Koha plugins cannot currently declare any dependencies. Not meeting them will occcasionally fail upon installation (if the main plugin class tries to load them at compile time) or runtime (if one of the other packages does, or code cleverly checks if the dependency is met). Ideally we'd have a way of specifying if a Koha plugin depends on another Perl module, or another Koha plugin. A nice feature of this would be to able be able to declare optional dependencies, which may only be required for a subset of the Plugin's features (like in https://github.com/HKS3/koha-normalize-marc2db/blob/main/Koha/Plugin/HKS3/NormalizeMARC2DB/Jobs/VerifyAll.pm#L34). Those shouldn't prevent installation, but should still warn loudly upon plugin installation, in a way that is hard/impossible to miss (e.g. have an intermitted screen on plugins-upload.pl, with an "are you sure"). Patch incoming.
Created attachment 191567 [details] [review] Bug 41651: Allow plugins do specify dependencies, abort installation if unmet This approach uses a new $metadata key, to minimize the scope of changes needed. The downside of that is the fact that if the base plugin package requires those dependencies in compile-time already, the code (and thus metadata itself) will fail to load in an unhandled way. plugins-upload.pl can't know for sure whether it's really the plugin being installed that doesn't have its dependencies met, which is a limitation to how it currently works.
Created attachment 191651 [details] [review] Bug 41651: Allow plugins do specify dependencies, abort installation if unmet This unpacks uploaded plugin into a temporary directory where we check the prerequisites/conflicts in standard CPAN ways, and only continue with the installation if all the runtime requirements are met.
Created attachment 192087 [details] [review] Bug 41651: Allow plugins to specify dependencies, abort installation if unmet This unpacks uploaded plugin into a temporary directory where we check the prerequisites/conflicts in standard CPAN ways, and only continue with the installation if all the runtime requirements are met. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Created attachment 192088 [details] [review] Bug 41651: (QA follow-up) Fix issues in plugin file copy We're focusing on reliability and security here, the improvements include: - Escape regex metacharacters in path using \Q...\E to prevent regex injection issues - Check copy() return value and collect errors, die if any copies fail to prevent silent partial installations - Make basename filter more specific to only skip cpanfile and META.json/META.yml, not files containing "META" anywhere
Created attachment 192089 [details] [review] Bug 41651: (follow-up) Improve plugin dependency handling The original patch was a great start, but I saw some area's for improvement including listing all missing dependencies as apposed to just the first. - Add POD documentation for the new 'from' parameter in InstallPlugins() - Normalize staging directory path by removing trailing slashes to prevent double-slash issues in destination paths - Fix path concatenation to avoid double slashes (plugins_dir already ends without slash, destdir starts with slash after substitution) - Report all unmet dependencies at once instead of dying on the first one, providing better user feedback - Add 'last' to break out of metafiles loop once a file is found
Created attachment 192090 [details] [review] Bug 41651: (follow-up) Add test coverage for dependency checking Tests for _check_dependencies(): - No dependency files present (passes silently) - cpanfile with satisfied dependencies (passes) - cpanfile with unmet dependencies (dies with message) - META.json with satisfied dependencies (passes) - META.yml with satisfied dependencies (passes) - META.json with unmet dependencies (dies) - Multiple unmet dependencies are all reported Tests for InstallPlugins() with 'from' parameter: - Files are copied from staging to plugins directory - cpanfile is NOT copied to plugins directory - META.json is NOT copied to plugins directory - META.yml is NOT copied to plugins directory - Trailing slash in path is handled correctly