Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125844
Feedback-ID: ifab94697:Fastmail
Precedence: bulk
MIME-Version: 1.0
Date: Thu, 24 Oct 2024 08:10:58 +0200
To: "fennic log" <fenniclog@gmail.com>,
 "Larry Garfield" <larry@garfieldtech.com>
Cc: "php internals" <internals@lists.php.net>
Message-ID: <c62b8d26-2af2-45b3-8f4e-11bf01c41ffb@app.fastmail.com>
In-Reply-To: 
 <CAO__Xv4nyrZLRm9ROUQUHAHtsPOSszo5uFx4rZf4WzS8njTGCQ@mail.gmail.com>
References: <92b537ac-62f4-435c-bf55-07223cfa1915@app.fastmail.com>
 <CAO__Xv4nyrZLRm9ROUQUHAHtsPOSszo5uFx4rZf4WzS8njTGCQ@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] Policy on 3rd party code
Content-Type: multipart/alternative;
 boundary=d381ce535b084f71937e124edefd08e7
From: rob@bottled.codes ("Rob Landers")

--d381ce535b084f71937e124edefd08e7
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable



On Thu, Oct 24, 2024, at 01:57, fennic log wrote:
>=20
> On Wed, 2 Oct 2024 at 19:37, Larry Garfield <larry@garfieldtech.com> w=
rote:
>> Since Jim's RFC proposal was criticized for being too vague, I hereby=
 offer a somewhat more prescriptive policy proposal on using 3rd party c=
ode.  (With JIm's blessing.)  It's still more heuristics than rules, but=
 I think that's the right approach generally.  It also includes a voting=
 mechanism to resolve edge cases when they come up.
>>=20
>> I'm sure we'll bikeshed it to death, but please keep an open mind abo=
ut the concept in the first place.  PHP is more than just php-src, and t=
hat's a good thing.  We need to catch up with that reality, while at the=
 same time maintaining a reasonable neutrality about projects Internals =
doesn't manage directly.
>>=20
>> https://wiki.php.net/rfc/third-party-code
>>=20
>> *Puts on trusty flame-retardant suit*
>>=20
>> --=20
>>   Larry Garfield
>>   larry@garfieldtech.com
>=20
> I remember a while ago a discussion about bundling composer with PHP b=
y default (and possibly dropping pear).
> What ever happened with that?
> As the first thing any dev does after setting up PHP, is install compo=
ser. As this RFC points out, almost every project modern uses composer t=
o manage dependencies, and every Library, SDK and framework requires com=
poser.
> So i'd change this line in the RFC
> >  We should use it, we should document it, we should promote it.
> To
> > We should use it, we should document it, we should promote it, we sh=
ould bundle it!
> =20
> As I mentioned, it is basically a requirement nowadays to work in PHP =
unless you are doing something custom that doesnt require any dependenci=
es, but then, is that person planning to release it to the public?
> I am of no opinion of weather php devs internally should use composer,=
 i have no skin in that game. But Documentation - Yes, Promotion - Yes, =
but does it really need it? Bundle it - Yes!

There is nothing stopping packagers from bundling composer. In fact, `in=
stall-php-extensions` (https://github.com/mlocati/docker-php-extension-i=
nstaller) can do it via `@composer`.=20

Debian packagers can recommend it via =E2=80=9Crecommends=E2=80=9D and I=
 believe the default settings will install it.

The main issue is that composer is updated fairly regularly and most pac=
kage maintainers don=E2=80=99t have the time to keep up with it.=20

=E2=80=94 Rob
--d381ce535b084f71937e124edefd08e7
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}</style></head><body><div><br></div><div>=
<br></div><div>On Thu, Oct 24, 2024, at 01:57, fennic log wrote:<br></di=
v><blockquote type=3D"cite" id=3D"qt" style=3D""><div dir=3D"ltr"><div><=
br></div><div class=3D"qt-gmail_quote"><div dir=3D"ltr" class=3D"qt-gmai=
l_attr">On Wed, 2 Oct 2024 at 19:37, Larry Garfield &lt;<a href=3D"mailt=
o:larry@garfieldtech.com">larry@garfieldtech.com</a>&gt; wrote:<br></div=
><blockquote class=3D"qt-gmail_quote" style=3D"margin-top:0px;margin-rig=
ht:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-=
left-style:solid;border-left-color:rgb(204, 204, 204);padding-left:1ex;"=
><div>Since Jim's RFC proposal was criticized for being too vague, I her=
eby offer a somewhat more prescriptive policy proposal on using 3rd part=
y code.&nbsp; (With JIm's blessing.)&nbsp; It's still more heuristics th=
an rules, but I think that's the right approach generally.&nbsp; It also=
 includes a voting mechanism to resolve edge cases when they come up.<br=
></div><div> <br></div><div> I'm sure we'll bikeshed it to death, but pl=
ease keep an open mind about the concept in the first place.&nbsp; PHP i=
s more than just php-src, and that's a good thing.&nbsp; We need to catc=
h up with that reality, while at the same time maintaining a reasonable =
neutrality about projects Internals doesn't manage directly.<br></div><d=
iv> <br></div><div> <a href=3D"https://wiki.php.net/rfc/third-party-code=
" rel=3D"noreferrer" target=3D"_blank">https://wiki.php.net/rfc/third-pa=
rty-code</a><br></div><div> <br></div><div> *Puts on trusty flame-retard=
ant suit*<br></div><div> <br></div><div> -- <br></div><div> &nbsp; Larry=
 Garfield<br></div><div> &nbsp; <a href=3D"mailto:larry@garfieldtech.com=
" target=3D"_blank">larry@garfieldtech.com</a><br></div></blockquote><di=
v><br></div><div><div>I remember a while ago a discussion about bundling=
 composer with PHP by default (and possibly dropping pear).<br></div><di=
v>What ever happened with that?<br></div><div>As the first thing any dev=
 does after setting up PHP, is install composer. As this RFC points out,=
 almost every project modern uses composer to manage dependencies, and e=
very Library, SDK and framework requires composer.<br></div><div>So i'd =
change this line in the RFC<br></div><div>&gt;&nbsp;=0A We should use it=
, we should document it, we should promote it.<br></div><div>To<br></div=
><div>&gt; We should use it, we should document it, we should promote it=
, we should bundle it!<br></div><div>&nbsp;<br></div></div><div>As I men=
tioned, it is basically a requirement nowadays to work in PHP unless you=
 are doing something custom that doesnt require any dependencies, but th=
en, is that person planning to release it to the public?<br></div><div>I=
 am of no opinion of weather php devs internally should use composer, i =
have no skin in that game. But Documentation - Yes, Promotion - Yes, but=
 does it really need it? Bundle it - Yes!<br></div></div></div></blockqu=
ote><div><br></div><div>There is nothing stopping packagers from bundlin=
g composer. In fact, `install-php-extensions` (<a href=3D"https://github=
.com/mlocati/docker-php-extension-installer">https://github.com/mlocati/=
docker-php-extension-installer</a>) can do it via `@composer`.&nbsp;<br>=
</div><div><br></div><div>Debian packagers can recommend it via =E2=80=9C=
recommends=E2=80=9D and I believe the default settings will install it.<=
br></div><div><br></div><div>The main issue is that composer is updated =
fairly regularly and most package maintainers don=E2=80=99t have the tim=
e to keep up with it.&nbsp;</div><div><br></div><div id=3D"sig121229152"=
>=E2=80=94 Rob<br></div></body></html>
--d381ce535b084f71937e124edefd08e7--