build-support/php: improve PHP builder stability (#459254)

doc/release-notes/rl-2605.section.md

@@ -82,4 +82,4 @@
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.05-lib-additions-improvements}
 
-- Create the first release note entry in this section!
+- The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.

pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh

@@ -5,6 +5,16 @@ declare -g pname
 declare -g composerVendor
 declare -g -i composerStrictValidation="${composerStrictValidation:-0}"
 
+declare -g composerNoDev
+declare -g composerNoPlugins
+declare -g composerNoScripts
+
+declare -ga composerFlags=()
+
+[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
+[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
+[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+
 preConfigureHooks+=(composerInstallConfigureHook)
 preBuildHooks+=(composerInstallBuildHook)
 preCheckHooks+=(composerInstallCheckHook)
@@ -14,12 +24,12 @@ preInstallHooks+=(composerInstallInstallHook)
 source @phpScriptUtils@
 
 composerInstallConfigureHook() {
-  echo "Executing composerInstallConfigureHook"
+  echo "Running phase: composerInstallConfigureHook"
 
   setComposerRootVersion
 
   if [[ ! -e "${composerVendor}" ]]; then
-    echo "No local composer vendor found." >&2
+    echo -e "\e[31mERROR: The 'composerVendor' attribute is missing or invalid.\e[0m" >&2
     exit 1
   fi
 
@@ -35,27 +45,39 @@ composerInstallConfigureHook() {
 
   chmod +w composer.json
 
-  echo "Finished composerInstallConfigureHook"
+  echo "Finished phase: composerInstallConfigureHook"
 }
 
 composerInstallBuildHook() {
-  echo "Executing composerInstallBuildHook"
+  echo "Running phase: composerInstallBuildHook"
 
-  echo "Finished composerInstallBuildHook"
+  setComposerEnvVariables
+
+  echo -e "\e[32mRestoring Composer vendor directory to '${COMPOSER_VENDOR_DIR}'...\e[0m"
+  cp -r "${composerVendor}/${COMPOSER_VENDOR_DIR}" .
+  chmod -R +w "${COMPOSER_VENDOR_DIR}"
+
+  echo -e "\e[32mGenerating optimized autoloader and restoring 'bin' directory...\e[0m"
+  COMPOSER_DISABLE_NETWORK=1 composer \
+    "${composerFlags[@]}" \
+    --no-interaction \
+    --no-progress \
+    --optimize-autoloader \
+    install
+
+  echo "Finished phase: composerInstallBuildHook"
 }
 
 composerInstallCheckHook() {
-  echo "Executing composerInstallCheckHook"
+  echo "Running phase: composerInstallCheckHook"
 
   checkComposerValidate
 
-  echo "Finished composerInstallCheckHook"
+  echo "Finished phase: composerInstallCheckHook"
 }
 
 composerInstallInstallHook() {
-  echo "Executing composerInstallInstallHook"
-
-  cp -ar "${composerVendor}"/* .
+  echo "Running phase: composerInstallInstallHook"
 
   # Copy the relevant files only in the store.
   mkdir -p "$out"/share/php/"${pname}"
@@ -64,10 +86,10 @@ composerInstallInstallHook() {
   # Create symlinks for the binaries.
   mapfile -t BINS < <(jq -r -c 'try (.bin[] | select(test(".bat$")? | not) )' composer.json)
   for bin in "${BINS[@]}"; do
-    echo -e "\e[32mCreating symlink ${bin}...\e[0m"
+    echo -e "\e[32mInstalling binary: ${bin}\e[0m"
     mkdir -p "$out/bin"
     ln -s "$out/share/php/${pname}/${bin}" "$out/bin/$(basename "$bin")"
   done
 
-  echo "Finished composerInstallInstallHook"
+  echo "Finished phase: composerInstallInstallHook"
 }

pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh

@@ -10,9 +10,9 @@ declare -g composerNoPlugins
 declare -g composerNoScripts
 
 declare -ga composerFlags=()
-[[ -n "${composerNoDev-}" ]] && composerFlags+=(--no-dev)
-[[ -n "${composerNoPlugins-}" ]] && composerFlags+=(--no-plugins)
-[[ -n "${composerNoScripts-}" ]] && composerFlags+=(--no-scripts)
+[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
+[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
+[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerVendorConfigureHook)
 preBuildHooks+=(composerVendorBuildHook)
@@ -20,20 +20,21 @@ preCheckHooks+=(composerVendorCheckHook)
 preInstallHooks+=(composerVendorInstallHook)
 
