Add allow-plugins config value #10314

Seldaek · 2021-11-25T21:01:24Z

Still a few TODOs / open questions

Currently this warns on every operation once you have a plugin which is not enabled, I am not sure if this gets annoying or not. Are there cases where you want to have plugins installed but not enable them? Or is this only a safety net?
Probably would be nicer if it instead prompted the user if the plugin should be added or not when something doesn't match the allow-plugins rules. Default to no of course.. Then we could modify the config in band and proceed activating the plugin if desired. Otherwise store it in a disallow-plugins list to make explicit those you don't wanna hear about again?
Docs
add the new /allow-plugins shortlink on getcomposer.org

src/Composer/Command/ConfigCommand.php

Seldaek · 2021-12-07T09:34:41Z

Latest version of the PR does prompt the user whether new unknown plugins should be enabled if interactive. When non-interactive and allow-plugins is not set at all, it allows all plugins for BC. When non-interactive and allow-plugins is set but does not include a given package, that package is not allowed.

Now I do wonder if we shouldn't build in some time-based feature switch in there that makes it forbid all plugins if allow-plugins is not set in 6months or 1year from now? That way 2.2.0 and above would keep working BC but would warn users, getting people to slowly add that config, and then at some point it'd remove the BC layer and default allow-plugins to false.

Any thoughts on this last point?

naderman · 2021-12-07T11:12:56Z

I agree with adding a mechanism to get people to start adding the setting in due time.

doc/06-config.md

res/composer-schema.json

src/Composer/Config.php

naderman · 2021-12-07T11:13:33Z

src/Composer/Plugin/PluginManager.php

@@ -69,6 +80,9 @@ public function __construct(IOInterface $io, Composer $composer, Composer $globa
        $this->globalComposer = $globalComposer;
        $this->versionParser = new VersionParser();
        $this->disablePlugins = $disablePlugins;
+
+        $this->allowPluginRules = $this->parseAllowedPlugins($composer->getConfig()->get('allow-plugins'));
+        $this->allowGlobalPluginRules = $this->parseAllowedPlugins($globalComposer ? $globalComposer->getConfig()->get('allow-plugins') : false);


I wonder how global plugin allow should even work? Merging the setting with local and applying to all plugins executed in this process or should the global setting apply to global plugins and local setting to local plugins?

Right now it does apply global setting to global plugins and local to local plugins. Note that this refers to the composer global installed plugins. The global config.json would just be merged in both local and global composer configs.

I think it's fine as is. If you add a plugin via composer global require ... it will prompt you and add it in that composer.json and it works.

I agree that's fine but this may require a bit more documentation? Can also add that when the first confused person shows up ;-)

src/Composer/Plugin/PluginManager.php

res/composer-schema.json

…sting plugins impossible

…o enable/disable some packages, so we can suppress warnings for things we never want enabled, and add a way to update the config for the user if run interactively

…alled globally

Co-authored-by: Nils Adermann <naderman@naderman.de>

bmack · 2021-12-07T16:07:29Z

Hey @Seldaek ,

Now I do wonder if we shouldn't build in some time-based feature switch in there that makes it forbid all plugins if allow-plugins is not set in 6months or 1year from now? That way 2.2.0 and above would keep working BC but would warn users, getting people to slowly add that config, and then at some point it'd remove the BC layer and default allow-plugins to false.

I was just reviewing your PR and was wondering why you put the timing check in the code, instead of using versioning. Otherwise people could stick with old versions (of course they should not do that), instead of faking their system time to make plugins work without configuration anymore :)

Seldaek · 2021-12-07T20:59:25Z

@bmack why would anyone want to do this though? I mean if you really don't care for security you can do composer config --global allow-plugins true to just tell it to run anything on all projects on your machine. NOT RECOMMENDED but it's there.

bmack · 2021-12-07T22:27:57Z

@Seldaek well, personally, I'd never do such things (but you know, people come up with stupid ideas to solve their issues). Also: I'd never put this in a global setting at all (my CI wouldn't have the plugins enabled, but I have it in my global config - would lead to inconsistencies), but I see this 100% on a per-project config level, and love it.

