PHAR distribution and manifest(s)

[llaville]

Hello,

Because I've tested today Deployer 7.5.5 on a PHP 8.4.0RC4 platform, and notice some issues, I would like here to suggest to upgrade your https://github.com/deployphp/deployer/blob/master/bin/build script and include some manifests.

A manifest define the contents of dependencies embedded with the PHAR distribution.
There are some non-standard format (plain text, console table, json, ...) and standard format (like SBOM: Software Bill Of Materials).

If you're agree with this suggestion, I may help you to add support to my project BOX Manifest that is able with a compatible BOX config file format to generate manifests files in different format.

WDYT ?

Related to PHP 8.4 issue, if I run this command :

php deployer-7.5.phar --version

I got :

Deprecated: React\Promise\Timer\timeout(): Implicitly marking parameter $loop as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/react/promise-timer/src/functions.php on line 142

Deprecated: React\Promise\Timer\sleep(): Implicitly marking parameter $loop as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/react/promise-timer/src/functions.php on line 229

Deprecated: React\Promise\Timer\resolve(): Implicitly marking parameter $loop as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/react/promise-timer/src/functions.php on line 287

Deprecated: React\Promise\Timer\reject(): Implicitly marking parameter $loop as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/react/promise-timer/src/functions.php on line 330

Fatal error: Uncaught ErrorException: Symfony\Component\Console\Input\ArgvInput::__construct(): Implicitly marking parameter $argv as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/symfony/console/Input/ArgvInput.php:46
Stack trace:
#0 phar:///shared/backups/php/deployer-7.5.phar/vendor/composer/ClassLoader.php(444): {closure:phar:///shared/backups/php/deployer-7.5.phar/bin/dep:79}(8192, 'Symfony\\Compone...', 'phar:///shared/...', 46)
#1 phar:///shared/backups/php/deployer-7.5.phar/vendor/composer/ClassLoader.php(444): include()
#2 phar:///shared/backups/php/deployer-7.5.phar/vendor/composer/ClassLoader.php(322): Composer\Autoload\includeFile('phar:///shared/...')
#3 phar:///shared/backups/php/deployer-7.5.phar/src/Deployer.php(304): Composer\Autoload\ClassLoader->loadClass('Symfony\\Compone...')
#4 phar:///shared/backups/php/deployer-7.5.phar/bin/dep(96): Deployer\Deployer::run('7.5.5', '')
#5 /shared/backups/php/deployer-7.5.phar(4): require('phar:///shared/...')
#6 {main}
  thrown in phar:///shared/backups/php/deployer-7.5.phar/vendor/symfony/console/Input/ArgvInput.php on line 46

Tip

php -d error_reporting=24575 deployer-7.5.phar --version allow to suppress deprecations

But notice that

Fatal error: Uncaught ErrorException: Symfony\Component\Console\Input\ArgvInput::__construct(): Implicitly marking parameter $argv as nullable is deprecated, the explicit nullable type must be used instead in phar:///shared/backups/php/deployer-7.5.phar/vendor/symfony/console/Input/ArgvInput.php:46

Without know what version of symfony/console is embedded (that is not PHP 8.4 compatible) : https://php.watch/versions/8.4/implicitly-marking-parameter-type-nullable-deprecated

[antonmedv]

Hi,

Yes, Deployer v7 is the last version with support for PHP 7. This is why deps are kept as is. The new version of Deployer v8 will be PHP 8 compatible.

[llaville]

Hello,

Reply to you with late, but was busy yesterday.

IF you want to keep Deployer v7 compatible PHP 7. And also recent PHP 8 versions, I suggest you to fix the
https://github.com/deployphp/deployer/blob/7.x/composer.json#L45 constraint as follow :

~8.0||~8.1||~8.2||~8.3||^7.3

Using double pipe instead of single one (Composer 2 syntax) because old syntax is unsupported by some tools now !

Checks with : https://jubianchi.github.io/semver-check/#/~8.0||~8.1||~8.2||~8.3||^7.3/7.4

[antonmedv]

About adding SBOM it will be cool. One think about box project, I tried it in the past and didn't liked it. So, I decided to stick with my own build script. One cool think: my script does not require any deps to build a phar, and I very like it as it simplifies my workflows.

[llaville]

Even if I used myself the BOX project to build my own PHAR copies, I may understand that you don't like it !

Many project has implemented their own solution : see llaville/box-manifest#1 (even if subject is related to phar-io/manifest), there is a list of project and links to their solution.

So I should be able to propose a solution that is able to build your PHAR distrib with your script and SBOM manifest (JSON or XML format) today.
I'll keep you aware !

[llaville]

@antonmedv Ok, I've be ready to generate manifests file (whatever format are required, supported by BOX Manifest) and include them in your bin/build script.

But, during my try/tests, I've noticed some bad declarations, and this is for me the reason of incompatibility between dependencies.

First You include your vendors into your repo (brut force) without declared them into the composer.json
A good example is the symfony/console that is used for all deployer commands, but it's missing in Composer require section.

Second, If you want to keep a compatibility with PHP 7.3/7.4 platform, you should declare it into the composer.json https://getcomposer.org/doc/06-config.md#platform
Otherwise composer will install highest dependencies that are not PHP 7 compatible, and thus the PHAR distrib embed wrong versions.

Third, I see is that you use your old project https://github.com/deployphp/phar-update/blob/master/composer.json#L32 that include very old symfony/console component. Another incompatibility way !

Here is a preview (chunk ofr results) of what we could get, if we fix all those problems :

[chenrui333]

seeing the same when bumping php to 8.4, 8.3 seems working fine for deployer 7.5.5

relates to Homebrew/homebrew-core#198473