 composerVendorConfigureHook() {
-  echo "Executing composerVendorConfigureHook"
+  echo "Running phase: composerVendorConfigureHook"
 
   setComposerRootVersion
 
   if [[ -f "composer.lock" ]]; then
-    echo -e "\e[32mUsing \`composer.lock\` file from the source package\e[0m"
+    echo -e "\e[32mFound 'composer.lock' in source root.\e[0m"
   fi
 
   if [[ -e "$composerLock" ]]; then
-    echo -e "\e[32mUsing user provided \`composer.lock\` file from \`$composerLock\`\e[0m"
+    echo -e "\e[32mUsing provided 'composer.lock' from: $composerLock\e[0m"
     install -Dm644 "$composerLock" ./composer.lock
   fi
 
   if [[ ! -f "composer.lock" ]]; then
+    echo "No 'composer.lock' found. Updating dependencies to generate one..."
     composer \
       --no-cache \
       --no-install \
@@ -47,16 +48,17 @@ composerVendorConfigureHook() {
       install -Dm644 composer.lock -t "$out"/
 
       echo
-      echo -e "\e[31mERROR: No composer.lock found\e[0m"
+      echo -e "\e[31mERROR: Missing 'composer.lock' file.\e[0m"
       echo
-      echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
-      echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
+      echo -e "\e[31mA 'composer.lock' file is required to ensure reproducible builds, but it was not found in the source.\e[0m"
+      echo -e "\e[31mA temporary lock file has been generated for you at:\e[0m"
+      echo -e "\e[31m  $out/composer.lock\e[0m"
       echo
-      echo -e '\e[31mTo fix the issue:\e[0m'
-      echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
-      echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
-      echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
-      echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
+      echo -e "\e[31mTo fix this issue:\e[0m"
+      echo -e "\e[31m1. Copy the generated lock file to your project source:\e[0m"
+      echo -e "\e[31m     cp $out/composer.lock <path/to/project_root>/\e[0m"
+      echo -e "\e[31m2. Register the lock file in your Nix expression:\e[0m"
+      echo -e "\e[31m     composerLock = ./composer.lock;\e[0m"
       echo
 
       exit 1
@@ -69,39 +71,45 @@ composerVendorConfigureHook() {
 
   chmod +w composer.json
 
-  echo "Finished composerVendorConfigureHook"
+  echo "Finished phase: composerVendorConfigureHook"
 }
 
 composerVendorBuildHook() {
-  echo "Executing composerVendorBuildHook"
+  echo "Running phase: composerVendorBuildHook"
 
   setComposerEnvVariables
 
+  echo -e "\e[32mInstalling Composer dependencies to '${COMPOSER_VENDOR_DIR}'...\e[0m"
   composer \
     --no-cache \
     --no-interaction \
     --no-progress \
-    --optimize-autoloader \
+    --no-autoloader \
     "${composerFlags[@]}" \
     install
 
-  echo "Finished composerVendorBuildHook"
+  # Clarified: We remove it because we only want the 'vendor' folder here, not the bins yet.
+  echo -e "\e[32mCleaning up Composer 'bin' directory (will be regenerated during install).\e[0m"
+  rm -rf "$(composer config bin-dir)"
+
+  echo "Finished phase: composerVendorBuildHook"
 }
 
 composerVendorCheckHook() {
-  echo "Executing composerVendorCheckHook"
+  echo "Running phase: composerVendorCheckHook"
 
   checkComposerValidate
 
-  echo "Finished composerVendorCheckHook"
+  echo "Finished phase: composerVendorCheckHook"
 }
 
 composerVendorInstallHook() {
-  echo "Executing composerVendorInstallHook"
+  echo "Running phase: composerVendorInstallHook"
 
   mkdir -p "$out"
 
-  cp -ar composer.json "$(composer config vendor-dir)" "$out"/
+  echo -e "\e[32mPreserving Composer vendor directory from '${COMPOSER_VENDOR_DIR}'...\e[0m"
+  cp -ar composer.json "${COMPOSER_VENDOR_DIR}" "$out"/
   mapfile -t installer_paths < <(jq -r -c 'try((.extra."installer-paths") | keys[])' composer.json)
 
   for installer_path in "${installer_paths[@]}"; do
@@ -111,7 +119,7 @@ composerVendorInstallHook() {
     # Copy the installer path if it exists
     if [[ -d "$installer_path" ]]; then
       mkdir -p "$(dirname "$out_installer_path")"
-      echo -e "\e[32mCopying installer path $installer_path to $out_installer_path\e[0m"
+      echo -e "\e[32mPreserving custom installer path: $installer_path\e[0m"
       cp -ar "$installer_path" "$out_installer_path"
       # Strip out the git repositories
       find "$out_installer_path" -name .git -type d -prune -print -exec rm -rf {} ";"
@@ -122,5 +130,5 @@ composerVendorInstallHook() {
     cp -ar composer.lock "$out"/
   fi
 
