Symfony Flex & Aliases

after installation sec-checker

Executing script security-checker security:check [KO]
[KO]
Script security-checker security:check returned with error code 1
!!
!! An error occurred: .
!!
!!
Script @auto-scripts was called via post-update-cmd

Hey Алексей Скоробогатов

Which version of Symfony are you using?
Could you run that command again but passing it "-vvv" so we can see more logs

Cheers!

C:\OSPanel\domains\symfony.local>composer require sec-checker -vvv
Reading ./composer.json
Loading config file ./composer.json
Checked CA file C:\OSPanel\modules\php\PHP-7.2-x64\cacert.pem: valid
Executing command (C:\OSPanel\domains\symfony.local): git branch --no-color --no-abbrev -v
Reading C:/Users//AppData/Roaming/Composer/composer.json
Loading config file C:/Users//AppData/Roaming/Composer/composer.json
Reading C:\OSPanel\domains\symfony.local/vendor/composer/installed.json
Reading C:/Users//AppData/Roaming/Composer/vendor/composer/installed.json
Loading plugin Symfony\Flex\Flex
Downloading https://repo.packagist.org/...
Writing C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... into cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Downloading http://repo.packagist.org/p...
Downloading http://repo.packagist.org/p...
Writing C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... into cache
Writing C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... into cache
Running 1.7.2 (2018-08-16 16:57:12) with PHP 7.2.0 on Windows NT / 10.0
Reading C:/Users//AppData/Local/Composer/repo/https---flex.symfony.com/al... from cache
Downloading https://flex.symfony.com/al...
Writing C:/Users//AppData/Local/Composer/repo/https---flex.symfony.com/al... into cache
Downloading https://repo.packagist.org/...
Writing C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... into cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Using version ^4.1 for sensiolabs/security-checker
./composer.json has been updated
Reading ./composer.json
Loading config file ./composer.json
Executing command (C:\OSPanel\domains\symfony.local): git branch --no-color --no-abbrev -v
Reading C:/Users//AppData/Roaming/Composer/composer.json
Loading config file C:/Users//AppData/Roaming/Composer/composer.json
Reading C:\OSPanel\domains\symfony.local/vendor/composer/installed.json
Reading C:/Users//AppData/Roaming/Composer/vendor/composer/installed.json
Loading plugin Symfony\Flex\Flex_composer_tmp0
Reading ./composer.lock
Loading composer repositories with package information
Downloading https://repo.packagist.org/...
Writing C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... into cache
Updating dependencies (including require-dev)
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Restricting packages listed in "symfony/symfony" to "4.1.*"
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Reading C:/Users//AppData/Local/Composer/repo/https---repo.packagist.org/... from cache
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.010 seconds
Analyzed 1766 packages to resolve dependencies
Analyzed 3124 rules to resolve dependencies
Nothing to install or update
Resolving dependencies through SAT
Looking at all rules.

Dependency resolution completed in 0.001 seconds
Reading C:\OSPanel\domains\symfony.local/vendor/composer/installed.json
Generating autoload files
> post-update-cmd: @auto-scripts
Executing script cache:clear
Executed script cache:clear [OK]
Executing script assets:install public
Executed script assets:install %PUBLIC_DIR% [OK]
Executing script security-checker security:check
Executed script security-checker security:check [KO]
[KO]
Script security-checker security:check returned with error code 1
!!
!! An error occurred: .
!!
!!
Script @auto-scripts was called via post-update-cmd

Uhmm, that's weird... Have you tried re-installing the security-checker dependency?

Please run only that command php ./bin/console security:check -vvv using the same flag to see the logs

I have the same problem

C:\Server\data\htdocs\myproject2>php ./bin/console security:check -vvv

An error occurred: .

2018-09-15T06:49:41+00:00 [debug] Command "security:check -vvv" exited with code "1"

Hey Виктория Барышникова!

Good thinking running the command directly to see what the problem is! Even better idea to run the -vvv!

But, is this the only output you see? You don't see any other error on the screen? It just exits immediately with only that line? Is there a stacktrace also?

It seems like there is some issue - as several people have reported things. I would love to be able to debug it :).

Cheers!

I tried with recommended option but not working. I am using windows 10.
Package sensiolabs/security-checker is abandoned, you should avoid using it. Use https://github.com/fabpot/l... instead.

Hey Hiranya,

I just replied to your similar comment here: https://symfonycasts.com/sc...

Did you try to install another tool that error message suggests? If not, please do it. If you have any issues with installing https://github.com/fabpot/l... too - please, let us know!

Cheers!

I am not able to install it. I tried with recommended options but not working. I am using Windows 10.
<b>Package sensiolabs/security-checker is abandoned, you should avoid using it. Use https://github.com/fabpot/local-php-security-checker instead.</b>

Hey Hiranya,

If you're talking about installing "sensiolabs/security-checker" - that's true, that package is abandoned for today and so you won't be able to install it anymore. Do as the error message suggested, install and use https://github.com/fabpot/l... instead. Or use symfony CLI as an alternative option, run "symfony check:security".

Cheers!

When I executed composer require sec-checker; it shows me this error
[UnexpectedValueException] <br /> "sec-checker" is not a valid alias.

Do anyone has an idea? thanks in advance

Hey Ahmed C.!

Hmm... that's really interesting! I just double-checked: that alias DOES still exist, and I can even run "composer require sec-checker" without any issues. And I can see from the error, that flex IS trying to find the alias. I'm really not sure what would be going wrong - it could even be a temporary internet issue. I'd try again - and if it doesn't work still, try running composer up symfony/flex (though that shouldn't be needed).

