automatic_updates.module

@@ -6,6 +6,7 @@
  */
 
 use Drupal\automatic_updates\BatchProcessor;
+use Drupal\automatic_updates\CronUpdater;
 use Drupal\Core\Routing\RouteMatchInterface;
 use Drupal\automatic_updates\Validation\AdminStatusCheckMessages;
 use Drupal\Core\Url;
@@ -95,6 +96,16 @@ function automatic_updates_mail(string $key, array &$message, array $params): vo
       }
     }
   }
+  elseif ($key === 'status_check_failed') {
+    $message['subject'] = t('Automatic updates readiness checks failed', [], $options);
+
+    $url = Url::fromRoute('system.status')
+      ->setAbsolute()
+      ->toString();
+    $message['body'][] = t('Your site has failed some readiness checks for automatic updates and may not be able to receive automatic updates until further action is taken. Please visit @url for more information.', [
+      '@url' => $url,
+    ], $options);
+  }
 
   // If this email was related to an unattended update, explicitly state that
   // this isn't supported yet.
@@ -153,7 +164,9 @@ function automatic_updates_module_implements_alter(&$implementations, $hook) {
  * Implements hook_cron().
  */
 function automatic_updates_cron() {
-  \Drupal::service('automatic_updates.cron_updater')->handleCron();
+  /** @var \Drupal\automatic_updates\CronUpdater $updater */
+  $updater = \Drupal::service('automatic_updates.cron_updater');
+  $updater->handleCron();
 
   /** @var \Drupal\automatic_updates\Validation\StatusChecker $status_checker */
   $status_checker = \Drupal::service('automatic_updates.status_checker');
@@ -165,6 +178,11 @@ function automatic_updates_cron() {
     $status_checker->run();
   }
 
+  // Only try to send failure notifications if unattended updates are enabled.
+  if ($updater->getMode() !== CronUpdater::DISABLED) {
+    \Drupal::service('automatic_updates.status_check_mailer')
+      ->sendFailureNotifications($last_results, $status_checker->getResults());
+  }
 }
 
 /**

automatic_updates.post_update.php

+<?php
+
+/**
+ * @file
+ * Contains post-update hooks for Automatic Updates.
+ */
+
+use Drupal\automatic_updates\StatusCheckMailer;
+
+/**
+ * Creates the automatic_updates.settings:status_check_mail config.
+ */
+function automatic_updates_post_update_create_status_check_mail_config(): void {
+  \Drupal::configFactory()
+    ->getEditable('automatic_updates.settings')
+    ->set('status_check_mail', StatusCheckMailer::ERRORS_ONLY)
+    ->save();
+}

automatic_updates.services.yml

@@ -14,6 +14,12 @@ services:
       - 24
     tags:
       - { name: event_subscriber }
+  automatic_updates.status_check_mailer:
+    class: Drupal\automatic_updates\StatusCheckMailer
+    arguments:
+      - '@config.factory'
+      - '@plugin.manager.mail'
+      - '@language_manager'
   automatic_updates.readiness_validation_manager:
     class: Drupal\automatic_updates\Validation\ReadinessValidationManager
     arguments:
@@ -41,7 +47,7 @@ services:
       - '@automatic_updates.release_chooser'
       - '@logger.factory'
       - '@plugin.manager.mail'
-      - '@language_manager'
+      - '@automatic_updates.status_check_mailer'
       - '@state'
       - '@config.factory'
       - '@package_manager.path_locator'
@@ -98,6 +104,8 @@ services:
       - { name: event_subscriber }
   automatic_updates.config_subscriber:
     class: Drupal\automatic_updates\EventSubscriber\ConfigSubscriber
+    arguments:
+      - '@automatic_updates.status_checker'
     tags:
       - { name: event_subscriber }
   automatic_updates.validator.scaffold_file_permissions:

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/automatic_updates_extensions_test_api.info.yml

@@ -4,3 +4,4 @@ type: module
 package: Testing
 dependencies:
   - automatic_updates:automatic_updates_extensions
+  - automatic_updates:package_manager_test_api

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/automatic_updates_extensions_test_api.routing.yml

@@ -4,3 +4,9 @@ automatic_updates_extensions_test_api:
     _controller: 'Drupal\automatic_updates_extensions_test_api\ApiController::run'
   requirements:
     _access: 'TRUE'
+automatic_updates_extensions_test_api.finish:
+  path: '/automatic-updates-extensions-test-api/finish/{id}'
+  defaults:
+    _controller: 'Drupal\automatic_updates_extensions_test_api\ApiController::finish'
+  requirements:
+    _access: 'TRUE'

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/src/ApiController.php

@@ -2,45 +2,19 @@
 
 namespace Drupal\automatic_updates_extensions_test_api;
 
