"Box requirements" check does not respect version constraint of "conflict"

[donquixote]

(This might be a problem from phpro/grumphp, but we are using the phar so I am reporting it here.)

Symptoms

We are working with a container with redis 6.3.0 extension.
(this is what I get from php --re redis | head -1)

In our project we require phpro/grumphp-shim.
Until recently we had version 2.17.*, now we have version 2.18.0.

Now we get this report when we run grumphp:

> Checking Box requirements:
  ✔ This application requires a PHP version matching "~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0".
  ✔ The package "amphp/dns" requires the extension "filter".
  ✔ The package "league/uri-interfaces" requires the extension "filter".
  ✔ The package "symfony/polyfill-mbstring" requires the extension "iconv".
  ✔ This application requires the extension "json".
  ✔ The package "amphp/dns" requires the extension "json".
  ✔ The package "nikic/php-parser" requires the extension "json".
  ✔ The package "amphp/socket" requires the extension "openssl".
  ✔ The package "kelunik/certificate" requires the extension "openssl".
  ✔ The package "gitonomy/gitlib" requires the extension "pcre".
  ✔ The package "nikic/php-parser" requires the extension "tokenizer".
  ✔ The package "symfony/dependency-injection" conflicts with the extension "psr".
  ✔ The package "symfony/service-contracts" conflicts with the extension "psr".
  ✘ The package "symfony/cache" conflicts with the extension "redis".
  ✔ The package "symfony/cache" conflicts with the extension "relay".
  
                                                                                                                                                                   
 [ERROR] Your system is not ready to run the application.                                                                                                          
                                                                                                                                                                   

Fix the following mandatory requirements:
=========================================

 * The package "symfony/cache" conflicts with the extension "redis". You need to disable it in order to run this application.

When I look into vendor/phpro/grumphp-shim/phar.composer.lock, I see that symfony/cache has "conflict": {.."ext-redis": "<6.1",..}.
The older version of symfony/cache did not have this line, this is why the problem only occurs with phpro/grumphp-shim 2.18.0.

Given that our redis is at 6.3.0, there should not be a conflict.

Problem

It seems to me that the box requirements check does not consider the version constraint of a line in "conflict".

(I would like to know where the check is implemented)

[veewee]

Thanks for reporting @donquixote.

The build script in this repository uses humbug/box for compiling the code into phar.
The mandatory requirements checker is added by box, so I think it is better to report an issue in that repository.

It can be disabled by using BOX_REQUIREMENT_CHECKER=0 in your env in the meantime.

[donquixote]

It can be disabled by using BOX_REQUIREMENT_CHECKER=0 in your env in the meantime.

Thanks!
This works when explicitly calling grumphp.

However, grumphp also runs as a composer plugin as 'post-update-cmd' and 'post-install-cmd', and here I don't see how we could disable. Maybe we globally put this env variable in the web container or system where we run composer?

[veewee]

@donquixote I don't know ... putting the env var in your container setup is perfectly possible but not optimal.

My point in previous comment is that the issue then lies in humbug/box and probably should be handled in there. If it's fixed in there, I am able to create a new phar.
Can you create an issue in that repo? Thanks!

[donquixote]

I created box-project/box#1578.

I don't know ... putting the env var in your container setup is perfectly possible but not optimal.

Our new workaround is now to disable the plugin in our composer.json.
The container was not really a good place because in our CI the container is not controlled by project code.

    "config": {
        [...]
        "allow-plugins": {
            [...]
            "phpro/grumphp-shim": false,
        }
    }

EDIT: In addition, we still use the env var when calling grumphp directly, so BOX_REQUIREMENT_CHECKER=0 ./vendor/bin/grumphp run.

[donquixote]

Can you create an issue in that repo? Thanks!

I did that!
box-project/box#1578

I wanted to create some steps to reproduce in isolation with just "box", but I would need to familiarize myself more with it first.
Instead I looked at the code, and indeed the version constraints are never looked at.

[veewee]

The build process of this project is this:

make compile TAG=2.18.0

grumphp-shim/Makefile

Lines 8 to 19 in 6a46a59

	compile:
	$(if $(TAG),,$(error TAG is not defined. Pass via "make compile TAG=4.2.1"))
	@echo Compiling $(TAG)
	$(eval BUILD_DIR := $(shell mktemp -d -t grumphp-shim-build))
	@echo Cloning GrumPHP $(TAG) in directory $(BUILD_DIR)
	git clone git@github.com:phpro/grumphp.git $(BUILD_DIR)
	git --work-tree=$(BUILD_DIR) --git-dir='$(BUILD_DIR)/.git' checkout 'tags/v$(TAG)'
	make prepare BUILD_DIR=$(BUILD_DIR)
	make sanity BUILD_DIR=$(BUILD_DIR)
	make cleanup BUILD_DIR=$(BUILD_DIR)
	# Release tag
	@echo "Run 'make release TAG=$(TAG)' to tag a new release"

grumphp-shim/Makefile

Lines 35 to 50 in 6a46a59

	prepare:
	$(if $(BUILD_DIR),,$(error BUILD_DIR is not defined. Pass via "make prepare BUILD_DIR=/tmp/prepared-grumphp-src"))
	cp build/* '$(BUILD_DIR)'
	cp src/Composer/FixBrokenStaticAutoloader.php '$(BUILD_DIR)/src/Composer'
	php $(BUILD_DIR)/fix-some-stuff-in-composer.php
	composer install --working-dir='$(BUILD_DIR)' --no-scripts --no-plugins --no-dev --no-interaction --optimize-autoloader
	# Bundle suggested optional packages:
	composer require --working-dir='$(BUILD_DIR)' 'nikic/php-parser:~5.0' --update-no-dev --no-interaction
	php -d error_reporting='(E_ALL & ~E_DEPRECATED)' ./vendor/bin/box compile --working-dir='$(BUILD_DIR)' -vvv
	# Copy composer plugin
	cp '$(BUILD_DIR)/src/Composer/GrumPHPPlugin.php' '$(ROOT_DIR)/src/Composer/GrumPHPPlugin.php'
	cp '$(BUILD_DIR)/composer.lock' '$(ROOT_DIR)/phar.composer.lock'
	# All good : lets finish up
	cp '$(BUILD_DIR)/grumphp.phar' '$(ROOT_DIR)'
	gpg --local-user toonverwerft@gmail.com --armor --detach-sign grumphp.phar
	gpg --verify grumphp.phar.asc grumphp.phar

Box configurations are located here:

https://github.com/phpro/grumphp-shim/tree/v2.x/build

[donquixote]

Just fyi, the maintainer is aware of the problem and working on it:
box-project/box#1578 (comment)

Indeed, I plan to address this.

Related to box-project/box#1243.