Make generating PATCHES.txt conditional

[Sutharsan]

Composer patches generates a PATCHES.txt file with info about the applied patch. In my view this info duplicates the patches section in composer.json which also documents the applied patches.

Further, having a PATCHES.txt may be a security vulnerability. I use composer-patches in a Drupal project, where the PATCHES.txt is web accessible. This exposes information about applied patches which I do not want to share.

I would like to see an option to disable generating the PATCHES.txt file.

Without this option, I have these work-arounds:

• Remove the PATCHES.txt file with a post-install-cmd/post-update-cmd script
• Add PATCHES.txt to .htaccess to prevent access to the files.
• Add PATCHES.txt to gitignore (I add all project code to the repo)

[cweagans]

Good points. I'm more than happy to put this in 2.x. 1.x might be okay depending on the impact, but it would have to be a really small thing.

[cweagans]

This is on the 2.0.0 roadmap (see #93).

[cweagans]

Patch report generation has been removed in master. I don't plan to add it back in unless people feel very strongly about it, and only as an optional thing at that point. This functionality will be replaced by a composer patch-list command.