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
-use Drupal\Core\Controller\ControllerBase;
-use Drupal\package_manager\PathLocator;
 use Symfony\Component\DependencyInjection\ContainerInterface;
-use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Drupal\package_manager_test_api\ApiController as PackageManagerApiController;
 
 /**
  * Provides API endpoints to interact with a staging area in functional tests.
  */
-class ApiController extends ControllerBase {
-
-
-  /**
-   * The extension updater.
-   *
-   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
-   */
-  private $extensionUpdater;
+class ApiController extends PackageManagerApiController {
 
   /**
-   * The path locator service.
-   *
-   * @var \Drupal\package_manager\PathLocator
-   */
-  private $pathLocator;
-
-  /**
-   * Constructs an ApiController object.
-   *
-   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $extension_updater
-   *   The updater.
-   * @param \Drupal\package_manager\PathLocator $path_locator
-   *   The path locator service.
+   * {@inheritdoc}
    */
-  public function __construct(ExtensionUpdater $extension_updater, PathLocator $path_locator) {
-    $this->extensionUpdater = $extension_updater;
-    $this->pathLocator = $path_locator;
-  }
+  protected $finishedRoute = 'automatic_updates_extensions_test_api.finish';
 
   /**
    * {@inheritdoc}
@@ -53,36 +27,13 @@ class ApiController extends ControllerBase {
   }
 
   /**
-   * Runs a complete stage life cycle.
-   *
-   * Creates a staging area, requires packages into it, applies changes to the
-   * active directory, and destroys the stage.
-   *
-   * @param \Symfony\Component\HttpFoundation\Request $request
-   *   The request. The runtime and dev dependencies are expected to be in
-   *   either the query string or request body, under the 'runtime' and 'dev'
-   *   keys, respectively. There may also be a 'files_to_return' key, which
-   *   contains an array of file paths, relative to the project root, whose
-   *   contents should be returned in the response.
-   *
-   * @return \Symfony\Component\HttpFoundation\JsonResponse
-   *   A JSON response containing an associative array of the contents of the
-   *   files listed in the 'files_to_return' request key. The array will be
-   *   keyed by path, relative to the project root.
+   * {@inheritdoc}
    */
-  public function run(Request $request): JsonResponse {
-    $this->extensionUpdater->begin($request->get('projects', []));
-    $this->extensionUpdater->stage();
-    $this->extensionUpdater->apply();
-    $this->extensionUpdater->postApply();
-    $this->extensionUpdater->destroy();
-
-    $dir = $this->pathLocator->getProjectRoot();
-    $file_contents = [];
-    foreach ($request->get('files_to_return', []) as $path) {
-      $file_contents[$path] = file_get_contents($dir . '/' . $path);
-    }
-    return new JsonResponse($file_contents);
+  protected function createAndApplyStage(Request $request): string {
+    $id = $this->stage->begin($request->get('projects', []));
+    $this->stage->stage();
+    $this->stage->apply();
+    return $id;
   }
 
 }

composer.json

@@ -13,7 +13,7 @@
   "require": {
     "ext-json": "*",
     "drupal/core": "^9.3",
-    "php-tuf/composer-stager": "^1.1",
+    "php-tuf/composer-stager": "^1.2",
     "composer/composer": "^2.2.12 || ^2.3.5",
     "composer-runtime-api": "^2.1",
     "symfony/config": "^4.4 || ^6.1",

config/install/automatic_updates.settings.yml

 cron: security
 allow_core_minor_updates: false
+status_check_mail: errors_only

config/schema/automatic_updates.schema.yml

@@ -11,3 +11,6 @@ automatic_updates.settings:
     allow_core_minor_updates:
       type: boolean
       label: 'Allow minor level Drupal core updates'
+    status_check_mail:
+      type: string
+      label: 'Whether to send status check failure e-mail notifications during cron'

dictionary.txt

@@ -3,4 +3,4 @@ updater's
 stager's
 syncer
 syncers
-unrequested
+kirk

package_manager/src/Stage.php

@@ -148,6 +148,13 @@ class Stage implements LoggerAwareInterface {
    */
   protected $eventDispatcher;
 
