Repository navigation
feat(software): read software definitions from Composer packages - #169
Merged
Merged
Conversation
feat(software): address the entry of a package as `<package>#<id>` and report shadowed entries fix(binary): run a binary without a shell, passing every argument as is fix(installer): keep binary names and file renames inside the destination directory fix(installer): install a binary named like `a.b` as `a.b`, not `a.b.b` fix(downloader): save an asset under a file name whatever the release API calls it fix(cli): strip console tags and terminal control characters from registry text A framework or CMS can ship the binaries it needs without every project copying them into its dload.xml, and without a DLoad release for each tool. Only the root package and its direct dependencies are read, and their entries never override dload.xml or the official registry (#140). Package entries are third-party input that `dload show` acts on, so the core stopped trusting any config: a version-command used to reach the shell, a binary name could leave the target directory, and on Windows escapeshellarg() corrupted `"`, `%` and `!` in arguments. Package entries are held to a stricter shape on top: one version option, file names, valid regexes. Assisted-By: Claude Opus 5.5
fix(software): find a `dload.xml` alias containing `#` by its exact id docs: say the official registry warns only when it points to other repositories, and document `__root__#<id>` On Windows proc_open() with an argument array warns when CreateProcess fails, for a truncated binary or one built for another OS; `bin/dload` has no error handler, so the warning reached the console. Assisted-By: Claude Opus 5.5
…nit command fix(cli): list a software with a numeric id in `dload show` and `dload init` docs: document the file name rule and the extension of `rename`, and the id rules of package entries Symfony's formatter reads `<fg=…>` and `<href=…>` in any printed text, and an invalid style in it throws; package strings reach the log through warnings and through call arguments kept in a stack trace. Assisted-By: Claude Opus 5.5
test(cli): keep call arguments in the trace whatever `zend.exception_ignore_args` is A binary name may contain `<` and `>` on POSIX, so the path of a package's binary could carry console tags. CI runs with php.ini-production, which drops call arguments from traces, so the trace escaping test found nothing to check there. Assisted-By: Claude Opus 5.5
fix(cli): print the output of a failed build literally test(cli): keep string arguments in the trace whatever `zend.exception_string_param_max_len` is A package's binary name may contain `<` and `>` on POSIX: an invalid style in it made the formatter throw after the file was written, before its chmod, so `get` reported a failure for an installed, non-executable binary. Assisted-By: Claude Opus 5.5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔍 What was changed
extra.dload.registryin a package'scomposer.jsonpoints to an XML file inside the package (thedload.xmlformat, only<registry>is read). DLoad reads the root package and its direct dependencies fromvendor/composer/installed.json, so no Composer plugin is involved.<package>#<id>picks a package's entry whatever shadows it (dload get acme/fw#gh:^2.0,<download software="acme/fw#gh">).dload softwareshows each entry's origin and aShadows:line;dload showshowsSource:.<registry from-packages="false">switches package entries off.How it works
dload.xml> official registry > packages; among packages the root one first, then the order ofrequire, thenrequire-dev. Transitive dependencies are never read.<package>#<id>to choose from.version-commandother than one option orversion) is a warning and is skipped; DLoad keeps working.Why?
Frameworks and CMSs need binaries of their own; copying entries into every project's
dload.xmlor growing the official registry for one package does not scale (#140).For users
version-commandis split on whitespace and passed to the binary as arguments, without a shell: pipes, redirects and quotes no longer work there. Official entries only use--versionandversion.binaryname or a filerenamemust be a file name: a path,..or a Windows device name fails the install instead of writing outside the destination.a.bis installed asa.b, no longer asa.b.b.dload showlists a configured software with a numeric id, likealias="7"; before, it never matched.Review notes
dload showacts on: it checks the version of every registry binary present on disk. Review rounds found ways to turn that into command execution — a shell inversion-command,../in a binary name, arguments chosen for a binary the project already has (bun vendor/evil.js,rr reset). Hence the strict shape of package entries, andshownever runs a package entry's binary unless it is requested or configured.escapeshellarg()on Windows replaces",%and!with spaces, so a path likeC:\proj\100%\velox.tomlreachedvxcorrupted.BinaryExecutornow usesproc_open()with an argument array and a closed stdin.Logger::text()(console tags escaped, control characters stripped) wherever it is printed: log values and exception traces,software,show,init, install messages, the output of a failed build. Reasons: XML 1.0 rejects ESC but allows C1 controls such as CSI (›), and an invalid style in printed text makes the Symfony formatter throw.Checklist
Documentation
version-command, the binary name andrename.dload.xsd(from-packages,<package>#<id>, and the same rules) andresources/software.schema.json; thedload-fetch-toolskill with a newreferences/package-registry.md.Squash commit message
Several later commits only fix what an earlier commit of this PR introduced; the changelog should carry only: