Game Changing Dependency Management

Composer
Game Changing Dependency Management

TechCamp Memphis 2013

Saturday, November 2, 13

Jeremy Kendall

I love to code


I love to code
I’m terribly forgetful


I love to code
I take pictures


I love to code
I take pictures
I work at OpenSky


Adding Dependencies is Easy


‣


Copy and Paste

‣
DIY Solution
‣

Copy and Paste


‣
DIY Solution
‣
SVN Externals
‣

Copy and Paste


‣
DIY Solution
‣
SVN Externals
‣
Git Submodules
‣
Copy and Paste


Managing them is Messy


What is Composer?


What is Composer?
‣


Dependency management tool

What is Composer?
‣
Per-project
‣



What is Composer?
‣
Per-project
‣
Inspired by:
‣



What is Composer?
‣
Per-project
‣
Inspired by:
‣
node’s npm
‣



What is Composer?
‣
Per-project
‣
Inspired by:
‣
node’s npm
‣
ruby’s bundler
‣



Beneﬁts


Beneﬁts
‣


Easily declare project dependencies

Beneﬁts
‣
Updating dependency versions extremely simple
‣


Beneﬁts
‣
‣
Ensures your team is on the same page
‣


Beneﬁts
‣
‣
Ensures your team is on the same page
‣
Tons of excellent related features
‣


Installing


Installing Locally
In your project:


$ curl -sS https://getcomposer.org/installer | php

Installing Locally
In your project:

Specify a directory:



$ curl -sS https://getcomposer.org/installer | php -- --install-dir=bin

Installing Locally
In your project:

Specify a directory:

What you’ll see:


$ curl -sS https://getcomposer.org/installer | php -- --install-dir=bin

#!/usr/bin/env php
All settings correct for using Composer
Downloading...
Composer successfully installed to: /Users/jkendall/dev/
composer.phar
Use it: php composer.phar


Installing Globally
Recommended
$ mv composer.phar /usr/local/bin/composer


Installing Globally
Recommended
$ mv composer.phar /usr/local/bin/composer

(You might need to use sudo)


(There’s an installer for
Windows folks)


Keeping up to Date
$ php composer.phar self-update
You are using the latest composer version.

or
$ composer self-update


Keeping up to Date
$ php composer.phar self-update

or
$ composer self-update

(Always updates to the latest dev-master)


Deﬁning Dependencies


composer.json
{
"require": {
"monolog/monolog": "1.6.*"
}
}


composer.json
{
"require": {
}
}

‣Place in the root of your project


composer.json
{
"require": {
}
}

‣“require” speciﬁes package and version


composer.json
{
"require": {
}
}

‣monolog logging library


composer.json
{
"require": {
}
}

‣Version >= 1.6.0 and < 1.7

composer.json
{
"require": {
}
}

‣Version >= 1.6.0 and < 1.7
‣No fuss, no muss

Versions


Versions
‣


Exact version: 1.0.0, 12.2.4, etc.

Versions
‣
Wildcard: 3.*, 4.2.*
‣



Versions
‣
‣
Range: >, >=, <=, !=
‣



Versions
‣
‣
Range: >, >=, <=, !=
‣
Example: >=2.4
‣



Versions
‣
‣
Range: >, >=, <=, !=
‣
Example: >=2.4
‣
Range: >=1.0,<1.7 (comma separated)
‣


Versions
‣
‣
Range: >, >=, <=, !=
‣
Example: >=2.4
‣
Range: >=1.0,<1.7 (comma separated)
‣
Next Signiﬁcant Release: ~1.3.3
‣


