In reply to @drupol:matrix.org
https://github.com/php-parallel-lint/PHP-Parallel-Lint/issues/153 that issue makes we want to reconsider adding composer.lock in nixpkgs 

I don't understand this. Putting a package under by-name is done for applications, so there you want a lock file. The application is the "end user" and thus decides all versions.

If you have some kind of library that might be a dependency elsewhere then the package should be in something like php83. and you still want a lock file.

We can't magically figure out at runtime which dependencies to build if there is no lockfile.

In reply to @drupol:matrix.org
Elis 🌱: Have a look at how Rector is packaged... https://github.com/rectorphp/rector

In reply to @drupol:matrix.org
Elis 🌱: Have a look at how Rector is packaged... https://github.com/rectorphp/rector

To me it makes sense. They are just "vendoring" their dependencies so they provide all dependencies for you already.

Unless you override it the dictate the exact dependencies. This seems to me the most reproducible way, isn't it?

In reply to @drupol:matrix.org
Elis 🌱: Have a look at how Rector is packaged... https://github.com/rectorphp/rector

In reply to @patka_123:matrix.org

I don't understand this. Putting a package under by-name is done for applications, so there you want a lock file. The application is the "end user" and thus decides all versions.

If you have some kind of library that might be a dependency elsewhere then the package should be in something like php83. and you still want a lock file.

We can't magically figure out at runtime which dependencies to build if there is no lockfile.

In reply to @patka_123:matrix.org
To me it makes sense. They are just "vendoring" their dependencies so they provide all dependencies for you already. Unless you override it they dictate the exact dependencies. This seems to me the most reproducible way, isn't it?

Who can make issue labels for nixpkgs? Every language seems to have a "6.topic: java" like tag.

But there's none for php

In reply to @drupol:matrix.org
Let's see how they are going to react with this: https://github.com/Smile-SA/gdpr-dump/issues/95

In reply to @drupol:matrix.org
Feel free to add your +1 and comments!

In reply to @patka_123:matrix.org
And is there anything (that's not too difficult) I can help with? I can't find any open packaging requests for php

In reply to @drupol:matrix.org
If they produce a PHAR, that means that they have the composer.lock that works ! https://github.com/Smile-SA/gdpr-dump/releases/tag/4.0.3

The phar just means that they also distribute an end user application.

If I have a work project and decide to use their tool and use composer for that I'd want to choose my own versions (or at least their their lock is accommodating enough).

So from their POV you can still make a valid case that a lock is not needed. And only useful if you create an end user application (which we do for nixpkgs so we can generate it ourselves)

In reply to @drupol:matrix.org
Yes, that's the middle-ground compromise that I wrote in my message.

In reply to @patka_123:matrix.org

The phar just means that they also distribute an end user application.

If I have a work project and decide to use their tool and use composer for that I'd want to choose my own versions (or at least their their lock is accommodating enough).

So from their POV you can still make a valid case that a lock is not needed. And only useful if you create an end user application (which we do for nixpkgs so we can generate it ourselves)