Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork206
Global Composer installation without commiting binary to version control?#477
-
Hey! I'm looking at distribution a compiled binary via Packagist, to be installed as a global Composer package. It seems like thedocumented way of doing this, but it also seems like this requires the compiled binary to be committed to the version control (judging by how theinstaller is set up). Is there an alternative way of doing this? I initially thought that this would use the latest release binary from GitHub Releases. Is that something that could be possible? |
BetaWas this translation helpful?Give feedback.
All reactions
Hi@caendesilva, just moved this to Discussions as I think it's more relevant here.
Unfortunately this isn't possible (unlike with package managers such as npm) as the GitHub repository (or tarball) is the thing that is downloaded by Composer. The only real way around this is to either:
- Have a single repository, that contains both source and the compiled Phar.
This approach is used by projects such as Expose (source / dist) and the Laravel Zero installer (source / dist) - Have 2 repositories (a source and a dist) which means that these files are stored separately.
This approach is used by projects such as PHPStan (source /dist) and Rector (source /dist).
Replies: 2 comments 1 reply
-
Hi@caendesilva, just moved this to Discussions as I think it's more relevant here. Unfortunately this isn't possible (unlike with package managers such as npm) as the GitHub repository (or tarball) is the thing that is downloaded by Composer. The only real way around this is to either:
|
BetaWas this translation helpful?Give feedback.
All reactions
-
Thanks for the reply,@owenvoke! That makes sense, and I understand the limitation. It feels wrong to me to commit binaries to version control, but it was fairly easy to upgrade my action to do so (https://github.com/hydephp/cli/pull/37/files). Hopefully this discussion can help others wondering about the same issue! |
BetaWas this translation helpful?Give feedback.
All reactions
👍 1
-
Somewhat related, just want to post here for others. If you're getting "SHA1 signature could not be verified: broken signature" on the committed binary, add the following to your |
BetaWas this translation helpful?Give feedback.
All reactions
This discussion was converted from issue #476 on December 11, 2023 13:45.