Allow arbitrary tag names

[lkmorlan]

In our use case, we often need to use locally-modified versions of packages. We tag them like <original version>-<local string>, for example, 5.2.0-localstring2 (this represents our second change to 5.2.0). When we put these in a require directive, Composer says "Could not parse version constraint".

Is there a way to get Composer to accept an arbitrary string as a tag name? Obviously, it won't do any version matching, but it would be very useful to be able to say "use this exact tag". Is there a way to do this?

[alcohol]

https://semver.org/#spec-item-10

[alcohol]

We also accept a limited subset of https://semver.org/#spec-item-9 (for historical reasons we are not fully compatible on this spec).

The subset is defined by this regex: https://github.com/composer/semver/blob/46d9139568ccb8d9e7cdd4539cab7347568a5e2e/src/VersionParser.php#L39

[lkmorlan]

Thanks very much. This almost does what we need. We can use, for example, 5.2+localstring.2. However, this doesn't quite work since "two versions that differ only in the build metadata, have the same precedence". So, if I require 5.2+localstring.1 or 5.2, I get 5.2+localstring.2. Build metadata is stripped off here:
https://github.com/composer/semver/blob/46d9139568ccb8d9e7cdd4539cab7347568a5e2e/src/VersionParser.php#L124
Is there a way around this?

[alcohol]

If you look at my second comment, you will see that we do support a subset of pre-release versions. Can you not work with any of those?

[lkmorlan]

Sort of. We could patch 5.2 like 5.2-patch.1. But if we wanted to patch 5.2-rc1, we can't do 5.2-rc1-patch.1.

[alcohol]

All this talking about patches only, makes me wonder, have you ever considered looking at https://github.com/cweagans/composer-patches ? Just wondering if this perhaps could benefit your use-case. It is of course not entirely clear to me what your use-case is, so it could be useless.

[lkmorlan]

We could do it that way, but it is more work and it means that in the composer.json file, information about a given package is spread between the require key and the extra key. With custom tags, it's easy: We make our modded version in Git, tag it, and require that tag.

[alcohol]

Well, unfortunately, the above thread pretty much summarizes all your options. We are not likely to be changing our way of matching versions to accommodate edge-case scenarios.

[lkmorlan]

Thanks. It comes back to the original request: I think it should be possible for people to require an exact tag and get it. Supporting semver build metadata (as opposed to just allowing it) would also solve this.

[alcohol]

Unfortunately there is a small disconnect between tags and versions. So this is currently not possible, and unlikely to change.

[lkmorlan]

Would the project accept a patch that would allow arbitrary tags to be used? I note that Composer bills itself as a dependency manager and semantic versions are not mentioned on the web site until well into the documentation. So it is not obvious that only semvar-compatible tags can be used.

[stof]

The question is, how would these versions be handled by the solver ?

[alcohol]

Yeah @stof has a very valid point. We cannot determine priority for arbitrary patch names. I really recommend you simply settle on a patching strategy that is more deterministic than "I want exactly this arbitrary patch". Composer handles versions really well. It is not a patching tool. Hence the plugin I referenced, or other options are available. We will not accept a patch to allow arbitrary tags at this point.

[lkmorlan]

The question is, how would these versions be handled by the solver ?

The solver could handle it the same way it handles other exact requires. If I require SomeProject 1.2.3 and something else has an incompatible require, it fails. Likewise, if I require SomeProject 1.2.3-local.1 and something else requires SomeProject at any other version, it fails.