[Vtigercrm-developers] Composer

Prasad prasad at vtiger.com
Sun Aug 15 19:48:36 GMT 2021


Dear Mohan,

When you do composer install / update - it pulls all the bundles (like docs
/ tests etc...) that are not required on the production build.
These extra fat need to be removed when persisting in the repo.

Regards,
Prasad

On Sun, Aug 15, 2021 at 11:24 PM Sukhdev Mohan <s.mohan at myti.it> wrote:

> Hi Prasad,
>
> What do you mean by “optimize required files to reduce the source
> file-size.” ?
>
> When dev runs composer install on their machine, composer downloads the
> required projects and stores them under vendor. Then you just use Namespace
> to load the files you want - are you guys creating a vtiger namespace to
> avoid conflicts? - how would you like to optimise this code?
>
> *Sukhdev Mohan*
> *Developer*
> On 15 Aug 2021, 19:24 +0200, Prasad <prasad at vtiger.com>, wrote:
>
> While working with RedBeanPHP, I found some advice on distancing
> (runtime tight-coupling) with dynamic dependency management.
>
> Arch Linux Incident
> <https://sensorstechforum.com/arch-linux-aur-repository-found-contain-malware/> and
> more (read Composer section <https://redbeanphp.com/index.php?p=/install>)
>
> Even with use of composer we will have the need to carefully
> freeze the dependencies and optimize required files to reduce
> the source file-size.
>
> Regards,
> Prasad
>
> On Wed, Jul 28, 2021 at 11:47 AM Prasad <prasad at vtiger.com> wrote:
>
>> Thank you all for sharing the feedback.
>>
>> Keep it coming.
>>
>> On Wed, Jul 28, 2021 at 10:23 AM nilay khatri <nilay.spartan at gmail.com>
>> wrote:
>>
>>> My take:
>>>
>>> 1. Agree with Ruben let's start with some selected dependencies first,
>>> which are currently actively maintained. I don't think we need to bundle
>>> them with Vtiger.
>>> 2. This is a general challenge. I am not fully aware, but cPanel for
>>> example has been doing some work to introduce support for composer. In
>>> general where composer is not available or you can not SSH, steps are
>>> provided to setup locally and then upload the files via FTP. It is
>>> generally well known thing to anyone who works on FTP only.
>>> 3. The packages do not have standard format, one can put the files in
>>> src other in dist as such there is no mechanism to do that. Moreover as per
>>> composer philosophy, a package must contain all required tests, docs etc.
>>> More on this here: https://github.com/composer/composer/issues/1750
>>>
>>> On Tue, Jul 27, 2021 at 11:12 PM Rubén A. Estrada Orozco <
>>> rulotec1 at gmail.com> wrote:
>>>
>>>> Ok, I understand Parsad,
>>>>
>>>> I think we could proceed little by little. Moving only some well known
>>>> libraries at first like  PHPMailer which is actively being maintained.
>>>> There are other libraries like CKFinder (if I recall the name correctly)
>>>> which are still being used in vtiger but have been dead for a long time. I
>>>> don't know what we should do about those. Find a replacement, I guess.
>>>>
>>>> About how it would work with commercial hosting companies. Maybe create
>>>> a build with the dependent libraries already there, but move the libraries
>>>> out of the code repository.
>>>>
>>>> About 3. I have no idea.
>>>>
>>>> Saludos
>>>>
>>>> Rubén
>>>>
>>>>
>>>> On Tue, Jul 27, 2021 at 7:34 AM Prasad <prasad at vtiger.com> wrote:
>>>>
>>>>> Dear Ruben,
>>>>>
>>>>> There were many questions on the composer adoption for long-term:
>>>>>
>>>>>    1. Should we bundle the dependency (as they may vanish if not
>>>>>    maintained) or change rapidly
>>>>>    2. How would composer work on hosting providers (who provide
>>>>>    Cpanel or FTP) based site management?
>>>>>       - Will two different builds - one-with and one-without
>>>>>       dependencies be maintained?
>>>>>    3. Composer install brings in dependent docs/tests etc... Is there
>>>>>    a way to do optimal install?
>>>>>       - How to cut-down the size of package - can this be achieved?
>>>>>       Without this overall size of application zip will increase.
>>>>>
>>>>> This discussion thread was opened to gather feedback before planning
>>>>> the way ahead.
>>>>>
>>>>> Regards,
>>>>> Prasad
>>>>>
>>>>> On Tue, Jul 27, 2021 at 4:57 AM Rubén A. Estrada Orozco <
>>>>> rulotec1 at gmail.com> wrote:
>>>>>
>>>>>> Composer was supposed to make it into 7.4.
>>>>>> Would it be a priority for 7.5? I think this was one of the most
>>>>>> voted changes when Uma asked for input for 7.4.
>>>>>>
>>>>>> Saludos
>>>>>>
>>>>>> Rubén
>>>>>>
>>>>>>
>>>>>> On Fri, Jul 23, 2021 at 11:18 AM Prasad <prasad at vtiger.com> wrote:
>>>>>>
>>>>>>> Since we are talking about composer, what exactly do you want to do?
>>>>>>>
>>>>>>>
>>>>>>> How would composer work on hosting providers (who provide Cpanel or
