Page MenuHomePhabricator
Create Task
Maniphest T279857

Re-build CI containers with Composer 2.x
Closed, ResolvedPublic
Actions

Description

At some point we need to rebuild CI containers with Composer 2.0 bundled, rather than Composer 1.x (I'm not sure if there's value in bundling both... Maybe there is for a while? For REL1_31 and maybe other usages?)

In https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/667051/2/composer.json I changed the composer-plugin-api version to ^2.0 to prevent (after it's merged) anyone accidentally running things with composer 1.x, but it won't pass CI.

Certainly, for now, it could be ^1.1||^2.0, but eventually, it seems a useful safeguard to have so that they get a strong warning if they try to run it with old composer 1.x

MediaWiki 1.31 doesn't support composer 2, and never will... And is EOL in June 2021, so we probably don't care about this use case too much. And we may just want to wait until that has passed, and drop composer 1.x support in CI completely.

At some point, https://blog.packagist.com/deprecating-composer-1-support/ will start to affect us

Reduced v1 metadata API update rate starting in May 2021
The update rate for new versions will be reduced from every-minute currently to once every 15 minutes. This means new releases will take a few minutes longer to be available for installation with Composer 1.x.

I know 15 minutes isn't a lot, but it's going to be enough in cases for CI's composer queries to fail for a little while...

Details

SubjectRepoBranchLines +/-
docker: Update dev images to newer version with Composer 2.xmediawiki/coremaster+3 -3
jjb: Switch everything to images using composer 2.x not 1.xintegration/configmaster+78 -78
dockerfiles: [composer-scratch] Upgrade to 2.1.8 and cascadeintegration/configmaster+218 -2
Customize query in gerrit
TitleReferenceAuthorSource BranchDest Branch
Update buster-based images to composer 2.1.8repos/releng/dev-images!7jforrestercomposer-2main
Customize query in GitLab

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedReedyT266419 Composer 2.0 updates and support
 ResolvedReedyT266421 Rebuild mediawiki-vendor on composer 2.0
 ResolvedReedyT275824 Bump wikimedia/composer-merge-plugin in vendor
 ResolvedtstarlingT248908 composer-merge-plugin support for composer 2.0
Restricted Task
 ResolvedJdforrester-WMFT279857 Re-build CI containers with Composer 2.x
 ResolvedJdforrester-WMFT281294 Drop CI for REL1_31 branch once it's EOL
 ResolvedReedyT279858 Formally EOL REL1_31
 ResolvedReedyT279859 Announce upcoming formal EOL of REL1_31
 ResolvedReedyT285404 Release MediaWiki 1.31.16/1.35.4/1.36.2
 ResolvedReedyT285405 Tracking bug for MediaWiki 1.31.16/1.35.4/1.36.2
 ResolvedSecurityZabeT285515 CVE-2021-41798: XSS vulnerability in Special:Search
Restricted Task
 ResolvedBUG REPORTLadsgroupT290379 2021-09-04 enwiki was down at 10:44 (UTC)
Restricted Task
Restricted Task
 ResolvedReedyT285407 Write and send pre-release announcements for MediaWiki 1.31.16/1.35.4/1.36.2
 ResolvedReedyT285408 Write and send release announcements for MediaWiki 1.31.16/1.35.4/1.36.2
 ResolvedReedyT285409 Tag 1.31.16/1.35.4/1.36.2
 ResolvedReedyT285410 Update onwiki news and Module:Version
 ResolvedReedyT285411 Update onwiki release notes for 1.31.16/1.35.4/1.36.2
 ResolvedReedyT285412 Update Wikidata Q83
 ResolvedReedyT285413 Update HISTORY in master after 1.31.16/1.35.4/1.36.2
 ResolvedMstylesT285414 Write and send supplementary release announcement for extensions and skins with security patches (1.31.16/1.35.4/1.36.2)
 ResolvedSecuritysbassettT286376 Add DataDump CVE-2021-32774 to extensions security announcement
 ResolvedSecurityRhinosF1T279090 CVE-2021-41801: ReplaceText continues performing actions if the user no longer has the correct permission (such as by being blocked)
Restricted Task
 ResolvedSecurityLegoktmT289385 Modified HTTP headers allow XSS in SecurePoll (CVE-2021-42045)
 ResolvedSecurityDannyS712T286385 XSS in GlobalWatchlist (CVE-2021-42046)
 ResolvedSecurity• Urbanecm_WMFT289063 Mentor dashboard: Permanent XSS exploitable by wiki admins (server-side part) (CVE-2021-42047)
 ResolvedSecurity• mewophT289064 Newcomer homepage Impact module: Permanent XSS exploitable by admins for new accounts (CVE-2021-42048)
 ResolvedSecurity• Urbanecm_WMFT289408 Mentor dashboard: Permanent XSS exploitable by wiki admins (client-side part) (CVE-2021-42044)
 ResolvedSecurity• Urbanecm_WMFT290692 Permanent XSS exploitable by wiki admins in SpecialEditGrowthConfig (CVE-2021-42042)
 ResolvedSecurityTheVoidwalkerT287347 Loops can cause php-fpm exhaustion (CVE-2021-42040)
 ResolvedReedyT292036 Write and send formal EOL email for REL1_31

