package_manager/src/Validator/PhpTufValidator.php

@@ -59,11 +59,15 @@ final class PhpTufValidator implements EventSubscriberInterface {
    *   The Composer inspector service.
    * @param \Drupal\Core\Extension\ModuleHandlerInterface $moduleHandler
    *   The module handler service.
+   * @param string $baseUrl
+   *   The base URL of the repository, or repositories, defined in
+   *   `composer.json`that must be protected by TUF.
    */
   public function __construct(
     private readonly PathLocator $pathLocator,
     private readonly ComposerInspector $composerInspector,
-    private readonly ModuleHandlerInterface $moduleHandler
+    private readonly ModuleHandlerInterface $moduleHandler,
+    private readonly string $baseUrl,
   ) {}
 
   /**
@@ -147,13 +151,12 @@ final class PhpTufValidator implements EventSubscriberInterface {
       $messages[] = $message;
     }
 
-    // Get the defined repositories that use packages.drupal.org.
+    // Get the defined repositories that live at the base URL, and confirm that
+    // they have all opted into TUF protection.
     $repositories = array_filter(
       Json::decode($this->composerInspector->getConfig('repositories', $dir)),
-      fn (array $r): bool => str_starts_with($r['url'], 'https://packages.drupal.org')
+      fn (array $r): bool => str_starts_with($r['url'], $this->baseUrl)
     );
-
-    // All packages.drupal.org repositories must have TUF protection.
     foreach ($repositories as $repository) {
       if (empty($repository['tuf'])) {
         $messages[] = $this->t('TUF is not enabled for the @url repository.', [
@@ -162,10 +165,11 @@ final class PhpTufValidator implements EventSubscriberInterface {
       }
     }
 
-    // There must be at least one repository using packages.drupal.org, since
-    // that's the only repository which supports TUF right now.
+    // There must be at least one repository using the base URL.
     if (empty($repositories)) {
-      $message = $this->t('The <code>https://packages.drupal.org</code> Composer repository must be defined in <code>composer.json</code>.');
+      $message = $this->t('The <code>@url</code> Composer repository must be defined in <code>composer.json</code>.', [
+        '@url' => $this->baseUrl,
+      ]);
       if (isset($help_url)) {
         $message = $this->t('@message See <a href=":url">the help page</a> for more information on how to set up this repository.', [
           '@message' => $message,

package_manager/src/Validator/RsyncValidator.php

@@ -72,7 +72,7 @@ final class RsyncValidator implements EventSubscriberInterface {
     if ($configured_syncer === 'php') {
       // Only status checks support warnings.
       if ($event instanceof StatusCheckEvent) {
-        $message = $this->t('You are currently using the PHP file syncer, which has known problems and is not stable. It is strongly recommended to switch back to the default <em>rsync</em> file syncer instead.');
+        $message = $this->t('You are currently using the PHP file syncer, which has known problems and is not stable. <strong>The PHP file syncer will be removed in Package Manager 3.1.0.</strong> Switch back to the default <em>rsync</em> file syncer to continue using Package Manager.');
 
         if (!$rsync_found) {
           $message = $this->t('@message <code>rsync</code> was not found on your system.', ['@message' => $message]);

package_manager/src/Validator/StageNotInActiveValidator.php

@@ -21,7 +21,7 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 final class StageNotInActiveValidator implements EventSubscriberInterface {
 
   use BaseRequirementValidatorTrait {
-    getSubscribedEvents as protected getSubscribedEventsFromTrait;
+    getSubscribedEvents as private getSubscribedEventsFromTrait;
   }
   use StringTranslationTrait;
 