>>>>>>> FTP) based site management?
>>>>>>>
>>>>>>> You mentioned npm, are you guy’s touching frontend and
>>>>>>>> migrating/integrating vue or some other library?
>>>>>>>
>>>>>>>
>>>>>>> I wanted to check how npm dependencies and sub-dependencies are
>>>>>>> handled for comparison.
>>>>>>> Where some night-mares was cited due to version different in
>>>>>>> child-dependencies. Hope such are not the
>>>>>>> case with composer - but wanted to still check.
>>>>>>>
>>>>>>> Regards,
>>>>>>> Prasad
>>>>>>>
>>>>>>> On Fri, Jul 23, 2021 at 9:19 PM Sukhdev Mohan <s.mohan at myti.it>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>>    1. When creating composer.json you’re inserting all the
>>>>>>>>    dependencies and you can lock versions of the libraries you are importing.
>>>>>>>>    Also look at PSR 4 for namespaces: in the same composer.json you define the
>>>>>>>>    namespace for your app.
>>>>>>>>    2. Yup, I’d leave it upon admin the decision to update. Vtiger
>>>>>>>>    can advise and don’t proceed with update with dependencies aren’t met.
>>>>>>>>    3. If core depends on something that you need to import/install
>>>>>>>>    how can you proceed with installation/update? In other projects when you
>>>>>>>>    install through composer it handles dependencies and proceeds to install.
>>>>>>>>    May be also vtiger should create it’s composer install?
>>>>>>>>    4. Composer doesn’t needs to be installed globally, if the user
>>>>>>>>    who downloads composer has RWX access he can launch composer and download
>>>>>>>>    the dependencies, which are PHP code and binary files. These may require
>>>>>>>>    some components that are missing in the standard php installation (ie.
>>>>>>>>    ioncube), so this is upon the single user.
>>>>>>>>
>>>>>>>>
>>>>>>>> Since we are talking about composer, what exactly do you want to do?
>>>>>>>>
>>>>>>>> You mentioned npm, are you guy’s touching frontend and
>>>>>>>> migrating/integrating vue or some other library?
>>>>>>>>
>>>>>>>> *Sukhdev Mohan*
>>>>>>>> *Developer*
>>>>>>>> On 23 Jul 2021, 16:39 +0200, Prasad <prasad at vtiger.com>, wrote:
>>>>>>>>
>>>>>>>> Team,
>>>>>>>>
>>>>>>>> I know I'm too late on this thread - did some homework using
>>>>>>>> composer
>>>>>>>> and npm packages got some questions that need assistance:
>>>>>>>>
>>>>>>>> 1. With composer  - we are not expected to package the dependencies?
>>>>>>>> Would admin expected to (composer install) command-line and then
>>>>>>>> launch the install.php?
>>>>>>>>
>>>>>>>> 2. When a package need update in subsequent version of Vtiger
>>>>>>>> Would admin be expected to (composer update) command-line and then
>>>>>>>> launch the migration.php?
>>>>>>>>
>>>>>>>> 3. What if composer fails with unmet / unavailable packages -
>>>>>>>> should install.php or
>>>>>>>> migration.php check if all dependencies was installed?
>>>>>>>>
>>>>>>>> 4. How would composer work on hosting providers (who provide
>>>>>>>> Cpanel or FTP) based site management?
>>>>>>>>
>>>>>>>> Regards,
>>>>>>>> Prasad
>>>>>>>>
>>>>>>>>
>>>>>>>> On Tue, Aug 13, 2013 at 2:47 AM Adam Heinz <amh at metricwise.net>
>>>>>>>> wrote:
>>>>>>>>
>>>>>>>>> Has anyone on the vtiger team looked into the use of Composer to
>>>>>>>>> supply dependencies?  It would certainly make things a little more
>>>>>>>>> flexible, reduce the size of the download, and discourage the light hacking
>>>>>>>>> that tends to go on when you have the code checked into the main
>>>>>>>>> development branch.
>>>>>>>>>
>>>>>>>>> http://getcomposer.org/
>>>>>>>>>
>>>>>>>>> I recently wired our systems up to use it to pull in the Sauce
>>>>>>>>> Labs "sausage" Selenium web driver for our automated tests.  Doing a bit
>>>>>>>>> more research, it seems to be the *de facto* replacement for PEAR
>>>>>>>>> these days.
>>>>>>>>> _______________________________________________
>>>>>>>>> http://www.vtiger.com/
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> http://www.vtiger.com/
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> http://www.vtiger.com/
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> http://www.vtiger.com/
>>>>>>
>>>>>> _______________________________________________
>>>>>> http://www.vtiger.com/
>>>>>
>>>>> _______________________________________________
>>>>> http://www.vtiger.com/
>>>>
>>>> _______________________________________________
>>>> http://www.vtiger.com/
>>>
>>> _______________________________________________
>>> http://www.vtiger.com/
>>
>> _______________________________________________
> http://www.vtiger.com/
>
> _______________________________________________
> http://www.vtiger.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20210816/d3588f6a/attachment-0001.html>


More information about the vtigercrm-developers mailing list