| 13 Feb 2024 |
 Pol | It works locally | 14:29:59 |
 @patka_123:matrix.org | That is strange... But I don't have the time to look into it too deeply. Would you mind creating the PR if you did the update already? | 14:30:46 |
| Pol | yup since the work is done here, I'm going to push it | 14:31:07 |
| @patka_123:matrix.org | Thanks. It fixes a CVE as well https://blog.packagist.com/composer-2-7-and-cve-2024-24821/ | 14:31:41 |
| Pol | https://github.com/NixOS/nixpkgs/pull/288574 | 14:34:06 |
| @patka_123:matrix.org | Hmm, I'm getting 38 packages failed to build. I guess somethings wrong on my side... | 14:40:42 |
| @patka_123:matrix.org | * Hmm, I'm getting 38 packages (so all of them) failed to build. I guess somethings wrong on my side... | 14:41:51 |
| @patka_123:matrix.org | What does nixpkgs-review pr --print-result 288574 do for you? | 14:42:26 |
| Pol | Let me spawn a shell with nixpkgs-review and I'll let you know | 14:44:00 |
| Pol | shit it's failing everywhere. | 15:00:41 |
| Pol | #investigating | 15:07:20 |
| Pol | I don't understand, it's failing on composer/ca-bundle, I don't know yet where it comes form | 15:11:55 |
| Pol | I will reproduce the issue at home and open an issue at composer/composer I guess... | 15:26:49 |
| Pol | * I will reproduce the issue without Nix at home and open an issue at composer/composer I guess... | 15:27:00 |
| Pol | Issue identified! | 15:29:54 |
| Pol | It's in https://github.com/nix-community/composer-local-repo-plugin | 15:30:11 |
| Pol | For some reason, some references are still refering Git instead of a local path | 15:30:25 |
| Pol | Oh no. | 15:30:54 |
| Pol | False alarm. | 15:30:57 |
| @patka_123:matrix.org | I'm on the road now so can't do much. But there's something in the release notes about plugins
https://github.com/composer/composer/releases/tag/2.7.0 | 15:42:30 |
| Pol | I can't reproduce it locally :S https://gist.github.com/drupol/ab25340ea5fa46e3c2f49c1d9ed5eb71 | 15:43:43 |
| Pol | I will bisect properly from home... | 15:44:53 |
| Pol | If you want to help, I just published the shell script that I use to test | 15:47:57 |
| Pol | This is basically replicating what pkgs.php.buildComposerProject {} is doing. | 15:48:16 |
| Pol | Ok I can reproduce it locally now :) | 16:11:01 |
| Pol | I will post the issue on composer/composer ! | 16:11:08 |
| Pol | But first, I need to bisect it so I can show which commit broke it. | 16:12:03 |
| Pol | The issue is in between 2.6.6 and 2.7.0 | 16:14:06 |
| Pol | I have a hunch, a gut feeling that tells me that this might be the issue: * Fixed update --lock not keeping the dist reference/url/checksum pinned (#11787) | 16:15:44 |
| Pol | Not sure yet. | 16:15:45 |