Doing this switch not via versioning but by date seems odd. I just wondered why we shouldn't stick to sem-ver here, instead of going with a fixed date "deadline". In any case: Thanks a bunch, very much looking forward to this!

naderman · 2021-12-07T22:34:51Z

@bmack We want this in 2.2 LTS so that this will apply to the majority of all users within a few months. As 2.3 is going to drop support for lots of old PHP versions, dependencies etc., we would have to introduce the requirement for allow-plugins in a 2.2.x release. But that would mean people who don't want the requirement have to stay on an outdated version missing bugfixes on the 2.2 LTS line, which we want to discourage them from doing.

So instead it'll be timed and included in all 2.2 releases, and worst case as Jordi described it can be disabled.

This PR was merged into the 4.4 branch. Discussion ---------- Add allow-plugins in the skeleton config Refs composer/composer#10314 For now, the default value in Composer is still to allow all plugins implicitly for BC. But the behavior will change in July 2022 to default to an empty list of allowed plugins. This PR has 2 effects: - it makes new project use the new Composer behavior directly instead of relying on the BC layer - it marks `symfony/flex` as an allowed plugin, as our skeleton is meant to be used with Flex The first point means that projects installing other composer plugins will need to mark them as allowed for them to run (but `composer update` running in an interactive shell will ask for that anyway) Commits ------- f757a29 Add allow-plugins in the skeleton config

see composer/composer#10314

GPHemsley-RELX · 2022-01-10T22:08:01Z

Is there a command that can be run that will do nothing but prompt about updating the allow-plugins config?

Seldaek · 2022-01-11T08:23:13Z

composer show for example would load the plugins and prompt, without other side effect.

Seldaek added the Feature label Nov 25, 2021

Seldaek added this to the 2.2 milestone Nov 25, 2021

Seldaek mentioned this pull request Nov 25, 2021

Global config option to disable plugins and scripts #5659

Closed

Seldaek force-pushed the disable_plugins branch from 1163b40 to fac5333 Compare November 25, 2021 21:09

stof reviewed Nov 26, 2021

View reviewed changes

src/Composer/Command/ConfigCommand.php Outdated Show resolved Hide resolved

Seldaek force-pushed the disable_plugins branch 2 times, most recently from 81507db to 6b97c95 Compare December 6, 2021 14:23

Seldaek marked this pull request as ready for review December 6, 2021 14:25

Seldaek requested a review from naderman December 6, 2021 20:51

naderman requested changes Dec 7, 2021

View reviewed changes

naderman reviewed Dec 7, 2021

View reviewed changes

src/Composer/Plugin/PluginManager.php Outdated Show resolved Hide resolved

Seldaek commented Dec 7, 2021

View reviewed changes

res/composer-schema.json Outdated Show resolved Hide resolved

Seldaek and others added 7 commits December 7, 2021 13:47

Add allow-plugins config value, fixes composer#5659

7142c71

Deprecate calling addPlugin without sourcePackage as it makes allowli…

7bad46a

…sting plugins impossible

Refactor allow-plugins to be an object with patterns and true/false t…

bb4dc29

…o enable/disable some packages, so we can suppress warnings for things we never want enabled, and add a way to update the config for the user if run interactively

Add allow-plugins to docs

307360b

Fix a few type errors and tests

f7dd9fb

Fix merging of allow-plugins config and clarify when a plugin is inst…

b88e546

…alled globally

Apply suggestions from code review

8cba323

Co-authored-by: Nils Adermann <naderman@naderman.de>

Seldaek force-pushed the disable_plugins branch from 36eb43a to 6305a7d Compare December 7, 2021 12:57