+  /**
+   * The shared temp store factory.
+   *
+   * @var \Drupal\Core\TempStore\SharedTempStoreFactory
+   */
+  protected $tempStoreFactory;
+
   /**
    * The shared temp store.
    *
@@ -202,7 +209,7 @@ class Stage implements LoggerAwareInterface {
    *   The file system service.
    * @param \Symfony\Contracts\EventDispatcher\EventDispatcherInterface $event_dispatcher
    *   The event dispatcher service.
-   * @param \Drupal\Core\TempStore\SharedTempStoreFactory $shared_tempstore
+   * @param \Drupal\Core\TempStore\SharedTempStoreFactory $temp_store_factory
    *   The shared tempstore factory.
    * @param \Drupal\Component\Datetime\TimeInterface $time
    *   The time service.
@@ -211,7 +218,7 @@ class Stage implements LoggerAwareInterface {
    * @param \Drupal\package_manager\FailureMarker $failure_marker
    *   The failure marker service.
    */
-  public function __construct(ConfigFactoryInterface $config_factory, PathLocator $path_locator, BeginnerInterface $beginner, StagerInterface $stager, CommitterInterface $committer, FileSystemInterface $file_system, EventDispatcherInterface $event_dispatcher, SharedTempStoreFactory $shared_tempstore, TimeInterface $time, PathFactoryInterface $path_factory = NULL, FailureMarker $failure_marker = NULL) {
+  public function __construct(ConfigFactoryInterface $config_factory, PathLocator $path_locator, BeginnerInterface $beginner, StagerInterface $stager, CommitterInterface $committer, FileSystemInterface $file_system, EventDispatcherInterface $event_dispatcher, SharedTempStoreFactory $temp_store_factory, TimeInterface $time, PathFactoryInterface $path_factory = NULL, FailureMarker $failure_marker = NULL) {
     $this->configFactory = $config_factory;
     $this->pathLocator = $path_locator;
     $this->beginner = $beginner;
@@ -220,7 +227,8 @@ class Stage implements LoggerAwareInterface {
     $this->fileSystem = $file_system;
     $this->eventDispatcher = $event_dispatcher;
     $this->time = $time;
-    $this->tempStore = $shared_tempstore->get('package_manager_stage');
+    $this->tempStoreFactory = $temp_store_factory;
+    $this->tempStore = $temp_store_factory->get('package_manager_stage');
     if (empty($path_factory)) {
       @trigger_error('Calling ' . __METHOD__ . '() without the $path_factory argument is deprecated in automatic_updates:8.x-2.3 and will be required before automatic_updates:3.0.0. See https://www.drupal.org/node/3310706.', E_USER_DEPRECATED);
       $path_factory = new PathFactory();
@@ -232,6 +240,16 @@ class Stage implements LoggerAwareInterface {
     }
     $this->failureMarker = $failure_marker;
     $this->setLogger(new NullLogger());
+    if (self::TEMPSTORE_METADATA_KEY !== static::TEMPSTORE_METADATA_KEY) {
+      @trigger_error('Overriding ' . __CLASS__ . '::TEMPSTORE_METADATA_KEY is deprecated in automatic_updates:8.x-2.5 and will not be possible in automatic_updates:3.0.0. There is no replacement. See https://www.drupal.org/node/3317450.', E_USER_DEPRECATED);
+      \Drupal::logger('package_manager')
+        ->error(__CLASS__ . '::TEMPSTORE_METADATA_KEY is overridden by ' . static::class . '. This is deprecated because it can cause errors or other unexpected behavior. It is strongly recommended to stop overriding this constant. See https://www.drupal.org/node/3317450 for more information.');
+    }
+    if (self::TEMPSTORE_LOCK_KEY !== static::TEMPSTORE_LOCK_KEY) {
+      @trigger_error('Overriding ' . __CLASS__ . '::TEMPSTORE_LOCK_KEY is deprecated in automatic_updates:8.x-2.5 and will not be possible in automatic_updates:3.0.0. There is no replacement. See https://www.drupal.org/node/3317450.', E_USER_DEPRECATED);
+      \Drupal::logger('package_manager')
+        ->error(__CLASS__ . '::TEMPSTORE_LOCK_KEY is overridden by ' . static::class . '. This is deprecated because it can cause errors or other unexpected behavior. It is strongly recommended to stop overriding this constant. See https://www.drupal.org/node/3317450 for more information.');
+    }
   }
 
   /**
@@ -259,7 +277,7 @@ class Stage implements LoggerAwareInterface {
   protected function getMetadata(string $key) {
     $this->checkOwnership();
 
-    $metadata = $this->tempStore->getIfOwner(static::TEMPSTORE_METADATA_KEY) ?: [];
+    $metadata = $this->tempStore->get(static::TEMPSTORE_METADATA_KEY) ?: [];
     return $metadata[$key] ?? NULL;
   }
 
@@ -317,6 +335,12 @@ class Stage implements LoggerAwareInterface {
     // while the event is being processed, the stage is marked as available.
     // @see ::dispatch()
     $id = Crypt::randomBytesBase64();
+    // Re-acquire the tempstore to ensure that the lock is written by whoever is
+    // actually logged in (or not) right now, since it's possible that the stage
+    // was instantiated (i.e., __construct() was called) by a different session,
+    // which would result in the lock having the wrong owner and the stage not
+    // being claimable by whoever is actually creating it.
+    $this->tempStore = $this->tempStoreFactory->get('package_manager_stage');
     $this->tempStore->set(static::TEMPSTORE_LOCK_KEY, [$id, static::class]);
     $this->claim($id);
 