package_manager/src/Validator/SupportedReleaseValidator.php

@@ -53,7 +53,7 @@ final class SupportedReleaseValidator implements EventSubscriberInterface {
    *   TRUE if the given version of the project is supported, otherwise FALSE.
    *   given version is not supported will return FALSE.
    */
-  protected function isSupportedRelease(string $name, string $semantic_version): bool {
+  private function isSupportedRelease(string $name, string $semantic_version): bool {
     $supported_releases = (new ProjectInfo($name))->getInstallableReleases();
     if (!$supported_releases) {
       return FALSE;
@@ -121,12 +121,16 @@ final class SupportedReleaseValidator implements EventSubscriberInterface {
       $event->addError($unsupported_packages, $summary);
     }
     if ($unknown_packages) {
-      $summary = $this->formatPlural(
-        count($unknown_packages),
-        'Cannot update because the following new or updated Drupal package does not have project information.',
-        'Cannot update because the following new or updated Drupal packages do not have project information.',
-      );
-      $event->addError($unknown_packages, $summary);
+      $event->addError([
+        $this->formatPlural(
+          count($unknown_packages),
+          'Cannot update because the following new or updated Drupal package does not have project information: @unknown_packages',
+          'Cannot update because the following new or updated Drupal packages do not have project information: @unknown_packages',
+          [
+            '@unknown_packages' => implode(', ', $unknown_packages),
+          ],
+        ),
+      ]);
     }
   }
 

package_manager/src/Validator/SymlinkValidator.php

@@ -9,7 +9,7 @@ use Drupal\package_manager\Event\PreRequireEvent;
 use Drupal\package_manager\PathLocator;
 use PhpTuf\ComposerStager\API\Exception\PreconditionException;
 use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
-use PhpTuf\ComposerStager\API\Path\Value\PathList;
+use PhpTuf\ComposerStager\API\Path\Factory\PathListFactoryInterface;
 use PhpTuf\ComposerStager\API\Precondition\Service\NoUnsupportedLinksExistInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -36,11 +36,14 @@ final class SymlinkValidator implements EventSubscriberInterface {
    *   The Composer Stager precondition that this validator wraps.
    * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
    *   The path factory service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathListFactoryInterface $pathListFactory
+   *   The path list factory service.
    */
   public function __construct(
     private readonly PathLocator $pathLocator,
     private readonly NoUnsupportedLinksExistInterface $precondition,
     private readonly PathFactoryInterface $pathFactory,
+    private readonly PathListFactoryInterface $pathListFactory,
   ) {}
 
   /**
@@ -65,17 +68,20 @@ final class SymlinkValidator implements EventSubscriberInterface {
     }
     $stage_dir = $this->pathFactory->create($stage_dir);
 
-    $excluded_paths = $event->getExcludedPaths();
     // Return early if no excluded paths were collected because this validator
     // is dependent on knowing which paths to exclude when searching for
     // symlinks.
     // @see \Drupal\package_manager\StatusCheckTrait::runStatusCheck()
-    if ($excluded_paths === NULL) {
+    if ($event->excludedPaths === NULL) {
       return;
     }
 
+    // The list of excluded paths is immutable, but the precondition may need to
+    // mutate it, so convert it back to a normal, mutable path list.
+    $exclusions = $this->pathListFactory->create(...$event->excludedPaths->getAll());
+
     try {
-      $this->precondition->assertIsFulfilled($active_dir, $stage_dir, new PathList(...$excluded_paths));
+      $this->precondition->assertIsFulfilled($active_dir, $stage_dir, $exclusions);
     }
     catch (PreconditionException $e) {
       $event->addErrorFromThrowable($e);

package_manager/tests/fixtures/build_test_projects/main_module/composer.json

+{
+  "name": "drupal/main_module",
+  "type": "drupal-module",
+  "version": "1.0.0"
+}

package_manager/tests/fixtures/build_test_projects/main_module/main_module.info.yml.hide

+name: Main module
+type: module
+core_version_requirement: ^9 || ^10
+project: main_module
+

package_manager/tests/fixtures/build_test_projects/main_module/main_module_submodule/main_module_submodule.info.yml.hide

+name: Main Module Submodule
+type: module
+core_version_requirement: ^9 || ^10
+project: main_module

package_manager/tests/fixtures/build_test_projects/updated_module/1.1.0/updated_module.services.yml

