Newer Composer version (>= 2.2) with allow-plugins Feature breaks installation with Contao Manager

[HoTodo]

When installing a new Contao instance on a system with a Composer of version 2.2 or higher the installation fails with:

In PluginManager.php line 768:

  contao-components/installer contains a Composer plugin which is blocked by   
  your allow-plugins config. You may add it to the list if you consider it sa  
  fe.                                                                          
  You can run "composer config --no-plugins allow-plugins.contao-components/i  
  nstaller [true|false]" to enable it (true) or disable it explicitly and sup  
  press this exception (false)                                                 
  See https://getcomposer.org/allow-plugins    

When running the installation on the command line, Composer asks to add the Plugin to the configuration. But with the Contao Manager there is no such option. It just fails.

I think the composer.json that is generated by the Contao Manager should already contain the necessary allow-plugin configuration, so that the installation does not need any user interaction to succeed.

[aschempp]

The Contao Manager dynamically allows all plugins at runtime (https://github.com/contao/contao-manager/blob/cf11e5b915619d87305d9757037b4393ca8e6445/api/Config/ComposerConfig.php#L45) if no configuration is set. So it begs the question whether you have an allow-plugins configuration in your system?

[fritzmg]

According to one report in the Slack community this apparently is not taking effect when not using the resolver cloud. Can you confirm that?

[HoTodo]

I just updated my Issue description.

The composer.json that gets created on my webspace lloks like

{
    "type": "project",
    "require": {
        "contao/conflicts": "*@dev",
        "contao/manager-bundle": "5.0.*",
        "contao/calendar-bundle": "5.0.*",
        "contao/comments-bundle": "5.0.*",
        "contao/faq-bundle": "5.0.*",
        "contao/listing-bundle": "5.0.*",
        "contao/news-bundle": "5.0.*",
        "contao/newsletter-bundle": "5.0.*"
    },
    "extra": {
        "public-dir": "public",
        "contao-component-dir": "assets"
    },
    "scripts": {
        "post-install-cmd": [
            "@php vendor/bin/contao-setup"
        ],
        "post-update-cmd": [
            "@php vendor/bin/contao-setup"
        ]
    }
}

So there is no allow-plugins configuration at all. Any ideas?

[HoTodo]

According to one report in the Slack community this apparently is not taking effect when not using the resolver cloud. Can you confirm that?

I can confirm that I am NOT using the resolver cloud due to CORS issues (its on a local development environment)

[HoTodo]

So it begs the question whether you have an allow-plugins configuration in your system?

I think I do not have a dedicated allow-plugins configuration. I'm using the docker image webdevops/php-apache:8.1 to run my webspace locally.

[HoTodo]

When using the resolver cloud, the installation (at least for v5.0) runs successfully. (no CORS issues this time)

[aschempp]

it is correct that there is no configuration added to your composer.json. The Contao Manager dynamically adds this at runtime. However, it sure should work when not using the Cloud. My guess would be that the config is now always available in the latest Composer versions therefore the value is never set by the Contao Manager.

[HoTodo]

Since I could perform the installation now by activating the resolver cloud, I'm fine for the moment. I'm not sure how I could help you any further right now. If there is anything, please ask.

BTW: It's impressive how fast you are reacting to new issues. Thanks for that. :-)

[aschempp]

I just tried to reproduce this, but I was unable to locally. I was able to update a Contao locally without using the cloud, and without having to set anything about plugins in my composer.json.

I actually had to re-engineer how this works (what I built 2 years ago 😂). In a Contao Manager environment, the global composer directory is /contao-manager. Inside that directory is the global configuration in the config.json, similar to what you can have in your regular home directory as a command line user when using Composer. This config.json should contain the allow-plugins: true statement.

I'm closing this for now, let me know if the issue still exists and how we could reproduce it.