@@ -610,7 +634,7 @@ class Stage implements LoggerAwareInterface {
       throw new StageException('Cannot claim the stage because no stage has been created.');
     }
 
-    $stored_lock = $this->tempStore->getIfOwner(self::TEMPSTORE_LOCK_KEY);
+    $stored_lock = $this->tempStore->getIfOwner(static::TEMPSTORE_LOCK_KEY);
     if (!$stored_lock) {
       throw new StageOwnershipException('Cannot claim the stage because it is not owned by the current user or session.');
     }

package_manager/src/ValidationResult.php

@@ -133,4 +133,24 @@ final class ValidationResult {
     return $results ? SystemManager::REQUIREMENT_WARNING : SystemManager::REQUIREMENT_OK;
   }
 
+  /**
+   * Determines if two validation results are equivalent.
+   *
+   * @param self $a
+   *   A validation result.
+   * @param self $b
+   *   Another validation result.
+   *
+   * @return bool
+   *   TRUE if the given validation results have the same severity, summary,
+   *   and messages (in the same order); otherwise FALSE.
+   */
+  public static function isEqual(self $a, self $b): bool {
+    return (
+      $a->getSeverity() === $b->getSeverity() &&
+      strval($a->getSummary()) === strval($b->getSummary()) &&
+      array_map('strval', $a->getMessages()) === array_map('strval', $b->getMessages())
+    );
+  }
+
 }

package_manager/src/Validator/ComposerExecutableValidator.php

@@ -23,7 +23,7 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  *   at any time without warning. External code should not interact with this
  *   class.
  */
-final class ComposerExecutableValidator implements EventSubscriberInterface, ProcessOutputCallbackInterface {
+class ComposerExecutableValidator implements EventSubscriberInterface {
 
   use StringTranslationTrait;
 
@@ -48,13 +48,6 @@ final class ComposerExecutableValidator implements EventSubscriberInterface, Pro
    */
   protected $moduleHandler;
 
-  /**
-   * The detected version of Composer.
-   *
-   * @var string
-   */
-  protected $version;
-
   /**
    * Constructs a ComposerExecutableValidator object.
    *
@@ -76,18 +69,24 @@ final class ComposerExecutableValidator implements EventSubscriberInterface, Pro
    */
   public function validateStagePreOperation(PreOperationStageEvent $event): void {
     try {
-      $this->composer->run(['--version'], $this);
+      $output = $this->runCommand();
     }
     catch (ExceptionInterface $e) {
       $this->setError($e->getMessage(), $event);
       return;
     }
 
-    if ($this->version) {
-      if (!Semver::satisfies($this->version, static::MINIMUM_COMPOSER_VERSION_CONSTRAINT)) {
+    $matched = [];
+    // Search for a semantic version number and optional stability flag.
+    if (preg_match('/([0-9]+\.?){3}-?((alpha|beta|rc)[0-9]*)?/i', $output, $matched)) {
+      $version = $matched[0];
+    }
+
+    if (isset($version)) {
+      if (!Semver::satisfies($version, static::MINIMUM_COMPOSER_VERSION_CONSTRAINT)) {
         $message = $this->t('A Composer version which satisfies <code>@minimum_version</code> is required, but version @detected_version was detected.', [
           '@minimum_version' => static::MINIMUM_COMPOSER_VERSION_CONSTRAINT,
-          '@detected_version' => $this->version,
+          '@detected_version' => $version,
         ]);
         $this->setError($message, $event);
       }
@@ -133,14 +132,35 @@ final class ComposerExecutableValidator implements EventSubscriberInterface, Pro
   }
 
   /**
-   * {@inheritdoc}
+   * Runs `composer --version` and returns its output.
+   *
+   * @return string
+   *   The output of `composer --version`.
    */
-  public function __invoke(string $type, string $buffer): void {
-    $matched = [];
-    // Search for a semantic version number and optional stability flag.
-    if (preg_match('/([0-9]+\.?){3}-?((alpha|beta|rc)[0-9]*)?/i', $buffer, $matched)) {
-      $this->version = $matched[0];
-    }
+  protected function runCommand(): string {
+    // For whatever reason, PHPCS thinks that $output is not used, even though
+    // it very clearly *is*. So, shut PHPCS up for the duration of this method.
+    // phpcs:disable
+    $callback = new class () implements ProcessOutputCallbackInterface {
+
+      /**
+       * The command output.
+       *
+       * @var string
+       */
+      public string $output = '';
+
+      /**
+       * {@inheritdoc}
+       */
+      public function __invoke(string $type, string $buffer): void {
+        $this->output .= $buffer;
+      }
+
+    };
+    $this->composer->run(['--version'], $callback);
+    return $callback->output;
+    // phpcs:enable
   }
 
