The index.xml format
This page is for developers who publish packages, run a mirror or debug the Site package step. It describes the
index.xml file of a release folder: its elements and attributes, which of them the code reads, and what happens
when one is wrong. The reference implementation is eZStepSiteTypes::retrieveRemotePackagesList() in
kernel/setup/steps/ezstep_site_types.php.
Contents
- An example
- The root element
- The package element
- How the setup wizard reads it
- How ezupdate reads it
- A minimal index of your own
- Checking an index
- Related pages
An example
Two entries of the 6.0.15 index, the first a required package, the second a site package (one line each in the file, wrapped here):
<packages vendor="7x">
<!-- DEPENDENCY PACKAGE LIST -->
<package name="sevenx_classes" type="contentclass"
url="https://exponential.packages.exponential.earth/exponential/6.0/6.0.15/sevenx_classes.ezpkg"/>
<package name="sevenx_multisite" version="6.0-15-stable" type="site"
summary="7x MultiSite Default Installation"
description="7x MultiSite Default Installation is a web based CMS solution based on Exponential. ..."
url="https://exponential.packages.exponential.earth/exponential/6.0/6.0.15/sevenx_multisite.ezpkg"
thumbnail_url="https://exponential.packages.exponential.earth/exponential/6.0/6.0.15/thumbnails/sevenx_multisite.png"/>
</packages>The whole file: https://exponential.packages.exponential.earth/exponential/6.0/6.0.15/index.xml (44 entries).
The root element
| Element | Required | Meaning |
|---|---|---|
<packages> | yes | The root. The setup wizard refuses any other root with the debug error "Malformed index file." |
vendor attribute | no | 7x on the server. It documents the vendor; neither the setup wizard nor ezupdate reads it |
Comments and white space between the entries are allowed; everything that is not a <package> element is skipped.
The package element
| Attribute | Used on | Read by | Meaning |
|---|---|---|---|
name | every entry | wizard, ezupdate | The package name, the same as <name> in its package.xml. Entries are keyed by name: a second entry with the same name replaces the first |
type | every entry | wizard, ezupdate | The package type. The wizard lists only type="site"; the other entries serve to find the URLs of required packages |
url | every entry | wizard, ezupdate | The full address of the .ezpkg file. It may point anywhere, not only to the same folder |
version | site packages | wizard, ezupdate | Shown as "(ver. version)" and compared with an imported copy. The same text as eZPackage::getVersion() of the package (<number>-<release> of its package.xml), so an imported copy compares equal (The index version and the package version) |
summary | site packages | wizard, ezupdate | The heading of the entry in the Site package step, and its image title |
description | site packages | wizard | The text under the heading |
thumbnail_url | site packages | wizard | The image shown for a site package that is not imported yet; without it a default image is shown |
Note
Fixed in 6.0.15. Before, the Site package step wrote description into the page as it was, not escaped
(design/standard/templates/setup/init/site_types.tpl), and put thumbnail_url into an image address unchecked.
From 6.0.15 on every field of an index entry is escaped (description is plain text, its line breaks kept), and
eZStepSiteTypes::sanitizeRemotePackageAttributes() keeps a url or thumbnail_url only when it is an http://
or https:// address and skips an entry whose name is not letters, digits, ., - and _. Write
description as plain text (HTML tags show as text), and still point an installation only at index files you
trust.
How the setup wizard reads it
- The index address is
RemotePackagesIndexURLplus/index.xml(a trailing slash is not doubled). - The file is downloaded like a package, with retries (When the package server cannot be reached),
into
<cache>/packages/index.xml, and deleted after it is parsed. - If the download fails, the wizard copies
index.xmlfrom the system repository,var/storage/packages/7x/index.xml, when there is one (Offline installs and mirrors). - The file is parsed with
DOMDocument. A file that does not parse logs "Unable to open index file." and the list stays empty. - Each
<package>element becomes an array of all its attributes, so attributes the code does not know are kept but ignored. - For the list on the screen only site packages are used; for the dependencies of a chosen package the whole list is
used, looked up by
name. A required package that is neither imported nor in the index stops the step with "Download of package 'name' failed. You may upload the package manually."
The radio button of a remote entry carries name|url. The step treats the choice as a download only when the name
consists of letters, digits and _ (/^(\w+)\|(.+)$/ in processPostData()); package names follow that rule
anyway (package.xml required fields).
How ezupdate reads it
The ezupdate extension's Package servers page reads the same format from every server it knows
(extension/ezupdate/classes/ezupdatepackageservers.php):
- the index must be at most 1 MiB, and is parsed without network access (
LIBXML_NONET); - a root other than
<packages>gives "The server did not answer with a package index."; - a
namemust match^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$, other entries are skipped; - it shows
name,type,summaryandversion, next to the version of an imported copy; - fetch accepts only a
urlthat starts withhttps://, and a package of at most 256 MiB.
See Package servers in ezupdate.
A minimal index of your own
For a server with one site package that requires one other package:
<packages vendor="example">
<package name="example_classes" type="contentclass"
url="https://packages.example.com/6.0/6.0.15/example_classes.ezpkg"/>
<package name="example_site" version="1.0-0" type="site"
summary="Example site"
description="The starter site of Example Inc."
url="https://packages.example.com/6.0/6.0.15/example_site.ezpkg"
thumbnail_url="https://packages.example.com/6.0/6.0.15/thumbnails/example_site.png"/>
</packages>Every package that a site package names in <dependencies><requires> must either have an entry here or already be
imported on the installation. See Running your own package server
and Declaring dependencies.
Checking an index
# well formed?
xmllint --noout index.xml
every url answers 200?
grep -o 'url="[^"]*"' index.xml | cut -d'"' -f2 | while read -r u; do
printf '%s %s\n' "$(curl -s -o /dev/null -w '%{http_code}' "$u")" "$u"
doneThe second command checks both url and thumbnail_url. Run both before you publish an index, and before you open
a pull request for the shared server (Contribute your site package).
Related pages
- Site packages: start here
- The package server
- What is on the package server
- Package server settings
- How the setup wizard uses packages
- The setup wizard, 5.3.8 Site package
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.