$ date
--- stdout ---
Thu Nov 21 09:23:42 UTC 2024
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-GPGMail.git repo --depth=1 -b REL1_43
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/REL1_43
--- stdout ---
bea0e00f63b3dbd0c2c9f0f0758701a98adbffb0 refs/heads/REL1_43
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100563,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [],
"range": "7.0.0 - 7.0.4",
"nodes": [
"node_modules/cross-spawn"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 1,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 313,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 313
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 24 installs, 0 updates, 0 removals
- Locking composer/installers (v2.3.0)
- Locking composer/semver (3.4.3)
- Locking composer/spdx-licenses (1.5.8)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.0.0)
- Locking mediawiki/mediawiki-codesniffer (v45.0.0)
- Locking mediawiki/minus-x (1.1.3)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.2.1)
- Locking phpcsstandards/phpcsutils (1.0.12)
- Locking psr/container (2.0.2)
- Locking psr/log (1.0.0)
- Locking squizlabs/php_codesniffer (3.10.3)
- Locking symfony/console (v7.1.8)
- Locking symfony/deprecation-contracts (v3.5.0)
- Locking symfony/polyfill-ctype (v1.31.0)
- Locking symfony/polyfill-intl-grapheme (v1.31.0)
- Locking symfony/polyfill-intl-normalizer (v1.31.0)
- Locking symfony/polyfill-mbstring (v1.31.0)
- Locking symfony/polyfill-php80 (v1.31.0)
- Locking symfony/service-contracts (v3.5.0)
- Locking symfony/string (v7.1.8)
- Locking wikimedia/gpglib (0.2.1)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 24 installs, 0 updates, 0 removals
- Downloading wikimedia/gpglib (0.2.1)
0/1 [>---------------------------] 0% Failed to download wikimedia/gpglib from dist: The "https://api.github.com/repos/wikimedia/php-gpglib/zipball/567bea37bb767fb334deaf48bdea97e154366df2" file could not be downloaded (HTTP/2 404 ):
{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#download-a-repository-archive-zip","status":"404"}
Now trying to download from source
- Syncing wikimedia/gpglib (0.2.1) into cache
1/1 [============================] 100%
In Git.php line 471:
Failed to clone https://github.com/wikimedia/php-gpglib.git via https, ssh
protocols, aborting.
- https://github.com/wikimedia/php-gpglib.git
Cloning into bare repository '/cache/composer/vcs/https---github.com-wiki
media-php-gpglib.git'...
remote: Support for password authentication was removed on August 13, 202
1.
remote: Please see https://docs.github.com/get-started/getting-started-wi
th-git/about-remote-repositories#cloning-with-https-urls for information on
currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/wikimedia/php-gpglib
.git/'
- git@github.com:wikimedia/php-gpglib.git
Cloning into bare repository '/cache/composer/vcs/https---github.com-wiki
media-php-gpglib.git'...
Host key verification failed.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
install [--prefer-source] [--prefer-dist] [--prefer-install PREFER-INSTALL] [--dry-run] [--download-only] [--dev] [--no-suggest] [--no-dev] [--no-autoloader] [--no-progress] [--no-install] [--audit] [--audit-format AUDIT-FORMAT] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--] [<packages>...]
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1868, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1792, in run
"composer": self.composer_audit(),
^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 183, in composer_audit
self.ensure_composer_lock()
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 142, in ensure_composer_lock
self.check_call(["composer", "install"])
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
res.check_returncode()
File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['/usr/bin/composer', 'install']' returned non-zero exit status 1.