 }

package_manager/tests/fixtures/fake_site/vendor/composer/installed.json

@@ -20,5 +20,6 @@
       "name": "drupal/core-dev",
       "version": "9.8.0"
     }
-  ]
+  ],
+  "dev-package-names": []
 }

package_manager/tests/modules/package_manager_test_api/src/ApiController.php

@@ -16,12 +16,19 @@ use Symfony\Component\HttpFoundation\Request;
  */
 class ApiController extends ControllerBase {
 
+  /**
+   * The route to redirect to after the stage has been applied.
+   *
+   * @var string
+   */
+  protected $finishedRoute = 'package_manager_test_api.finish';
+
   /**
    * The stage.
    *
    * @var \Drupal\package_manager\Stage
    */
-  private $stage;
+  protected $stage;
 
   /**
    * The path locator service.
@@ -83,14 +90,8 @@ class ApiController extends ControllerBase {
    * @see ::finish()
    */
   public function run(Request $request): RedirectResponse {
-    $id = $this->stage->create();
-    $this->stage->require(
-      $request->get('runtime', []),
-      $request->get('dev', [])
-    );
-    $this->stage->apply();
-
-    $redirect_url = Url::fromRoute('package_manager_test_api.finish')
+    $id = $this->createAndApplyStage($request);
+    $redirect_url = Url::fromRoute($this->finishedRoute)
       ->setRouteParameter('id', $id)
       ->setOption('query', [
         'files_to_return' => $request->get('files_to_return', []),
@@ -128,4 +129,29 @@ class ApiController extends ControllerBase {
     return new JsonResponse($file_contents);
   }
 
+  /**
+   * Creates a stage, requires packages into it, and applies the changes.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request. The runtime and dev dependencies are expected to be in
+   *   either the query string or request body, under the 'runtime' and 'dev'
+   *   keys, respectively. There may also be a 'files_to_return' key, which
+   *   contains an array of file paths, relative to the project root, whose
+   *   contents should be returned in the response.
+   *
+   * @return string
+   *   Unique ID for the stage, which can be used to claim the stage before
+   *   performing other operations on it. Calling code should store this ID for
+   *   as long as the stage needs to exist.
+   */
+  protected function createAndApplyStage(Request $request) : string {
+    $id = $this->stage->create();
+    $this->stage->require(
+      $request->get('runtime', []),
+      $request->get('dev', [])
+    );
+    $this->stage->apply();
+    return $id;
+  }
+
 }

package_manager/tests/src/Build/TemplateProjectTestBase.php

@@ -164,7 +164,7 @@ END;
    * @param array $xml_map
    *   The update XML map, as used by update_test.settings.
    *
-   * @see \Drupal\automatic_updates_test\TestController::metadata()
+   * @see \Drupal\package_manager_test_release_history\TestController::metadata()
    */
   protected function setReleaseMetadata(array $xml_map): void {
     foreach ($xml_map as $metadata_file) {

package_manager/tests/src/Kernel/ComposerExecutableValidatorTest.php

@@ -8,8 +8,7 @@ use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Validator\ComposerExecutableValidator;
 use Drupal\package_manager\ValidationResult;
 use PhpTuf\ComposerStager\Domain\Exception\IOException;
-use PhpTuf\ComposerStager\Domain\Service\ProcessRunner\ComposerRunnerInterface;
-use Prophecy\Argument;
+use PHPUnit\Framework\Assert;
 
 /**
  * @covers \Drupal\package_manager\Validator\ComposerExecutableValidator
@@ -18,21 +17,6 @@ use Prophecy\Argument;
  */
 class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
 
-  /**
-   * The mocked Composer runner.
-   *
-   * @var \Prophecy\Prophecy\ObjectProphecy|\PhpTuf\ComposerStager\Domain\Service\ProcessRunner\ComposerRunnerInterface
-   */
-  private $composerRunner;
-
-  /**
-   * {@inheritdoc}
-   */
-  protected function setUp(): void {
-    $this->composerRunner = $this->prophesize(ComposerRunnerInterface::class);
-    parent::setUp();
-  }
-
   /**
    * {@inheritdoc}
    */
@@ -40,7 +24,7 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
     parent::register($container);
 
     $container->getDefinition('package_manager.validator.composer_executable')
-      ->setArgument('$composer', $this->composerRunner->reveal());
+      ->setClass(TestComposerExecutableValidator::class);
   }
 
   /**
@@ -48,12 +32,7 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
    */
   public function testErrorIfComposerNotFound(): void {
     $exception = new IOException("This is your regularly scheduled error.");
-
-    // If the Composer executable isn't found, the executable finder will throw
-    // an exception, which will not be caught by the Composer runner.
-    $this->composerRunner->run(Argument::cetera())
-      ->willThrow($exception)
-      ->shouldBeCalled();
+    TestComposerExecutableValidator::setCommandOutput($exception);
 