-  echo "Finished composerVendorInstallHook"
+  echo "Finished phase: composerVendorInstallHook"
 }

pkgs/build-support/php/builders/v2/hooks/php-script-utils.bash

@@ -15,6 +15,8 @@ setComposerEnvVariables() {
   export COMPOSER_MIRROR_PATH_REPOS=1
   export COMPOSER_HTACCESS_PROTECT=0
   export COMPOSER_FUND=0
+  COMPOSER_VENDOR_DIR=$(composer config vendor-dir)
+  export COMPOSER_VENDOR_DIR
 }
 
 checkComposerValidate() {

pkgs/by-name/ba/baikal/package.nix

@@ -6,22 +6,22 @@
 php.buildComposerProject2 (finalAttrs: {
   pname = "baikal";
   version = "0.10.1";
+
   src = fetchFromGitHub {
     owner = "sabre-io";
     repo = "Baikal";
     tag = finalAttrs.version;
     hash = "sha256-YQQwTdwfHQZdUhO5HbScj/Bl8ype7TtPI3lHjvz2k04=";
   };
+
   # It doesn't provide a composer.lock file, we have to generate manually.
   composerLock = ./composer.lock;
-  vendorHash = "sha256-dYg7cULL4gquR5EenA0lD9ZC9Ge4qNwFFDNhELKgSso=";
+  vendorHash = "sha256-TM0dyr90bUDxUwywwkeHh0pAWkTB8FV3ricWCHGxA7k=";
 
   meta = {
     description = "Lightweight CalDAV+CardDAV server that offers an extensive web interface with easy management of users, address books and calendars";
     homepage = "https://sabre.io/baikal/";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ wrvsrx ];
-    # vendorHash non-reproducible
-    broken = true;
   };
 })

pkgs/by-name/bo/bookstack/package.nix

@@ -17,7 +17,7 @@ php83.buildComposerProject2 (finalAttrs: {
     hash = "sha256-2JyWCP2ISgl82P6W5dL5Zbl+phgREQEonQ+12fu3q/E=";
   };
 
-  vendorHash = "sha256-7T2pdzjqkT0bRw1d7IVVFHjJ22qKNj4czf5q8Xbs/aw=";
+  vendorHash = "sha256-tuVei2GRTrYyJQtX7Y7A4pgCjqhS+xjaH1FoCwjrHUg=";
 
   passthru = {
     phpPackage = php83;

pkgs/by-name/co/composer-require-checker/package.nix

@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-cTXXPsHI2yiHSakiWuuxripGLvkwmzIAADqKtwHOI7c=";
   };
 
-  vendorHash = "sha256-ZUAXo4X4B7Z6wfcmv7L1DFvD4Lx1sSoMmw1gR5nDEP0=";
+  vendorHash = "sha256-1c0PtgqHttqiOPdlHHTE4qRQx8xMsX/nXqsj3iyTgnQ=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/da/davis/package.nix

@@ -13,12 +13,11 @@ php.buildComposerProject2 (finalAttrs: {
     owner = "tchapi";
     repo = "davis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-okysA35sdtvbyn90fqGbhGr2yWYAw1DBJYBBhPep6T0=";
+    hash = "sha256-YLVfcoC8cIcCfi7R2zWXNxD4P+KIXOCL+MqFEt2Z7Tc=";
   };
 
-  vendorHash = "sha256-j28IsT7tdTg7+M8KwBa1LDWw0YGgv9EGnaCQNeTJZyw=";
-
   composerNoPlugins = false;
+  vendorHash = "sha256-VpINHPy2gwA5dk8OGQjmWnCpS9JVyEAUG+bptggCybk=";
 
   postInstall = ''
     chmod -R u+w $out/share

pkgs/by-name/de/deployer/package.nix

@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk=";
   };
 
-  vendorHash = "sha256-/bf1rvoG1N6GNqisBwMqY05qhTsy7gMeWXarXgElU/M=";
+  vendorHash = "sha256-sgWPZw5HiXd7c45I0f5qnw4l2HwgLaTJwzmXw8140kk=";
 
   meta = {
     changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}";

pkgs/by-name/dr/drupal/package.nix

@@ -18,8 +18,8 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-dVCDIKqLbYHlVwv5wveXG0oHc2g3Zl6J6LG1/e8IIZw=";
   };
 
