>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3580996. --> Reported by: [star-szr](https://www.drupal.org/user/1167326) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>(As far as we can tell, this aspect is handled by the 7.x-3.x codebase, but feel free to move it if that's not the case.)</p> <p>It looks like Composer metapackages in the packaging pipeline are not being passed to Rugged as a target for signing.</p> <p>For example <a href="https://packages.drupal.org/files/packages/8/p2/drupal/eca_modeller_bpmn.json">https://packages.drupal.org/files/packages/8/p2/drupal/eca_modeller_bpmn.json</a> is Composer metadata for a sub-module of ECA. The hash for that file should mean it lands in the bin <a href="https://packages.drupal.org/8/metadata/bin_984-987.json">https://packages.drupal.org/8/metadata/bin_984-987.json</a>, but it is missing.</p> <p>As a result, when the Composer plugin tells Composer the max download size, it defaults to 1024 (the default for 404s). This would be fine, if the file didn't exist, as it'd result in a 404 response (which php-tuf/composer-integration assume fits in 1024 bytes). But since that metapackage metadata <em>does</em> exist, and is <em>bigger</em> than 1024 bytes, Composer throws an exception since we've passed in a maximum size of 1024 bytes.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>Follow the Setup steps from <a href="https://www.drupal.org/project/infrastructure/issues/3579174#summary-steps-reproduce">https://www.drupal.org/project/infrastructure/issues/3579174#summary-steps-reproduce</a></p> <p>Then run <code>ddev composer require drupal/eca_modeller_bpmn</code></p> <p>Expected result:</p> <p>The metapackage installs successfully.</p> <p>Actual result:</p> <pre>https://packages.drupal.org/8 could not be fully loaded (Maximum allowed download size reached. Content-length header indicates 3261 bytes. Allowed 1024 bytes), package information was loaded from the local cache and may be out of date<br><br>In CurlDownloader.php line 511:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp; [Composer\Downloader\MaxFileSizeExceededException (100)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp; Maximum allowed download size reached. Content-length header indicates 3261 bytes. Allowed 1024 bytes</pre><p>Or similarly:</p> <pre>https://packages.drupal.org/8 could not be fully loaded (Maximum allowed download size reached. Downloaded 1024 of allowed 1024 bytes), package information was loaded from the local cache and may be out of date<br><br>In CurlDownloader.php line 429:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp; [Composer\Downloader\MaxFileSizeExceededException (100)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp; Maximum allowed download size reached. Downloaded 1024 of allowed 1024 bytes </pre><h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Send composer metapackage metadata to Rugged for signing.</p> <p>From a security perspective, if a new dependency were added to the metapackage this could be an attack vector.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Send metapackage composer metadata to Rugged for signing</li> <li>...</li> <li>Profit!</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>TBD</p> <h3 id="summary-api-changes">API changes</h3> <p>TBD</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>TBD</p> > Related issue: [Issue #3579174](https://www.drupal.org/node/3579174)