composer update (install step removed packages) fails because plugin-installer invokes autoloader

[mstilkerich]

Hello,

I have received reports of issues when upgrading to roundcube 1.6.0 (e.g. from 1.5.3), when the rcmcarddav plugin is also installed and upgraded during the process in the composer update --no-dev step. This problem will very likely apply with any other roundcube plugin installed using plugin-installer as well.

The problem seems to be the following:

• Some packages that were required by roundcube 1.5 are not required by roundcube 1.6 anymore.
• During the install step of composer update, these packages are removed first.
• When rcmcarddav is upgraded, the plugin code of plugin-installer is invoked. It appears to use the composer autoloader, which at this point apparently has not been updated yet. The autoloader tries to load the files of the packages that have already been removed, causing the process to die.

Running composer update --no-dev --no-plugins shows that the problem does not occur then, which confirms that the autoloader is loaded because of the plugin-installer code. However, I guess the plugin-installer code does some required actions and therefore this is not a valid workaround.

I'm not sure if this is a problem with plugin-installer or with the composer install process itself, i.e. if composer should have updated the autoloader before calling the plugin code first, or whether the plugin code is not supposed to use the autoloader.

A full log of the composer call for reference:

Loading composer repositories with package information
Updating dependencies
Lock file operations: 4 installs, 6 updates, 4 removals
  - Removing endroid/qr-code (1.6.6)
  - Removing symfony/polyfill-intl-idn (v1.26.0)
  - Removing symfony/polyfill-intl-normalizer (v1.26.0)
  - Removing symfony/polyfill-php72 (v1.26.0)
  - Locking bacon/bacon-qr-code (2.0.7)
  - Locking dasprid/enum (1.0.3)
  - Upgrading guzzlehttp/guzzle (6.5.8 => 7.4.5)
  - Upgrading guzzlehttp/psr7 (1.9.0 => 2.4.0)
  - Upgrading mstilkerich/carddavclient (v1.2.1 => v1.2.2)
  - Locking psr/http-factory (1.0.1)
  - Upgrading roundcube/carddav (v4.4.1 => v4.4.2)
  - Upgrading sabre/vobject (4.4.2 => 4.4.3)
  - Locking symfony/deprecation-contracts (v2.5.2)
  - Upgrading symfony/yaml (v4.4.43 => v4.4.44)
Writing lock file
Installing dependencies from lock file
Package operations: 4 installs, 5 updates, 4 removals
  - Removing symfony/polyfill-php72 (v1.26.0)
  - Removing symfony/polyfill-intl-normalizer (v1.26.0)
  - Removing symfony/polyfill-intl-idn (v1.26.0)
  - Removing endroid/qr-code (1.6.6)
  - Installing dasprid/enum (1.0.3): Extracting archive
  - Installing bacon/bacon-qr-code (2.0.7): Extracting archive
  - Installing symfony/deprecation-contracts (v2.5.2): Extracting archive
  - Installing psr/http-factory (1.0.1): Extracting archive
  - Upgrading guzzlehttp/psr7 (1.9.0 => 2.4.0): Extracting archive
  - Upgrading guzzlehttp/guzzle (6.5.8 => 7.4.5): Extracting archive
  - Upgrading sabre/vobject (4.4.2 => 4.4.3): Extracting archive
  - Upgrading mstilkerich/carddavclient (v1.2.1 => v1.2.2): Extracting archive
    Update of roundcube/carddav failed
 8/8 [============================] 100%
In autoload_real.php line 59:

  require(/tmp/rcold/roundcube/vendor/composer/../symfony/polyfill-php72/bootstrap.php): failed to open stream: No such file or directory

[mstilkerich]

So from reading the composer docs, I would conclude that plugin-installer should not load the regular composer autoloader because composer will setup autoloading specifically for the composer plugin so its declared dependencies can get loaded.

plugin-installer loads some roundcube classes, and therefore includes program/include/clisetup.php, which in turn includes program/include/iniset.php, which then includes the composer autoloader. This is where the error is triggered.

[mstilkerich]

Presumably the same issue prevents a plugin from being uninstalled:

SHELLPROMPT> tar xzf roundcubemail-1.6.0-complete.tar.gz
SHELLPROMPT> cd roundcubemail-1.6.0
SHELLPROMPT> composer require --update-no-dev -o "roundcube/carddav:*"
./composer.json has been updated
Running composer update roundcube/carddav
Loading composer repositories with package information
Updating dependencies
Lock file operations: 6 installs, 0 updates, 0 removals
  - Locking mstilkerich/carddavclient (v1.2.3)
  - Locking psr/log (1.1.4)
  - Locking roundcube/carddav (v4.4.3)
  - Locking sabre/uri (2.3.1)
  - Locking sabre/vobject (4.5.0)
  - Locking sabre/xml (2.2.5)
Writing lock file
Installing dependencies from lock file
Package operations: 6 installs, 0 updates, 0 removals
  - Installing psr/log (1.1.4): Extracting archive
  - Installing sabre/uri (2.3.1): Extracting archive
  - Installing sabre/xml (2.2.5): Extracting archive
  - Installing sabre/vobject (4.5.0): Extracting archive
  - Installing mstilkerich/carddavclient (v1.2.3): Extracting archive
  - Installing roundcube/carddav (v4.4.3): Extracting archive
 0/6 [>---------------------------]   0%Creating package config file
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating optimized autoload files
4 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found
SHELLPROMPT> composer remove --update-no-dev -o roundcube/carddav
./composer.json has been updated
Running composer update roundcube/carddav
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 0 updates, 6 removals
  - Removing mstilkerich/carddavclient (v1.2.3)
  - Removing psr/log (1.1.4)
  - Removing roundcube/carddav (v4.4.3)
  - Removing sabre/uri (2.3.1)
  - Removing sabre/vobject (4.5.0)
  - Removing sabre/xml (2.2.5)
Writing lock file
Installing dependencies from lock file
Package operations: 0 installs, 0 updates, 6 removals
  - Removing sabre/xml (2.2.5)
  - Removing sabre/vobject (4.5.0)
  - Removing sabre/uri (2.3.1)
    Uninstall of roundcube/carddav failed
  - Removing psr/log (1.1.4)
  - Removing mstilkerich/carddavclient (v1.2.3)
    0 [--->------------------------]
In autoload_real.php line 59:

  require(/tmp/roundcubemail-1.6.0/vendor/composer/../sabre/xml/lib/Deserializer/functions.php): Failed to open stream: No such file or directory

remove [--dev] [--dry-run] [--no-progress] [--no-update] [--no-install] [--no-audit] [--audit-format AUDIT-FORMAT] [--update-no-dev] [-w|--update-with-dependencies] [-W|--update-with-all-dependencies] [--with-all-dependencies] [--no-update-with-dependencies] [--unused] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--] <packages>...

When adding the --no-plugins switch to composer remove, the error does not occur (but also the plugin is not removed, because composer would look for it in vendor/, not plugins/.

[SvenLie]

Are there any updates on this issue? I can't install roundcube plugins via composer cause of this error

[ErrorException] include_once($ROUNDCUBE_ROOT_PATH/program/include/clisetup.php): failed to open stream: No such file or directory

I have replaced the original path cause of confidence

[alecpl]

Possibly fixed in 0.3.4.