-  vendorHash = "sha256-cGSOsASv3UlzSXDP2KgrlzBIMWLB25j9LFkJZsEbTTQ=";
   composerNoPlugins = false;
+  vendorHash = "sha256-CAntERLTmR9Gf/e+qBLJqqebdXZ0E9k8ifDh75ASoRo=";
 
   passthru = {
     tests = {

pkgs/by-name/en/engelsystem/package.nix

@@ -4,7 +4,6 @@
   fetchYarnDeps,
   nodejs,
   yarn,
-  yarnBuildHook,
   yarnConfigHook,
   nixosTests,
   php,
@@ -23,9 +22,9 @@ php.buildComposerProject2 (finalAttrs: {
 
   inherit php;
 
-  vendorHash = "sha256-ODJgsvECw+q3sAA6pWNw4X2Png7f4G2Jty9AQSj/SgE=";
-  composoerNoDev = true;
+  composerNoDev = true;
   composerStrictValidation = false;
+  vendorHash = "sha256-JRd5FJviNf5NUI9PwRcMqdDXYBlMoBB6o5yx7dvostE=";
 
   yarnOfflineCache = fetchYarnDeps {
     pname = "${finalAttrs.pname}-yarn-deps";

pkgs/by-name/fi/firefly-iii/package.nix

@@ -28,17 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
     nodejs.python
     buildPackages.npmHooks.npmConfigHook
+    php84.packages.composer
     php84.composerHooks2.composerInstallHook
   ];
 
   composerVendor = php84.mkComposerVendor {
     inherit (finalAttrs) pname src version;
-    composerNoDev = true;
-    composerNoPlugins = true;
-    composerNoScripts = true;
     composerStrictValidation = true;
     strictDeps = true;
-    vendorHash = "sha256-pvPyWvPzMhn4drxK5H2ItZBRkcoIBuhMfFt4NvWS01I=";
+    vendorHash = "sha256-fLL0FAhd8r2igiZZ+wb1gse+vembHS6rzUnKe9LXXmI=";
   };
 
   npmDeps = fetchNpmDeps {

pkgs/by-name/fl/flarum/package.nix

@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
 
   composerLock = ./composer.lock;
   composerStrictValidation = false;
-  vendorHash = "sha256-peQMR7+Jx+oXo0HdXOHzTYB9Fn0AkELm43fiV4ssLnI=";
+  vendorHash = "sha256-EHl+Mr6y5A51EpLPAWUGtiPkLOky6KvsSY4JWHeyO28=";
 
   meta = {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";

pkgs/by-name/gr/grocy/package.nix

@@ -19,7 +19,9 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-MnN6TIkNZWT+pAQf0+z5l3hj/7K/d3BfI7VAaUEKG8s=";
   };
 
-  vendorHash = "sha256-6vWV8+4tETUFBLeEoG7d8lHKILXvM7ezWbDiG11GA/s=";
+  # Upstream composer.json file is missing the name, description and license fields
+  composerStrictValidation = false;
+  vendorHash = "sha256-11+NIZX8i9uwcImwSE0HAeMc/WOCsecpMRqiba1mkrs=";
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
@@ -31,9 +33,6 @@ php.buildComposerProject2 (finalAttrs: {
     fixup-yarn-lock
   ];
 
-  # Upstream composer.json file is missing the name, description and license fields
-  composerStrictValidation = false;
-
   # NOTE: if patches are created from a git checkout, those should be modified
   # with `unix2dos` to make sure those apply here.
   patches = [

pkgs/by-name/ki/kimai/package.nix

@@ -38,9 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-x62+uhrwlbjRGitMlvxSZpN1Pb1VrWGVJ+WxCvO2w9A=";
-
-  composerNoPlugins = false;
+  vendorHash = "sha256-3/LT5HjCpnO3Sz+NshrSMTujtYka0FMyT56qmiEi2t4=";
 
   postInstall = ''
     # Make available the console utility, as Kimai doesn't list this in
@@ -50,7 +48,7 @@ php.buildComposerProject2 (finalAttrs: {
 
     # Install bundled assets. This is normally done in the `composer install`
     # post-install script, but it's being skipped.
-    (cd "$out"/share/php/kimai && php ./bin/console assets:install)
+    # (cd "$out"/share/php/kimai && php ./bin/console assets:install)
   '';
 
   passthru.tests = {

pkgs/by-name/la/laravel/package.nix

@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   nativeBuildInputs = [ makeWrapper ];
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-TUCv+zXE+xmdtN0vDToEqlw4+WOi+xX87IrGmUAeQkM=";
+  vendorHash = "sha256-fQGj673X6Zmm+6jy2WZ8su8zELPlcI6z4u5NbtQ9gAk=";
 
