Fix installer

README.md

@@ -27,6 +27,10 @@ command. This allows you to perform some basic tasks without needing to install
 # Run "ddev drupal install" to see all available options
 ddev drupal install standard
 
+# Reset the site so it can be installed again
+# Use this rather than deleting sites/default/files and settings.php by hand
+ddev drupal uninstall
+
 # Run PHPUnit tests
 ddev phpunit core/modules/announcements_feed
 
@@ -52,7 +56,7 @@ ddev nightwatch --skiptags core
 
 Run a single test
 ```
-ddev nightwatch tests/Drupal/Nightwatch/Tests/exampleTest.js
+ddev nightwatch tests/Drupal/Nightwatch/Tests/a11yTestAdmin.js
 ```
 
 a11y tests for both the admin and default themes

commands/web/drupal

@@ -14,9 +14,9 @@
  */
 
 use Drupal\Core\Command\GenerateTheme;
-use Drupal\Core\Command\InstallCommand;
 use DrupalCoreDev\Command\AdminLoginCommand;
 use DrupalCoreDev\Command\CacheCommand;
+use DrupalCoreDev\Command\InstallCommand;
 use DrupalCoreDev\Command\LintCommand;
 use DrupalCoreDev\Command\LintCspellCommand;
 use DrupalCoreDev\Command\LintCssCommand;
@@ -40,23 +40,22 @@ $loader->addPsr4('DrupalCoreDev\\', $composer_root . '/.ddev/core-dev/src/');
 
 $application = new Application('drupal', \Drupal::VERSION);
 
-// Use ->addCommands() which works in different versions of symfony/console.
 $application->addCommands([
-  new InstallCommand($loader),
-  new UninstallCommand(),
-  new ModuleInstallCommand($loader),
-  new CacheCommand($loader),
-  new AdminLoginCommand($loader),
-  new GenerateTheme(),
-  new TestCommand(),
-  new TestExtensionsCommand(),
-  new TestBrowserCommand(),
-  new LintPhpCsCommand(),
-  new LintPhpStanCommand(),
-  new LintCssCommand(),
-  new LintJsCommand(),
-  new LintCspellCommand(),
-  new LintCommand(),
+    new InstallCommand($loader),
+    new UninstallCommand(),
+    new ModuleInstallCommand($loader),
+    new CacheCommand($loader),
+    new AdminLoginCommand($loader),
+    new GenerateTheme(),
+    new TestCommand(),
+    new TestExtensionsCommand(),
+    new TestBrowserCommand(),
+    new LintPhpCsCommand(),
+    new LintPhpStanCommand(),
+    new LintCssCommand(),
+    new LintJsCommand(),
+    new LintCspellCommand(),
+    new LintCommand(),
 ]);
 
 $application->run();

core-dev/src/Command/InstallCommand.php

@@ -0,0 +1,48 @@
+<?php
+#ddev-generated
+
+namespace DrupalCoreDev\Command;
+
+use Drupal\Core\Command\InstallCommand as CoreInstallCommand;
+use Drupal\Core\DrupalKernel;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+/**
+ * Installs Drupal, leaving the site directory writable.
+ *
+ * Once a site is running, Drupal hardens the site directory to 0555 and
+ * settings.php to 0444. That makes the next install fail, because the
+ * installer cannot copy default.settings.php into a read-only directory.
+ * Seeding settings.php with skip_permissions_hardening before handing over to
+ * core keeps both writable, so reinstalling never needs a chmod or sudo.
+ */
+class InstallCommand extends CoreInstallCommand {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function execute(InputInterface $input, OutputInterface $output): int {
+    $root = (new DrupalKernel('prod', $this->classLoader, FALSE))->getAppRoot();
+    $site_path = $root . '/' . $this->getSitePath();
+    $settings = $site_path . '/settings.php';
+
+    if (!is_dir($site_path)) {
+      mkdir($site_path, 0775, TRUE);
+    }
+    elseif (!is_writable($site_path)) {
+      // A site installed before this command existed left it hardened.
+      chmod($site_path, 0755);
+    }
+
+    // Core skips its own copy when settings.php is already there, so this is
+    // the only chance to get the setting in before the installer reads it.
+    if (!file_exists($settings)) {
+      copy($root . '/sites/default/default.settings.php', $settings);
+      file_put_contents($settings, "\n\$settings['skip_permissions_hardening'] = TRUE;\n", FILE_APPEND);
+    }
+
+    return parent::execute($input, $output);
+  }
+
+}

install.yaml

@@ -14,6 +14,7 @@ project_files:
   - core-dev/src/Command/AdminLoginCommand.php
   - core-dev/src/Command/BootCommand.php
   - core-dev/src/Command/CacheCommand.php
+  - core-dev/src/Command/InstallCommand.php
   - core-dev/src/Command/TestCommand.php
   - core-dev/src/Command/TestBrowserCommand.php
   - core-dev/src/Command/TestExtensionsCommand.php

web-build/Dockerfile.chromium

@@ -16,3 +16,58 @@ RUN apt-get install -y --no-install-recommends \
     libflac12 \
     libopenh264-7 \
     && rm -rf /var/lib/apt/lists/*
+
+# 3. Apt config for the layers below. The snapshot repos above are "expired" by design, so
+# make the valid-until exemption permanent rather than a per-command flag. The pins make the
+# bookworm snapshot a last resort: anything trixie can satisfy comes from trixie, so we only
+# borrow from bookworm where chromium 143 genuinely needs it (the sonames pinned above).
+RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until && \
+    printf 'Package: *\nPin: release n=bookworm\nPin-Priority: 1\n' \
+        > /etc/apt/preferences.d/bookworm-last-resort && \
+    printf 'Package: *\nPin: release n=bookworm-security\nPin-Priority: 1\n' \
+        >> /etc/apt/preferences.d/bookworm-last-resort
+
+# 4. Browser system libraries for Playwright, i.e. the "tools" and "chromium" entries of the
+# debian13-x64 map in playwright-core 1.62.1 (lib/server/registry/nativeDeps.ts). Listed
+# explicitly instead of calling `npx playwright install-deps` so the image does not depend on
+# whatever npm serves at build time, matching how chromium and the apt snapshot are pinned above.
+# To regenerate after a Playwright bump:
+#   docker run --rm ddev/ddev-webserver:<tag> npx --yes playwright@<version> install-deps --dry-run
+# Most of the chromium entries are already satisfied by the Debian chromium package installed
+# above; the four libatk/libasound names resolve to Debian's t64 transition packages, which
+# provide the same sonames and leave chromium itself untouched.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    xvfb \
+    fonts-noto-color-emoji \
+    fonts-unifont \
+    libfontconfig1 \
+    libfreetype6 \
+    xfonts-scalable \
+    fonts-liberation \
+    fonts-ipafont-gothic \
+    fonts-wqy-zenhei \
+    fonts-tlwg-loma-otf \
+    fonts-freefont-ttf \
+    libasound2t64 \
+    libatk-bridge2.0-0t64 \
+    libatk1.0-0t64 \
+    libatspi2.0-0t64 \
+    libcairo2 \
+    libcups2t64 \
+    libdbus-1-3 \
+    libdrm2 \
+    libgbm1 \
+    libglib2.0-0t64 \
+    libnspr4 \
+    libnss3 \
+    libpango-1.0-0 \
+    libx11-6 \
+    libxcb1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxext6 \
+    libxfixes3 \
+    libxkbcommon0 \
+    libxrandr2 \
+    && rm -rf /var/lib/apt/lists/*