add a strict mode to Composer and enable it by default

[lsloan]

With the following composer.json:

{"repositories":[{
  "packagist":false,
  "type":"vcs",
  "url":"https://github.com/hoopy-dude/thing-one",
  "url":"https://github.com/hoopy-dude/thing-two"
}],"require":{
  "hoopy-dude/thing-one":"1.0.1",
  "hoopy-dude/thing-two":"dev-master"
}}

When I run this command:

composer install

It will give the warning "Key url is a duplicate in ./composer.json at line 5", but it will continue executing. This should be an error and execution should stop then.

Also, the "packagist":false, line is ignored, and thing-one is installed from Packagist. If disabling Packagist there in that way is not valid, it should cause an error.

Please add a "strict mode" to Composer for parsing its JSON files and enable that mode by default. Allow an option (command line or in the JSON file) to disable strict mode if necessary.

[alcohol]

It is ignored because it should be a repository by itself. Your configuration should be:

"repositories":[{
  "packagist":false
}, {
  "type":"vcs",
  "url":"https://github.com/hoopy-dude/thing-one"
}, {
  "type":"vcs",
  "url":"https://github.com/hoopy-dude/thing-two"
}]

[alcohol]

Also, see composer validate for parsing the JSON file.

During runtime of normal commands, Composer will prefer trying to do the right thing, rather than failing instantly.

[sloanlance]

Ignoring the "packagist" key in that case is not ideal. I'd prefer it to cause an error message and either halt Composer or at least cause that entire "repository" entry to be ignored. At the very least, if the current ignorance behavior is kept, a warning message needs to be given.

[alcohol]

Why? Neither install nor update imply validation. That is explicitly what the validate command is for. Your opinion is noted, but I do not agree.

[sloanlance]

Then I ask you the same question about the warning given for duplicate keys within an object. Why is that shown during update and install if validation isn't implied?

I've also wondered: why the special key for "packagist"? Why not use "type": "packagist"; "enabled": false; instead? The "enabled" key would be useful for other types of repository objects, too.

[lsloan]

Is a JSON schema definition available for composer.json files?

[hkdobrev]

@lsloan https://getcomposer.org/schema.json

[Seldaek]

I added a warning for the case where packagist:false is in the wrong place, as this can help debugging a problem there.