   # Adding npm (nodejs) and php composer to path
   postInstall = ''

pkgs/by-name/mo/movim/package.nix

@@ -88,7 +88,7 @@ php.buildComposerProject2 (finalAttrs: {
     ++ lib.optional minify.style.enable lightningcss
     ++ lib.optional minify.svg.enable scour;
 
-  vendorHash = "sha256-t95OVDUb7hJfbokFhSOyGP02laVcTTJX7bK/reYJ99I=";
+  vendorHash = "sha256-8tEs+kQGB0pmhEQndOOOUDTFkIq+OvyKTmi9YAvK6qc=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;

pkgs/by-name/pd/pdepend/package.nix

@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-uK+nJFXDVPYFbosAUxqu+mmNsD7AnZ18NnIN9FYAaPQ=";
+  vendorHash = "sha256-IowPh4CymahgfbnvLS2QWu8e+TXya9AszTK+mlR/DTY=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/pe/pest/package.nix

@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-4CpyerXmfXbwsNsK16V+GY3Rzo4BfavGpOVITD14p8w=";
+  vendorHash = "sha256-Lv+wbOJVO7gGs4bOcECKyaw7+k3Z4f8gbNEv9uk4he8=";
 
   meta = {
     changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";

pkgs/by-name/ph/phel/package.nix

@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-v/xRYzKCwF1kKDV00jK7Cwz3TupkNZVec/h2JnhVq4E=";
   };
 
-  vendorHash = "sha256-oABfUeL52XFKUui1tBuoyK2B7kBcYdLuVo4OllX07AQ=";
+  vendorHash = "sha256-rA05SIv+rP90KHTeYTym1Db64KMOY6iXnLh3I/DY3ks=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/ph/phpactor/package.nix

@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-A/ajGQ75z/EdWFFJK0kLjcSFfa9z15TZCNZZpwq9k2E=";
   };
 
-  vendorHash = "sha256-qLcwAmnkh3nxrvdDa/OI3RQOi/4qhxURhcXM1r5iE88=";
+  vendorHash = "sha256-Y0U5GH2NGOhwDSqsJnDxUe+VOQbKrCOZDX6f2pCeUqY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ph/phpdocumentor/package.nix

@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-T1aN/I06OdQnMxjutSsk3nNyXQ0Z+GWY6fADvJc7Iks=";
   };
 
-  vendorHash = "sha256-bTzDCHJHp31oruOHMxzfkJooPHGn4DUeGG0NzGLSZLs=";
+  vendorHash = "sha256-IPKwEESlcwGotRAM1ZnTB+wbFF6tkMZTnpQ1aYDakSQ=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
@@ -30,7 +30,6 @@ php.buildComposerProject2 (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 

pkgs/by-name/ph/phpunit/package.nix

@@ -3,8 +3,6 @@
   fetchFromGitHub,
   nix-update-script,
   php,
-  phpunit,
-  testers,
   versionCheckHook,
 }:
 
@@ -19,11 +17,10 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-asHHNHUBt4EO/vLQdc5JyffgUqgOeJSXSG+b5bL0IQk=";
   };
 
-  vendorHash = "sha256-VERFWkcjIepOZO2/bvJj51lfMjs/5e8srsd0kIAp7bI=";
+  vendorHash = "sha256-ypZLrCNNh/QUa5cvA6zuh3b/eyE0YMH0Diiet7cDveI=";
 
   passthru = {
     updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = phpunit; };
   };
 
   doInstallCheck = true;

pkgs/by-name/pi/pixelfed/package.nix

@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-FxJWoFNyIGQ6o9g2Q0/jaBMyeH8UnbTgha2goHAurvY=";
   };
 
-  vendorHash = "sha256-ciHP6dE42pXupZl4V37RWcHkIZ+xf6cnpwqd3C1dNmQ=";
+  vendorHash = "sha256-4x+vvkQUhqxBwm+9Lx7n6Ww6qvfLwqd8IXXCuCSAijE=";
 
   postInstall = ''
     chmod -R u+w $out/share

pkgs/by-name/po/postfixadmin/package.nix

@@ -18,11 +18,10 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-mr5FBURTGP2J3JMlcexXjz4GFJNqPR4rZyqHVN7+6iM=";
   };
 
