Support oomphinc/composer-installers-extender and wikimedia/composer-merge-plugin

You can work around this, for now, by setting a hidden config option -- package_manager.settings:additional_trusted_composer_plugins.

With Drush:

drush cset package_manager.settings:additional_trusted_composer_plugins "oomphinc/composer-installers-extender\nwikimedia/composer-merge-plugin"

That should do the trick.

That said, I agree that these two plugins are likely in very wide use and should probably be supported.

Thank you for pointing me in the right direction. The drush command didn't work (missing "value" parameter). After I removed the colon character (as below) the error went away, but I got a WSOD when I tried to re-run the Readiness Tests.

drush cset package_manager.settings additional_trusted_composer_plugins "oomphinc/composer-installers-extender\nwikimedia/composer-merge-plugin"

I got the following error in the log when the WSOD was displayed:
[Thu Apr 04 12:47:28.986587 2024] [php:notice] [pid 2578] [client 127.0.0.1:41148] Uncaught PHP Exception TypeError: "array_map(): Argument #2 ($array) must be of type array, string given" at /var/www/docroot/modules/contrib/automatic_updates/package_manager/src/Validator/ComposerPluginsValidator.php line 122, referer: http://www-csr/admin/reports/status

Finally, I fixed the issue with the unsupported composer plugins by editing package_manager.settings using the Devel module, like this:

_core:
  default_config_hash: U5mNVZBLMBkapwx5Dc8_QzKFegYocQmrNUl_wGsp0aQ
file_syncer: rsync
executables:
  composer: null
  rsync: null
additional_trusted_composer_plugins:
  - oomphinc/composer-installers-extender
  - wikimedia/composer-merge-plugin
include_unknown_files_in_project_root: false

Is there a way to change the command above to alter package_manager.settings using drush? (sorry if this is a noob question...)

Also, is there a solution for my first issue in the initial post?

Thank you!

@lucian.ilea thanks for filing the issue.

I think there are few problems here

1. \Drupal\package_manager\Validator\ComposerPluginsValidator does not provide a link to a help section about how to allow other composer plugins. I think this is the problem that we should solve first.
2. We have an open issue to determine which and how new plugins should get approved 📌 Determine how new Composer plugins will be supported Active . This has considerations for Drupal core also. We don't allow just any plugins because they can affect files anywhere in your project so that makes staging Composer operations without copying the entire project folder impossible. It is not just a matter of whether the plugin does not conflict now but if we know that plugin will never conflict, at least within the composer version constraint we specify
3. The "scaffold files" problem should be handled in another issue. Also error message should have linked to this documentation page so it would be good place to start https://www.drupal.org/docs/develop/using-composer/using-drupals-compose... →

@tedbow Thank you for the clarifications.

I think my use-case is not a generic one (using Varbase theme). But, if that's ok, I will report back on this issue any results related to the usage of the Automatic Updates module in this context.

I added the unsupported Composer plugins as exceptions. If I find a way to get past the scaffolding issue, maybe the results I will get over time will be usefull to decide whether these plugins are safe to be approved or not.

This doesn't help the underlying issues as pointed out in comment #4, but the correct drush command for the work around is:

drush cset --input-format=yaml package_manager.settings additional_trusted_composer_plugins '[oomphinc/composer-installers-extender,wikimedia/composer-merge-plugin]'