@@ -2,6 +2,6 @@ services:
   updated_module.post_apply_subscriber:
     class: Drupal\updated_module\PostApplySubscriber
     arguments:
-      - '@package_manager.path_locator'
+      - '@Drupal\package_manager\PathLocator'
     tags:
       - { name: event_subscriber }

package_manager/tests/fixtures/fake_site/composer.json

@@ -20,42 +20,19 @@
         "bar": 134,
         "foo-bar": null
     },
-    "baz": null
+    "baz": null,
+    "installer-paths": {
+      "modules/contrib/{$name}": ["type:drupal-module"],
+      "profiles/contrib/{$name}": ["type:drupal-profile"],
+      "themes/contrib/{$name}": ["type:drupal-theme"]
+    }
   },
   "repositories": {
-    "packagist.org": false,
-    "drupal/core-recommended": {
-      "type": "path",
-      "version": "9.8.0",
-      "url": "../path_repos/drupal--core-recommended",
-      "options": {
-        "symlink": false
-      }
-    },
-    "drupal/core-dev": {
-      "type": "path",
-      "version": "9.8.0",
-      "url": "../path_repos/drupal--core-dev",
-      "options": {
-        "symlink": false
-      }
+    "fake-packages": {
+      "type": "composer",
+      "url": "./"
     },
-    "drupal/core": {
-      "type": "path",
-      "version": "9.8.0",
-      "url": "../path_repos/drupal--core",
-      "options": {
-        "symlink": false
-      }
-    },
-    "cweagans/composer-patches": {
-      "type": "path",
-      "version": "1.7.333",
-      "url": "../path_repos/cweagans--composer-patches",
-      "options": {
-        "symlink": false
-      }
-    }
+    "packagist.org": false
   },
   "minimum-stability": "stable",
   "config": {

package_manager/tests/fixtures/fake_site/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "672a2db4be3ba5e4f025ddea6b7dacd7",
+    "content-hash": "17cd7e695939dc97e22d10fa4efbe10b",
     "packages": [
         {
             "name": "drupal/core",
@@ -50,11 +50,7 @@
                     }
                 }
             },
-            "description": "A fake version of drupal/core",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            }
+            "description": "A fake version of drupal/core"
         },
         {
             "name": "drupal/core-recommended",
@@ -65,11 +61,7 @@
                 "reference": "112e4f7cfe8312457cd0eb58dcbffebc148850d8"
             },
             "type": "project",
-            "description": "A fake version of drupal/core-recommended",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            }
+            "description": "A fake version of drupal/core-recommended"
         }
     ],
     "packages-dev": [
@@ -82,11 +74,7 @@
                 "reference": "b99a99a11ff2779b5e4c5787dc43575382a3548c"
             },
             "type": "package",
-            "description": "A fake version of drupal/core-dev",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            }
+            "description": "A fake version of drupal/core-dev"
         }
     ],
     "aliases": [],
@@ -96,5 +84,5 @@
     "prefer-lowest": false,
     "platform": [],
     "platform-dev": [],
-    "plugin-api-version": "2.3.0"
+    "plugin-api-version": "2.6.0"
 }

