Remove Magento Connect, Downloader and PEAR.

[colinmollenhour]

Fixes #903

Only lightly tested.

[tmotyl]

should this be merged to the 1.9 branch or 20.x ?

[Flyingmana]

Iam undecided.
The Pear part is the only which worries me as it may be used by someone.
But the other parts I would definitely merge into the 1.9 branch

[tmotyl]

Im ok with removing it as i never used magento connect nor pear in my projects :)

[sreichel]

Iam undecided.
The Pear part is the only which worries me as it may be used by someone.
But the other parts I would definitely merge into the 1.9 branch

Never used one of them .... so i'm okay with removal, but if you want to keep PEAR for now. Is it okay to update PR?

[sreichel]

If there would ne no concerns about PEAR i'd approve ... ;)

[tmotyl]

Afaik PeAR is not supported by PHP any more.

[simbus82]

Is not possible to "rewrite" Magento Download to give users the same functions but updating "parts" of the system from OpenMage?
Many and many basic stores use this method to do updates of their Magento installations...

[Flyingmana]

@simbus82
It is possible, but then we need someone who can take this over.

@colinmollenhour @tmotyl
The argument that many merchants could use it for updating is valid.
Maybe we should put this whole topic through our RFC Process at least once.

[tmotyl]

Isn't magento connect for m1 not supported any more or will vanish in the next weeks?

[colinmollenhour]

Although my opinion is currently that it should be removed (perhaps waiting until Connect is actually taken offline), I feel like I'm not qualified to answer the question as I don't know how others are using this and might use it in the future. Whenever I wanted to install an extension from Connect I'd just download the zip and then manually convert it to a modman directory, so I'm not the typical user. 😁

The pros:

• over 60,000 lines of code removed, never to have to be maintained again, less security risk

The cons:

• I need the community to shed some light on this...

So, @simbus82 can you describe how you see this code being important to keep after the EOL date? Does keeping it outweigh the pros in your view?

[simbus82]

Although my opinion is currently that it should be removed (perhaps waiting until Connect is actually taken offline), I feel like I'm not qualified to answer the question as I don't know how others are using this and might use it in the future. Whenever I wanted to install an extension from Connect I'd just download the zip and then manually convert it to a modman directory, so I'm not the typical user. 😁

The pros:

• over 60,000 lines of code removed, never to have to be maintained again, less security risk

The cons:

• I need the community to shed some light on this...

So, @simbus82 can you describe how you see this code being important to keep after the EOL date? Does keeping it outweigh the pros in your view?

No, i'm an optimization addicted, so if it were up to me i would kill so many useless parts of old Magento 😄

@colinmollenhour But i'm in the middle of development and web project management (SEO and CRO), so i try to take all "real users experience" to the "software level".

Until today many merchant's "developers" updates magento with the GUI (Magento Downloader), same for packages installation, with the uploader GUI. Since 1.9.3.x it works very well, not as in the past.

If tomorrow can't be used because Adobe is going to kill the server that push Magento 1.x core packages, i'm with you! Let's remove this useless code!

I'm just a little concerned about the ease with which non-developers in the past could download and install a .tgz or .zip without even opening an FTP client.

I like a lot Modman and Composer, but since they are managed only from the command line, they will be complicated to use for some merchants (or is it just my inexperienced impression?).

I fear that a Merchant who uses OpenMage is a merchant who does not have the budget to embark on the migration in that Magento 2 tank, so it is very likely that these merchants are flanked by inexperienced developers ... or they are doing some "amateurish devops".

Obviously the best solution would be to remove all this stuff from the old Magento like you say, and put a simple GUI to install the "core updates" and "extension packages" in the backed area...

It is also true that soon there will be very few updated Magento plugins that we can install ... 🤔

[Flyingmana]

As far as I know, the direct downloads for packages were still usable for the connect downloader. But I think the update functionality (automatic listing of packages needing updates) was not working anymore for over a year.

[colinmollenhour]

Thanks for the insights, guys.

One thought that might be a compromise between remove and keep would be to remove just the GUI and keep the CLI. The CLI code, as long as it is protected properly, is much less susceptible to attacks (you need shell and write permission to use it so you're already screwed). I understand the desire to have one-click install capability but to me the ability to download and write source code all through the web UI is too dangerous. That said, if realistically the CLI will not be used then I still say remove it all. :)

Is there a project somewhere for Magento 1 which allows a user to install a Magento Connect package via "composer install"?

[simbus82]

But I think the update functionality (automatic listing of packages needing updates) was not working anymore for over a year.

This screenshot is taken few minutes ago from an abandoned Magento 1.9.2.4 😝

One thought that might be a compromise between remove and keep would be to remove just the GUI and keep the CLI. The CLI code, as long as it is protected properly, is much less susceptible to attacks (you need shell and write permission to use it so you're already screwed). I understand the desire to have one-click install capability but to me the ability to download and write source code all through the web UI is too dangerous.

Yes, too dangerous, because sometimes things are breaking easily!

That said, if realistically the CLI will not be used then I still say remove it all. :)

CLI and command line are "same thing", so it is useless to maintain a CLI 😅. Let's remove it!
If wil be needed then i'll go to write a good tutorial for some "noob developer" that i know are working with some merchants!

Is there a project somewhere for Magento 1 which allows a user to install a Magento Connect package via "composer install"?

Maybe this? https://github.com/AydinHassan/magento-connect-composer-plugin

[Flyingmana]

Good example, I dont know if there is a newer Release, but it is one from before they cut off the connect releases.
This "new" release is from 2016.
https://github.com/OpenMageModuleFostering/owebia_shipping_2/blob/master/package.xml

I crawled everything which is available, and noticed there is a date, from which on no new releases did appear there anymore.

[colinmollenhour]

So remove, but after how-to's are updated for the following?

• Install old Magento Connect extensions that do not exist on Firegento package repo
• Preferred way to install and maintain extensions (composer install; composer update)

[daim2k5]

@colinmollenhour @Flyingmana
i wrote the update script for the "Firegento package repo". The pear packages are old because we can't get the newer versions.

[colinmollenhour]

@daim2k5 Can you clarify what you are referring to by "i wrote the update script for the 'Firegento package repo'"?

[fballiano]

I vote for removing download and connect, I always manually deleted them from all the projects I've worked on and I'd never allow a backend user to update a module or anything else :-)

[Flyingmana]

will execute the removal now for current reasons, as security comes first:

• https://sansec.io/research/largest-magento-hack-to-date
• https://twitter.com/sansecio/status/1305461119314690048

we need to look into alternatives or partial reversal afterwards

[bryanveIoso]

Finally! I also remove downloader in all my M1 instances. Finally, lesser inodes to use. 👍

[sreichel]

.... remember #1160 ;)

[Flyingmana]

@sreichel I dont see #1160 referenced here anywhere, is this related to this changes?

[sreichel]

@sreichel I dont see #1160 referenced here anywhere, is this related to this changes?

was just an reminder for me to update README

[colinmollenhour]

Looks like we successfully dodged a bullet... https://sansec.io/research/cardbleed
This shows there are many merchants though that have not adopted OpenMage that.. well, obviously should have. :)