Composer in the wilderness: A guide to dependency management

6/19/13 Composer in the wilderness
2012.symfonycamp.org.ua/uploads/slides/composer/index.html?print-pdf#/ 1/62
IN THE WILDERNESS

WHO AM I?
Józef Bielawski, better known as stloyd
Sarcastic Pole with a flair for being real troll
Symfony2 and other OSS contributions
Author of many features at
Working at with Happy Awesome
Developers!
https://github.com/stloyd
KnpBundles
KnpLabs

LITTLE NOTE WHAT IS COMPOSER?
In real simply words Composer is dependency manager written in PHP. It
allows you to define and manage your project dependencies in really easy
way.
Inspiration for it was taken from such projects like npm for NodeJS &
Bundler for Ruby lang, yet internal solver code is inspired by OpenSuse
Libzypp satsolver.

YEAH SURE... BUT WHY USE COMPOSER?

ADOPTION BY PHP ECOSYSTEM
5 100+ packages with over 14 000 defined versions on
Packagist
Already 6 250 000+ installs only from Packagist
Supported by: Symfony2, Zend Framework, eZ Publish,
and many others...
with support for 17
different projects!
Multi-Framework Library Installer

HOW TO GET COMPOSER READY TO GO?

CHECK YOUR ENVIRONMENT:
$ curl -s http://getcomposer.org/installer | php -- --check

IF IT'S OK, DOWNLOAD:
$ curl -s http://getcomposer.org/installer | php

AND RUN LOCALLY:
$ php composer.phar --version
Composer version cd4d569

OR SETUP FOR GLOBAL USE:
ADD A CRON JOB FOR AUTO-UPDATE:
$ sudo mv composer.phar /usr/local/bin/composer
$ composer --version
Composer version cd4d569
$ crontab -e
* 12 * * * /usr/local/bin/composer self-update >/dev/null 2>&1

BUT WHAT WITH WINDOWS USERS?

USE EXECUTABLE INSTALLER
Download:
Run it and enjoy this simple process!
All required steps were done automatically, go to your
console and test!
http://getcomposer.org/Composer-Setup.exe

WE USED COMPOSER LONG TIME
AGO IN PROJECT
Will update be boring and painful?

UPDATING COMPOSER.LOCK TO NEW FORMAT

ADVANTAGES WITH NEW FORMAT
OF COMPOSER.LOCK FILE:
Composer is slower when using old format
New format is much more human-friendly
And probably more boring ones =)

UPDATE... NOTHING!
Update of composer.lockfile is really easy, just run:
Yep! None of your packages was updated!
$ composer update nothing

UPDATE ONLY WHAT YOU WANT!
$ composer update mypackage1 mypackage5

I DON'T WANNA UPDATE YET!
Check what updates are waiting for you:
$ composer update --dry-run

ADDITIONS TO UPDATE/INSTALL

DO YOU PREFER TO USE GIT CLONE?
$ composer update --prefer-source

OR MAYBE ZIP ARCHIVES?
$ composer update --prefer-dist

WHAT IS IN THIS?
$ composer update --verbose # or simply -v

YOU CAN COMBINE THOSE OPTIONS:
$ composer update --dry-run --dev -v

SO I GUESS YOU ARE BORED WITH
DEFINING OPTIONS IN EVERY PROJECT...

YET DEFINING SAME REPOSITORIES
AGAIN & AGAIN IN YOUR PROJECTS?

EDIT GLOBAL COMPOSER CONFIG!
Look into: $COMPOSER_HOME/config.json, this file
holds default settings.

PLACES WHERE CONFIG FILE CAN BE:
*nix: /home/YourUser/.composer/config.json
OSX: /Users/YourUser/.composer/config.json
Windows:
C:UsersYourUserAppDataRoamingComposerconfig.json

AVAILABLE SETTINGS
vendor-dir
bin-dir
process-timeout
github-protocols
notify-on-install
cache-files-ttl
Change them once and use in all your projects. No more boring defining
option in all your projects!

ADD EXTERNAL REPOSITORIES!
Similar way to global configuration, you can define repositories that will be always
checked in your projects i.e. Zend Framework packages! Simply open again your
configuration*: $COMPOSER_HOME/config.json, and simply add:
{
"repositories": [
{
"type": "composer",
"url": "http://packages.zendframework.com/"
}
]
}

BUT WHAT WITH OUR
PRIVATE REPOSITORY?

ADD IT TO YOUR GLOBAL CONFIG!
Composer have additional tool for generation and management of private
repositories:
Statis - package repository generator.