package_manager/tests/fixtures/fake_site/packages.json

+{
+    "packages": {
+        "drupal/core-recommended": {
+            "9.8.0": {
+                "name": "drupal/core-recommended",
+                "description": "A fake version of drupal/core-recommended",
+                "type": "project",
+                "version": "9.8.0",
+                "dist": {
+                    "type": "path",
+                    "url": "../path_repos/drupal--core-recommended",
+                    "reference": "112e4f7cfe8312457cd0eb58dcbffebc148850d8"
+                }
+            }
+        },
+        "drupal/core-dev": {
+            "9.8.0": {
+                "name": "drupal/core-dev",
+                "description": "A fake version of drupal/core-dev",
+                "type": "package",
+                "version": "9.8.0",
+                "dist": {
+                    "type": "path",
+                    "url": "../path_repos/drupal--core-dev",
+                    "reference": "b99a99a11ff2779b5e4c5787dc43575382a3548c"
+                }
+            }
+        },
+        "drupal/core": {
+            "9.8.0": {
+                "name": "drupal/core",
+                "type": "drupal-core",
+                "description": "A fake version of drupal/core",
+                "version": "9.8.0",
+                "extra": {
+                    "_readme": [
+                        "The 'drupal-scaffold' section below is needed because 'Drupal\\automatic_updates\\Validator\\ScaffoldFilePermissionsValidator'",
+                        "uses this section to determine which files to check. The actual composer.json file for drupal/core will have more files listed",
+                        "but this limited list is used in '\\Drupal\\Tests\\automatic_updates\\Kernel\\StatusCheck\\ScaffoldFilePermissionsValidatorTest'",
+                        "to ensure this section determines the file list."
+                    ],
+                    "drupal-scaffold": {
+                        "file-mapping": {
+                            "[project-root]/.editorconfig": "assets/scaffold/files/editorconfig",
+                            "[project-root]/.gitattributes": "assets/scaffold/files/gitattributes",
+                            "[web-root]/.csslintrc": "assets/scaffold/files/csslintrc",
+                            "[web-root]/.eslintignore": "assets/scaffold/files/eslintignore",
+                            "[web-root]/.eslintrc.json": "assets/scaffold/files/eslintrc.json",
+                            "[web-root]/.ht.router.php": "assets/scaffold/files/ht.router.php",
+                            "[web-root]/.htaccess": "assets/scaffold/files/htaccess",
+                            "[web-root]/example.gitignore": "assets/scaffold/files/example.gitignore",
+                            "[web-root]/index.php": "assets/scaffold/files/index.php",
+                            "[web-root]/INSTALL.txt": "assets/scaffold/files/drupal.INSTALL.txt",
+                            "[web-root]/README.md": "assets/scaffold/files/drupal.README.md",
+                            "[web-root]/robots.txt": "assets/scaffold/files/robots.txt",
+                            "[web-root]/update.php": "assets/scaffold/files/update.php",
+                            "[web-root]/web.config": "assets/scaffold/files/web.config",
+                            "[web-root]/sites/README.txt": "assets/scaffold/files/sites.README.txt",
+                            "[web-root]/sites/development.services.yml": "assets/scaffold/files/development.services.yml",
+                            "[web-root]/sites/example.settings.local.php": "assets/scaffold/files/example.settings.local.php",
+                            "[web-root]/sites/example.sites.php": "assets/scaffold/files/example.sites.php",
+                            "[web-root]/sites/default/default.services.yml": "assets/scaffold/files/default.services.yml",
+                            "[web-root]/sites/default/default.settings.php": "assets/scaffold/files/default.settings.php",
+                            "[web-root]/modules/README.txt": "assets/scaffold/files/modules.README.txt",
+                            "[web-root]/profiles/README.txt": "assets/scaffold/files/profiles.README.txt",
+                            "[web-root]/themes/README.txt": "assets/scaffold/files/themes.README.txt"
+                        }
+                    }
+                },
+                "dist": {
+                    "type": "path",
+                    "url": "../path_repos/drupal--core",
+                    "reference": "31fd2270701526555acae45a3601c777e35508d5"
+                }
+            }
+        },
+        "cweagans/composer-patches": {
+            "1.7.333": {
+                "name": "cweagans/composer-patches",
+                "description": "A fake version of cweagans/composer-patches",
+                "type": "composer-plugin",
+                "version": "1.7.333",
+                "extra": {
+                    "class": "\\cweagans\\Fake\\ComposerPatches"
+                },
+                "dist": {
+                    "type": "path",
+                    "url": "../path_repos/cweagans--composer-patches"
+                },
+                "require": {
+                    "composer-plugin-api": "^1.0 || ^2.0"
+                },
+                "autoload": {
+                    "psr-4": {
+                        "cweagans\\Fake\\": "src"
+                    }
+                }
+            }
+        }
+    }
+}

