[META] Drupal should not commit compressed files, binaries, or databases

Created on 19 June 2024, 6 months ago
Updated 9 July 2024, 5 months ago

Problem/Motivation

Compressed files, binaries, and databases are difficult to maintain and inspect.

You can see an example here:
See the change core/tests/fixtures/config_install/multilingual.tar.gz in this MR: https://git.drupalcode.org/project/drupal/-/merge_requests/5282/diffs#di...

The only changes were to update the compressed views config but there is no way for a reviewer to see that. The only way they could see what was changed would be to extract it before the commit, after the commit and do a manual diff.

Background information

This was first reported to the Drupal security team who determined this could be a public followup.

Steps to reproduce

Proposed resolution

Remaining tasks

Here are all of the zipped files found with
find . -iname *gz

๐Ÿ“Œ Decompress files for update_test_new_module Active
./core/modules/update/tests/update_test_new_module/8.x-1.0/update_test_new_module.tar.gz
./core/modules/update/tests/update_test_new_module/8.x-1.1/update_test_new_module.tar.gz
./core/modules/update/tests/update_test_new_module/8.x-1.1/update_test_new_module.zip
./core/modules/update/tests/update_test_new_module/8.x-1.0/update_test_new_module.zip

๐Ÿ› Decompress files for aaa_update_test Active
./core/modules/update/tests/aaa_update_test.tar.gz

๐Ÿ“Œ Rework database update tests so we don't have to ship database dumps in git Active
./core/modules/system/tests/fixtures/update/drupal-10.3.0.bare.standard.php.gz
./core/modules/system/tests/fixtures/update/drupal-10.3.0.filled.standard.php.gz

๐Ÿ› Decompress files for config_install testing Fixed

User interface changes

None

API changes

May require test process updates since current tests grab config and or databases from the repository.

Data model changes

Unknown

Release notes snippet

TBD

๐Ÿ› Bug report
Status

Needs work

Version

11.0 ๐Ÿ”ฅ

Component
PHPUnitย  โ†’

Last updated 18 minutes ago

Created by

๐Ÿ‡บ๐Ÿ‡ธUnited States nicxvan

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupalโ€™s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the โ€œReport a security vulnerabilityโ€ link in the project pageโ€™s sidebar. See how to report a security issue for details.

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024