic Updates hosting test result on Siteground Active thanks @Gรกbor Hojtsy!

Error message
The command "'/usr/local/bin/composer' '--working-dir=/tmp/.package_managercce85fb1-d95c-44ca-8454-28bcde88432f/75-5Exhe8R3XjsAj9aDqsLYgZm-SFeDn755whLv86H8' 'update' '--with-all-dependencies' 'drupal/core-composer-scaffold:9.4.11' 'drupal/core-project-message:9.4.11' 'drupal/core-recommended:9.4.11' 'drupal/core-vendor-hardening:9.4.11'" failed. Exit Code: 2(Misuse of shell builtins) Working directory: /home/customer/www/drupalupdatetest.org/public_html Output: ================ Error Output: ================ Loading composer repositories with package information Info from https://repo.packagist.org: #StandWithUkraine Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - symfony/finder v6.2.5 requires php >=8.1 -> your php version (7.4.33) does not satisfy that requirement. - drush/drush 11.4.0 requires symfony/finder ^4.0 || ^5 || ^6 -> satisfiable by symfony/finder[v6.2.5]. - drush/drush is locked to version 11.4.0 and an update of this package was not requested.

This was after he had updated the web server and CLI versions to php 8.1 somehow php used for the Composer Stager calls was still `7.4.33`๐Ÿค”

Proposed resolution

We should validate the PHP version that will be used for process call is the exact same as Drupal is running. This could be for MVP and the later make it more nuanced.

Basically something like `ComposerExecutableValidator` but for PHP version itself. This maybe different that the version that the webserver is using

We should be able to use composer -vvv about and parse the results

Remaining tasks

Should the version of php that is running the Drupal website and version that composer would use have to be the same thing?

Or should we just check that the php version satisfies what Drupal needs?

What about when Drupal supports 2 major versions in the future? What if the website reports it is running PHP 8.x and the composer command reports it is using PHP 9.x or the opposite? This could result in packages being installed that require PHP 9.x and then failing once the update is applied because they use php 10.x features.

One option would be to run composer config platform.php 8.1.0(assuming platform.php is not already set), running the composer operation, and then unsetting platform.php. This could possibly get around the process running a version that Drupal doesn't support

๐Ÿ› Bug report
Status

Needs work

Version

3.0

Component

Code

Created by

๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Issue created by @tedbow
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA
  • Assigned to tedbow
  • Status changed to Postponed: needs info almost 2 years ago
  • ๐Ÿ‡ง๐Ÿ‡ชBelgium wim leers Ghent ๐Ÿ‡ง๐Ÿ‡ช๐Ÿ‡ช๐Ÿ‡บ

    If it's core-post-mvp, shouldn't we remove the sprint tag? ๐Ÿค”

  • Status changed to Active almost 2 years ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA
    1. @Gรกbor Hojtsy mentioned in chat

      I think the PHP platform setting is an interesting idea, unless you have composer plugins that need PHP 8.x itself and will choke on trying to run on PHP 7 (or other version variants as applicable in the future).

      This is a good point. If we wanted to get real complicated we could make sure that no allowed plugins, which I think would be the only packages that would have PHP code that will run during composer commands, don't have php requirement that is incompatible with version PHP that is actually used for the process.

    2. #4 removed the sprint tag.

      If we wanted to do something for MVP I think the minimum we could do would be add a validation error if 2 php versions were not exactly the same. But of course that might start to cause failures because we might have been missing the fact the 2 versions of php might have been different for some sites but does not cause any problems. Maybe because the php version were in the same major or patch version

    3. One thing that would make this situation better if \PhpTuf\ComposerStager\Domain\Exception\RuntimeException gave us access to the actual process so we could output a more trimmed version of the error. @Wim Leers do you make an issue for this problem?

      I think that would allow up to trim the error in the issue summary down to just what is after "Error Output" so it would be

      Loading composer repositories with package information Info from https://repo.packagist.org: #StandWithUkraine Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - symfony/finder v6.2.5 requires php >=8.1 -> your php version (7.4.33) does not satisfy that requirement. - drush/drush 11.4.0 requires symfony/finder ^4.0 || ^5 || ^6 -> satisfiable by symfony/finder[v6.2.5]. - drush/drush is locked to version 11.4.0 and an update of this package was not requested.

      I think this would slightly better for end user because there is not quite as much to get through before you see the actual problem. it won't be as nice a specific validator for this problem but it would have the benefit of helping any composer error.

  • Issue was unassigned.
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA

    Adding to sprint because people are running of issues. A lot of other issue are interdependent.

    updated the suggested solution

  • Assigned to omkar.podey
  • Assigned to tedbow
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States phenaproxima Massachusetts

    OK, so, I don't think we should we doing this as proposed. I have a better idea. ๐Ÿ˜ˆ

    Rather than meekly ask Composer which PHP version it's going to use, we can and should just force it to use the same runtime the web server is.

    Try this at the terminal: php $(which composer) --version. You can just have PHP directly execute the Composer phar, rather than have it to try to just start in the nearest available PHP runtime.

    So, in ProcessFactory, IMHO what we should do here is, if we're trying to execute a Composer command (we have a method for that), detect the path to the current PHP runtime (there is a constant, PHP_BINARY, or PHP_BINDIR, which will work for that), and prefix the command string with the path to the PHP executable. Boom. No need for validation: it will just always use the one we want.

    Assigning to @tedbow to validate this approach before Omkar implements it.

  • Status changed to Postponed over 1 year ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA

    I chatted with @phenaproxima about. while I agree his solution could be an improvement, it also seems possible that it *could* break some sites. Probably a low probability but also we can't be sure the solution would even solve the original problem on ๐Ÿ› Automatic Updates hosting test result on Siteground Active . It is likely @gabor doesn't have access to this site anymore since it was just for testing. So it seem too risky for now to put in a solution for problem that was only reported 1x and we can't actually confirm it will fix that problem

    Postponing for now. We need to figure how to test this on real host that has this problem

  • Status changed to Needs work over 1 year ago
  • ๐Ÿ‡ง๐Ÿ‡ชBelgium wim leers Ghent ๐Ÿ‡ง๐Ÿ‡ช๐Ÿ‡ช๐Ÿ‡บ

    Postponing for now. We need to figure how to test this on real host that has this problem

    Shouldn't we not postpone this issue and instead do the necessary investigation here? ๐Ÿ˜…

  • Issue was unassigned.
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA

    #11 yes you are right. We need to investigate more.

  • Assigned to phenaproxima
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States tedbow Ithaca, NY, USA

    Assigning to @phenaproxima update the summary with different proposed solution

Production build 0.71.5 2024