package_manager/tests/fixtures/fake_site/vendor/composer/installed.json

@@ -47,10 +47,6 @@
             },
             "installation-source": "dist",
             "description": "A fake version of drupal/core",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            },
             "install-path": "../drupal/core"
         },
         {
@@ -65,10 +61,6 @@
             "type": "package",
             "installation-source": "dist",
             "description": "A fake version of drupal/core-dev",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            },
             "install-path": "../drupal/core-dev"
         },
         {
@@ -83,10 +75,6 @@
             "type": "project",
             "installation-source": "dist",
             "description": "A fake version of drupal/core-recommended",
-            "transport-options": {
-                "symlink": false,
-                "relative": true
-            },
             "install-path": "../drupal/core-recommended"
         }
     ],

package_manager/tests/fixtures/path_repos/main_module_submodule/composer.json

+{
+  "name": "drupal/main_module_submodule",
+  "type": "metapackage",
+  "version": "1.0.0",
+  "require": {
+    "drupal/main_module": "*"
+  }
+}

package_manager/tests/fixtures/release-history/drupal.9.8.0-rc1.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\automatic_updates\Functional\UpdaterFormTest.
+
+Contains metadata about the following (fake) releases of Drupal core, in order:
+- 9.8.0-rc1
+- 9.7.0
+- 9.8.x-dev
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <supported_branches>9.8.,9.7.</supported_branches>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms>
+        <term>
+            <name>Projects</name>
+            <value>Drupal project</value>
+        </term>
+    </terms>
+    <releases>
+        <release>
+          <name>Drupal 9.8.0-rc1</name>
+          <version>9.8.0-rc1</version>
+          <status>published</status>
+          <release_link>http://example.com/drupal-9-8-0-rc1-release</release_link>
+          <download_link>http://example.com/drupal-9-8-0-rc1-.tar.gz</download_link>
+          <date>1250424521</date>
+          <terms>
+            <term>
+              <name>Release type</name>
+              <value>New features</value>
+            </term>
+            <term>
+              <name>Release type</name>
+              <value>Bug fixes</value>
+            </term>
+          </terms>
+        </release>
+        <release>
+            <name>Drupal 9.7.0</name>
+            <version>9.7.0</version>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-7-0-release</release_link>
+            <download_link>http://example.com/drupal-9-7-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 9.8.x-dev</name>
+            <version>9.8.x-dev</version>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-8-x-dex-release</release_link>
+            <download_link>http://example.com/drupal-9-8-x-dex.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

package_manager/tests/fixtures/release-history/main_module.1.0.0.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\package_manager\Build\PackageInstallTest.
+
+Contains metadata about the following (fake) releases of main_module, all of which are secure, in order:
+- 1.0.0
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Main Module</title>
+<short_name>main_module</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>1.0.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/main_module</link>
+  <terms>
+   <term><name>Projects</name><value>Main Module project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>Main Module 1.0.0</name>
+    <version>1.0.0</version>
+    <tag>1.0.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/main_module-1-0-0-release</release_link>
+    <download_link>http://example.com/main_module-1-0-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

package_manager/tests/modules/fixture_manipulator/fixture_manipulator.services.yml

 services:
-  fixture_manipulator.stage_manipulator:
-    class: Drupal\fixture_manipulator\StageFixtureManipulator
-    arguments: ['@state', '@fixture_manipulator.stage_manipulator.inner']
-    decorates: 'package_manager.beginner'
+  _defaults:
+    autowire: true
+  Drupal\fixture_manipulator\StageFixtureManipulator:
+    decorates: 'PhpTuf\ComposerStager\API\Core\BeginnerInterface'
+  Drupal\fixture_manipulator\ProcessFactory:
+    decorates: 'PhpTuf\ComposerStager\API\Process\Factory\ProcessFactoryInterface'

package_manager/tests/modules/fixture_manipulator/src/ActiveFixtureManipulator.php

@@ -4,6 +4,8 @@ declare(strict_types = 1);
 
 namespace Drupal\fixture_manipulator;
 
