So the problem is with PHP8.2 and upwards. Not with our target PHP8.1 and PHP7.4 ( per linked failing job:

https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php81-noselenium/6671/console : SUCCESS in 13m 17s
https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php81-selenium/5107/console : SUCCESS in 10m 14s
https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php82-noselenium/5815/console : FAILURE in 1m 38s
https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php83-noselenium/4115/console : FAILURE in 1m 15s

Let me update ticket.

This has come back to bite us again, causing T390754: Extensions that pull in WebAuthn for their CI can support PHP 7.4 or PHP 8.2+, but not both (was: quibble-composer-mysql-php8[23] fail since 31/3) due to rCICF8d4fe15c61b3: zuul: Update WikimediaEvents dependencies

Very explicitly, for PHP8.2+ support, even running it in CI, it will need to be upgraded.

Needs to wait until PHP 7 is gone from Wikimedia production.

As @Tgr said, if we need to support both PHP7 and PHP8 - we will need to support two different library versions (WebAuthn v3, and WebAuthn v4). And this makes things complicated. We're pretty close to migrating away from PHP7 entirely - therefore it would be better to wait and just migrate this extension to newer version of WebAuthN lib. This approach substantially reduces the risk related to running two different major versions of auth library.

BTW, a note - there is a WebAuthn v5 but this requires PHP8.2 and up - therefore we cannot migrate directly to 5.x

I'm very aware of the complexities. See what happened with https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WebAuthn/+/1024971, and as such, why I gave up.

But not before working on various amounts of supporting changes, such as T373752: Build php-uuid package, and add to WMF production and CI.

We wouldn't be running two versions, in reality. Release branches are already only on PHP 8+ (and have been for aw hile), and most of production, even more so where thus code would be being run. So the migration could be done against REL1_43 (for example), and then cherry picked forward. The code differences between the release branches and master are going to be pretty minimal.

There's some big changes in the libraries anyway. Hopefully there's some backwards compatibility to allow upgrading...

Or even just against master, and not merged. CI is already being run on other PHP versions, and you can ignore the PHP 7.4 failures, for example.

I was pointing out that this will become a high(er) priority in the very near future, potentially blocking other upgrades of libraries etc due to the incompatibilites.

We can get ahead of things, rather than waiting until it becomes a blocker for other tasks, and then starting work.

I suspect Gergo's response was at least in part to the movement on the workboard, as such, it's not necessarily a "next" task.

In T363639#10721146, @Reedy wrote:

I suspect Gergo's response was at least in part to the movement on the workboard, as such, it's not necessarily a "next" task.

The comment was meant mostly as a self-reminder as we discussed this at the sprint planning meeting as something to work on right now, but we decided we can't yet.

So the migration could be done against REL1_43 (for example), and then cherry picked forward.

That's fine as long as the migration is just changing a number in composer.json. But we'll be moving up a major version - if that requires significant code changes, I don't think it's good to have that kind of difference between your master and release branches. It can make backporting other changes a lot harder.

Maybe worth doing if otherwise we'd have to put up with CI issues for a long time. But AIUI the last remnants of PHP 7 will be gone from production in a few weeks so waiting for that shouldn't be a big deal?

Change #1024723 abandoned by Reedy:

[mediawiki/extensions/WebAuthn@REL1_42] Allow web-auth/webauthn-lib ^4.8.0 as well as ~3.3.12 for PHP 8+

https://gerrit.wikimedia.org/r/1024723

Change #1143550 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] Zuul: Expand WebAuthn CI disable to all non-master/non-wmf branches

https://gerrit.wikimedia.org/r/1143550

Change #1143550 merged by jenkins-bot:

[integration/config@master] Zuul: Expand WebAuthn CI disable to all non-master/non-wmf branches

https://gerrit.wikimedia.org/r/1143550

Now that PHP 7.4 support is dropped, presumably this can move forward?

Is there a deadline for 8.2 support on Wikimedia servers?

T360995: Migrate Wikimedia production from PHP 8.1 to PHP 8.3 doesn’t seem to have a date…

This blocks upgrading symfony stuff (well, primarily symfony/process) in T396296: Upgrade symfony/* to PHP 8.1 versions

Problem 1
  - Root composer.json requires web-auth/webauthn-lib 3.3.12 -> satisfiable by web-auth/webauthn-lib[v3.3.12].
  - web-auth/webauthn-lib v3.3.12 requires symfony/process ^3.0|^4.0|^5.0 -> found symfony/process[v3.0.0, ..., v3.4.47, v4.0.0, ..., v4.4.44, v5.0.0, ..., v5.4.47] but it conflicts with your root composer.json require (6.4.20).

In T363639#10893101, @Tgr wrote:

Is there a deadline for 8.2 support on Wikimedia servers?

