package_manager/src/Validator/MultisiteValidator.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\package_manager\Validator;
 
 use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\StringTranslation\TranslationInterface;
-use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
  * Checks that the current site is not part of a multisite.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
  */
-class MultisiteValidator implements PreOperationStageValidatorInterface {
+final class MultisiteValidator implements EventSubscriberInterface {
 
+  use BaseRequirementValidatorTrait;
   use StringTranslationTrait;
 
-  /**
-   * The path locator service.
-   *
-   * @var \Drupal\package_manager\PathLocator
-   */
-  protected $pathLocator;
-
   /**
    * Constructs a new MultisiteValidator.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
-   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
-   *   The string translation service.
    */
-  public function __construct(PathLocator $path_locator, TranslationInterface $translation) {
-    $this->pathLocator = $path_locator;
-    $this->setStringTranslation($translation);
+  public function __construct(private readonly PathLocator $pathLocator) {
   }
 
   /**
-   * {@inheritdoc}
+   * Validates that the current site is not part of a multisite.
    */
-  public function validateStagePreOperation(PreOperationStageEvent $event): void {
+  public function validate(PreOperationStageEvent $event): void {
     if ($this->isMultisite()) {
       $event->addError([
-        $this->t('Multisites are not supported by Package Manager.'),
+        $this->t('Drupal multisite is not supported by Package Manager.'),
       ]);
     }
   }
@@ -51,24 +47,23 @@ class MultisiteValidator implements PreOperationStageValidatorInterface {
    *
    * @return bool
    *   TRUE if the current site is part of a multisite, otherwise FALSE.
-   *
-   * @todo Make this smarter in https://www.drupal.org/node/3267646.
    */
-  protected function isMultisite(): bool {
+  private function isMultisite(): bool {
     $web_root = $this->pathLocator->getWebRoot();
     if ($web_root) {
       $web_root .= '/';
     }
-    return file_exists($this->pathLocator->getProjectRoot() . '/' . $web_root . 'sites/sites.php');
-  }
+    $sites_php_path = $this->pathLocator->getProjectRoot() . '/' . $web_root . 'sites/sites.php';
 
-  /**
-   * {@inheritdoc}
-   */
-  public static function getSubscribedEvents() {
-    return [
-      PreCreateEvent::class => 'validateStagePreOperation',
-    ];
+    if (!file_exists($sites_php_path)) {
+      return FALSE;
+    }
+
+    // @see \Drupal\Core\DrupalKernel::findSitePath()
+    $sites = [];
+    include $sites_php_path;
+    // @see example.sites.php
+    return count(array_unique($sites)) > 1;
   }
 
 }

package_manager/src/Validator/OverwriteExistingPackagesValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that newly installed packages don't overwrite existing directories.
+ *
+ * Whether a new package in the stage directory would overwrite an existing
+ * directory in the active directory when the operation is applied is determined
+ * by inspecting the `path` property of the staged package.
+ *
+ * Certain packages, such as those with the `metapackage` type, don't have a
+ * `path` property and are ignored by this validator. The Composer facade at
+ * https://packages.drupal.org/8 currently uses the `metapackage` type for
+ * submodules of Drupal projects.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ *
+ * @link https://getcomposer.org/doc/04-schema.md#type
+ */
+final class OverwriteExistingPackagesValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a OverwriteExistingPackagesValidator object.
+   *
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   */
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector
+  ) {}
+
+  /**
+   * Validates that new installed packages don't overwrite existing directories.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent $event
+   *   The event being handled.
+   */
+  public function validate(PreApplyEvent $event): void {
+    $active_dir = $this->pathLocator->getProjectRoot();
+    $stage_dir = $event->stage->getStageDirectory();
+    $active_packages = $this->composerInspector->getInstalledPackagesList($active_dir);
+    $new_packages = $this->composerInspector->getInstalledPackagesList($stage_dir)
+      ->getPackagesNotIn($active_packages);
+
+    foreach ($new_packages as $package) {
+      if (empty($package->path)) {
+        // Packages without a `path` cannot overwrite existing directories.
+        continue;
+      }
+      $relative_path = str_replace($stage_dir, '', $package->path);
+      if (is_dir($active_dir . DIRECTORY_SEPARATOR . $relative_path)) {
+        $event->addError([
+          $this->t('The new package @package will be installed in the directory @path, which already exists but is not managed by Composer.', [
+            '@package' => $package->name,
+            '@path' => $relative_path,
+          ]),
+        ]);
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      PreApplyEvent::class => 'validate',
+    ];
+  }
+
+}

package_manager/src/Validator/PendingUpdatesValidator.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\package_manager\Validator;
 
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\StringTranslation\TranslationInterface;
 use Drupal\Core\Update\UpdateRegistry;
 use Drupal\Core\Url;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
  * Validates that there are no pending database updates.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
  */
-class PendingUpdatesValidator implements PreOperationStageValidatorInterface {
+final class PendingUpdatesValidator implements EventSubscriberInterface {
 
   use StringTranslationTrait;
 