+use Drupal\package_manager\PathLocator;
+
 /**
  * A fixture manipulator for the active directory.
  */
@@ -16,7 +18,7 @@ final class ActiveFixtureManipulator extends FixtureManipulator {
     if ($dir) {
       throw new \UnexpectedValueException("$dir cannot be specific for a ActiveFixtureManipulator instance");
     }
-    $dir = \Drupal::service('package_manager.path_locator')->getProjectRoot();
+    $dir = \Drupal::service(PathLocator::class)->getProjectRoot();
     parent::doCommitChanges($dir);
   }
 

package_manager/tests/modules/fixture_manipulator/src/FixtureManipulator.php

@@ -4,8 +4,9 @@ namespace Drupal\fixture_manipulator;
 
 use Drupal\Component\FileSystem\FileSystem;
 use Drupal\Component\Utility\NestedArray;
-use PhpTuf\ComposerStager\API\Process\Service\ProcessOutputCallbackInterface;
+use PhpTuf\ComposerStager\API\Process\Service\OutputCallbackInterface;
 use PhpTuf\ComposerStager\API\Process\Service\ComposerProcessRunnerInterface;
+use PhpTuf\ComposerStager\API\Process\Value\OutputTypeEnum;
 use Symfony\Component\Filesystem\Filesystem as SymfonyFileSystem;
 use Drupal\Component\Serialization\Yaml;
 
@@ -137,7 +138,7 @@ class FixtureManipulator {
             $fs->mkdir($file_dir);
           }
         }
-        file_put_contents("$repo_path/$file_name", $file_contents);
+        assert(file_put_contents("$repo_path/$file_name", $file_contents) !== FALSE);
       }
     }
     return $this->requirePackage($package['name'], $package['version'], $is_dev_requirement, $allow_plugins);
@@ -276,7 +277,7 @@ class FixtureManipulator {
     if ($file_name === NULL) {
       $file_name = "$project_name.info.yml";
     }
-    file_put_contents("$path/$file_name", Yaml::encode(['project' => $project_name]));
+    assert(file_put_contents("$path/$file_name", Yaml::encode(['project' => $project_name])) !== FALSE);
     return $this;
   }
 
@@ -376,18 +377,6 @@ class FixtureManipulator {
     }
   }
 
-  /**
-   * Ensures a path is writable.
-   *
-   * @param string $path
-   *   The path.
-   */
-  private static function ensureFilePathIsWritable(string $path): void {
-    if (!is_writable($path)) {
-      throw new \LogicException("'$path' is not writable.");
-    }
-  }
-
   /**
    * Creates an empty .git folder after being provided a path.
    */
@@ -437,28 +426,23 @@ class FixtureManipulator {
     return $this->manipulatorArguments;
   }
 
-  protected function runComposerCommand(array $command_options): ProcessOutputCallbackInterface {
-    $plain_output = new class() implements ProcessOutputCallbackInterface {
+  protected function runComposerCommand(array $command_options): OutputCallbackInterface {
+    $plain_output = new class() implements OutputCallbackInterface {
       public string $stdout = '';
       public string $stderr = '';
 
       /**
        * {@inheritdoc}
        */
-      public function __invoke(string $type, string $buffer): void {
-        // \Symfony\Component\Process\Process defines the output types in
-        // lowercase, but Composer Stager uses uppercase.
-        $type = strtoupper($type);
-
-        if ($type === self::OUT) {
+      public function __invoke(OutputTypeEnum $type, string $buffer): void {
+        if ($type === OutputTypeEnum::OUT) {
           $this->stdout .= $buffer;
           return;
         }
-        elseif ($type === self::ERR) {
+        elseif ($type === OutputTypeEnum::ERR) {
           $this->stderr .= $buffer;
           return;
         }
-        throw new \InvalidArgumentException("Unsupported output type: '$type'");
       }
 
     };
@@ -591,31 +575,18 @@ class FixtureManipulator {
       $this->createPathRepo($package, $repo_path, NULL);
     }
 