-  vendorHash = "sha256-gv6QYuHGo2r2WgtLPLco/PmKxYSijDkpWoF/vIR5y5s=";
-
   # Upstream does not ship a lock file, we have to maintain our own for now.
   # https://github.com/postfixadmin/postfixadmin/issues/948
   composerLock = ./composer.lock;
+  vendorHash = "sha256-uyHEfWCC6V4d+ez7FbqBKrh4IfbQ2pgD4UvbdGEfobI=";
 
   postInstall = ''
     out_dir="$out"/share/php/postfixadmin/

pkgs/by-name/pr/pretty-php/package.nix

@@ -2,7 +2,8 @@
   lib,
   php,
   fetchFromGitHub,
-  testers,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "pretty-php";
@@ -15,14 +16,13 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-V+xncL02fY0olGxqjWBWqD6N1J0XOeOPe55aULuN2bA=";
   };
 
-  vendorHash = "sha256-62KnzttuLsDP7DlEING/koS7lxf5A673F5DwppJs3vw=";
+  vendorHash = "sha256-r5LhN2OjEpiHR0RtK7d/pMd8bqFJbM8CuCXEDGjgG4A=";
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "HOME=$TMPDIR pretty-php --version";
-    };
-  };
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Opinionated PHP code formatter";

pkgs/by-name/ps/psysh/package.nix

@@ -40,12 +40,12 @@ php.buildComposerProject2 (finalAttrs: {
 
     preBuild = ''
       composer config platform.php 7.4
-      composer require --no-update symfony/polyfill-iconv:1.31 symfony/polyfill-mbstring:1.31
-      composer require --no-update --dev roave/security-advisories:dev-latest
-      composer update --lock --no-install
+      composer require --no-cache --no-update symfony/polyfill-iconv:1.31 symfony/polyfill-mbstring:1.31
+      composer require --no-cache --no-update --dev roave/security-advisories:dev-latest
+      composer update --no-cache --lock --no-install
     '';
 
-    vendorHash = "sha256-8l5bQ+VnLOtPUspMN1f+iXo7LldPTuYqyrAeW2aVoH8=";
+    vendorHash = "sha256-S3rekG0KPHk6cmQecmb5ETQ1V4ey5+pK+PpHNSEcXNw=";
   };
 
   doInstallCheck = true;
@@ -58,7 +58,5 @@ php.buildComposerProject2 (finalAttrs: {
     mainProgram = "psysh";
     license = lib.licenses.mit;
     homepage = "https://psysh.org/";
-    # `composerVendor` doesn't build
-    broken = true;
   };
 })

pkgs/by-name/ro/roave-backward-compatibility-check/package.nix

@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-vhoV8AkkcL1pDmHkpPYs5lD6TUcvMC6BXkQF1T2esIE=";
   };
 
-  vendorHash = "sha256-ADqWN0cF9hB+s9rfza0bQ3pB6NZ9NMzvDhN8sdL3Sg8=";
+  vendorHash = "sha256-LBvqnBcSpjffS3cjgVgql8eNmaP45uNx9BKr72Mr+ZY=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/sn/snipe-it/package.nix

@@ -21,7 +21,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-hqJUhjL4k6fC5ed8pFOb3Ym0CmelfVZYWqmMuTjHN/U=";
   };
 
-  vendorHash = "sha256-DXkRKijjkT4GI0sMj3T8fD90weCLwe681yBqKs4/cVI=";
+  vendorHash = "sha256-6ryHXXWtih/eHSQk36NSf4UjZZfUH+zjnyZoLnLNqHU=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"

pkgs/development/php-packages/castor/default.nix

@@ -18,7 +18,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-ot4akuKhNtEXukiDSy69q75phx6EvkJsL0XHAN+el+M=";
   };
 
-  vendorHash = "sha256-S5NCV3wd/EA282NA0Wbtj7gbZw9YU835cr5CmpAnapc=";
+  vendorHash = "sha256-fLx4uLS9708IFKnBus3R7nt6V/BCsZZflYEhwzUkXzc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -39,7 +39,6 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/jolicode/castor/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "DX oriented task runner and command launcher built with PHP";
     homepage = "https://github.com/jolicode/castor";

