Resolves issues where files from vendor are not being committed to repo

[misilot]

Solution from: http://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md

Option #4

[miku]

Just a general question on this. In the linked composer docs above the question

Should I commit the dependencies in my vendor directory?

is answered:

The general recommendation is no.

As smoebody pointed out, it would be somewhat nicer, if dependencies would not be in the repo at all. I tried to search for an explanation, why the dependencies must be in the repo, but had no luck so far.

[demiankatz]

There are two main reasons that the vendor dependencies are committed in the repo right now:

1.) In VuFind 1.x, dependencies were not bundled. This frequently led to problems because third-party sites would go offline, bugs would be introduced in new versions of libraries, etc. By committing dependencies, we ensure that a particular VuFind release has known working versions immediately available, and third-party outages cannot prevent a user from installing the software.

2.) Many VuFind users are not experienced developers but rather librarians with a bit of system administration experience. I have tried to make the barrier to running the software as low as possible. Right now, you can do a git checkout and immediately have working software. Introducing composer into the mix creates new stumbling blocks and increases the traffic to the support mailing lists.

This being said, I understand that there are disadvantages to this approach, and those disadvantages grow greater as we include more and more dependencies. It may be necessary to change our strategy soon, and I am open to that possibility. We may be able to address part 1 of the problem by including very specific version numbers in our composer.json (something that was not possible in VuFind 1.x, since we used PEAR instead of Composer). We may be able to address part 2 of the problem by bundling dependencies in the distribution versions of VuFind and recommending that novice users always install from package instead of using Git.

I encourage you to start a thread on vufind-tech if you'd like to discuss this further with a larger section of the community.

[miku]

Thanks for taking the time to answer, I think I understand the reasoning behind this now. Also, I do like your suggested ways out of this situation:

We may be able to address part 1 of the problem by including very specific version numbers in our composer.json

This sounds good to me. Specific versions should help avoid library version mismatch kind of errors.

We may be able to address part 2 of the problem by bundling dependencies in the distribution versions of VuFind and recommending that novice users always install from package instead of using Git.

I imagine, if a person is acquainted with git, maybe composer would not be too hard.

Anyway, I'll keep your suggestions in mind, will familiarize myself a bit more with VuFind2 and will post to the ML in the near future.