| 7 Apr 2023 |
 Pol | Merci | 09:57:46 |
 Jan Tojnar | also there is some context in the composition-c4 readme: https://github.com/fossar/composition-c4#what-are-the-limitations | 10:01:41 |
| Pol | I did this: https://gist.github.com/drupol/22a98547bff80aaf5e9f236b2a4d0ab6 | 10:13:56 |
| Pol | But it's failing and I can't figure out why yet. | 10:14:23 |
| Pol | 
Download image.png | 10:14:27 |
| Pol | Looks like ${vendor} doesn't contain anything in it. | 10:14:40 |
| Pol | I'm pretty sure this is something stupid. | 10:15:16 |
| Pol | Jan Tojnar: Any clue on this ? ^^ | 10:16:39 |
| Jan Tojnar | Pol: might be a Nix bug, try dontPatchShebangs = true in the vendor | 10:19:48 |
| Jan Tojnar | this one, IIRC https://github.com/NixOS/nix/issues/6660 | 10:20:49 |
| Pol | it works when I do that... thanks... I don't know how you find it out | 10:21:04 |
| Jan Tojnar | I hit this issue in the past, took me a long time to figure out 😿 | 10:21:44 |
| Pol | Thanks mate | 10:22:40 |
| Pol | pushed the changes, now I'm going to wait for CI and see if it fixes the stuff. | 10:23:26 |
| Pol | Damn, it's still failing, the checksums are different: https://github.com/NixOS/nixpkgs/pull/225129 | 10:25:11 |
| Pol | I can't figure out why. | 10:25:16 |
| Pol | forget about it, I found the issue !!! | 10:26:43 |
| Pol | IT WORKS ! :) | 10:28:06 |
| Pol | This is super cool because we can document that and help people package their PHP app !!! | 10:28:52 |
| Pol | tgerbet, @Shyim ^^ | 10:30:12 |
| Jan Tojnar | Pol: ideally, we would have a function like rustPlatform.fetchCargoTarball to avoid the boilerplate | 10:33:37 |
| Pol | I will work on this very soon :) | 10:33:54 |
 tgerbet | In reply to @drupol:matrix.org
tgerbet, @Shyim ^^ Yeah this is not something really new, this is fine for personal/corporate stuff but not so much for nixpkgs:
- that cannot work with dependencies only using a source repository because that make us dependent on the output of git/svn/mercurial/whatever
- AFAIK there is no way to tell composer to use only dist tarball, there is a
--prefer-dist flag but it will happily switch
| 10:43:26 |
| Jan Tojnar | oh, right source deps are a thing. Maybe we could post-process the output to strip the VCS directories | 10:51:52 |
| Pol | In reply to @jtojnar:matrix.org
oh, right source deps are a thing. Maybe we could post-process the output to strip the VCS directories Where ? | 11:10:13 |
| tgerbet | In reply to @jtojnar:matrix.org
oh, right source deps are a thing. Maybe we could post-process the output to strip the VCS directories I'm also not sure how Composer behaves with things like Git LFS and submodules. It would also requires dealing with the things the "traditional" fetchers are dealing with like the path to the CA bundle, proxy information...
Even with all of that I'm not sure it is currently possible to tell Composer to use only the dist tarball or the source for package proposing both. If I remember correctly even with --fetch-dist it will try to fallback to to the source if the dist tarball cannot be retrieved for some reasons | 11:23:16 |
| Pol | https://planttext.com/api/plantuml/png/hP7D2i8m48JlUOg0ju3w0gKKl7YIujNsa3IhHjDisAHetzxK7ugWFVMukxFVC4mHegJO6gTRwHaBL-CuOG3612-tPUKssFeqK-K8FA7k6gECDR5F2i7ta8uc8lMLorH-C_7Cc_V7oc9ppTOgJq8nRYy1tIYMNKIBKWCjFS7Ht3yFuh0u4O2h1u-dhrGM9b3OnKaQWQxv3YEdRzwl30DhjXZ_ZESDmWf87RvwV000 | 11:32:25 |
| Pol | here's a diagram summarizing the situation with composer. | 11:32:35 |
| Jan Tojnar | ugh, that will not be reproducible then, GitHub filters out stuff from the tarballs according to .gitattributes so dist archives will commonly be different from vcs checkout | 11:33:13 |
| tgerbet | Yep and it's something that is often used in the packages to filter out tests in the dist tarballs for example | 11:34:52 |