     // The validator should translate that exception into an error.
     $error = ValidationResult::createError([
@@ -163,21 +142,7 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
    * @dataProvider providerComposerVersionValidation
    */
   public function testComposerVersionValidation(string $reported_version, array $expected_results): void {
-    // Mock the output of `composer --version`, will be passed to the validator,
-    // which is itself a callback function that gets called repeatedly as
-    // Composer produces output.
-    $this->composerRunner->run(['--version'], Argument::type(ComposerExecutableValidator::class))
-      // Whatever is passed to ::run() will be passed to this mock callback in
-      // $arguments, and we know exactly what that will contain: an array of
-      // command arguments for Composer, and the validator object.
-      ->will(function (array $arguments) use ($reported_version) {
-        /** @var \Drupal\package_manager\Validator\ComposerExecutableValidator $validator */
-        $validator = $arguments[1];
-        // Invoke the validator (which, as mentioned, is a callback function),
-        // with fake output from `composer --version`. It should try to tease a
-        // recognized, supported version number out of this output.
-        $validator($validator::OUT, "Composer version $reported_version");
-      });
+    TestComposerExecutableValidator::setCommandOutput("Composer version $reported_version");
 
     // If the validator can't find a recognized, supported version of Composer,
     // it should produce errors.
@@ -220,3 +185,32 @@ class ComposerExecutableValidatorTest extends PackageManagerKernelTestBase {
   }
 
 }
+
+/**
+ * A test-only version of ComposerExecutableValidator that returns set output.
+ */
+class TestComposerExecutableValidator extends ComposerExecutableValidator {
+
+  /**
+   * Sets the output of `composer --version`.
+   *
+   * @param string|\Throwable $output
+   *   The output of the command, or an exception to throw.
+   */
+  public static function setCommandOutput($output): void {
+    \Drupal::state()->set(static::class, $output);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function runCommand(): string {
+    $output = \Drupal::state()->get(static::class);
+    Assert::assertNotNull($output, __CLASS__ . '::setCommandOutput() should have been called first 💩');
+    if ($output instanceof \Throwable) {
+      throw $output;
+    }
+    return $output;
+  }
+
+}

