[5.3] build.php Bug fix and stability improvements

[muhme]

Summary of Changes

This is a follow-up to #45535 and was discussed in maintainer meeting 11 June 2025.

• Copying of non-existing build/fido.jwt file is simple deleted
  • I was wondering, why do we have this error and nobody cares? Looking around I found:
    • plugins/system/webauthn/fido.jwt file is created by composer i
      • Which runs php build/update_fido_cache.php
        • Which downloads the FIDO metadata about authenticators from https://mds.fidoalliance.org into plugins/system/webauthn/fido.jwt file
    • The line with system('cp build/fido.jwt ' . $fullpath . '/plugins/system/webauthn/fido.jwt'); was added on 2 Sep 2022 with c2191a7 'Joomla! 4.2.2 Stable'
    • I assume this was another implementation of getting the FIDO metadata and is no more valid.
    • btw, the check file_exists 'plugins/system/webauthn/fido.jwt' was added with 205c7a5 'Fix/38233 webauth preload fido (Fix/38233 webauth preload fido #38664)'
• Improvement of two places where a variable was used for both the return code and the system output
• The exit codes are now checked for all system commands and the script stops in case of errors
• Before this PR, the zip commands displayed every added file. But before #45535, the output of the zip command with all added file names was suppressed by redirecting stdout to /dev/null. The same behaviour is now restored with the -q option.

Testing Instructions

1. Run php build/build.php
2. Run php build/build.php --remote=HEAD
3. Choose one system_and_check call and hack an error in, e.g. change composer to composerXXX and check the script stops
4. Hack one passthru() replacement e.g. change which git with which cheesecake and check the script stops

check the latest tag from Git repository is used, e.g.
Start build for remote tags/6.0.0-alpha1.

After merging this PR, we should check the nightly builds as they also use the script.

Actual result BEFORE applying this Pull Request

• Error message line
  cp: build/fido.jwt: No such file or directory
• Release build is working
• Output is ~30'000 lines

Expected result AFTER applying this Pull Request

• No error message line
• Release build is working
• Output is ~5'000 lines

Link to documentations

Please select:

• Documentation link for docs.joomla.org:

• No documentation changes for docs.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed

[muhme]

@tecpromotion May I ask you to test with macOS?
@Bodge-IT @softforge Could one of you do a test with Windows?

[tecpromotion]

I have tested this item ✅ successfully on ef8e99f

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45622.}

Choose one system_and_check call and hack an error in, e.g. change composer to composerXXX and check the script stops

Hack one passthru() replacement e.g. change which git with which cheesecake and check the script stops

Run build command

php build/build.php --remote=HEAD

[richard67]

I have tested this item ✅ successfully on 2732677

I've successfully tested that

• The created packages without and with this PR show only the expected differences between 2 builds, which come from the more or less random order in which npm dependencies are fetched and css and js is built.
• The cp: build/fido.jwt: No such file or directory message has disappeared from output with this PR.
• Script output is shown in the same way without and with this PR, i.e. nothing gets lost with this PR.
• When an error happens on a system call, the error messages of the system are still shown, but with this PR the script does not continue anymore but stops with a final error message showing the error code and the failed command.
  The run_and_check I have tested by changing the owner of the build/tmp/<date and time> folder from the previous build to root so the folder could not be deleted when deleting the build/tmpfolder.
  The capture_or_fail I have tested by adding an invalid option --bla to the git command to get the latest tag when no remote is given as command line option.
  In both cases the error messages from the rm or the git command were completely shown.

What I could not verify is the effect of the -q option for the zip because on my Ubuntu VMs that command seem to use the quiet mode by default.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45622.}

[richard67]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45622.}