Event Timeline

Reedy created this task.Apr 11 2021, 3:17 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 11 2021, 3:17 PM
Reedy renamed this task from Build CI containers with Composer 2.0 to Re-build CI containers with Composer 2.0.Apr 11 2021, 3:17 PM
Reedy added a parent task: T266419: Composer 2.0 updates and support.
Reedy updated the task description. (Show Details)
Reedy updated the task description. (Show Details)Apr 11 2021, 3:20 PM
Jdforrester-WMF subscribed.Apr 12 2021, 9:50 PM
Reedy updated the task description. (Show Details)Apr 13 2021, 2:29 AM
Daimona subscribed.Apr 14 2021, 4:23 PM
gerritbot added a comment.Apr 27 2021, 6:04 PM

Change 683030 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] [DNM] dockerfiles: [composer-scratch] Upgrade to 2.0.13 and cascade

https://gerrit.wikimedia.org/r/683030

gerritbot added a project: Patch-For-Review.Apr 27 2021, 6:04 PM
hashar added a parent task: Restricted Task.May 27 2021, 11:17 AM
Reedy changed the status of subtask T281294: Drop CI for REL1_31 branch once it's EOL from Open to In Progress.Sep 29 2021, 4:15 PM
Reedy renamed this task from Re-build CI containers with Composer 2.0 to Re-build CI containers with Composer 2.x.Sep 30 2021, 9:46 PM
Reedy closed subtask T281294: Drop CI for REL1_31 branch once it's EOL as Resolved.Sep 30 2021, 9:54 PM
Jdforrester-WMF changed the task status from Open to In Progress.Oct 4 2021, 4:26 PM
gerritbot added a comment.Oct 4 2021, 6:07 PM

Change 683030 merged by jenkins-bot:

[integration/config@master] dockerfiles: [composer-scratch] Upgrade to 2.1.8 and cascade

https://gerrit.wikimedia.org/r/683030

Maintenance_bot removed a project: Patch-For-Review.Oct 4 2021, 6:10 PM
Stashbot added a comment.Oct 4 2021, 6:12 PM

Mentioned in SAL (#wikimedia-releng) [2021-10-04T18:12:52Z] <James_F> Docker: Publish composer 2.x-based images for T279857

Jdforrester-WMF added a comment.Oct 4 2021, 6:26 PM

https://gitlab.wikimedia.org/releng/dev-images/-/merge_requests/7 for upgrading the dev-images.

gerritbot added a comment.Oct 4 2021, 7:35 PM

Change 726039 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] jjb: Switch everything to images using composer 2.x not 1.x

https://gerrit.wikimedia.org/r/726039

gerritbot added a project: Patch-For-Review.Oct 4 2021, 7:35 PM
gerritbot added a comment.Oct 6 2021, 7:13 PM

Change 726039 merged by jenkins-bot:

[integration/config@master] jjb: Switch everything to images using composer 2.x not 1.x

https://gerrit.wikimedia.org/r/726039

Jdforrester-WMF closed this task as Resolved.Oct 6 2021, 7:13 PM
Jdforrester-WMF claimed this task.
Maintenance_bot removed a project: Patch-For-Review.Oct 6 2021, 8:10 PM
Krinkle mentioned this in T292684: All quibble-fresnel jobs crash before starting: "Could not find browser".Oct 7 2021, 4:40 AM
gerritbot added a comment.Oct 23 2021, 1:21 AM

Change 733095 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@master] docker: Update dev images to newer version with Composer 2.x

https://gerrit.wikimedia.org/r/733095

gerritbot added a project: Patch-For-Review.Oct 23 2021, 1:21 AM
gerritbot added a comment.Oct 23 2021, 1:52 AM

Change 733095 merged by jenkins-bot:

[mediawiki/core@master] docker: Update dev images to newer version with Composer 2.x

https://gerrit.wikimedia.org/r/733095

ReleaseTaggerBot added a project: MW-1.38-notes (1.38.0-wmf.6; 2021-10-26).Oct 23 2021, 2:00 AM
Maintenance_bot removed a project: Patch-For-Review.Oct 23 2021, 2:10 AM
Zabe mentioned this in T294260: Upgrade dockerfiles to use composer 2.1.9 per CVE-2021-41116.Oct 25 2021, 3:47 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits