I thought I'd start this discussion in earnest here on the mw-core list and then take it to a larger list if needed once we have a reasonable plan.
My logging changes [0][1][2][3] are getting closer to being mergeable (the first has already been merged). Tony Thomas' Swift Mailer change [4] is also progressing. Both sets of changes introduce the concept of specifying external library dependencies, both required and suggested, to mediawiki/core.git via composer.json. Composer can be used by people directly consuming the git repository to install and manage these dependencies. I gave a example set of usage instructions in the commit message for my patch that introduced the dependency on PSR-3 [0]. In the production cluster, on Jenkins job runners and in the tarball releases prepared by M&M we will want a different solution.
My idea of how to deal with this is to create a new gerrit repository (mediawiki/core/vendor.git?) that contains a composer.json file similar to the one I had in patch set 7 of my first logging patch [5]. This composer.json file would be used to tell Composer the exact versions of libraries to download. Someone would manually run Composer in a checkout of this repository and then commit the downloaded content, composer.lock file and generated autoloader.php to the repository for review. We would then be able to branch and use this repository as git submodule in the wmf/1.2XwmfY branches that are deployed to production and ensure that it is checked out along with mw-core on the Jenkins nodes. By placing this submodule at $IP/vendor in mw-core we would be mimicking the configuration that direct users of Composer will experience. WebStart.php already includes $IP/vendor/autoload.php when present so integration with the rest of wm-core should follow from that. It would also be possible for M&M to add this repo to their tarballs for distribution.
I think Ori has a slightly different idea about how to approach this issue. I'd like to hear his idea in this thread and then reach consensus on how to move forward here or take both ideas (and any other credible alternatives) to a large list for a final decision.
[0]: https://gerrit.wikimedia.org/r/#/c/119939/ [1]: https://gerrit.wikimedia.org/r/#/c/119940/ [2]: https://gerrit.wikimedia.org/r/#/c/119941/ [3]: https://gerrit.wikimedia.org/r/#/c/119942/ [4]: https://gerrit.wikimedia.org/r/#/c/135290/ [5]: https://gerrit.wikimedia.org/r/#/c/119939/7/libs/composer.json,unified
Bryan