-  /**
-   * The Drupal root.
-   *
-   * @var string
-   */
-  protected $appRoot;
-
-  /**
-   * The update registry service.
-   *
-   * @var \Drupal\Core\Update\UpdateRegistry
-   */
-  protected $updateRegistry;
-
   /**
    * Constructs an PendingUpdatesValidator object.
    *
-   * @param string $app_root
+   * @param string $appRoot
    *   The Drupal root.
-   * @param \Drupal\Core\Update\UpdateRegistry $update_registry
+   * @param \Drupal\Core\Update\UpdateRegistry $updateRegistry
    *   The update registry service.
-   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
-   *   The translation service.
    */
-  public function __construct(string $app_root, UpdateRegistry $update_registry, TranslationInterface $translation) {
-    $this->appRoot = $app_root;
-    $this->updateRegistry = $update_registry;
-    $this->setStringTranslation($translation);
-  }
+  public function __construct(
+    private readonly string $appRoot,
+    private readonly UpdateRegistry $updateRegistry
+  ) {}
 
   /**
-   * {@inheritdoc}
+   * Validates that there are no pending database updates.
    */
-  public function validateStagePreOperation(PreOperationStageEvent $event): void {
+  public function validate(PreOperationStageEvent $event): void {
     if ($this->updatesExist()) {
       $message = $this->t('Some modules have database schema updates to install. You should run the <a href=":update">database update script</a> immediately.', [
         ':update' => Url::fromRoute('system.db_update')->toString(),
@@ -79,9 +71,11 @@ class PendingUpdatesValidator implements PreOperationStageValidatorInterface {
   /**
    * {@inheritdoc}
    */
-  public static function getSubscribedEvents() {
+  public static function getSubscribedEvents(): array {
     return [
-      PreCreateEvent::class => 'validateStagePreOperation',
+      PreCreateEvent::class => 'validate',
+      StatusCheckEvent::class => 'validate',
+      PreApplyEvent::class => 'validate',
     ];
   }
 

package_manager/src/Validator/PhpExtensionsValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Component\FileSystem\FileSystem as DrupalFilesystem;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\PreCreateEvent;
+use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Performs validation if certain PHP extensions are enabled.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+class PhpExtensionsValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Indicates if a particular PHP extension is loaded.
+   *
+   * @param string $name
+   *   The name of the PHP extension to check for.
+   *
+   * @return bool
+   *   TRUE if the given extension is loaded, FALSE otherwise.
+   */
+  final protected function isExtensionLoaded(string $name): bool {
+    // If and ONLY if we're currently running a test, allow the list of loaded
+    // extensions to be overridden by a state variable.
+    if (self::insideTest()) {
+      // By default, assume OpenSSL is enabled and Xdebug isn't. This allows us
+      // to run tests in environments that we might not support in production,
+      // such as Drupal CI.
+      $loaded_extensions = \Drupal::state()
+        ->get('package_manager_loaded_php_extensions', ['openssl']);
+      return in_array($name, $loaded_extensions, TRUE);
+    }
+    return extension_loaded($name);
+  }
+
+  /**
+   * Flags a warning if Xdebug is enabled.
+   *
+   * @param \Drupal\package_manager\Event\StatusCheckEvent $event
+   *   The event object.
+   */
+  public function validateXdebug(StatusCheckEvent $event): void {
+    if ($this->isExtensionLoaded('xdebug')) {
+      $event->addWarning([
+        $this->t('Xdebug is enabled, which may have a negative performance impact on Package Manager and any modules that use it.'),
+      ]);
+    }
+  }
+
+  /**
+   * Flags an error if the OpenSSL extension is not installed.
+   *
+   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
+   *   The event object.
+   */
+  public function validateOpenSsl(PreOperationStageEvent $event): void {
+    if (!$this->isExtensionLoaded('openssl')) {
+      $message = $this->t('The OpenSSL extension is not enabled, which is a security risk. See <a href=":url">the PHP documentation</a> for information on how to enable this extension.', [
+        ':url' => 'https://www.php.net/manual/en/openssl.installation.php',
+      ]);
+      $event->addError([$message]);
+    }
+  }
+
+  /**
+   * Whether this validator is running inside a test.
+   *
+   * @return bool
+   */
+  private static function insideTest(): bool {
+    // @see \Drupal\Core\CoreServiceProvider::registerTest()
+    $in_functional_test = drupal_valid_test_ua();
+    // @see \Drupal\Core\DependencyInjection\DependencySerializationTrait::__wakeup()
+    $in_kernel_test = isset($GLOBALS['__PHPUNIT_BOOTSTRAP']);
+    // @see \Drupal\BuildTests\Framework\BuildTestBase::setUp()
+    $in_build_test = str_contains(__FILE__, DrupalFilesystem::getOsTemporaryDirectory() . '/build_workspace_');
+    return $in_functional_test || $in_kernel_test || $in_build_test;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      StatusCheckEvent::class => [
+        ['validateXdebug'],
+        ['validateOpenSsl'],
+      ],
+      PreCreateEvent::class => ['validateOpenSsl'],
+      PreApplyEvent::class => ['validateOpenSsl'],
+    ];
+  }
+
+}

package_manager/src/Validator/PhpTufValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\PreCreateEvent;
+use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\PreRequireEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that PHP-TUF is installed and correctly configured.
+ *
+ * In both the active and stage directories, this checks for the following
+ * conditions:
+ * - The PHP-TUF plugin is installed.
+ * - The plugin is not explicitly blocked by Composer's `allow-plugins`
+ *   configuration.
+ * - Composer is aware of at least one repository hosted at
+ *   packages.drupal.org (since that's currently the only server that supports
+ *   TUF), and that those repositories have TUF support explicitly enabled.
+ *
+ * Note that this validator is currently not active, because the service
+ * definition is not tagged as an event subscriber. This will be changed in
+ * https://drupal.org/i/3358504, once TUF support is rolled out on
+ * packages.drupal.org.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class PhpTufValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * The name of the PHP-TUF Composer integration plugin.
+   *
+   * @var string
+   */
+  public const PLUGIN_NAME = 'php-tuf/composer-integration';
+
+  /**
+   * Constructs a PhpTufValidator object.
+   *
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $moduleHandler
+   *   The module handler service.
+   * @param string $baseUrl
+   *   The base URL of the repository, or repositories, defined in
+   *   `composer.json`that must be protected by TUF.
+   */
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector,
+    private readonly ModuleHandlerInterface $moduleHandler,
+    private readonly string $baseUrl,
+  ) {}
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      StatusCheckEvent::class => 'validate',
+      PreCreateEvent::class => 'validate',
+      PreRequireEvent::class => 'validate',
+      PreApplyEvent::class => 'validate',
+    ];
+  }
+
+  /**
+   * Reacts to a stage event by validating PHP-TUF configuration as needed.
+   *
+   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
+   *   The event object.
+   */
+  public function validate(PreOperationStageEvent $event): void {
+    $messages = $this->validateTuf($this->pathLocator->getProjectRoot());
+    if ($messages) {
+      $event->addError($messages, $this->t('The active directory is not protected by PHP-TUF, which is required to use Package Manager securely.'));
+    }
+
+    $stage = $event->stage;
+    if ($stage->stageDirectoryExists()) {
+      $messages = $this->validateTuf($stage->getStageDirectory());
+      if ($messages) {
+        $event->addError($messages, $this->t('The stage directory is not protected by PHP-TUF, which is required to use Package Manager securely.'));
+      }
+    }
+  }
+
+  /**
+   * Flags messages if PHP-TUF is not installed and configured properly.
+   *
+   * @param string $dir
+   *   The directory to examine.
+   *
+   * @return \Drupal\Core\StringTranslation\TranslatableMarkup[]
+   *   The error messages, if any.
+   */
+  private function validateTuf(string $dir): array {
+    $messages = [];
+
+    if ($this->moduleHandler->moduleExists('help')) {
+      $help_url = Url::fromRoute('help.page', ['name' => 'package_manager'])
+        ->setOption('fragment', 'package-manager-tuf-info')
+        ->toString();
+    }
+
+    // The Composer plugin must be installed.
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($dir);
+    if (!isset($installed_packages[static::PLUGIN_NAME])) {
+      $message = $this->t('The <code>@plugin</code> plugin is not installed.', [
+        '@plugin' => static::PLUGIN_NAME,
+      ]);
+      if (isset($help_url)) {
+        $message = $this->t('@message See <a href=":url">the help page</a> for more information on how to install the plugin.', [
+          '@message' => $message,
+          ':url' => $help_url,
+        ]);
+      }
+      $messages[] = $message;
+    }
+
+    // And it has to be explicitly enabled.
+    $allowed_plugins = $this->composerInspector->getAllowPluginsConfig($dir);
+    if ($allowed_plugins !== TRUE && empty($allowed_plugins[static::PLUGIN_NAME])) {
+      $message = $this->t('The <code>@plugin</code> plugin is not listed as an allowed plugin.', [
+        '@plugin' => static::PLUGIN_NAME,
+      ]);
+      if (isset($help_url)) {
+        $message = $this->t('@message See <a href=":url">the help page</a> for more information on how to configure the plugin.', [
+          '@message' => $message,
+          ':url' => $help_url,
+        ]);
+      }
+      $messages[] = $message;
+    }
+
+    // Get the defined repositories that live at the base URL, and confirm that
+    // they have all opted into TUF protection.
+    $repositories = array_filter(
+      Json::decode($this->composerInspector->getConfig('repositories', $dir)),
+      fn (array $r): bool => str_starts_with($r['url'], $this->baseUrl)
+    );
+    foreach ($repositories as $repository) {
+      if (empty($repository['tuf'])) {
+        $messages[] = $this->t('TUF is not enabled for the @url repository.', [
+          '@url' => $repository['url'],
+        ]);
+      }
+    }
+
+    // There must be at least one repository using the base URL.
+    if (empty($repositories)) {
+      $message = $this->t('The <code>@url</code> Composer repository must be defined in <code>composer.json</code>.', [
+        '@url' => $this->baseUrl,
+      ]);
+      if (isset($help_url)) {
+        $message = $this->t('@message See <a href=":url">the help page</a> for more information on how to set up this repository.', [
+          '@message' => $message,
+          ':url' => $help_url,
+        ]);
+      }
+      $messages[] = $message;
+    }
+    return $messages;
+  }
+
+}

package_manager/src/Validator/PreOperationStageValidatorInterface.php

-<?php
-
-namespace Drupal\package_manager\Validator;
-
-use Drupal\package_manager\Event\PreOperationStageEvent;
-use Symfony\Component\EventDispatcher\EventSubscriberInterface;
-
-/**
- * Defines an interface for classes that validate a stage before an operation.
- */
-interface PreOperationStageValidatorInterface extends EventSubscriberInterface {
-
-  /**
-   * Validates a stage before an operation.
-   *
-   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
-   *   The stage event.
-   */
-  public function validateStagePreOperation(PreOperationStageEvent $event): void;
-
-}

package_manager/src/Validator/RsyncValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Url;
+use Drupal\package_manager\Event\PreCreateEvent;
+use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use PhpTuf\ComposerStager\API\Exception\LogicException;
+use PhpTuf\ComposerStager\API\Finder\Service\ExecutableFinderInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Checks that rsync is available, if it is the configured file syncer.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class RsyncValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs an RsyncValidator object.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
+   *   The config factory.
+   * @param \PhpTuf\ComposerStager\API\Finder\Service\ExecutableFinderInterface $executableFinder
+   *   The executable finder service.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $moduleHandler
+   *   The module handler service.
+   */
+  public function __construct(
+    private readonly ConfigFactoryInterface $configFactory,
+    private readonly ExecutableFinderInterface $executableFinder,
+    private readonly ModuleHandlerInterface $moduleHandler,
+  ) {}
+
+  /**
+   * Checks that rsync is being used, if it's available.
+   *
+   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
+   *   The event being handled.
+   */
+  public function validate(PreOperationStageEvent $event): void {
+    try {
+      $this->executableFinder->find('rsync');
+      $rsync_found = TRUE;
+    }
+    catch (LogicException) {
+      $rsync_found = FALSE;
+    }
+
+    if ($this->moduleHandler->moduleExists('help')) {
+      $help_url = Url::fromRoute('help.page')
+        ->setRouteParameter('name', 'package_manager')
+        ->setOption('fragment', 'package-manager-faq-rsync')
+        ->toString();
+    }
+
+    $configured_syncer = $this->configFactory->get('package_manager.settings')
+      ->get('file_syncer');
+
+    // If the PHP file syncer is selected, warn that we don't recommend it.
+    if ($configured_syncer === 'php') {
+      // Only status checks support warnings.
+      if ($event instanceof StatusCheckEvent) {
+        $message = $this->t('You are currently using the PHP file syncer, which has known problems and is not stable. <strong>The PHP file syncer will be removed in Package Manager 3.1.0.</strong> Switch back to the default <em>rsync</em> file syncer to continue using Package Manager.');
+
+        if (!$rsync_found) {
+          $message = $this->t('@message <code>rsync</code> was not found on your system.', ['@message' => $message]);
+        }
+        if (isset($help_url)) {
+          $message = $this->t('@message See the <a href=":url">Package Manager help</a> for more information on how to resolve this.', [
+            ':url' => $help_url,
+            '@message' => $message,
+          ]);
+        }
+        $event->addWarning([$message]);
+      }
+      // If we're not doing a status check, well, I guess we'll be using the
+      // PHP file syncer. There's nothing else to do.
+      return;
+    }
+
+    if ($rsync_found === FALSE) {
+      $message = $this->t('<code>rsync</code> is not available.');
+
+      if (isset($help_url)) {
+        $message = $this->t('@message See the <a href=":url">Package Manager help</a> for more information on how to resolve this.', [
+          '@message' => $message,
+          ':url' => $help_url,
+        ]);
+      }
+      $event->addError([$message]);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      StatusCheckEvent::class => 'validate',
+      PreCreateEvent::class => 'validate',
+    ];
+  }
+
+}

src/Validator/SettingsValidator.php → package_manager/src/Validator/SettingsValidator.php

 <?php
 
-namespace Drupal\automatic_updates\Validator;
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
 
-use Drupal\automatic_updates\Event\ReadinessCheckEvent;
-use Drupal\automatic_updates\Updater;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
-class SettingsValidator implements EventSubscriberInterface {
+/**
+ * Checks that Drupal's settings are valid for Package Manager.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class SettingsValidator implements EventSubscriberInterface {
 
   use StringTranslationTrait;
 
   /**
-   * Constructs a SettingsValidator object.
-   *
-   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
-   *   The string translation service.
-   */
-  public function __construct(TranslationInterface $translation) {
-    $this->setStringTranslation($translation);
-  }
-
-  /**
-   * Validates site settings before an update starts.
-   *
-   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
-   *   The event object.
+   * Checks that Drupal's settings are valid for Package Manager.
    */
-  public function checkSettings(PreOperationStageEvent $event): void {
-    if ($event->getStage() instanceof Updater && Settings::get('update_fetch_with_http_fallback')) {
+  public function validate(PreOperationStageEvent $event): void {
+    if (Settings::get('update_fetch_with_http_fallback')) {
       $event->addError([
-        $this->t('The <code>update_fetch_with_http_fallback</code> setting must be disabled for automatic updates.'),
+        $this->t('The <code>update_fetch_with_http_fallback</code> setting must be disabled.'),
       ]);
     }
   }
@@ -42,10 +38,11 @@ class SettingsValidator implements EventSubscriberInterface {
   /**
    * {@inheritdoc}
    */
-  public static function getSubscribedEvents() {
+  public static function getSubscribedEvents(): array {
     return [
-      ReadinessCheckEvent::class => 'checkSettings',
-      PreCreateEvent::class => 'checkSettings',
+      PreCreateEvent::class => 'validate',
+      PreApplyEvent::class => 'validate',
+      StatusCheckEvent::class => 'validate',
     ];
   }
 

package_manager/src/Validator/StageNotInActiveValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates staging root is not a subdirectory of active.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class StageNotInActiveValidator implements EventSubscriberInterface {
+
+  use BaseRequirementValidatorTrait {
+    getSubscribedEvents as private getSubscribedEventsFromTrait;
+  }
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a new StageNotInActiveValidator object.
+   *
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(private readonly PathLocator $pathLocator) {
+  }
+
+  /**
+   * Check if staging root is a subdirectory of active.
+   */
+  public function validate(PreOperationStageEvent $event): void {
+    $project_root = $this->pathLocator->getProjectRoot();
+    $staging_root = $this->pathLocator->getStagingRoot();
+    if (str_starts_with($staging_root, $project_root)) {
+      $message = $this->t("Stage directory is a subdirectory of the active directory.");
+      $event->addError([$message]);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events = static::getSubscribedEventsFromTrait();
+    // We don't need to listen to PreApplyEvent because once the stage directory
+    // has been created, it's not going to be moved.
+    unset($events[PreApplyEvent::class]);
+    return $events;
+  }
+
+}

package_manager/src/Validator/StagedDBUpdateValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\Component\Assertion\Inspector;
+use Drupal\Core\Extension\Extension;
+use Drupal\Core\Extension\ModuleExtensionList;
+use Drupal\Core\Extension\ThemeExtensionList;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Flags a warning if there are database updates in a staged update.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+class StagedDBUpdateValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a StagedDBUpdateValidator object.
+   *
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \Drupal\Core\Extension\ModuleExtensionList $moduleList
+   *   The module list service.
+   * @param \Drupal\Core\Extension\ThemeExtensionList $themeList
+   *   The theme list service.
+   */
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ModuleExtensionList $moduleList,
+    private readonly ThemeExtensionList $themeList,
+  ) {}
+
+  /**
+   * Checks that the staged update does not have changes to its install files.
+   *
+   * @param \Drupal\package_manager\Event\StatusCheckEvent $event
+   *   The event object.
+   */
+  public function checkForStagedDatabaseUpdates(StatusCheckEvent $event): void {
+    if (!$event->stage->stageDirectoryExists()) {
+      return;
+    }
+    $stage_dir = $event->stage->getStageDirectory();
+    $extensions_with_updates = $this->getExtensionsWithDatabaseUpdates($stage_dir);
+    if ($extensions_with_updates) {
+      $extensions_with_updates = array_map($this->t(...), $extensions_with_updates);
+      $event->addWarning($extensions_with_updates, $this->t('Database updates have been detected in the following extensions.'));
+    }
+  }
+
+  /**
+   * Determines if a staged extension has changed update functions.
+   *
+   * @param string $stage_dir
+   *   The path of the stage directory.
+   * @param \Drupal\Core\Extension\Extension $extension
+   *   The extension to check.
+   *
+   * @return bool
+   *   TRUE if the staged copy of the extension has changed update functions
+   *   compared to the active copy, FALSE otherwise.
+   *
+   * @todo In https://drupal.org/i/3253828 use a more sophisticated method to
+   *   detect changes in the staged extension. Right now, we just compare hashes
+   *   of the .install and .post_update.php files in both copies of the given
+   *   extension, but this will cause false positives for changes to comments,
+   *   whitespace, or runtime code like requirements checks. It would be
+   *   preferable to use a static analyzer to detect new or changed functions
+   *   that are actually executed during an update. No matter what, this method
+   *   must NEVER cause false negatives, since that could result in code which
+   *   is incompatible with the current database schema being copied to the
+   *   active directory.
+   */
+  public function hasStagedUpdates(string $stage_dir, Extension $extension): bool {
+    $active_dir = $this->pathLocator->getProjectRoot();
+
+    $web_root = $this->pathLocator->getWebRoot();
+    if ($web_root) {
+      $active_dir .= DIRECTORY_SEPARATOR . $web_root;
+      $stage_dir .= DIRECTORY_SEPARATOR . $web_root;
+    }
+
+    $active_functions = $this->getUpdateFunctions($active_dir, $extension);
+    $staged_functions = $this->getUpdateFunctions($stage_dir, $extension);
+
+    return (bool) array_diff($staged_functions, $active_functions);
+  }
+
+  /**
+   * Returns a list of all update functions for a module.
+   *
+   * @param string $root_dir
+   *   The root directory of the Drupal code base.
+   * @param \Drupal\Core\Extension\Extension $extension
+   *   The module to check.
+   *
+   * @return string[]
+   *   The names of the update functions in the module's .install and
+   *   .post_update.php files.
+   */
+  protected function getUpdateFunctions(string $root_dir, Extension $extension): array {
+    $name = $extension->getName();
+
+    $path = implode(DIRECTORY_SEPARATOR, [
+      $root_dir,
+      $extension->getPath(),
+      $name,
+    ]);
+    $function_names = [];
+
+    $patterns = [
+      '.install' => '/^' . $name . '_update_[0-9]+$/i',
+      '.post_update.php' => '/^' . $name . '_post_update_.+$/i',
+    ];
+    foreach ($patterns as $suffix => $pattern) {
+      $file = $path . $suffix;
+
+      if (!file_exists($file)) {
+        continue;
+      }
+      // Parse the file and scan for named functions which match the pattern.
+      $code = file_get_contents($file);
+      $tokens = token_get_all($code);
+
+      for ($i = 0; $i < count($tokens); $i++) {
+        $chunk = array_slice($tokens, $i, 3);
+        if ($this->tokensMatchFunctionNamePattern($chunk, $pattern)) {
+          $function_names[] = $chunk[2][1];
+        }
+      }
+    }
+    return $function_names;
+  }
+
+  /**
+   * Determines if a set of tokens contain a function name matching a pattern.
+   *
+   * @param array[] $tokens
+   *   A set of three tokens, part of a stream returned by token_get_all().
+   * @param string $pattern
+   *   If the tokens declare a named function, a regular expression to test the
+   *   function name against.
+   *
+   * @return bool
+   *   TRUE if the given tokens declare a function whose name matches the given
+   *   pattern; FALSE otherwise.
+   *
+   * @see token_get_all()
+   */
+  private function tokensMatchFunctionNamePattern(array $tokens, string $pattern): bool {
+    if (count($tokens) !== 3 || !Inspector::assertAllStrictArrays($tokens)) {
+      return FALSE;
+    }
+    // A named function declaration will always be a T_FUNCTION (the word
+    // `function`), followed by T_WHITESPACE (or the code would be syntactically
+    // invalid), followed by a T_STRING (the function name). This will ignore
+    // anonymous functions, but match class methods (although class methods are
+    // highly unlikely to match the naming patterns of update hooks).
+    $names = array_map('token_name', array_column($tokens, 0));
+    if ($names === ['T_FUNCTION', 'T_WHITESPACE', 'T_STRING']) {
+      return (bool) preg_match($pattern, $tokens[2][1]);
+    }
+    return FALSE;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      StatusCheckEvent::class => 'checkForStagedDatabaseUpdates',
+    ];
+  }
+
+  /**
+   * Gets extensions that have database updates in the stage directory.
+   *
+   * @param string $stage_dir
+   *   The path of the stage directory.
+   *
+   * @return \Drupal\Core\StringTranslation\TranslatableMarkup[]
+   *   The names of the extensions that have database updates.
+   */
+  public function getExtensionsWithDatabaseUpdates(string $stage_dir): array {
+    $extensions_with_updates = [];
+    // Check all installed extensions for database updates.
+    $lists = [$this->moduleList, $this->themeList];
+    foreach ($lists as $list) {
+      foreach ($list->getAllInstalledInfo() as $name => $info) {
+        if ($this->hasStagedUpdates($stage_dir, $list->get($name))) {
+          $extensions_with_updates[] = $info['name'];
+        }
+      }
+    }
+
+    return $extensions_with_updates;
+  }
+
+}