Originally, the deadline was the end of this month (as this was in the Foundation's annual plan for 24/25), but the delays on the first upgrade mean that that's been delayed. "Soon", certainly.

Removing the immense blocker task tree for clarity.

Change #1159483 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrade web-auth/webauthn-lib and dependancies...

https://gerrit.wikimedia.org/r/1159483

From T397068: Upgrade psr/http-message to 2.0 or later:

…
web-auth/webauthn-lib v3.3.12     requires psr/http-message (^1.0)
…

Upstream web-auth/webauthn-lib removed the psr/http-message direct dependency in v4.2.1. They do still require "psr/http-client": "^1.0" and "psr/http-factory": "^1.0", and those still indirectly depend on psr/http-message, but they already support both 1 || 2 and are those not an issue.

https://github.com/web-auth/webauthn-lib/commit/985ed1a371fbc955851a80a71f10f73c38f60c30

Which means upgrading from webauthn-lib 3.x to 4.x will also unblock T397068: Upgrade psr/http-message to 2.0 or later.

In other words, I've been looking at upgrading brick/math which we have currenly at 0.9, which is EOL with upstream at 0.13 already (previously highlighted in T319432#9810951). We couldn't upgrade this until now because the latest versions of brick/math require PHP 8.0+, and by now require PHP 8.1+.

The good news:

• brick/math has a very stable API.
• We don't use brick/math directly.
• Our dependencies that use it (ramsey/uuid and spomky-labs/cbor-php) all support a wide range of versions, which means it is mostly in our control what version we use.
  • ramsey/uuid: brick/math: ^0.8.8 || ^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13
  • spomky-labs/cbor-php: brick/math: ^0.9|^0.10|^0.11|^0.12|^0.13

The bad news:

• The web-auth/webauthn-lib package, of which we use version 3.x right now, required 1.x or 2.x of spomky-labs/cbor-php which is from 2021 and still required brick/math: ^0.8.15|^0.9.0, thus narrowing us to 0.9.0, which is exactly where we are already.

This means we can't upgrade brick/math until we upgrade webauthn-lib.

In T363639#10893101, @Tgr wrote:

Is there a deadline for 8.2 support on Wikimedia servers?

As part of the APP of FY25-26 there will be another PHP upgrade by the end of Q2. Unless we resolve hard dependencies on PHP 8.4, the next upgrade will be PHP 8.3.

The upgrade docs say

The Metadata Statement embraces the version 3 of the specification. There is no migration tool to convert the MDS from v2 to v3.

AIUI the MDS is basically a web API run by (or on behalf of) the manufacturer of the authenticator device that can be used to validate the claims the device makes about itself. We probably don't use this, and as such, don't need to worry about this change? The docs say

It is mandatory to get the statement from the manufacturer of your authenticators otherwise the Attestation Statement won't be verified and the Attestation Ceremony will fail.

which makes it sound like it's something done automatically by the library, but I think if the library made web requests to an external server, we'd know about that.

Per web-auth/webauthn-framework#585 Android SafetyNet support is deprecated in 4.9 and removed in 5.0. Not relevant for this task but we want to go 4.x -> 5.x once the PHP upgrade is done. Not sure if the SafetyNet deprecation is important. A quick Googling says SafetyNet is one of two Android APIs for WebAuthn attestation (the other being Android Keystore); attestation is about establishing the capabilities of the authenticator device (as opposed to assertion, which is verifying the user is logging in with the same device they created the passkey with) so at the very least the change shouldn't affect existing passkeys.

I think the relevant parts of the codebase are here and here (is it normal that those two lists differ?) and neither includes AndroidSafetyNetAttestationStatementSupport so we'll probably be fine?
(Or at least not more broken than we already are - why aren't we including AndroidKeyAttestationStatementSupport for registration? Why aren't we including AppleAttestationStatementSupport at all?)

Change #1159483 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrade web-auth/webauthn-lib and dependencies...

https://gerrit.wikimedia.org/r/1159483

Change #1024971 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Upgrade to web-auth/webauthn-lib ^4.9.2

https://gerrit.wikimedia.org/r/1024971

Change #1190596 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/extensions/WebAuthn@REL1_44] Upgrade to web-auth/webauthn-lib ^4.9.2

https://gerrit.wikimedia.org/r/1190596

Change #1190610 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/extensions/WebAuthn@REL1_43] Upgrade to web-auth/webauthn-lib ^4.9.2

https://gerrit.wikimedia.org/r/1190610

Change #1190596 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@REL1_44] Upgrade to web-auth/webauthn-lib ^4.9.2

https://gerrit.wikimedia.org/r/1190596

Change #1190610 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@REL1_43] Upgrade to web-auth/webauthn-lib ^4.9.2

https://gerrit.wikimedia.org/r/1190610