Cheers!

hello. when installing sec-checker, the tutorial shows the security_checker.yaml file in the config/packages/dev folder.
in my case, even i followed the tip to require with --dev, this file is not in that folder but in config/packages folder instead. is this normal?
i'm following the tutorial starting with sf 4.4 though.

Hey Crevillo,

Yeah, that's totally fine. As you can see from the recipe, it only has this one "config/packages/security_checker.yaml" file: https://github.com/symfony/... - looks like the recipe was changed since we recorded this screencast.

Cheers!

Hi Guys,

I am using apache2 as a server. If I go to localhost/project/public I get the 'OMG! First Page...' page, however none of the /news/why-something-taste-like-something works. If I test it with php -S localhost:8000 it works perfectly. Any idea why?

BTW: Amazing tutotial! Great job!

Hey @callmebob!

Try running composer require apache-pack

In order for Apache to rewrite the URLs correctly, you need a public/.htaccess file. The recipe behind that pack adds that for you :).

Cheers!

BTW: Thank you ❤️;)

Hey!
I have got a problem. After install my security_checker.yaml is in wrong path. It's in /config/packages/
What can i do with it?

Hey Maciek,

Yes, it was renamed, see related PR: https://github.com/symfony/... . In short, just use the new path and that's it, it's not a big deal.

Cheers!

Just something I found out now:
If installing sec-checker with --dev option, it'll KO when you deploy in prod environment:

Executing script security-checker security:check [KO]
 [KO]
Script security-checker security:check returned with error code 127
!!  sh: 1: security-checker: not found
!!  

Hey IvanPuntiy

Yeah, it won't find the command because that bundle is missing from the production project.
Anyway, you should not need to run it on production,

Cheers!

So how should I deploy it now then?
For previous projects (without Symfony) this command worked well in automatization:

composer install -noq --no-dev --no-progress```

So now it's either to move sec-checker into require array, or use --no-scripts and call each script separately?

Hey Ivan,

I think if you want to check for security vulnerabilities on production - then you need explicitly install this checker for both dev / prod environments. Otherwise, you can install Composer dev dependencies first, let the command checks for security vulnerabilities, and then install Composer deps again but without dev ones and with --no-scripts as you said if you want to keep this command in composer.json.

Cheers!

Thanks.
And since I've now discovered Ansible and Ansistrano, I think I'm going to switch to them from my homebrewed scripts, after finishing their tutorials.

Hey Ivan,

Good news! I'm glad it was helpful for you. And I bet you'll love Ansible & Ansistrano ;)

Cheers!

so I am getting this operation must be run in a work tree when I type into the terminal git add . or git status..... this is after I pushed up the initial repository, that symfony did not make for me. I can not find the solution to this anywhere. Please advise.

Hey Dean D.!

Ah, sorry about that! Try running this first:

git init

And THEN run the git add . and git status. After we recorded the screencast, Symfony stopped making the git repository for you. It's no big deal - except that it made this part of our screencast inaccurate :/. We'll be adding a note soon to help with this - sorry it confused you - we definitely do not want that!

So, run "git init", then keep going!

Cheers!

thank you .
but now I'm getting all this :
$ git init
Reinitialized existing Git repository in C:/Users/desig/Desktop/apps/the_spacebar/.git/

desig@Deans-A-Gamer MINGW64 ~/Desktop/apps/the_spacebar (master)$ git add .
fatal: CRLF would be replaced by LF in src/Controller/ArticleController.php.

desig@Deans-A-Gamer MINGW64 ~/Desktop/apps/the_spacebar (master)
$ git commit -m "making so much good progress"
On branch master
Your branch is up to date with 'origin/master'.

Changes not staged for commit:
modified: composer.json
modified: composer.lock
modified: config/bundles.php
modified: config/routes.yaml
modified: symfony.lock

Untracked files:
config/packages/security_checker.yaml
config/packages/sensio_framework_extra.yaml
config/routes/
src/Controller/ArticleController.php

no changes added to commit

Hey Dean D.!

Let's walk through each line :).

Reinitialized existing Git repository in C:/Users/desig/Desktop/apps/the_spacebar/.git/

That's ok. It just means that there was already a git repository initialized in this directory - maybe because you already ran this command when trying to debug the issue, or used a GUI to initialize the repo. Regardless, it's not a problem - git is basically saying "Hey! There's already a git repo in this directory".

fatal: CRLF would be replaced by LF in src/Controller/ArticleController.php

So, this is an annoying one :/. Windows & Linux-based systems use different line endings. And so git can get confused by this - it wants to use a certain line ending because you're on Windows, but the code uses a different line ending. It's sort of a famous, annoying issue that Windows users face. But it's ultimately superficial. Here are some details on it: https://stackoverflow.com/questions/20168639/git-commit-get-fatal-error-fatal-crlf-would-be-replaced-by-lf-in

One solution would be to run:

git config --global core.autocrlf false
git config --global core.safecrlf false

This tells git not to worry about the line endings: to keep them how you have them. After this, you should be able to run "git add ." again to initialize the git repo. Also, if you like using a GUI better, check out https://desktop.github.com/

$ git commit -m "making so much good progress"
On branch master
Your branch is up to date with 'origin/master'.

This is the effect if the "git add ." command failing because of the line ending stuff. Nothing was "added" to git, so nothing was able to be committed.

Btw, if you want to learn a lot more about Git, there's a great site where you can play with it - I highly recommend :) https://learngitbranching.js.org/

Cheers!

Hey Daniel,

Haha, where did you find that "run" command in our screencasts? The command should be "git diff composer.json", the "run" was just a word, a simple verb ;)

Cheers!