Automatically switch off plugins by default in July 2022

9e2a586

Seldaek force-pushed the disable_plugins branch 2 times, most recently from bbd9cf3 to 55569a1 Compare December 7, 2021 13:14

Seldaek added 2 commits December 7, 2021 14:18

PHPStan fixes

79d8a3e

Reword more hashes into object in schema

b2da692

Seldaek force-pushed the disable_plugins branch from 55569a1 to b2da692 Compare December 7, 2021 13:18

Fixup

f262f47

Seldaek force-pushed the disable_plugins branch from 6cb5abe to f262f47 Compare December 7, 2021 13:23

Seldaek added a commit to composer/getcomposer.org that referenced this pull request Dec 7, 2021

Add allow-plugins shortcut, refs composer/composer#10314

3169a81

Fix type of preferred-install object values

6768c9f

Prompt for plugin enabling should explain it writes to composer.json

f5f45ce

naderman approved these changes Dec 7, 2021

View reviewed changes

naderman merged commit a3e91b5 into composer:main Dec 7, 2021

Seldaek deleted the disable_plugins branch December 8, 2021 08:47

villfa mentioned this pull request Dec 8, 2021

[Composer 2.2] Update README about allow-plugins config villfa/composer-substitution-plugin#24

Closed

stof mentioned this pull request Dec 8, 2021

Add allow-plugins in the skeleton config symfony/skeleton#201

Merged

aschempp mentioned this pull request Dec 10, 2021

Allow default Contao plugins contao/managed-edition#59

Merged

aschempp added a commit to contao/contao-manager that referenced this pull request Dec 14, 2021

Always allow our default composer plugins

891e59e

see composer/composer#10314

michael-careplanner mentioned this pull request Dec 23, 2021

composer hang even with --no-interaction passed #10393

Closed

MichaIng mentioned this pull request Dec 30, 2021

[Automated] Update psalm-baseline.xml nextcloud/server#30399

Closed

paul121 mentioned this pull request Dec 30, 2021

Add allow-plugins config. farmOS/composer-project#6

Closed

driesvints mentioned this pull request Jan 4, 2022

[8.x] Add allowed plugins laravel/framework#40246

Merged

Un1matr1x mentioned this pull request Jan 8, 2022

use composer-normalize Un1matr1x/PublicPlayground#16

Closed

jasonvarga mentioned this pull request Jan 13, 2022

Add allowed composer plugins statamic/cms#5069

Merged

localheinz mentioned this pull request Jan 21, 2022

Fix: Run tests with --no-interaction option ergebnis/composer-normalize#870

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add allow-plugins config value #10314

Add allow-plugins config value #10314

Seldaek commented Nov 25, 2021 •

edited

Loading

Seldaek commented Dec 7, 2021

naderman commented Dec 7, 2021

naderman Dec 7, 2021

Seldaek Dec 7, 2021

naderman Dec 7, 2021

bmack commented Dec 7, 2021

Seldaek commented Dec 7, 2021 •

edited

Loading

bmack commented Dec 7, 2021

naderman commented Dec 7, 2021

GPHemsley-RELX commented Jan 10, 2022

Seldaek commented Jan 11, 2022

Add allow-plugins config value #10314

Add allow-plugins config value #10314

Conversation

Seldaek commented Nov 25, 2021 • edited Loading

Seldaek commented Dec 7, 2021

naderman commented Dec 7, 2021

naderman Dec 7, 2021

Choose a reason for hiding this comment

Seldaek Dec 7, 2021

Choose a reason for hiding this comment

naderman Dec 7, 2021

Choose a reason for hiding this comment

bmack commented Dec 7, 2021

Seldaek commented Dec 7, 2021 • edited Loading

bmack commented Dec 7, 2021

naderman commented Dec 7, 2021

GPHemsley-RELX commented Jan 10, 2022

Seldaek commented Jan 11, 2022

Seldaek commented Nov 25, 2021 •

edited

Loading

Seldaek commented Dec 7, 2021 •

edited

Loading