Installing Dependencies
composer install
$ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev)
- Installing psr/log (1.0.0)
Loading from cache
- Installing monolog/monolog (1.6.0)
Loading from cache
monolog/monolog suggests installing
Writing lock file
Generating autoload files


mlehner/gelf-php (Allow sending log messages to a GrayLog2 server)
raven/raven (Allow sending log messages to a Sentry server)
doctrine/couchdb (Allow sending log messages to a CouchDB server)
ext-amqp (Allow sending log messages to an AMQP server (1.0+ required))

composer.lock


composer.lock
‣


install writes a dependency lock ﬁle

composer.lock
‣
List of exact versions installed
‣



composer.lock
‣
‣
Commit both composer.lock and composer.json
‣


composer.lock
‣
‣
‣

‣ composer

install now checks the lock ﬁle, not

composer.json


composer.lock
‣
‣
‣

‣ composer

install now checks the lock ﬁle, not

composer.json

‣

Update dependencies with composer update

Updating Dependencies


{
"require": {
"monolog/monolog": "1.6.*@dev"
}
}


{
"require": {
}
}

‣Updates monolog library version


{
"require": {
}
}

‣Updates monolog library version
‣Version >= 1.6.0 and < 1.7 (dev)

composer update
$ composer update
Updating dependencies (including require-dev)
- Removing monolog/monolog (1.5.0)
- Installing monolog/monolog (dev-master c933bb6)
Cloning c933bb67a8a2e45c42d0626a0cd6569789bf6ed7
Writing lock file


composer update
$ composer update
Writing lock file

‣Reads from composer.json


composer update
$ composer update
Writing lock file

‣Updates dependencies

composer update
$ composer update
Writing lock file

‣Updates dependencies
‣Rewrites lock ﬁle

Adding New Dependencies
Edit composer.json . . .
{
"require": {
"monolog/monolog": "1.6.*@dev",
"ircmaxell/password-compat": "1.0.3"

}
}


Adding New Dependencies
Or use the command line
composer require
$ composer require ircmaxell/password-compat:1.0.3
composer.json has been updated
- Installing ircmaxell/password-compat (1.0.3)
Downloading: 100%
Writing lock file


Autoloading


Autoloading
‣


Composer generates vendor/autoload.php

Autoloading
‣
Add require ‘vendor/autoload.php’;
‣



Autoloading
‣
Add require ‘vendor/autoload.php’;
‣
Immediately begin using your dependencies
‣



Autoloading
Don’t forget to add your own code!
{
"require": {
},
"autoload": {
"psr-0": {
"Beeblebrox": "src/"
}
}
}


Autoloading
Pro Tip
Grab an autoloader instance and
add more namespaces.
$loader = require 'vendor/autoload.php';
$loader->add('AcmeTest', __DIR__);


Kickstart a Project
composer create-project
$ composer create-project slim/slim-skeleton super-sweet-application
Installing slim/slim-skeleton (1.1.0)
- Installing slim/slim-skeleton (1.1.0)
Downloading: 100%
Created project in super-sweet-application
Installing dependencies (including require-dev)
- Installing slim/slim (2.3.0)
Downloading: 100%
- Installing slim/extras (2.0.3)
Loading from cache
- Installing twig/twig (v1.13.1)
Loading from cache
Writing lock file


Little Bobby Tables as a Service
composer create-project jeremykendall/lbtaas lbtaas


Little Bobby Tables as a Service
http://lbtaas.dev

{
"status":"success",
"data":{
"name":"Exploits of a Mom",
"permalink":"http://xkcd.com/327/",
"image":"http://imgs.xkcd.com/comics/exploits_of_a_mom.png"
}
}


Your Very Own Library


Libraries


Libraries
‣


Everyone has written a library of some sort

Libraries
‣
Making up examples is not my strong suit
‣



Libraries
‣
‣
Let’s walk through a real library . . .
‣



Libraries
‣
‣
Let’s walk through a real library . . .
‣
. . . and check out some awesome Composer features
‣


PHP Domain Parser

https://github.com/jeremykendall/php-domain-parser

{

}

"name": "jeremykendall/php-domain-parser",
"description": "Public Suffix List based URL parsing implemented in PHP.",
"license": "MIT",
"authors": [
{
"name": "Jeremy Kendall",
"homepage": "http://about.me/jeremykendall",
"role": "Developer"
}
],
"bin": ["bin/pdp-psl"],
"keywords": ["Public Suffix List", "domain parsing", "url parsing"],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
"mikey179/vfsStream": "1.1.*",
"jeremykendall/phpctagger": "0.0.*"
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
"post-install-cmd": [
"PhpCtaggerComposerScriptCtagger::ctag"
],
"post-update-cmd": [
]
}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Package requirements

}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Package requirements

}

Autoloading

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Add the “name” key
and it’s installable

}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Additional
metadata

}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Don’t forget the license!

