Update README install instructions

[justinbeaty]

Description (*)

IMO, the install instructions are both unclear and inaccurate. I expanded on the section to explain exactly how to install via composer. I also added in notes about allowing patches which is critical to avoid security vulns.

View formatted README here: https://github.com/justinbeaty/magento-lts/tree/topic-readme-install#installation

Related Pull Requests

OpenMage/OpenMage.github.io#118

Manual testing scenarios (*)

• Try to install via composer the old way, it doesn't work
• Try to install via composer the new way, it should work.

Questions or comments

1. I changed "openmage/magento-lts":"^19.5.0" to "openmage/magento-lts":"^19.4.0" because 19.5.x doesn't exist. Plus, ^19.4.0 allows 19.5.x when it will exist.
2. Packagist is outdated. It tries to install 19.4.18.
3. Is it just me, or does the branch alias not work? composer require "openmage/magento-lts":"dev-main" doesn't work for me. I believe there's special consideration when a branch has a numerical name. (Ref)

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All automated tests passed successfully (all builds are green)
• Add yourself to contributors list

[sreichel]

Nice.

I'm currently work on refactoring docs. Every improvement is welcome :)

[justinbeaty]

Sometimes I feel like it's a secret handshake to know how to install magento-lts via composer. 😉

[Flyingmana]

did we have this part before like this? because extracting it over an existing install is only updating/adding files. But files which got deleted or moved will stay in their place, which in some cases might be a security issue.

[fballiano]

@Flyingmana I think it's related to the "composer thing". It is true that just overwriting everything can leave orphaned files, maybe we could write it in a better way. It's still a difficult task since, if people installed everything in the same docroot, how will they be able to "remove everything" and reinstall? They'll for sure have css/js and other stuff in various directories that make everything more difficult.

BTW we have a specific section "Since OpenMage 19.5.0 / 20.1.0" in the readme with a "rm" command, check it out ;-)

[Flyingmana]

what we could do is updating the migration project https://github.com/OpenMage/migrate/blob/master/create-patches.sh to create diff based patches as in the old days. Also github offers patch files for release upgrades as for example https://github.com/OpenMage/magento-lts/compare/v20.0.17...v20.0.18.patch although thats not covering the composer dependencies, so the migration project which creates and hosts patches might be a valuable approach

[justinbeaty]

I suppose that this is the "classic" way to install / upgrade Magento. Not the best, but is for people who just use FTP.

I wouldn't personally work on creating diff based patches since simply using composer would be a better approach and we should be encouraging that way intead.

[fballiano]

LGTM

[fballiano]

merged and v20ed

[fballiano]

I'm following the instructions but it seems the ZF1 patches are not applied :-(

[justinbeaty]

What version of magento-lts are you requiring?

I did:

$ composer require "openmage/magento-lts":"20.0.x-dev"

[...]

  - Installing openmage/magento-lts (20.0.x-dev 2fd3199): Extracting archive
  - Applying patches for shardj/zf1-future
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/MAG-1.1.1.patch (MAG-1.1.1)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/MAG-1.9.3.0.patch (MAG-1.9.3.0)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/MAG-1.9.3.7.patch (MAG-1.9.3.7 - SUPEE-10415)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/MAG-1.9.3.9.patch (MAG-1.9.3.9)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/OM-918.patch (OM-918 - Add runtime cache to Zend_Locale_Data)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/OM-1081.patch (OM-1081 - Not detecting HTTPS behind a proxy)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/OM-2047.patch (OM-2047 - Pass delimiter char to preg_quote)
    https://raw.githubusercontent.com/OpenMage/composer-patches/74862e7a9fa29dd62c5c02d585d931ce9e3c5815/patches/OM-2050.patch (OM-2050 - Prevent checking known date codes)

[justinbeaty]

But if I do:

composer require "openmage/magento-lts":"^19.4.0"
# or
composer require "openmage/magento-lts":"^20.0.0"

Then no patches, since it's not in those releases.

[fballiano]

you're totally right and I'm sorry, what stupid comment I posted 🤦🏻‍♂️
but my brain is boiled cause I'm working on a cool project I'll tell you about probably tomorrow heheheh

[justinbeaty]

No problem, I have those moments too. 😅

Also nice! Looking forward to it.

[fballiano]

@justinbeaty #2995