-    // Register the repository, keyed by package name and version. This ensures
-    // each package is registered only once and its version can be updated (but
-    // must have unique versions).
-    $repo_key = "repo.$name";
-    if ($is_new_or_fork === 'fork') {
-      $repositories = json_decode(file_get_contents($this->dir . '/composer.json'), TRUE, flags: JSON_THROW_ON_ERROR)['repositories'];
-      // @todo consistently use 'version' or 'options.versions.PACKAGE_NAME', by fixing ComposerFixtureCreator in https://drupal.org/i/3347055
-      $original_version = isset($repositories[$name]['version']) ? $repositories[$name]['version'] : $repositories[$name]['options']['versions'][$name];
-      if ($package['version'] !== $original_version) {
-        $repo_key .= "--" . $package['version'];
-      }
-    }
-    $repository = json_encode([
+    // Add the package to the Composer repository defined for the site.
+    $packages_json = $this->dir . '/packages.json';
+    $packages_data = file_get_contents($packages_json);
+    $packages_data = json_decode($packages_data, TRUE, flags: JSON_THROW_ON_ERROR);
+
+    $version = $package['version'];
+    $package['dist'] = [
       'type' => 'path',
       'url' => $repo_path,
-      'options' => [
-        'symlink' => FALSE,
-        'versions' => [
-          $name => $package['version'],
-        ],
-        // @see https://getcomposer.org/repoprio
-        'canonical' => FALSE,
-      ],
-    ], JSON_UNESCAPED_SLASHES);
-    $this->runComposerCommand(['config', $repo_key, $repository]);
+    ];
+    $packages_data['packages'][$name][$version] = $package;
+    assert(file_put_contents($packages_json, json_encode($packages_data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES)) !== FALSE);
 
     return $repo_path;
   }
@@ -635,8 +606,8 @@ class FixtureManipulator {
     }
     // Update all the repos in the composer.json file to point to the new
     // repos at the absolute path.
-    $composer_json = file_get_contents($this->dir . '/composer.json');
-    file_put_contents($this->dir . '/composer.json', str_replace('../path_repos/', "$path_repo_base/", $composer_json));
+    $composer_json = file_get_contents($this->dir . '/packages.json');
+    assert(file_put_contents($this->dir . '/packages.json', str_replace('../path_repos/', "$path_repo_base/", $composer_json)) !== FALSE);
     $this->runComposerCommand(['update', '--lock']);
     $this->runComposerCommand(['install']);
   }

package_manager/tests/modules/fixture_manipulator/src/ProcessFactory.php

+<?php
+
+namespace Drupal\fixture_manipulator;
+
+use PhpTuf\ComposerStager\API\Process\Factory\ProcessFactoryInterface;
+use PhpTuf\ComposerStager\API\Process\Service\ProcessInterface;
+
+/**
+ * Process factory that always sets the COMPOSER_MIRROR_PATH_REPOS env variable.
+ *
+ * This is necessary because the fake_site fixture is built from a Composer-type
+ * repository, which will normally try to symlink packages which are installed
+ * from local directories, which in turn will break Package Manager because it
+ * does not support symlinks pointing outside the main code base. The
+ * COMPOSER_MIRROR_PATH_REPOS environment variable forces Composer to mirror,
+ * rather than symlink, local directories when installing packages.
+ *
+ * @see \Drupal\fixture_manipulator\FixtureManipulator::setUpRepos()
+ */
+final class ProcessFactory implements ProcessFactoryInterface {
+
+  /**
+   * Constructs a ProcessFactory object.
+   *
+   * @param \PhpTuf\ComposerStager\API\Process\Factory\ProcessFactoryInterface $decorated
+   *   The decorated process factory service.
+   */
+  public function __construct(private readonly ProcessFactoryInterface $decorated) {}
+
+  /**
+   * {@inheritdoc}
+   */
+  public function create(array $command): ProcessInterface {
+    $process = $this->decorated->create($command);
+
+    $env = $process->getEnv();
+    $env['COMPOSER_MIRROR_PATH_REPOS'] = '1';
+    return $process->setEnv($env);
+  }
+
+}