1. Dependency management with
Composer
Jason Grimes / @jason_grimes / jason@grimesit.com
Triangle PHP - June 2013

2. Composer is a
dependency manager
for
PHP.
Like npm in Node,
or bundler in Ruby.

3. What are dependencies?
Third-party libraries
or other assets your project depends on
which are stored in a separate repository
from your project sources.

4. • Define dependencies in a version controlled
config file.
• Download & install them all with one
command.
• Have identical versions in all project
environments.
• Automate this part of your build process.
A dependency manager lets you:

5. ComposerPEAR
• Per-project
• Open inclusion
• Central repository
• System-wide
• Strict control
• Dispersed channels
vs
Composer is becoming the de-facto standard

6. Installing Composer:
$ curl -sS https://getcomposer.org/installer | php
$ sudo mv composer.phar /usr/local/bin/composer

7. Keeping Composer
up to date periodically:
$ sudo composer self-update
Updating to version
d498e73363f8dae5b9984bf84ff2a2ca27240925.
Downloading: 100%

8. Two main use cases:
• Managing dependencies in a project
• Distributing a library

9. Managing dependencies
in a project

10. Getting a dependency:
{
"require": {
"silex/silex": "~1.0"
}
}
$ cd ~/myproject
$ vim composer.json
$ composer install

11. $ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev)
- Installing psr/log (1.0.0)
Loading from cache
- Installing symfony/routing (v2.3.0)
Loading from cache
- Installing symfony/debug (v2.3.1)
Downloading: 100%
- Installing symfony/http-foundation (v2.3.1)
Downloading: 100%
- Installing symfony/event-dispatcher (v2.3.0)
Loading from cache
- Installing symfony/http-kernel (v2.3.0)
Loading from cache
- Installing pimple/pimple (v1.0.2)
Loading from cache
- Installing silex/silex (v1.0.0)
Loading from cache
symfony/routing suggests installing symfony/config ()
...
Writing lock file
Generating autoload files

12. Packages are installed
in the vendor/ subdirectory
$ ls vendor
autoload.php
composer/
pimple/
psr/
silex/
symfony/

13. Specifying versions
"~1.2"
">=1.2,<2.0"
"1.2.*"
"1.2.3"
Recommended. “Up to next significant release.” (semver)

14. Only stable packages are installed by default.
Get a non-stable version like this:
{
"require": {
"silex/silex": "~1.0@dev"
},
}
Stability flags, in order of priority: dev, alpha, beta, RC, and stable.
To get the latest commit from the master branch:
{
"require": {
"silex/silex": "dev-master"
},
}

15. Ensuring identical versions
in all project environments

16. • composer.json - the config file.
Specifies versions as flexible patterns.
• composer.lock - the lock file.
Automatically written by composer.
Lists the exact versions that were installed.
Both files should be stored in version control.
Two important files:

17. • composer install - Install dependencies,
using the versions listed in composer.lock.
• composer update - Determine the latest
allowed versions, install them, and write the
version numbers to composer.lock.
Two important commands:

18. You can specify which packages to update,
leaving the others untouched:
$ composer update monolog/monolog
This can be useful when adding a new dependency.

19. composer update might break things.
Only run it in dev environments.
Commit composer.lock to version
control when you’re ready to deploy the
new versions.
Remember:

20. composer install ensures you have
the exact same versions as everyone else
using that composer.lock file.
Run composer install in your build
scripts.

21. Autoloading

22. Composer sets up autoloading of your
dependencies (for free).
Just include vendor/autoload.php:
<?php
require ‘vendor/autoload.php’;
$app = new SilexApplication();

23. You can also use composer to configure
autoloading for your own code.
{
"require": {...},
"autoload": {
"psr-0": {"MyApp": "src/"}
},
}
<?php
require ‘vendor/autoload.php’;
$app = new MyAppFoo(); // From src/MyApp/Foo.php
composer.json

24. Various autoloading conventions are supported.
"autoload": {
"psr-0": {
"MyAppTest": "src/test",
"MyApp_": "src",
"": "src/"
},
"classmap": ["src/", "lib/", "Something.php"],
"files": ["src/MyLibrary/functions.php"]
},
MyAppTestFooTest => src/test/MyApp/Test/FooTest.php
MyApp_Foo => src/MyApp/Foo.php
Foo => src/Foo.php
Search for classes in *.php and *.inc files in these locations,
and generate a key/value array mapping class names to files.
Explicitly load these files on every request.

25. You can generate the autoload files
without running an install or update:
$ composer dump-autoload
In production, you can generate a class map
for all classes, to optimize performance:
$ composer dump-autoload --optimize

26. Finding packages

27. https://packagist.org

29. $ composer search oauth2 server
adoy/oauth2 Light PHP wrapper for the OAuth 2.0 protocol (based on
OAuth 2.0 Authorization Protocol draft-ietf-oauth-v2-15)
drahak/oauth2 Nette OAuth2 Provider bundle
opauth/oauth2 Base OAuth2 strategy for Opauth
zircote/oauth2 OAuth2 Library, this is by no means complete nor is
the test coverage optimal, mileage may (will) vary.
friendsofsymfony/oauth2-php OAuth2 library
bshaffer/oauth2-server-php OAuth2 Server for PHP
league/oauth2-server A lightweight and powerful OAuth 2.0
authorization and resource server library with support for all the
core specification grants. This library will allow you to secure
your API with OAuth and allow your applications users to approve
apps that want to access their data from your API.
...

30. $ composer show league/oauth2-server
name : league/oauth2-server
descrip. : A lightweight and powerful OAuth 2.0 authorization and resource server
library with support for all the core specification grants. This library will
allow you to secure your API with OAuth and allow your applications users to
approve apps that want to access their data from your API.
keywords : authorization, api, Authentication, oauth, oauth2, server, resource
versions : dev-master, 2.1.1, 2.1, 2.0.5, 2.0.4, 2.0.3, 2.0.2, 2.0, 1.0.8, 1.0.7,
1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0, 0.4.2, 0.4.1, 0.4, 0.3.5, 0.3.4,
0.3.3, 0.3.2, 0.3.1, 0.3, 0.2.3, 0.2.2, 0.2.1, 0.2, dev-develop, dev-temp
type : library
license : MIT
source : [git] https://github.com/php-loep/oauth2-server.git 2.1.1
dist : [zip] https://api.github.com/repos/php-loep/oauth2-server/zipball/
2.1.1 2.1.1
names : league/oauth2-server, lncd/oauth2, league/oauth2server
autoload
psr-0
LeagueOAuth2Server => src/
requires
php >=5.3.0
requires (dev)
mockery/mockery >=0.7.2
suggests
zetacomponents/database Allows use of the build in PDO storage classes
replaces
lncd/oauth2 *
league/oauth2server *

31. Bootstrapping a project

32. $ composer create-project fabpot/silex-skeleton ~/myproject
create-project clones a project skeleton
and installs its dependencies.

33. $ composer create-project fabpot/silex-skeleton ~/myproject
Installing fabpot/silex-skeleton (v1.0.0)
- Installing fabpot/silex-skeleton (v1.0.0)
Downloading: 100%
Created project in /home/vagrant/myproject
Loading composer repositories with package information
Installing dependencies (including require-dev)
- Installing psr/log (1.0.0)
Loading from cache
- Installing twig/twig (v1.13.1)
Downloading: 100%
- Installing symfony/icu (v1.2.0)
Downloading: 100%
- Installing symfony/intl (v2.3.1)
Downloading: 100%
...
symfony/twig-bridge suggests installing symfony/templating ()
...
Writing lock file
Generating autoload files

34. $ ls ~/myproject
cache/
composer.json
composer.lock
config/
console
logs/
src/
templates/
vendor/
web/

35. Adding another dependency
from the command line
$ composer require doctrine/dbal:~2.3
composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
- Installing doctrine/common (2.3.0)
Loading from cache
- Installing doctrine/dbal (2.3.4)
Loading from cache
Writing lock file
Generating autoload files

36. Distributing a library

37. Any directory with a composer.json file
is a package.
To be installable, a package just needs a
name:
{
"name": "myvendorname/my-package",
"require": {...}
}

38. Recommended info for composer.json
{
"name": "jasongrimes/silex-simpleuser",
"description": "A simple db-backed user provider for Silex.",
"keywords": ["silex", "user", "user provider"],
"homepage": "http://github.com/jasongrimes/silex-simpleuser",
"license": "MIT",
"authors": [
{"name": "Jason Grimes", "email": "jason@grimesit.com"}
],
"require": { ... },
"autoload": {
"psr-0": {"JGSimpleUser": "src/"}
},
"suggest": {
"monolog/monolog": "Allows more advanced logging."
}
}

39. Specify versions with tags in yourVCS.
Tags should match X.Y.Z or vX.Y.Z
with optional RC, beta, alpha or patch suffix.
1.0.0
v1.0.0
1.10.5-RC1
v4.4.4beta2
v2.0.0-alpha
v2.0.4-p1

40. “dev” versions are created automatically
for every branch

41. Branch names that look like versions
become {branch}-dev:
2.0 => 2.0.x-dev
1.2.x => 1.2.x-dev

42. Other branch names become
dev-{branch}:
master => dev-master
bugfix => dev-bugfix

43. Specifying system requirements
{
"require": {
...
"php": ">=5.3",
"ext-PDO": “~1.0@dev”,
"lib-openssl": "openssl"
}
}
Run composer show --platform for a list of
locally available platform packages.

44. Executing scripts with Composer
{
"scripts": {
"post-update-cmd": "MyVendorMyClass::postUpdate",
"post-package-install": [
"MyVendorMyClass::postPackageInstall"
],
"post-install-cmd": [
"MyVendorMyClass::warmCache",
"phpunit -c app/"
]
}
}
composer.json
Many other pre- and post- event hooks are supported.

45. Submitting to Packagist
https://packagist.org

46. If using github, add a service hook
Packagist will update whenever you push, instead of being crawled only once daily.
https://github.org

47. Custom repositories

48. Maintaining your own forks
When you fix a bug in a third-party library,
use your own fork until your fix gets accepted upstream.
{
"repositories": [
{
"type": "vcs",
"url": “https://github.com/jasongrimes/monolog”,
}
],
"require": {
"monolog/monolog": "dev-bugfix"
}
}
Your fork
Branch with your fix
Custom repos have priority over packagist, so your fork gets used instead of the original.

49. PEAR packages
{
"repositories": [
{
"type": "pear",
"url": "http://pear2.php.net"
}
],
"require": {
"pear-pear2.php.net/PEAR2_Text_Markdown": "*",
"pear-pear2/PEAR2_HTTP_Request": "*"
}
}

50. Non-composer packages
{
"repositories": [
{
"type": "package",
"package": {
"name": "smarty/smarty",
"version": "3.1.7",
"dist": {
"url": "http://smarty.net/Smarty-3.1.7.zip",
"type": "zip"
},
"source": {
"url": "http://smarty-php.googlecode.com/svn/",
"type": "svn",
"reference": "tags/Smarty_3_1_7/distribution/"
},
"autoload": {
"classmap": ["libs/"]
}
}
}
],
"require": {
"smarty/smarty": "3.1.*"
}
}

51. Private repositories

52. Use Satis to generate private Composer repositories.
$ composer create-project composer/satis --stability=dev
$ vim config.json
{
"repositories": [
{ "type": "vcs", "url": "http://github.com/mycompany/privaterepo" },
{ "type": "vcs", "url": "http://svn.example.org/private/repo" },
{ "type": "vcs", "url": "http://github.com/mycompany/privaterepo2" }
],
"require": {
"company/package": "*",
"company/package2": "*",
"company/package3": "2.0.0"
}
}
$ php bin/satis build config.json web/
Builds static repo
in web/

53. Use your private repo like any other:
{
"repositories": [ {
"type": "composer",
"url": "http://packages.example.org/"
} ],
"require": {
"company/package": "1.2.0",
"company/package2": "1.5.2",
"company/package3": "dev-master"
}
}

54. In conclusion...

55. • ...install dependencies not stored in your project’sVCS repo.
• ...ensure identical versions in all your project’s environments.
• ...handle autoloading.
• ...distribute your open source libraries.
• ...manage your private repositories.
Use Composer to:

56. Resources
• http://getcomposer.org
• https://packagist.org/
• #composer on freenode
Jason Grimes / @jason_grimes / jason@grimesit.com