}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

Full ﬂedged library!

}

Now for the cool(er)
stuff . . .


{

}

"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

require-dev

require-dev


require-dev
‣


Lists packages required for development (think tests)

require-dev
‣
Only applies to the root package
‣



require-dev
‣
‣
Both install and update install require-dev by default
‣


require-dev
‣
‣
Both install and update install require-dev by default
‣
(Use the --no-dev ﬂag to skip installing dev
‣ dependencies)


{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],


}

bin

"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

bin
‣


cli scripts to pass along to package users

bin
‣
A set of ﬁles that should be treated as binaries
‣


bin
‣
‣
Installs binaries to vendor/bin for any project that
‣ depends on your project


bin
‣
‣
Installs binaries to vendor/bin for any project that
‣ depends on your project

‣


php-domain-parser uses a bin to update the local copy
of the public sufﬁx list

{

}

"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}

scripts

scripts


scripts
‣


Used to execute custom code during the Composer
execution process

scripts
‣
‣


execution process
PHP callback (deﬁned as a static method) . . .

scripts
‣

execution process

‣
. . . or any command-line executable command
‣


scripts
‣

execution process

‣
‣
Only scripts deﬁned in the root composer.json are
‣ executed


scripts
‣

execution process

‣
‣
Only scripts deﬁned in the root composer.json are
‣ executed

‣

If a script is deﬁned in a dependency, you can use it in
your composer.json

scripts
‣


Composer ﬁres “named events” during execution

scripts
‣
Named events include:
‣



scripts
‣
‣
pre- and post-install-cmd
‣



scripts
‣
‣
‣
pre- and post-update-cmd
‣



scripts
‣
‣
‣
‣
post-root-package-install
‣



scripts
‣
‣
‣
‣
post-root-package-install
‣
Many more . . .
‣



Running scripts


Running scripts
Execute Composer (script will execute if the named
event is triggered) or . . .


Running scripts
Execute Composer (script will execute if the named
event is triggered) or . . .
composer run-script <named event>


Example
public static function create(Event $event)
{
$dir = dirname($event->getComposer()->getConfig()->get('vendor-dir'));
$io = $event->getIO();
$io->write('Reviewing your Flaming Archer environment . . .', true);
$configExists = file_exists($dir . '/config.php');
$configDistExists = file_exists($dir . '/config-dist.php');
if (!$configExists && $configDistExists) {
$io->write('Creating config.php by copying config-dist.php . . .', true);
copy($dir . '/config-dist.php', $dir . '/config.php');
$io->write("Done! Please edit config.php.", true);
} else {
$io->write('Found config.php.', true);
}
}

https://github.com/jeremykendall/ﬂaming-archer/blob/develop/library/Fa/Composer/Script/Conﬁg.php

You’ve built your library.
Now what?


Push it to a VCS


Push it to a VCS
‣


git, svn, or hg all work equally well

Push it to a VCS
‣
For the sake of simplicity I’ll assume git/github
‣


Push it to a VCS
‣
‣
Package versions:
‣


Push it to a VCS
‣
‣
Package versions:
‣
Tags are package versions (1.0.0, v2.5.4, etc)
‣


Push it to a VCS
‣
‣
Package versions:
‣
‣
Branches are dev versions (dev-{branchname},
‣ {branchname}-dev)


Push it to a VCS
‣
‣
Package versions:
‣
‣
Branches are dev versions (dev-{branchname},
‣ {branchname}-dev)

‣

For this reason, I strongly recommend using semantic
versioning: http://semver.org

Share!