pkgs/development/php-packages/composer/default.nix

@@ -1,109 +1,41 @@
 {
   lib,
-  stdenvNoCC,
   fetchFromGitHub,
   callPackage,
   php,
-  unzip,
-  _7zz,
-  xz,
-  gitMinimal,
-  curl,
-  cacert,
   makeBinaryWrapper,
+  _7zz,
+  curl,
+  gitMinimal,
+  unzip,
+  xz,
   versionCheckHook,
 }:
-
-/*
-    XXX IMPORTANT
-
-    Make sure to check if the `vendorHash` of `buildComposerProject2` changes when updating!
-    See https://github.com/NixOS/nixpkgs/issues/451395
-*/
-
-stdenvNoCC.mkDerivation (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
   pname = "composer";
-  version = "2.8.12";
-
-  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
-  # use together with the version from this package to keep the
-  # bootstrap phar file up-to-date together with the end user composer
-  # package.
-  passthru.pharHash = "sha256-9EbqcZcIu4X8v07xje9dBRXx+bTXA/bYIMnBZW4QovI=";
-
-  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
-    inherit (finalAttrs) version;
-    inherit (finalAttrs.passthru) pharHash;
-  };
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "composer";
     repo = "composer";
     tag = finalAttrs.version;
-    hash = "sha256-UHCsdJmoE7X2ZiiBAWfC004FUMqHyd0URt+v8R3hn70=";
+    hash = "sha256-Ke+QGcKPqm1wEVVYgUCL0K3nT+qmzWpRX6HcZnzdhgA=";
   };
 
-  nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
 
-  buildInputs = [ php ];
-
-  vendor = stdenvNoCC.mkDerivation {
-    pname = "${finalAttrs.pname}-vendor";
-
-    inherit (finalAttrs) src version;
-
-    nativeBuildInputs = [
-      cacert
-      finalAttrs.composer
-    ];
-
-    dontPatchShebangs = true;
-    doCheck = true;
-
-    buildPhase = ''
-      runHook preBuild
-
-      composer install --no-dev --no-interaction --no-progress --optimize-autoloader
-
-      runHook postBuild
-    '';
-
-    checkPhase = ''
-      runHook preCheck
-
-      composer validate
-
-      runHook postCheck
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      cp -ar . $out/
-
-      runHook postInstall
-    '';
-
-    env = {
-      COMPOSER_CACHE_DIR = "/dev/null";
-      COMPOSER_DISABLE_NETWORK = "0";
-      COMPOSER_HTACCESS_PROTECT = "0";
-      COMPOSER_MIRROR_PATH_REPOS = "1";
-      COMPOSER_ROOT_VERSION = finalAttrs.version;
-    };
-
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "sha256-gnCPcp+c2dFL+9MJf0JRCQ5E95/dET1F0ZZAYj/rWq4=";
+  # Bootstrapping Composer (source) with Composer (PHAR distribution).
+  # Override the default `composer` attribute to prevent infinite recursion.
+  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
+    inherit (finalAttrs) version;
+    inherit (finalAttrs.passthru) pharHash;
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -ar ${finalAttrs.vendor}/* $out/
-    chmod +w $out/bin
+  vendorHash = "sha256-cqELlLH7d5KR62uVn7VtpQhVjkhXZkclXfc5d8RAG5Y=";
 
+  postInstall = ''
     wrapProgram $out/bin/composer \
       --prefix PATH : ${
         lib.makeBinPath [
@@ -114,14 +46,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           xz
         ]
       }
-
-    runHook postInstall
   '';
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
+  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
+  # use together with the version from this package to keep the
+  # bootstrap phar file up-to-date together with the end user composer
+  # package.
+  passthru.pharHash = "sha256-Rx8thXq/DsGK97BV5hRyIU2RrbJPm9u7hkwcZPqtfdY=";
+
   meta = {
     changelog = "https://github.com/composer/composer/releases/tag/${finalAttrs.version}";
     description = "Dependency Manager for PHP";

pkgs/development/php-packages/grumphp/default.nix

@@ -12,11 +12,11 @@ php.buildComposerProject2 (finalAttrs: {
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-g2V2clNI0+KzKAPStq1vJZ3gHpBV1EbduWBmzRnuzv8=";
   };
 
-  vendorHash = "sha256-wDxrLsBA8TMc6Fk+voeHlxQNfJaaef1ydg0ppuJgO2E=";
+  vendorHash = "sha256-lgXDxfBTCtGlrDzi+leeE8J8VIsaKpwyB1CUTUvdpMg=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/development/php-packages/phive/default.nix

@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-dv9v1KCLNheFmrRQ7cID5WFvoiH0OWVPWSrN023dEqA=";
   };
 