package_manager/tests/src/Kernel/FixtureUtilityTraitTest.php

+<?php
+
+namespace Drupal\Tests\package_manager\Kernel;
+
+use Drupal\Tests\package_manager\Traits\FixtureUtilityTrait;
+use PHPUnit\Framework\AssertionFailedError;
+
+/**
+ * @coversDefaultClass \Drupal\Tests\package_manager\Traits\FixtureUtilityTrait
+ *
+ * @group package_manager
+ */
+class FixtureUtilityTraitTest extends PackageManagerKernelTestBase {
+
+  use FixtureUtilityTrait;
+
+  /**
+   * The root directory of the virtual project.
+   *
+   * @var string
+   */
+  private string $dir;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+
+    $this->dir = $this->container->get('package_manager.path_locator')
+      ->getProjectRoot();
+
+    $this->addPackage($this->dir, [
+      'name' => 'my/package',
+    ]);
+    $this->addPackage($this->dir, [
+      'name' => 'my/dev-package',
+      'version' => '2.1.0',
+      'dev_requirement' => TRUE,
+      'install_path' => '../relative/path',
+    ]);
+  }
+
+  /**
+   * @covers ::addPackage
+   */
+  public function testAddPackage(): void {
+    // Packages cannot be added without a name.
+    try {
+      $this->addPackage($this->dir, ['type' => 'unknown']);
+      $this->fail('Adding an anonymous package should raise an error.');
+    }
+    catch (AssertionFailedError $e) {
+      $this->assertSame("Failed asserting that an array has the key 'name'.", $e->getMessage());
+    }
+
+    // We should not be able to add an existing package.
+    try {
+      $this->addPackage($this->dir, ['name' => 'my/package']);
+      $this->fail('Trying to add an existing package should raise an error.');
+    }
+    catch (AssertionFailedError $e) {
+      $this->assertStringContainsString("Expected package 'my/package' to not be installed, but it was.", $e->getMessage());
+    }
+
+    // We should not be able to add a package with an absolute installation
+    // path.
+    try {
+      $this->addPackage($this->dir, [
+        'name' => 'absolute/path',
+        'install_path' => '/absolute/path',
+      ]);
+    }
+    catch (AssertionFailedError $e) {
+      $this->assertSame('Failed asserting that \'/absolute/path\' starts with "../".', $e->getMessage());
+    }
+
+    $expected_packages = [
+      'my/package' => [
+        'name' => 'my/package',
+      ],
+      'my/dev-package' => [
+        'name' => 'my/dev-package',
+        'version' => '2.1.0',
+        'dev_requirement' => TRUE,
+        'install_path' => '../relative/path',
+      ],
+    ];
+    [$installed_json, $installed_php] = $this->getData();
+    $installed_json['packages'] = array_intersect_key($installed_json['packages'], $expected_packages);
+    $this->assertSame($expected_packages, $installed_json['packages']);
+    $this->assertContains('my/dev-package', $installed_json['dev-package-names']);
+    $this->assertNotContains('my/package', $installed_json['dev-package-names']);
+    // In installed.php, the relative installation path of my/dev-package should
+    // have been prefixed with the __DIR__ constant, which should be interpreted
+    // when installed.php is loaded by the PHP runtime.
+    $expected_packages['my/dev-package']['install_path'] = "$this->dir/vendor/composer/../relative/path";
+    $this->assertSame($expected_packages, $installed_php);
+  }
+
+  /**
+   * @covers ::modifyPackage
+   */
+  public function testModifyPackage(): void {
+    // We should not be able to modify a non-existent package.
+    try {
+      $this->modifyPackage($this->dir, 'junk/drawer', ['type' => 'library']);
+      $this->fail('Modifying a non-existent package should raise an error.');
+    }
+    catch (AssertionFailedError $e) {
+      $this->assertStringContainsString("Expected package 'junk/drawer' to be installed, but it wasn't.", $e->getMessage());
+    }
+
+    // Add a key to an existing package.
+    $this->modifyPackage($this->dir, 'my/package', ['type' => 'metapackage']);
+    // Change a key in an existing package.
+    $this->modifyPackage($this->dir, 'my/dev-package', ['version' => '3.2.1']);
+    // Move an existing package to dev requirements.
+    $this->addPackage($this->dir, [
+      'name' => 'my/other-package',
+      'type' => 'library',
+    ]);
+    $this->modifyPackage($this->dir, 'my/other-package', ['dev_requirement' => TRUE]);
+
+    $expected_packages = [
+      'my/package' => [
+        'name' => 'my/package',
+        'type' => 'metapackage',
+      ],
+      'my/dev-package' => [
+        'name' => 'my/dev-package',
+        'version' => '3.2.1',
+        'dev_requirement' => TRUE,
+        'install_path' => '../relative/path',
+      ],
+      'my/other-package' => [
+        'name' => 'my/other-package',
+        'type' => 'library',
+        'dev_requirement' => TRUE,
+      ],
+    ];
+
+    [$installed_json, $installed_php] = $this->getData();
+    $installed_json['packages'] = array_intersect_key($installed_json['packages'], $expected_packages);
+    $this->assertSame($expected_packages, $installed_json['packages']);
+    $this->assertContains('my/dev-package', $installed_json['dev-package-names']);
+    $this->assertContains('my/other-package', $installed_json['dev-package-names']);
+    $this->assertNotContains('my/package', $installed_json['dev-package-names']);
+    // @see ::testAddPackage()
+    $expected_packages['my/dev-package']['install_path'] = "$this->dir/vendor/composer/../relative/path";
+    $this->assertSame($expected_packages, $installed_php);
+  }
+
+  /**
+   * @covers ::removePackage
+   */
+  public function testRemovePackage(): void {
+    // We should not be able to remove a package that's not installed.
+    try {
+      $this->removePackage($this->dir, 'junk/drawer');
+      $this->fail('Removing a non-existent package should raise an error.');
+    }
+    catch (AssertionFailedError $e) {
+      $this->assertStringContainsString("Expected package 'junk/drawer' to be installed, but it wasn't.", $e->getMessage());
+    }
+
+    $this->removePackage($this->dir, 'my/package');
+    $this->removePackage($this->dir, 'my/dev-package');
+
+    foreach (['json', 'php'] as $extension) {
+      $contents = file_get_contents("$this->dir/vendor/composer/installed.$extension");
+      $this->assertStringNotContainsString('my/package', $contents);
+      $this->assertStringNotContainsString('my/dev-package', $contents);
+    }
+  }
+
+  /**
+   * Returns the data from installed.php and installed.json.
+   *
+   * @return array[]
+   *   An array of two arrays. The first array will be the contents of
+   *   installed.json, with the `packages` array keyed by package name. The
+   *   second array will be the `versions` array from installed.php.
+   */
+  private function getData(): array {
+    $installed_json = file_get_contents("$this->dir/vendor/composer/installed.json");
+    $installed_json = json_decode($installed_json, TRUE, 512, JSON_THROW_ON_ERROR);
+
+    $keyed_packages = [];
+    foreach ($installed_json['packages'] as $package) {
+      $keyed_packages[$package['name']] = $package;
+    }
+    $installed_json['packages'] = $keyed_packages;
+
+    $installed_php = require "$this->dir/vendor/composer/installed.php";
+    return [
+      $installed_json,
+      $installed_php['versions'],
+    ];
+  }
+
+}

package_manager/tests/src/Kernel/StageOwnershipTest.php

@@ -127,6 +127,20 @@ class StageOwnershipTest extends PackageManagerKernelTestBase {
     }
   }
 