package_manager/src/Validator/SupportedReleaseValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\LegacyVersionUtility;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that updated projects are secure and supported.
+ *
+ * @internal
+ *   This class is an internal part of the module's update handling and
+ *   should not be used by external code.
+ */
+final class SupportedReleaseValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a SupportedReleaseValidator object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator
+  ) {}
+
+  /**
+   * Checks if the given version of a project is supported.
+   *
+   * Checks if the given version of the given project is in the core update
+   * system's list of known, secure, installable releases of that project.
+   * considered a supported release by verifying if the project is found in the
+   * core update system's list of known, secure, and installable releases.
+   *
+   * @param string $name
+   *   The name of the project.
+   * @param string $semantic_version
+   *   A semantic version number for the project.
+   *
+   * @return bool
+   *   TRUE if the given version of the project is supported, otherwise FALSE.
+   *   given version is not supported will return FALSE.
+   */
+  private function isSupportedRelease(string $name, string $semantic_version): bool {
+    $supported_releases = (new ProjectInfo($name))->getInstallableReleases();
+    if (!$supported_releases) {
+      return FALSE;
+    }
+
+    // If this version is found in the list of installable releases, it is
+    // secured and supported.
+    if (array_key_exists($semantic_version, $supported_releases)) {
+      return TRUE;
+    }
+    // If the semantic version number wasn't in the list of
+    // installable releases, convert it to a legacy version number and see
+    // if the version number is in the list.
+    $legacy_version = LegacyVersionUtility::convertToLegacyVersion($semantic_version);
+    if ($legacy_version && array_key_exists($legacy_version, $supported_releases)) {
+      return TRUE;
+    }
+    // Neither the semantic version nor the legacy version are in the list
+    // of installable releases, so the release isn't supported.
+    return FALSE;
+  }
+
+  /**
+   * Checks that the packages are secure and supported.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent $event
+   *   The event object.
+   */
+  public function validate(PreApplyEvent $event): void {
+    $active = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged = $this->composerInspector->getInstalledPackagesList($event->stage->getStageDirectory());
+    $updated_packages = array_merge(
+      $staged->getPackagesNotIn($active)->getArrayCopy(),
+      $staged->getPackagesWithDifferentVersionsIn($active)->getArrayCopy()
+    );
+    $unknown_packages = [];
+    $unsupported_packages = [];
+    foreach ($updated_packages as $package_name => $staged_package) {
+      // Only packages of the types 'drupal-module' or 'drupal-theme' that
+      // start with 'drupal/' will have update XML from drupal.org.
+      if (!in_array($staged_package->type, ['drupal-module', 'drupal-theme'], TRUE)
+         || !str_starts_with($package_name, 'drupal/')) {
+        continue;
+      }
+      $project_name = $staged[$package_name]->getProjectName();
+      if (empty($project_name)) {
+        $unknown_packages[] = $package_name;
+        continue;
+      }
+      $semantic_version = $staged_package->version;
+      if (!$this->isSupportedRelease($project_name, $semantic_version)) {
+        $unsupported_packages[] = $this->t('@project_name (@package_name) @version', [
+          '@project_name' => $project_name,
+          '@package_name' => $package_name,
+          '@version' => $semantic_version,
+        ]);
+      }
+    }
+    if ($unsupported_packages) {
+      $summary = $this->formatPlural(
+        count($unsupported_packages),
+        'Cannot update because the following project version is not in the list of installable releases.',
+        'Cannot update because the following project versions are not in the list of installable releases.'
+      );
+      $event->addError($unsupported_packages, $summary);
+    }
+    if ($unknown_packages) {
+      $event->addError([
+        $this->formatPlural(
+          count($unknown_packages),
+          'Cannot update because the following new or updated Drupal package does not have project information: @unknown_packages',
+          'Cannot update because the following new or updated Drupal packages do not have project information: @unknown_packages',
+          [
+            '@unknown_packages' => implode(', ', $unknown_packages),
+          ],
+        ),
+      ]);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      PreApplyEvent::class => 'validate',
+    ];
+  }
+
+}

