Decomposing Packages (Symfony Live Berlin 2015)

Using Composer and Packagist makes using 3rd-party code easier but relying on 3rd-party code can have drawbacks. Projects are abandoned. Maintainers become unresponsive. Fortunately, Composer provides tools to help make these situations a little easier to manage. Learn how to leverage Composer features like "replace" and tools like Satis to manage forks of 3rd-party packages. See pros and cons of various methods so that you can feel more confident in how you decide to move forward with decomposing other people's packages.

Transcript

1. Decomposing Packages Beau Simensen @beausimensen • @moniidev • @thatpodcast joind.in/15054
2. <3 Composer
3. <3 Dependencies
4. :( Dependencies
5. Security
6. Change Tracking
7. Version Conflict
8. Slow Release Cycle
9. Abandoned
10. Different Goals
11. Working on Dependencies
12. Debugging
13. Bug Squashing
14. vendor Development
15. Live Debugging
16. @dev installed and/or --prefer-source
17. composer remote
18. Fork ...Clone and Develop In Another Directory
19. Override versus Rename and replace
20. Override
21. Fork's composer.json { name: "their-vendor/their-package" }
22. Consumer's composer.json { "require": { "their-vendor/their-package": "^1.0" } }
23. Rename and replace
24. No need to rename a package just to work on it.
25. vendor/package is not always username/repo
26. Fork's composer.json? { name: "my-vendor/their-package" }
27. Fork's composer.json { name: "my-vendor/their-package" } BAD
28. Consumer's composer.json { "require": { "their-vendor/their-package": "^1.0" } } my-vendor/their-package?!
29. Fork's composer.json { name: "my-vendor/their-package", replace: { "their-vendor/their-package": "self.version" } }
30. Working on a short-term solution? Avoid replace.
31. Repositories
32. Configuration composer config \ repositories.their-package \ vcs \ https://github.com/me/their-package
33. vcs Composer Repository Type
34. Consumer's composer.json { "require": { "their-vendor/their-package": "^1.0" }, "repositories": { "their-package": { "type": "vcs", "url": "https://github.com/me/their-package" } } }
35. Consumer's composer.json { "require": { "their-vendor/their-package": "^1.0" }, "repositories": { "their-package": { "type": "vcs", "url": "file:///path/to/clone-of/their-package" } } }
36. as
37. Consumer's composer.json { "require": { "their-vendor/their-package": "dev-my-fix as 1.0.5" }, "repositories": { "their-package": { "type": "vcs", "url": "file:///path/to/clone-of/their-package" } } }
38. path Composer repository type
39. Consumer's composer.json { "require": { "their-vendor/their-package": "^1.0" }, "repositories": { "their-package": { "type": "path", "url": "../their-package" } } }
40. Long-term
41. Abandoned
42. Refused or Ignored Pull Requests
43. Ownership
44. Change Tracking
45. Repositories
46. Global Repositories composer config --global \ repositories.their-package \ vcs \ https://github.com/me/their-package
47. VCS Repositories
48. Slow
49. Composer Repositories
50. Faster on edges
51. Packagist github.com/composer/packagist
52. Satis github.com/composer/satis
53. Static
54. Rebuild on Cron
55. Rebuild on Push
56. Toran toranproxy.com
57. "Dynamic"
58. Proxy
59. Disable Packagist
60. Monolith The Cool Kids.
61. All Your Eggs in One Basket
62. provide
63. App's composer.json { "name": "your-vendor/your-app", "provide": { "their-vendor/their-package": "1.0.3" } }
64. replace
65. App's composer.json { "name": "your-vendor/your-app", "replace": { "their-vendor/their-package": "1.0.3" } }
66. App's composer.json { "name": "your-vendor/your-app", "replace": { "their-vendor/their-package": "1.0.3" } } Meh. Provide more reasonable?
67. Forks's composer.json { "name": "your-vendor/their-package", "replace": { "their-vendor/their-package": "self.version" } }
68. Path Repository
69. Fiddler github.com/beberlei/fiddler
70. { "deps": [ "components/Foo", "vendor/symfony/symfony" ], "autoload": { "psr-0": {"Foo\\": "src/"} } }
71. Conductor github.com/mybuilder/conductor
72. Artifacts and Symlinks
73. Version Conflicts
74. ^2.7|3@dev
75. Guzzle
76. Stack & Pimple
77. Many Stack Middleware Have Pimple 1 at Their Core... { "name": "stack/session", "require": { "pimple/pimple": "^1.0" } }
78. And Are Completely Incompatible with Silex 2 { "name": "silex/silex", "require": { "pimple/pimple": "~3.0" } }
79. No Resolution
80. Question Why do Stack middleware depend on Pimple?
81. Reuse! Reuse! Reuse! Reuse! Reuse! Reuse!
82. Just Copy It™ — @davedevelopment
83. decomposer* github.com/paircasts/decomposer * kinda a joke... but the repo exists.
84. When you install a library, you are responsible for the code in that library. — https://igor.io/2013/09/24/dependency- responsibility.html
85. joind.in/15054 Questions? @beausimensen • @moniidev • @thatpodcast