Composer was unable canonicalize URLs in non-HTTP(S) Composer
repositories. For example it was not possible to use a `providers-url`
in a repository loaded via the `file://` scheme.
See also: #8115
hhvm-nightly (and next week's release) now report 4.x, so all the 3.x
constraints are now giving misleading error messages with this patch.
Before:
```
- facebook/fbexpect v2.3.0 requires hhvm ^3.28 -> you are running this with PHP and not HHVM.
```
After:
```
- facebook/fbexpect v2.3.0 requires hhvm ^3.28 -> your HHVM version (4.0.0-dev) does not satisfy that requirement.
```
This 5 character fix comes with a solver test as well as a functional
installer test essentially verifying the same thing. The solver test is
more useful when working on the solver. But the functional test is less
likely to be accidentally modified incorrectly during refactoring, as
every single package, version and link in the rather complex test
scenario is essential, and a modified version of the test may very well
still result in a successful installation but no longer verify the bug
described below.
Background:
In commit 451bab1c2c from May 19, 2012 I
refactored literals from complex objects into pure integers to reduce
memory consumption. The absolute value of an integer literal is the id
of the package it refers to in the package pool. The sign indicates
whether the package should be installed (positive) or removed (negative),
So a major part of the refactoring was swapping this call:
$literal->getPackageId()
For this:
abs($literal)
Unintentionally in line 554/523 I incorrectly applied this change to the
line:
$this->literalFromId(-$literal->getPackageId());
It was converted to:
-abs($literal);
The function literalFromId used to create a new literal object. By using
the abs() function this change essentially forces the resulting literal
to be negative, while the minus sign previously inverted the literal, so
positive into negative and vice versa.
This particular line is in a function meant to analyze a conflicting
decision during dependency resolution and to draw a conclusion from it,
then revert the state of the solver to an earlier position, and attempt
to solve the rest of the rules again with this new "learned" conclusion.
Because of this bug these conclusions could only ever occur in the
negative, e.g. "don't install package X". This is by far the most likely
scenario when the solver reaches this particular line, but there are
exceptions.
If you experienced a solver problem description that contained a
statement like "Conclusion: don't install vendor/package 1.2.3" which
directly contradicted other statements listed as part of the problem,
this could likely have been the cause.
When a full 'composer' cannot be constructed (because there is no
local composer.json and no global composer.json), some commands
(e.g. `show -a`) fall back to the default repositories from the
`$COMPOSER_HOME/config.json` file. Without this fix, any auth
configuration from `$COMPOSER_HOME/auth.json` is not used for
these repositories in such a fallback scenario.
Steps to reproduce:
* Configure a password-protected composer repository in
`$COMPOSER_HOME/config.json`.
* Configure valid credentials for that repository in
`$COMPOSER_HOME/auth.json`.
* Make sure there is no file `$COMPOSER_HOME/composer.json`.
* Ensure the current working directory has no `composer.json`.
* Run `composer show -a some/package`.
Expected: Information about `some/package` is shown without
needing to enter credentials.
Actual: A prompt "Authentication required" is shown for the
private repository. When running the same command in a dir
that has a `composer.json`, or when `$COMPOSER_HOME/composer.json`
exists, things work as expected.
Nicolas Grekas
Rob Bast
Jordi Boggiano
pfofi
Nils Adermann
Stephan Vock
Elan Ruusamäe
Markus Staab
Markus Staab
johnstevenson
Michael Telgmann
Fred Emmott
Arnout Boks