package_manager/src/Validator/SymlinkValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager\Validator;
+
+use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\PreRequireEvent;
+use Drupal\package_manager\PathLocator;
+use PhpTuf\ComposerStager\API\Exception\PreconditionException;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
+use PhpTuf\ComposerStager\API\Path\Factory\PathListFactoryInterface;
+use PhpTuf\ComposerStager\API\Precondition\Service\NoUnsupportedLinksExistInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Flags errors if unsupported symbolic links are detected.
+ *
+ * @see https://github.com/php-tuf/composer-stager/tree/develop/src/Domain/Service/Precondition#symlinks
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class SymlinkValidator implements EventSubscriberInterface {
+
+  use BaseRequirementValidatorTrait;
+
+  /**
+   * Constructs a SymlinkValidator object.
+   *
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \PhpTuf\ComposerStager\API\Precondition\Service\NoUnsupportedLinksExistInterface $precondition
+   *   The Composer Stager precondition that this validator wraps.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
+   *   The path factory service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathListFactoryInterface $pathListFactory
+   *   The path list factory service.
+   */
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly NoUnsupportedLinksExistInterface $precondition,
+    private readonly PathFactoryInterface $pathFactory,
+    private readonly PathListFactoryInterface $pathListFactory,
+  ) {}
+
+  /**
+   * Flags errors if the project root or stage directory contain symbolic links.
+   */
+  public function validate(PreOperationStageEvent $event): void {
+    if ($event instanceof PreRequireEvent) {
+      // We don't need to check symlinks again during PreRequireEvent; this was
+      // already just validated during PreCreateEvent.
+      return;
+    }
+    $active_dir = $this->pathFactory->create($this->pathLocator->getProjectRoot());
+
+    // The precondition requires us to pass both an active and stage directory,
+    // so if the stage hasn't been created or claimed yet, use the directory
+    // that contains this file, which contains only a few files and no symlinks,
+    // as the stage directory. The precondition itself doesn't care if the
+    // directory actually exists or not.
+    $stage_dir = __DIR__;
+    if ($event->stage->stageDirectoryExists()) {
+      $stage_dir = $event->stage->getStageDirectory();
+    }
+    $stage_dir = $this->pathFactory->create($stage_dir);
+
+    // Return early if no excluded paths were collected because this validator
+    // is dependent on knowing which paths to exclude when searching for
+    // symlinks.
+    // @see \Drupal\package_manager\StatusCheckTrait::runStatusCheck()
+    if ($event->excludedPaths === NULL) {
+      return;
+    }
+
+    // The list of excluded paths is immutable, but the precondition may need to
+    // mutate it, so convert it back to a normal, mutable path list.
+    $exclusions = $this->pathListFactory->create(...$event->excludedPaths->getAll());
+
+    try {
+      $this->precondition->assertIsFulfilled($active_dir, $stage_dir, $exclusions);
+    }
+    catch (PreconditionException $e) {
+      $event->addErrorFromThrowable($e);
+    }
+  }
+
+}

package_manager/src/Validator/WritableFileSystemValidator.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\package_manager\Validator;
 
-use Drupal\package_manager\Event\PreCreateEvent;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\StringTranslation\TranslationInterface;
 use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
  * Checks that the file system is writable.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
  */
-class WritableFileSystemValidator implements PreOperationStageValidatorInterface {
+class WritableFileSystemValidator implements EventSubscriberInterface {
 
+  use BaseRequirementValidatorTrait;
   use StringTranslationTrait;
 
