Managing private composer packages

Everybody in the open source community knows about Composer, THE dependency manager for php. The reason for this success is probably the ease of use for both installing and creating packages. This talk is about using Composer in a corporate environment.

This talk is about how to use composer and how to create your own repository.

Transcript

1. Managing private composer packages
2. Reen Lokum  @reenlokum  https://github.com/reenl/  IRC: Freenode #010php ReenL
3. Composer basics
4. Composer  https://getcomposer.org/  Dependency Manager for PHP  Project based
5. The composer “API” <?php require 'vendor/autoload.php'; ❯ vendor/bin/... ❯ composer help
6. composer.json { "require": { "monolog/monolog": "~1.3" } } ❯ composer require monolog/monolog ~1.3
7. Composer install
8. Packagist.org  Default package repository  Anyone can submit  Must be public repository
9. Semantic versioning MAJOR.MINOR.PATCH Compatible Feature Compatible Bugfix Incompatible 3 . 2 . 1
10. Version selection  Fixed: 1.0.2  Range: >=1.0  And: >=1.0,<1.1  Wildcard: 1.0.*  Tilde: ~1.2 >=1.2,<2.0
11. Why wildcard sucks  troll/package  monolog/monolog: 1.2.*  reen/package  troll/package: ~1.0  monolog/monolog: ~1.3
12. Why tilde rocks  awesome/package  monolog/monolog: ~1.2  reen/package  awesome/package : ~1.0  monolog/monolog: ~1.3
13. Composer update & install
14. (My) Composer Flow  Composer install --prefer-source  Development  Composer update --prefer-source  After composer.json modification  Bugfixes for dependencies  Commit composer.lock!  Composer install --no-dev --optimize-autoloader  Deployment
15.  Composer install and update  Require autoloader  Use tilde ~ for dependencies  Semantic versioning Composer basics
16. Hosting private packages
17. Satis ❯ composer create-project composer/satis --stability=dev --keep-vcs /path/to/satis Self-hosted package repository for composer
18. Satis.json { "name": "Alphacomm", "homepage": "https://packages.alphacomm.nl", "output-dir": "web", "repositories": [ { "type": "vcs", "url": "https://user:password@bitbucket.org/alphacomm/acgr-sms-api.git" } ], "require-all": true }
19. ❯ bin/satis build
20. Enable repository in composer.json ❯ composer config repositories.alphacomm composer https://packages.alphacomm.nl ❯ composer require alphacomm/sms-api ~1.0
21. Satis: Host dependencies { "repositories": [ { "type": "composer", "url": "https://packagist.org" }, { "type": "vcs", "url": "https://user:password@bitbucket.org/alphacomm/acgr-sms-api.git" } ], "require-all": false, "require-dependencies": true, "require": { "alphacomm/sms-api": "*" } }
23. Archives { "archive": { "directory": "dist", "format": "zip", "skip-dev": true, "blacklist": [ "acos/annabel-scripts" ] } }
26. Add satis build to your crontab
27. Authentication  Add basic http auth to webserver  Create deploy user  Configure composer (globally?) <Directory /path/to/web> AuthType Basic AuthName "Authentication Required" AuthUserFile "/path/to/.htpasswd" Require valid-user </Directory> ❯ composer config http-basic.<host> <deploy-user> <deploy-password>
28. Satis: Summary  Satis installation  Require packages in satis.json  Enable in project: ❯ composer config repositories.alphacomm composer https://packages.alphacomm.nl
29. Questions?
30. Thanks!
31. Bonus slides
32. Suggestions
33. Suggestions { "suggest": { "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server" } }
34. Dependencies! monolog/graylog2-bridge  Require  graylog2/gelf-php: ~1.0  monolog/monolog: ~1.10 monolog/monolog  Suggest  monolog/graylog2-bridge
35. Satis Customization { "twig-template": "path/to/template.html.twig" }
36. Disabling packagist  Remove packagist.org  Issue: can’t add new dependencies without waiting for satis build { "repositories": [ { "packagist": false }, { "type": "composer", "url": "https://packages.alphacomm.nl" } ] }
37. Toran Proxy  https://toranproxy.com/  Packagist proxy  Free for personal use