Composer : Require for zendframework/zend-permissions-rbac installing whole zf2

[harikt]

Hi Guys,

I have been playing with zendframework/zend-permissions-rbac .

Installing via composer.json with only require works good.

And I created a package for the Aura.Framework named Domicile.Access

https://github.com/harikt/Domicile.Access/blob/master/composer.json#L23

But when downloading via composer I noticed the whole zf2 is installed.

I thought it may be for some issues with the aura installer and created a sample for testing .

https://raw.github.com/bridgyhari/Example.Testing/master/composer.json

{
    "name": "example/testing",
    "type": "libary",
    "homepage": "https://github.com/bridgyhari",
    "license": "BSD-2-Clause",
    "authors": [
        {
            "name": "Hari K T",
            "homepage": "http://harikt.com"
        }
    ],
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.zendframework.com/"
        }
    ],
    "require": {
        "zendframework/zend-permissions-rbac": "2.1"
    },
    "autoload": {
        "psr-0": {
            "Example\\Testing": "src/"
        }
    }
}

But it still having trouble . I am wondering why its so.

https://github.com/zendframework/zf2/blob/master/library/Zend/Permissions/Rbac/composer.json

Thank you for the help

[weierophinney]

Try "2.1.*" as the version, please, and let me know how that works.

[weierophinney]

BTW, I tried the above using "2.1.*" as the version, and worked perfectly the first time (IIRC, "2.1" will not work as a regular version; it must be a fully qualified version, or a wildcard). Try removing $HOME/.composer (it's a directory) as well, before running an install, to see if you had a stale cache.

You may need to take this to the composer developers, as I cannot reproduce the issue.

[harikt]

@weierophinney can you share me the composer.json you tried ?

I guess it is something like

{
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.zendframework.com/"
        }
    ],
    "require": {
        "zendframework/zend-permissions-rbac": "2.1.*"
    }
}

This works well as stated earlier .

The only issue is when you add into the package I am trying to download which uses zendframework/zend-permissions-rbac

{
    "minimum-stability": "dev",
    "require": {
        "domicile/access": "dev-master"
    }
}

Try the above and see what is downloading at your end .

[weierophinney]

If you specify a minimum-stability of "dev", you will always get a full checkout. This is because we do not have separate repositories for each component; source for all components is in the same repository. As such, our ZF2 composer.json specifies that it replaces all packages we normally offer via our channel, and when you specify a dev version, you get the full framework.

We are considering some solutions, including the git-subsplit project, but that's not an issue for this tracker; it's an infrastructure issue.

[harikt]

@weierophinney when I am keeping "minimum-stability": "dev" I am assuming to install development version of the package "domicile/access" . Not sure whether this can be resolved by the composer guys then for I am not requesting the development version of the zend framework package. The package is clearly specified to 2.1 .

[weierophinney]

@harikt "2.1" is an imprecise version -- it's saying "latest 2.1", not "2.1.0". If you want specifically 2.1.0, use 2.1.0 as the version string.

Whenever you set "minimum-stability" to "dev", it affects any package you install. If the version is imprecise, it will grab the latest dev version for that package. You have to tell composer a specific version, or that you want only stable versions -- which is not what you're doing in your example above.

One thing you can try is as follows:

{
        "repositories": [
                {
                "type": "composer",
                "url": "https://packages.zendframework.com/"
                }
        ],
        "minimum-stability": "dev",
        "require": {
           "zendframework/zend-permissions-rbac" : "2.1.*@stable"
        }
}

Note the "@stable" flag -- that ensures that only stable packages are considered for that dependency. I've tried this, and it works fine.

[harikt]

Hi @weierophinney ,

Thank you for the help . But you are thinking differently .

I am talking different I guess.

Consider you are going to create another library which make use of some of the components of zend framework.

My library will be stable only after certain releases . So the composer.json of my library which uses is as below . ( what I have written earlier itself )

{
    "name": "domicile/access",
    "type": "aura-package",
    "description": "Dynamic role based access control for Aura.Framework with the help of Zend\\Permission\\Rbac",
    "keywords": [ "role based", "access", "aura framework" ],
    "homepage": "https://github.com/harikt/Domicile.Access",
    "license": "BSD-2-Clause",
    "authors": [
        {
            "name": "Hari K T",
            "homepage": "http://github.com/harikt/Domicile.Access/contributors"
        }
    ],
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.zendframework.com/"
        }
    ],
    "require": {
        "php": ">=5.4.0",
        "aura/installer-system": "1.0.0",
        "zendframework/zend-permissions-rbac": "2.1.0"
    },
    "autoload": {
        "psr-0": {
            "Domicile\\Access": "src/"
        }
    }
}

Please note that the version is 2.1.0 specifically .