ADD IT TO YOUR GLOBAL CONFIG!
Same way as before, open configuration and add:
{
"repositories": [
{
"type": "composer",
},
{
"type": "composer",
"url": "http://statis.yourdomain.com/"
}
]
}

BUT OUR REPOSITORY IS NOW
NOT SECURED!

BLOCK ACCESS WITH SSH!
Statis allows to secure your private repository using over SSH (which
requires SSH2 PECL extension installed).
{
"repositories": [
{
"type": "composer",
"url": "ssh2.sftp://yourdomain.com",
"options": {
"ssh2": {
"username": "secret_user",
"pubkey_file": "/home/composer/.ssh/id_rsa.pub
",
"privkey_file": "/home/composer/.ssh/id_rsa"
}
}
}
]
}

OR USE SSL WITH CLIENT CERTIFICATE:
{
"repositories": [
{
"type": "composer",
"url": "https://yourdomain.com",
"options": {
"ssl": {
"cert_file": "/home/composer/.ssl/composer.pem
"
}
}
}
]
}

YOU USE ONLY CUSTOM REPOSITORIES
AND ZEND FRAMEWORK REPOSITORY?

YET YOU DON'T WANT TO CALL
PACKAGIST ON EVERY UPDATE?!

TURN OFF PACKAGIST!
Composer allows you to simply disable package lookup at official
repository.
{
"repositories": [
{
"type": "composer",
},
{
"type": "composer",
"url": "http://statis.yourdomain.com/"
},
{
"packagist": false
}
]
}
Packagist.org

WHAT TO DO IF WE HAVE OUR
BUGFIX/FEATURE FOR PACKAGE BUT
IT WAS NOT MERGED YET?

OVERRIDING "DEFAULT" PACKAGES
Dependency solver implemented in Composer allows to easily override
any package defined in repositories: default (from Packagist), yet those
really custom.

To do that add your fork as repository, and require patched version:
{
"repositories": [
{
"type": "vcs",
"url": "https://github.com/stloyd/Buzz"
}
],
"require": {
"kriswallsmith/buzz": "dev-feature/awesome-thing"
}
}

To prevent conflicts in dependency solver, you would need to use very
useful aliasing feature (it's possible because custom repositories have
higher priority when resolving dependencies).
{
"repositories": [
{
"type": "vcs",
"url": "https://github.com/stloyd/Buzz"
}
],
"require": {
"kriswallsmith/buzz": "dev-feature/awesome-thing as 0.7",
"hwi/oauth-bundle": "*"
}
}

BUT SEEMS THAT OUR FORK WILL
NOT BE MERGE SOON...
WE REALLY NEED THIS FEATURE!

REPLACING "DEFAULT" PACKAGES
In your composer.json for forked package, you need to define
replacetag.
{
"name": "stloyd/buzz",
"replace": {
"kriswallsmith/buzz": "0.7"
}
}

REPLACING "DEFAULT" PACKAGES
Now add your forked package to custom repository or to the Packagist
and define that package in composer.jsonfor your project!
{
"require": {
"stloyd/buzz": "1.0",
"hwi/oauth-bundle": "*"
}
}

HOUSTON, WE HAVE A PROBLEM!

COMMON PROBLEMS

THAT PACKAGE CANNOT BE FOUND?
Yet you can we can see it at Packagist or in any other repository. Be sure
to check that in your composer.jsonyou have pointed all required
repositories.
$ composer show pagerfanta/pagerfanta

THAT PACKAGE CANNOT BE FOUND?
If you have all required repositories defined in your composer.json,
you should check that for package you are looking for is defined stable
version.
By default Composer always tries to install/update to latest stable version
in defined range. Sorry to say, but many packages don't have yet any
"stable" version defined.

FORCE PACKAGE STABILITY
You can force Composer to always install packages with different stability,
yet I would not recommend this approach.
{
"require": {
"pagerfanta/pagerfanta": "*"
},
"minimum-stability": "dev"
}

FORCE PACKAGE STABILITY
Better approach is to define stability for specific packages:
{
"require": {
"pagerfanta/pagerfanta": "dev-master"
"symfony/symfony": "2.2.*@dev",
"doctrine/orm": "2.3.*"
}
}

Composer in the wilderness: A guide to dependency management

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Composer in the wilderness: A guide to dependency management

Ähnlich wie Composer in the wilderness: A guide to dependency management (20)

Mehr von php-user-group-minsk

Mehr von php-user-group-minsk (6)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Composer in the wilderness: A guide to dependency management