-  /**
-   * The path locator service.
-   *
-   * @var \Drupal\package_manager\PathLocator
-   */
-  protected $pathLocator;
-
-  /**
-   * The Drupal root.
-   *
-   * @var string
-   */
-  protected $appRoot;
-
   /**
    * Constructs a WritableFileSystemValidator object.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
-   * @param string $app_root
-   *   The Drupal root.
-   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
-   *   The translation service.
    */
-  public function __construct(PathLocator $path_locator, string $app_root, TranslationInterface $translation) {
-    $this->pathLocator = $path_locator;
-    $this->appRoot = $app_root;
-    $this->setStringTranslation($translation);
+  public function __construct(private readonly PathLocator $pathLocator) {
   }
 
   /**
-   * {@inheritdoc}
+   * Checks that the file system is writable.
    *
-   * @todo It might make sense to use a more sophisticated method of testing
-   *   writability than is_writable(), since it's not clear if that can return
-   *   false negatives/positives due to things like SELinux, exotic file
-   *   systems, and so forth.
+   * @todo Determine if 'is_writable()' is a sufficiently robust test across
+   *   different operating systems in https://drupal.org/i/3348253.
    */
-  public function validateStagePreOperation(PreOperationStageEvent $event): void {
+  public function validate(PreOperationStageEvent $event): void {
     $messages = [];
 
-    if (!is_writable($this->appRoot)) {
-      $messages[] = $this->t('The Drupal directory "@dir" is not writable.', [
-        '@dir' => $this->appRoot,
+    $project_root = $this->pathLocator->getProjectRoot();
+
+    // If the web (Drupal) root and project root are different, validate the
+    // web root separately.
+    $web_root = $this->pathLocator->getWebRoot();
+    if ($web_root) {
+      $drupal_root = $project_root . DIRECTORY_SEPARATOR . $web_root;
+      if (!is_writable($drupal_root)) {
+        $messages[] = $this->t('The Drupal directory "@dir" is not writable.', [
+          '@dir' => $drupal_root,
+        ]);
+      }
+    }
+
+    if (!is_writable($project_root)) {
+      $messages[] = $this->t('The project root directory "@dir" is not writable.', [
+        '@dir' => $project_root,
       ]);
     }
 
@@ -67,18 +66,33 @@ class WritableFileSystemValidator implements PreOperationStageValidatorInterface
       $messages[] = $this->t('The vendor directory "@dir" is not writable.', ['@dir' => $dir]);
     }
 
+    // During pre-apply don't check whether the staging root is writable.
+    if ($event instanceof PreApplyEvent) {
+      if ($messages) {
+        $event->addError($messages, $this->t('The file system is not writable.'));
+      }
+      return;
+    }
+    // Ensure the staging root is writable. If it doesn't exist, ensure we will
+    // be able to create it.
+    $dir = $this->pathLocator->getStagingRoot();
+    if (!file_exists($dir)) {
+      $dir = dirname($dir);
+      if (!is_writable($dir)) {
+        $messages[] = $this->t('The stage root directory will not able to be created at "@dir".', [
+          '@dir' => $dir,
+        ]);
+      }
+    }
+    elseif (!is_writable($dir)) {
+      $messages[] = $this->t('The stage root directory "@dir" is not writable.', [
+        '@dir' => $dir,
+      ]);
+    }
+
     if ($messages) {
       $event->addError($messages, $this->t('The file system is not writable.'));
     }
   }
 
-  /**
-   * {@inheritdoc}
-   */
-  public static function getSubscribedEvents() {
-    return [
-      PreCreateEvent::class => 'validateStagePreOperation',
-    ];
-  }
-
 }

package_manager/tests/fixtures/build_test_projects/README.md

+# Why do we need the `updated_module` fixtures?
+Because there is a need to thoroughly test the updating of a module. See `\Drupal\Tests\package_manager\Build\PackageUpdateTest`.
+
+This requires 2 versions (`1.0.0` and `1.1.0`) of the same module (`updated_module`), each with a different code bases.
+
+The test updates from one version to the next, and verifies the updated module's code base is actually used after the update: it verifies the updated logic of version of `\Drupal\updated_module\PostApplySubscriber` is being executed.
+
+`\Drupal\fixture_manipulator\FixtureManipulator` cannot manipulate code nor does it modify the file system: it only creates a "skeleton" extension. (See `\Drupal\fixture_manipulator\FixtureManipulator::addProjectAtPath()`.)
+
+# Why do we need the `alpha` fixtures?
+To be able to test that `php-tuf/composer-stager` indeed only updates the package for which an update was requested (even though more updates are available), no fixture manipulation is allowed to occur. This requires updating a `path` composer package repository to first serve contain one version of a package, and then another. That is what these fixtures are used for.
+

package_manager/tests/fixtures/build_test_projects/alpha/1.0.0/alpha.info.yml.hide

+name: Alpha
+type: module
+core_version_requirement: ^9.7 || ^10
+project: alpha

package_manager/tests/fixtures/build_test_projects/alpha/1.1.0/alpha.info.yml.hide

+name: Alpha
+type: module
+core_version_requirement: ^9.7 || ^10
+project: alpha

package_manager/tests/fixtures/build_test_projects/main_module/composer.json

+{
+  "name": "drupal/main_module",
+  "type": "drupal-module",
+  "version": "1.0.0"
+}

package_manager/tests/fixtures/build_test_projects/main_module/main_module.info.yml.hide

+name: Main module
+type: module
+core_version_requirement: ^9 || ^10
+project: main_module
+