+  /**
+   * Tests that the stage is owned by the person who calls create() on it.
+   */
+  public function testStageOwnedByCreator(): void {
+    // Even if the stage is instantiated before anyone is logged in, it should
+    // still be owned (and claimable) by the user who called create() on it.
+    $stage = $this->createStage();
+
+    $account = $this->createUser([], NULL, FALSE, ['uid' => 2]);
+    $this->setCurrentUser($account);
+    $id = $stage->create();
+    $this->createStage()->claim($id);
+  }
+
   /**
    * Tests behavior of claiming a stage.
    */
@@ -253,8 +267,8 @@ class StageOwnershipTest extends PackageManagerKernelTestBase {
         // Normally, the stage will call this method as it tries to make
         // everything in the staging area writable so it can be deleted. We
         // don't wan't to do that in this test, since we're specifically testing
-        // what happens when we try to delete a staging area with unwritable
-        // files.
+        // what happens when we try to delete a staging area with
+        // write-protected files.
       }
 
     });
@@ -264,8 +278,8 @@ class StageOwnershipTest extends PackageManagerKernelTestBase {
     $stage->create();
     $this->assertFalse($stage->isAvailable());
 
-    // Make the stage directory unwritable, which should prevent files in it
-    // from being deleted.
+    // Write-protect the stage directory, which should prevent files in it from
+    // being deleted.
     $dir = $stage->getStageDirectory();
     chmod($dir, 0400);
     $this->assertDirectoryIsNotWritable($dir);

package_manager/tests/src/Kernel/StageTest.php

@@ -5,6 +5,7 @@ namespace Drupal\Tests\package_manager\Kernel;
 use Drupal\Component\Datetime\Time;
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Extension\ModuleUninstallValidatorException;
+use Drupal\Core\Logger\RfcLogLevel;
 use Drupal\package_manager\Event\PostApplyEvent;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\StageEvent;
@@ -393,9 +394,16 @@ class StageTest extends PackageManagerKernelTestBase {
    * @group legacy
    */
   public function testConstructorDeprecations(): void {
+    $logger = new TestLogger();
+    $this->container->get('logger.factory')
+      ->get('package_manager')
+      ->addLogger($logger);
+
     $this->expectDeprecation('Calling Drupal\package_manager\Stage::__construct() without the $path_factory argument is deprecated in automatic_updates:8.x-2.3 and will be required before automatic_updates:3.0.0. See https://www.drupal.org/node/3310706.');
     $this->expectDeprecation('Calling Drupal\package_manager\Stage::__construct() without the $failure_marker argument is deprecated in automatic_updates:8.x-2.3 and will be required before automatic_updates:3.0.0. See https://www.drupal.org/node/3311257.');
-    new Stage(
+    $this->expectDeprecation('Overriding Drupal\package_manager\Stage::TEMPSTORE_METADATA_KEY is deprecated in automatic_updates:8.x-2.5 and will not be possible in automatic_updates:3.0.0. There is no replacement. See https://www.drupal.org/node/3317450.');
+    $this->expectDeprecation('Overriding Drupal\package_manager\Stage::TEMPSTORE_LOCK_KEY is deprecated in automatic_updates:8.x-2.5 and will not be possible in automatic_updates:3.0.0. There is no replacement. See https://www.drupal.org/node/3317450.');
+    new TestStageOverriddenConstants(
       $this->container->get('config.factory'),
       $this->container->get('package_manager.path_locator'),
       $this->container->get('package_manager.beginner'),
@@ -406,6 +414,8 @@ class StageTest extends PackageManagerKernelTestBase {
       $this->container->get('tempstore.shared'),
       $this->container->get('datetime.time')
     );
+    $this->assertTrue($logger->hasRecord('Drupal\package_manager\Stage::TEMPSTORE_METADATA_KEY is overridden by ' . TestStageOverriddenConstants::class . '. This is deprecated because it can cause errors or other unexpected behavior. It is strongly recommended to stop overriding this constant. See https://www.drupal.org/node/3317450 for more information.', RfcLogLevel::ERROR));
+    $this->assertTrue($logger->hasRecord('Drupal\package_manager\Stage::TEMPSTORE_LOCK_KEY is overridden by ' . TestStageOverriddenConstants::class . '. This is deprecated because it can cause errors or other unexpected behavior. It is strongly recommended to stop overriding this constant. See https://www.drupal.org/node/3317450 for more information.', RfcLogLevel::ERROR));
   }
 
   /**
@@ -496,3 +506,17 @@ class TestTime extends Time {
   }
 
 }
+
+class TestStageOverriddenConstants extends Stage {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected const TEMPSTORE_LOCK_KEY = 'overridden_lock';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected const TEMPSTORE_METADATA_KEY = 'overridden_metadata';
+
+}