I am trying to get a site up and running using the drupal-composer/drupal-project method of installation. When I try to do a:

composer require drupal/composer_security_manager

I get:

[InvalidArgumentException]
Could not find package drupal/composer_security_manager at any version for your minimum-stability (stable). Check the package spelling or your minimum-stability

I then proceeded to the manual method and did:
composer require sensiolabs/security-checker ~3.0.0
composer require roave/security-advisories dev-master

Nothing was said about downloading the module but I did so and enabled it. I then opened reports and selected the link "Composer Security Checker Report" and received the following:

The website encountered an unexpected error. Please try again later.
SensioLabs\Security\Exception\RuntimeException: Lock file does not exist

I looked in the code and it is looking for the lockfile to be in the web directory and not the project root directory.

If I change the $lock to be /home/myuser/staging.mywebsite.com/web instead of "/home/myuser/staging.mywebsite.com/web" the report functions as expected.

Suggestions?

CommentFileSizeAuthor
#7 composer_security_checker-2839404-7.patch6.82 KBbadjava
#6 composer_security_checker-2839404-5.patch6.83 KBbadjava
#4 composer_security_checker-2839404-4.patch0 bytesbadjava
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Christopher Riley created an issue. See original summary.

chapabu’s picture

chapabu CreditAttribution: chapabu as a volunteer commented
Title: Trouble installing » Assumption that lockfile is in Drupal root is not always correct.

Hmm..that makes sense. So, we either need an option to specify the lockfile path relative to the Drupal root (makes the most sense to me in terms of flexibility), or we need to traverse directories and look for it.

I guess it'd also be nice to not throw an exception, and rather catch the error in the logs and display a message.

I can take a look at this as soon as I can, but my time is a little stretched right now :(

Christopher Riley’s picture

Christopher Riley CreditAttribution: Christopher Riley commented

I understand and appreciate it. I think specifying the path is the quickest and most flexible way of doing it.

badjava’s picture

badjava CreditAttribution: badjava at Metasun for Pfizer, Inc. commented
FileSize
composer_security_checker-2839404-4.patch0 bytes

+1 for this. The Drupal Composer Template has the project root one folder above the web root so this will be a pretty standard use case.

Here is a stab at a patch. The only thing it doesn't do is try and catch the error on the reports page when composer.lock isn't found.

badjava’s picture

badjava CreditAttribution: badjava at Metasun for Pfizer, Inc. commented
Status: Active » Needs review
badjava’s picture

badjava CreditAttribution: badjava at Metasun for Pfizer, Inc. commented
FileSize
composer_security_checker-2839404-5.patch6.83 KB

Let's try this again.

badjava’s picture

badjava CreditAttribution: badjava at Metasun for Pfizer, Inc. commented
FileSize
composer_security_checker-2839404-7.patch6.82 KB

Fixed a minor issue in the form field.

Christopher Riley’s picture

Christopher Riley CreditAttribution: Christopher Riley commented

Thank you for the patch seems as if it applies cleanly via composer patch. One thing else that you may want to do is to fix the docs so that they do a:

composer require drupal/composer_security_checker

and not

composer require drupal/composer_security_manager

Thanks again for the patch just waiting for something that should be reported to actually get reported.

chapabu’s picture

chapabu CreditAttribution: chapabu as a volunteer commented

Wow, this looks great @badjava!

I'll try and get this merged in the next couple of days! Thanks for your help :)

  • chapabu committed 0386351 on 8.x-1.x authored by badjava 
    Issue #2839404 by badjava: Assumption that lockfile is in Drupal root is...
chapabu’s picture

chapabu CreditAttribution: chapabu as a volunteer commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

shrop’s picture

shrop CreditAttribution: shrop at Mediacurrent commented

I am having this error while running 1.x-dev: My webroot ins in the web folder beneath my composer.json and composer.lock files.

Requirement in my composer.lock file. 

   "name": "drupal/composer_security_checker",
        "version": "dev-1.x",
        "source": {
            "type": "git",
            "url": "https://git.drupal.org/project/composer_security_checker",
             "reference": "75af37aa7d5a364be8fd1280b47451fa2490f56e"
        },
shrop’s picture

shrop CreditAttribution: shrop at Mediacurrent commented
Issue tags: +Guardr
chapabu’s picture

chapabu CreditAttribution: chapabu as a volunteer commented

That's weird, because this did fix it for me and I've not had any issues thus far. It might be a stupid question, but you changed the settings from the defaults?

If you did, perhaps you could give me a little more information so I can try to reproduce the issue?

I doubt it's of any use whatsoever, but I did just tag an 8.x-1.1 release containing this fix, so maybe when that's made it's way through the d.o chain you could try that, then if the problem persists we can either reopen this or create a new issue :)

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous as a volunteer commented

I just got this:

SensioLabs\Security\Exception\RuntimeException: Lock file does not exist. in SensioLabs\Security\SecurityChecker->check() (line 47 of /Users/stephenpurkiss/Sites/d8/vendor/sensiolabs/security-checker/SensioLabs/Security/SecurityChecker.php).

I saw a tweet go by with the module update & thought "ooo that looks interesting I shall try that" so ran my rebuild script which uses composer:

composer create-project drupal-composer/drupal-project:8.x-dev d8 --stability dev --no-interaction

Then enabled the module, went to the report and got the "unexpected" error message.

Then I looked at the issue queue and saw it was @chapabu. And @shrop. So I thought I'd post here too.

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous as a volunteer commented

...I thought for a moment there it was my bad cos I didn't specify dev but does the same when I do:

composer require drupal/composer_security_checker:1.x-dev

chapabu’s picture

chapabu CreditAttribution: chapabu as a volunteer commented

Yeah, dev and stable are in line at the mo!

I'll spin up en env later this week from drupal-composer and see if I can see what's up!.

shrop’s picture

shrop CreditAttribution: shrop at Mediacurrent commented

@chapabu: Thanks for checking into it as you can. I am thinking of adding is to Guardr via https://www.drupal.org/node/2862133

@stevepurkiss: Thanks for the verifying!