composer does not add entry for "Zend\Session\ValidatorChain" with option "--classmap-authoritative" to "composer/autoload_classmap.php"

[jonathanmaron]

When installing:

zendframework/zend-session (2.6.1)

using:

composer update --classmap-authoritative

The following error is returned:

Fatal error: Class 'Zend\Session\ValidatorChain' not found in /var/www/www.example.com/vendor/zendframework/zend-session/src/SessionManager.php on line 360

The application in question uses exclusively composer for auto-loading of all application libraries and dependency libraries.

The file:

composer/autoload_classmap.php

does not contain an entry for:

Zend\Session\ValidatorChain

This is because the file:

zendframework/zend-session/src/ValidatorChain.php 

does not contain a class definition. Instead, it contains a Polyfill for ValidatorChain. Therefore, the composer "--classmap-authoritative" option cannot locate the class "Zend\Session\ValidatorChain". As far as composer is concerned, it does not exist.

[jonathanmaron]

For a quick and temporary fix, add:

"zendframework/zend-session": "2.5.2 as 2.6.1",

to your composer.json file.

This forces composer to use "zendframework/zend-session" 2.5.2, which does not suffer from the above mentioned issue.

[weierophinney]

@jonathanmaron I've never heard of the --classmap-authoratative option; is that equivalent to running composer dump-autoload --optimize after update? I'll see how we handled this previously in zend-stdlib for the ArrayObject polyfill, and try and get a fix in shortly.

(Also, I wouldn't alias 2.5.2 to 2.6.1, as that implies that the code will work with the v3 releases of zend-eventmanager and zend-servicemanager, and it will not.)

[weierophinney]

Found the docs on --classmap-authoritative: when that option is used, it implies --optimize, but also forces the autoloader to only autoload from the class map.

Frankly, I consider this a dangerous option. When using --optimize, if a class is not found in the class map, it falls back to other forms of autoloading, which ensures that the following are considered:

• package-specific autoloaders (generally provided via the files array); these are sometimes necessary to ensure functions exposed by the package are present, particularly if they are namespaced.
• polyfill shims such as we expose in this package, which can be reached via opportunistic PSR-0/PSR-4 autoloading.

As such, I'd recommend not using that flag. However, I'll still investigate to see if we can do the autoloading resolution another way.

[weierophinney]

2.6.2 contains updates that allow you to use --classmap-authoritative.

[jonathanmaron]

@weierophinney thank you for taking the time to explain the details of --classmap-authoritative. In the specific case of a past application, --classmap-authoritative resulted in a marginally faster autoload execution time than dump-autoload --optimize after composer update, hence I decided to use it. Since then, I have used --classmap-authoritative for all projects. However, following the arguments against this approach, which you kindly enumerated, dump-autoload --optimize works equally well on my current project. Thank you also for fixing the issue I originally reported in 2.6.2.