composer: warn when running as root by russoz · Pull Request #12090 · ansible-collections/community.general

russoz · 2026-05-23T10:43:58Z

SUMMARY

When the community.general.composer module runs as root, composer itself emits a security warning that is currently silently swallowed. This PR adds a module.warn() call when the effective UID is 0, so operators are made aware of the issue. The COMPOSER_ALLOW_SUPERUSER environment variable is documented in the module notes as the upstream escape hatch.

Fixes #2388

ISSUE TYPE

Feature Pull Request

COMPONENT NAME

composer

ADDITIONAL INFORMATION

N/A

ansibullbot · 2026-05-23T10:44:26Z

cc @dmtrs
click here for bot help

felixfontein

I'm not sure this is the right approach. I think it would be better to surface warnings emitted by composer to the user, instead of ignoring them.

In particular, https://getcomposer.org/doc/faqs/how-to-install-untrusted-packages-safely.md#running-composer-inside-docker-podman-containers shows that emitting a warning when root is used is simply wrong in general.

Especially after reading that, I really don't think we should try to second-guess composer, but simply pass its warnings on.

Fixes ansible-collections#2388 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The composer_as_root test case still expected the pre-rebase command format (working-dir as a separate trailing option) instead of the current --working-dir=<path> token placed before the subcommand.

russoz · 2026-09-13T05:05:32Z

Rebased (fixing conflict)

…f reimplementing it Per review feedback, stop independently deciding when running as root is unsafe (which is wrong in cases like official containers) and instead surface composer's own warning as an Ansible warning. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

russoz · 2026-09-13T05:49:32Z

I'm not sure this is the right approach. I think it would be better to surface warnings emitted by composer to the user, instead of ignoring them.

In particular, https://getcomposer.org/doc/faqs/how-to-install-untrusted-packages-safely.md#running-composer-inside-docker-podman-containers shows that emitting a warning when root is used is simply wrong in general.

Especially after reading that, I really don't think we should try to second-guess composer, but simply pass its warnings on.

Agree. I have rewritten the changes.

…ble-core versions CI on ansible-core 2.18 failed: module.warn() serializes warnings as plain strings there, but as structured WarningSummary/Event dicts on 2.19+. Assert via substring match instead of exact equality so the test passes on both. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

patchback · 2026-09-13T14:38:26Z

Backport to stable-13: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-13/9bb7aee82639bf5f569d8cde375f87223c52ac72/pr-12090

Backported as #12722

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

felixfontein · 2026-09-13T14:38:40Z

@russoz thanks for implementing this!

…as root (#12722) composer: warn when running as root (#12090) * feat(composer): warn when running as root Fixes #2388 * feat(changelog): add fragment for PR 12090 * fix(test_composer): update expected working-dir command format The composer_as_root test case still expected the pre-rebase command format (working-dir as a separate trailing option) instead of the current --working-dir=<path> token placed before the subcommand. * reformat * fix(composer): relay composer's own root/super-user warning instead of reimplementing it Per review feedback, stop independently deciding when running as root is unsafe (which is wrong in cases like official containers) and instead surface composer's own warning as an Ansible warning. * fix(test_composer): make root-warning assertion resilient across ansible-core versions CI on ansible-core 2.18 failed: module.warn() serializes warnings as plain strings there, but as structured WarningSummary/Event dicts on 2.19+. Assert via substring match instead of exact equality so the test passes on both. --------- (cherry picked from commit 9bb7aee) Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

ansibullbot added feature This issue/PR relates to a feature request module module plugins plugin (any type) tests tests unit tests/unit labels May 23, 2026

felixfontein added check-before-release PR will be looked at again shortly before release and merged if possible. backport-13 Automatically create a backport for the stable-13 branch labels May 23, 2026

felixfontein requested changes May 30, 2026

View reviewed changes

Comment thread plugins/modules/composer.py Outdated

ansibullbot added needs_rebase https://docs.ansible.com/ansible/devel/dev_guide/developing_rebasing.html needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR labels May 30, 2026

ansibullbot added the stale_ci CI is older than 7 days, rerun before merging label Jun 7, 2026

russoz and others added 3 commits September 13, 2026 16:39

feat(composer): warn when running as root

ac849c1

Fixes ansible-collections#2388 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(changelog): add fragment for PR 12090

682e2c7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(test_composer): update expected working-dir command format

38b8fe3

The composer_as_root test case still expected the pre-rebase command format (working-dir as a separate trailing option) instead of the current --working-dir=<path> token placed before the subcommand.

russoz force-pushed the 2388-composer-warn-root branch from d18f41a to 38b8fe3 Compare September 13, 2026 05:04

ansibullbot removed needs_rebase https://docs.ansible.com/ansible/devel/dev_guide/developing_rebasing.html stale_ci CI is older than 7 days, rerun before merging labels Sep 13, 2026

This comment was marked as outdated.

Sign in to view

ansibullbot added the ci_verified Push fixes to PR branch to re-run CI label Sep 13, 2026

reformat

2ad12cc

ansibullbot removed the ci_verified Push fixes to PR branch to re-run CI label Sep 13, 2026

ansibullbot removed the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 13, 2026

ansibullbot added the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 13, 2026

russoz requested a review from felixfontein September 13, 2026 06:50

felixfontein approved these changes Sep 13, 2026

View reviewed changes

ansibullbot removed the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR label Sep 13, 2026

felixfontein merged commit 9bb7aee into ansible-collections:main Sep 13, 2026
126 checks passed

felixfontein removed the check-before-release PR will be looked at again shortly before release and merged if possible. label Sep 13, 2026

felixfontein deleted the 2388-composer-warn-root branch September 13, 2026 14:38

patchback Bot mentioned this pull request Sep 13, 2026

[PR #12090/9bb7aee8 backport][stable-13] composer: warn when running as root #12722

Merged

Navigation Menu

Uh oh!

composer: warn when running as root - #12090

composer: warn when running as root#12090
felixfontein merged 6 commits into
ansible-collections:mainfrom
russoz-ansible:2388-composer-warn-root

russoz commented May 23, 2026

Uh oh!

ansibullbot commented May 23, 2026

Uh oh!

felixfontein left a comment

Uh oh!

Uh oh!

russoz commented Sep 13, 2026

Uh oh!

This comment was marked as outdated.

russoz commented Sep 13, 2026

Uh oh!

Uh oh!

patchback Bot commented Sep 13, 2026 •

edited

Loading

Uh oh!

felixfontein commented Sep 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

russoz commented May 23, 2026

SUMMARY

ISSUE TYPE

COMPONENT NAME

ADDITIONAL INFORMATION

Uh oh!

ansibullbot commented May 23, 2026

Uh oh!

felixfontein left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

russoz commented Sep 13, 2026

Uh oh!

This comment was marked as outdated.

russoz commented Sep 13, 2026

Uh oh!

Uh oh!

patchback Bot commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to stable-13: 💚 backport PR created

Uh oh!

felixfontein commented Sep 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

patchback Bot commented Sep 13, 2026 •

edited

Loading