Now I have my package in @packagist .

You can download the package via adding a composer.json as below

{
    "minimum-stability": "dev",
    "require": {
        "domicile/access": "dev-master"
    }
}

The "minimum-stability": "dev" is mentioned to download the package domicile/access and not for the package it is having.

If the @Package inside it is also downloading different version then a BC break is always hard .

Please try yourself creating a simple hello/world package and downloading the right version. Please point me to the packagist one. I will download from there .

[weierophinney]

@harikt Here are the results I've had:

matthew@vimes:~tmp/composer|⇒  rm -Rf ~/.composer composer.lock vendor
matthew@vimes:~tmp/composer|⇒  cat composer.json
{
        "repositories": [
                {
                "type": "composer",
                "url": "https://packages.zendframework.com/"
                }
        ],
        "minimum-stability": "dev",
        "require": {
           "zendframework/zend-permissions-rbac" : "2.1.*@stable"
        }
}
matthew@vimes:~tmp/composer|⇒  php ~/bin/composer.phar install
Loading composer repositories with package information
Installing dependencies
  - Installing zendframework/zend-permissions-rbac (2.1.0)
    Downloading: 100%

Writing lock file
Generating autoload files

The above uses the "@stable" notation, which forces usage of the stable version.

The next test uses "2.1.0" as the specific version. Note, it works as well:

matthew@vimes:~tmp/composer|⇒  rm -Rf ~/.composer composer.lock vendor
matthew@vimes:~tmp/composer|⇒  cat composer.json
{
        "repositories": [
                {
                "type": "composer",
                "url": "https://packages.zendframework.com/"
                }
        ],
        "minimum-stability": "dev",
        "require": {
           "zendframework/zend-permissions-rbac" : "2.1.0"
        }
}
matthew@vimes:~tmp/composer|⇒  php ~/bin/composer.phar install
Loading composer repositories with package information
Installing dependencies
  - Installing zendframework/zend-permissions-rbac (2.1.0)
    Downloading: 100%

Writing lock file
Generating autoload files

Also note in each, I ensured my composer cache was empty, and that I had not installed in the current project, to ensure that the results were reproducible.

This will also work if a project defines a minimum-stability of dev; when the package is installed, its dependencies follow the project's, and then any specific versioning we provide in the "require" section.

It this is not working for you, you need to bring it up with the Composer and/or Packagist developers; the packages we've defined are correct, and follow the same rules as those specified by Composer for versioning; any conflicts you have are either a result of the project definition, individual packages (and conflicting dependencies), or specific composer configuration you've defined for yourself.

[harikt]

@weierophinney see comment #3664 (comment) .

[harikt]

And you are talking about the one which already works for me. And I am talking about a package which uses a component of zf2.

I wished you could have created a sample package like https://github.com/bridgyhari/Example.Testing and add a dependency on a component .

Add to packagist and try downloading your package. Not the zend package as you are doing.

[weierophinney]

@harikt Additional note: the project package has to define repositories it plans to use; it will not use those defined in individual packages. Please see:

• http://getcomposer.org/doc/faqs/why-can%27t-composer-load-repositories-recursively.md

Your sample package also needs to define the ZF2 repository if it's going to query packages.zendframework.com for packages.

[harikt]

may I know what should I add here then?

https://github.com/harikt/Domicile.Access/blob/master/composer.json

I am totally blank .

[weierophinney]

@harikt That package is correct. I'm saying that the project consuming that package also needs to define the "repositories" key and entries. So, borrowing from an earlier comment:

{
    "minimum-stability": "dev",
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.zendframework.com/"
        }
    ],
    "require": {
        "domicile/access": "dev-master"
    }
}

would rectify the situation.

[harikt]

Hm :-) . Thank you for the patience. The day seems a bit bad.
Sorry if any words in the previous sentences came harsh / annoying.