[Flow] Commit the composer.lock file or not?

[Jigal van Hemert]

Hi,

On 26-7-2013 15:47, Mario Rimann wrote:
> The guys that brought us composer suggest to commit the composer.lock
> file, so that the exact same set of packages/revisions is installed
> wherever the installation happens.
>
> Basically this seems to be a great idea. But it would bring us back to
> something very similar like updating Git submodule pointers on each
> change - I don't want this to come back.

Thanks for brining this up. There are some things about composer that 
bring more questions:

Version
-------

On one hand you want to set the version number of a package as flexible 
as possible. This way you can easily update to new versions for example 
when a security update is published.
On the other hand authors of software may very well introduce breaking 
changes in any new version. In that case an update may not work fine or 
even introduce bugs or side effects.

If you use a lock file to freeze the versions the advantage of updates 
is gone and you could easily have included the package in the distribution.

Location
--------

Packages are hosted outside our infrastructure. That makes us depending 
on third party websites for our distributions. I know we use sourceforce 
to serve our distributions, but we've shown in the past that we can 
quickly switch in case of problems.
How can that be done with composer packages?
If we host our own repository then we introduce more maintenance work 
for this and if we host the packages (mirror) we introduce even more 
maintenance work.

Offline / restricted access use
-------------------------------

There are plenty of installations in a closed intranet or with 
restricted access to the internet (white list). For this we should have 
a distribution which includes all the packages.
Combine such a distribution with the possible need to include a lock 
file and there is no real reason to use composer at all for everything 
except our own repository (replacement of part of the extension manager)

I'd love to hear suggestions on how to handle these issues.

-- 
Jigal van Hemert
TYPO3 CMS Active Contributor

TYPO3 .... inspiring people to share!
Get involved: typo3.org