Hey everybody,
tl;dr - How do we add 3rd party libs to core: composer, git submodules, or
copying the code?
So I have a question to discuss concerning MW core that I was hoping to get
some feedback on: what is our policy on including third-party libraries in
core?
To clarify, by policy I don't mean what factors do we take into account
when deciding to include a library (although feel free to weigh in on that
if you want to say something), but rather how one would go about doing it.
Here are the possibilities:
1) Use Composer to install dependencies
2) Use git submodules to store a reference to the repository
3) Copy the code and add a note somewhere of where it came from
(If I am missing an option, please enlighten me.)
My opinion on the matter is that option 1 is probably the best, primarily
because Composer was designed specifically for this purpose, and it is
widely used and is unlikely to randomly disappear in the near future. Also,
it makes the incorporation of these libraries trivial, since the autoloader
will be automatically registered using Composer. However, the method is not
without fault. A recent patch to core actually removed our composer.json
file, in hopes of allowing MediaWiki sysadmins to make their own custom
composer.json file so that extensions could be installed that way. Which is
more important: better maintenance of core dependencies, or allowing easier
extension installation? I don't know; that's for us to decide. I'm a bit
conflicted on the matter because I really do want to make extension
installation and management easier, but at the same time making sure the
core itself is easy to use should probably be a higher priority.
The next option is pretty much similar to Composer in that you have a
reference to some external code that will be downloaded when told to do so
by the user. However, it's different from Composer in a number of ways: 1)
when packaging tarballs, the code has to be downloaded anyway since
submodules are git-specific, and 2) we have to manage the autoloader
manually. Not too bad. If we decide the Composer option is not viable, I
think this would be a good alternative.
I don't like the final option at all, but it seems to be our current
approach. It's basically the same thing as git submodules except rather
than having a clear reference to where the code came from and where we can
update it, we have to add a README or something explaining it.
Also, just to clarify, this is not an out-of-the-blue request for comment.
I am currently considering whether we might want to replace our
HttpFunctions file with the third-party Guzzle library, since the latter is
very stable, much much more functional, and a lot easier to use. However,
this is out-of-scope for the discussion, so if you have an opinion on
whether doing this is a good/bad idea, please start another thread.
*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2016
Major in Computer Science