-  vendorHash = "sha256-U6BHAd4tWQKm6uCJ5sM51PltXhF3J4ieTnbC060+8Jg=";
+  vendorHash = "sha256-9X8z+A4uHsO1w8CdQkKZ/sZ+5BHooRD2q7ij6epr/Yc=";
 
   meta = {
     changelog = "https://github.com/phar-io/phive/releases/tag/${finalAttrs.version}";

pkgs/development/php-packages/php-codesniffer/default.nix

@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-2fubJMn44pS+++QgK66vm4YTT+0zdgtAJVHKvvWO/QA=";
   };
 
-  vendorHash = "sha256-SswaHYkDhuW2HZX7QiBd7K6wTmt42z2/TpB7HP68b7k=";
+  vendorHash = "sha256-t+cNnrs/4xzIDg3qM/MIRyu1Ulen03s2asZ2JuOxQgI=";
 
   meta = {
     changelog = "https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/${finalAttrs.version}";

pkgs/development/php-packages/php-cs-fixer/default.nix

@@ -17,14 +17,13 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-I4F6WDnWDEmLJFRGMS2QV62jaNAtZoTNQBoH3gT3OAw=";
+  vendorHash = "sha256-iQRY9DY2AEHuP3KJKC9ei8xcXgMvzxvyFl/9FwtN+kE=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/v${finalAttrs.version}";
     description = "Tool to automatically fix PHP coding standards issues";
     homepage = "https://cs.symfony.com/";

pkgs/development/php-packages/php-parallel-lint/default.nix

@@ -17,11 +17,11 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-AQAASj5vrSE1xkJ/SZHU4GwOWNobe9ES0Yo+YrLH354=";
+  vendorHash = "sha256-tAS4EAFb3SyL3j6oIB+YTyZPQcrRbyDFt4QzOwEB8wU=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Tool to check syntax of PHP files faster than serial check with fancier output";

pkgs/development/php-packages/phpinsights/default.nix

@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-uy8/bkgjDXnt544S70IOwX9I8U0lMLAkbiBDYXyJBcY=";
+  vendorHash = "sha256-/Kvj3vd2YG7DFvodtvEkWdAsbMazBHJHmUTBexxFsII=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
@@ -26,7 +26,6 @@ php.buildComposerProject2 (finalAttrs: {
   doInstallCheck = true;
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/nunomaduro/phpinsights/releases/tag/v${finalAttrs.version}";
     description = "Instant PHP quality checks from your console";
     homepage = "https://phpinsights.com/";

pkgs/development/php-packages/phpmd/default.nix

@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   # Missing `composer.lock` from the repository.
   # Issue open at https://github.com/phpmd/phpmd/issues/1056
   composerLock = ./composer.lock;
-  vendorHash = "sha256-tiL8PL6Muc/i4Il1rCeEKenCmIEVn3rHFZInbUGQW9o=";
+  vendorHash = "sha256-Vx5JolyOeCRst+wzqPB7bZopBa2LU7SOJmA4tEvWj1c=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

pkgs/development/php-packages/phpstan/default.nix

@@ -16,8 +16,8 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-fP+R22TN3I/Afn+N/6sqlYuN0GxTzPt3bSZjtFrkr1A=";
   };
 
-  vendorHash = "sha256-OYPX3ofhe71zb02FSzbQMwCuw/iY4NKaRqYxZ65CCys=";
   composerStrictValidation = false;
+  vendorHash = "sha256-NW5yx9jD7aXmqq9kzSNr/U1CkW0VN8qm0yHOQlxVi0c=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/development/php-packages/psalm/default.nix

@@ -31,14 +31,13 @@ php.buildComposerProject2 (finalAttrs: {
     ${lib.getExe php} -r '$phar = new Phar("${psalm-phar}"); $phar->extractTo(".", "composer.lock");'
     cp composer.lock $out
   '';
-  vendorHash = "sha256-18FAMuOO6rWAQEIJOLGxj/Avr5ZQRuI4ao2RL2nJlYc=";
+  vendorHash = "sha256-gtN3Gml/gNeg7FBNnr6I7IV0zF6iK4oWproRESPbK/4=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
   meta = {
-    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";
     description = "Static analysis tool for finding errors in PHP applications";
     homepage = "https://github.com/vimeo/psalm";

pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix

@@ -18,8 +18,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerNoDev = false;
-
-  vendorHash = "sha256-KWvHgPeTLy/a6NusLpKBgYJWjSzc+MNF7cE5u31JqKs=";
+  vendorHash = "sha256-js9O89jIRxX2DKI+LYjL3d9RsLdzUB4iUNUgngTryz8=";
 
   postInstall = ''
     chmod -R u+w $out/share