[Owncloud] Composer for PHP dependency management / untangling dependencies and license issues

[Thomas Müller]

Hey,

from my point of view we can use composer to build up the 3rdparty repo.
I've been working on this as well:

https://github.com/owncloud/3rdparty/commits/with-composer-master

With such an approach we can update dependencies easier for sure.
But I'd keep the 3rdparty repo in order to not break the dev setup (again)
and to have a place where we store components which are not available via
composer.

Regards,

Thomas

Am Sonntag, dem 18.08.2013 um 15:44 schrieb François Kooman:
> Hi,
> 
> As an experiment I updated the user_oauth app 
> (https://github.com/owncloud/apps/tree/master/user_oauth) to use 
> Composer (http://getcomposer.org) to do the dependency management. It 
> depends on the php-oauth-lib-rs library to validate tokens.
> 
> It uses the central "packagist.org" repository to resolve dependencies, 
> although directly specifying Git repositories is also possible.
> 
> Running composer will install the dependencies in the "3rdparty" 
> directory of the user_oauth module. The file for the module looks like this:
> 
> {
>      "autoload": {
>          "classmap": [
>              "src/"
>          ]
>      },
>      "config": {
>          "vendor-dir": "3rdparty"
>      },
>      "require": {
>          "fkooman/php-oauth-lib-rs": "0.1.*"
>      }
> }
> 
> It has some major advantages for dependency management, like for example 
> the ability to show all used licenses by the dependencies, as an example 
> my demo OAuth client application:
> 
> Name: fkooman/demo-oauth-app
> Version: 1.0.0
> Licenses: none
> Dependencies:
> 
>    fkooman/guzzle-bearer-auth-plugin   0.2.1                MIT
>    fkooman/php-oauth-client            dev-master 7f028ce   LGPL-3.0+
>    guzzle/guzzle                       v3.7.2               MIT
>    monolog/monolog                     1.5.0                MIT
>    psr/log                             1.0.0                MIT
>    symfony/event-dispatcher            v2.3.3               MIT
> 
> This makes it very easy to do license auditing. In addition it will take 
> care of PSR-0, or classmap, as in the user_oauth case, autoloading of 
> classes. There will no longer be a need to include the 3rdparty 
> repository in Git as it will point at the "official" repositories. 
> Making a release would just mean running "composer install" on the 
> source tree and create a tarball with all the 3rdparty libraries included.
> 
> It would be a fun project to try to see if it is possible to create a 
> composer file for ownCloud by checking the current dependencies and 
> looking as to whether there is a "composerized" version of that library.
> 
> Regards,
> François
> 
> 
> 
> _______________________________________________
> Owncloud mailing list
> Owncloud at kde.org
> https://mail.kde.org/mailman/listinfo/owncloud