Packagist


Packagist
‣


The main package repository for Composer

Packagist
‣
(Aside: Search Packagist before “rolling your own”)
‣


Packagist
‣
‣
Packages published there need no special settings in
‣ composer.json to be installable (see “repositories” key)


Packagist
‣
‣

‣


Submitting is dead simple

Packagist
‣
‣

‣
Create account, hit big green submit button
‣
Submitting is dead simple


Packagist: Package Search


Packagist: Keyword Search


Packagist: Package


But what about internal
proprietary packages?


Satis to the Rescue


Satis to the Rescue
‣


Static composer repository generator

Satis to the Rescue
‣
Lightweight, static ﬁle based version of Packagist
‣


Satis to the Rescue
‣
‣
Simple to conﬁgure
‣


Satis to the Rescue
‣
‣
Simple to conﬁgure
‣
Flexible
‣


composer create-project composer/satis --stability=dev

$ composer create-project composer/satis --stability=dev --keep-vcs
Installing composer/satis (dev-master 059588ef0fd0977964ad13637e02012519686202)
- Installing composer/satis (dev-master master)
Cloning master
Created project in /Users/jkendall/dev/satis
Installing dependencies (including require-dev) from lock file
Warning: The lock file is not up to date with the latest changes in composer.json . . .
- Installing symfony/process (dev-master 75c8101)
Cloning 75c810176f8e069714cef8696d7ecc3aa86e8168
- [ . . . ]
- Installing twig/twig (v1.13.1)
Loading from cache
symfony/console suggests installing symfony/event-dispatcher ()


Satis conﬁg.json
{
"name": "Satis Demo",
"homepage": "http://satis.dev",
"repositories": [
{ "type": "vcs", "url": "https://github.com/jeremykendall/php-domain-parser" },
{ "type": "vcs", "url": "https://github.com/jeremykendall/phpctagger" }
],
"require": {
"jeremykendall/php-domain-parser": ">=0.0.5",
"jeremykendall/phpctagger": ">0.0.6"
},
"archive": {
"directory": "dist",
"format": "tar"
}
}


Build Repo
$ php bin/satis build config.json web/


composer.json
{
"repositories": [
{ "type": "composer", "url": "http://satis.dev" }
],
"require": {
"jeremykendall/php-domain-parser": "0.0.7"
}
}


Satis Demo Project


Satis Demo Project
‣


Want to goof around with Satis?

Satis Demo Project
‣
See: https://github.com/jeremykendall/satis-demo
‣


Satis Demo Project
‣
‣
Clone, follow instructions in README, and WIN
‣


Satis Demo Project
‣
‣
Clone, follow instructions in README, and WIN
‣
Satis really is dead simple to set up
‣


Parting Tips and Tricks


composer install --no-dev --prefer-dist --optimize-autoloader


“example/package”: “2.3.x-dev#5aec89a”


Non-Composer and PEAR packages can be installed
(see “repositories” key documentation)


archive key


http://getcomposer.org
#composer on irc.freenode.org


There’s So Much More!


Credits


Credits
‣

Thanks to TechCamp for having me

IMMA LET YOU FINISH,
BUT RAFAEL DOHMS
HAS THE BEST
COMPOSER TALK OF
ALL TIME.

Credits
‣


Thanks to Rafael Dohms, the Composer presenter

Credits
‣
‣



Credits
‣
‣
Thanks to Jordi Boggiano, Nils Adermann, and the
‣ community for an amazing project (and all the


documentation I cribbed from)


Credits
‣
‣



‣

Thanks to our sponsors for help making this happen

Credits
‣
‣



‣
Thanks to all of you for being here
‣

Thanks to our sponsors for help making this happen


Thanks!
jeremy@jeremykendall.net
http://about.me/jeremykendall
@jeremykendall
http://365.jeremykendall.net


Game Changing Dependency Management

More Related Content

What's hot (20)

Viewers also liked (6)

Similar to Game Changing Dependency Management (20)

More from Jeremy Kendall (15)

Recently uploaded (20)

Game Changing Dependency Management