| 19 May 2023 |
 Jan Tojnar | we can, but it will still look for dev dependencies so that it can lock them | 21:21:18 |
| Jan Tojnar | it just will not install them | 21:21:31 |
| Jan Tojnar | * it just will skip installing them | 21:21:44 |
 Pol | Right, so, we have to parse lock files and intersect with composer.json.require then ? | 21:22:21 |
| Jan Tojnar | we could have the setup hook patch the sources inside the lockfile, instead of running composer update --lock | 21:23:38 |
| Jan Tojnar | and rely on the fact that the dev dependencies will not be installed with --no-dev so it would not matter that the path would be non-existent | 21:24:19 |
| Jan Tojnar | or we could just optimize the fetcher so that downloading dev dependencies is not pain | 21:25:00 |
| Pol | I prefer to optimize the fetcher | 21:25:21 |
| Pol | Maybe we can just skip the package if the package is not in require section. | 21:27:53 |
| Jan Tojnar | actually, maybe just using the dists would be fine for you, then | 21:27:54 |
| Pol | What do you mean? | 21:28:06 |
| Pol | How about making the changes in the composer plugin ? | 21:28:23 |
| Pol | Just added you as a maintainer | 21:29:25 |
| Pol | Feel free to hack into it | 21:29:47 |
 tgerbet | In reply to @drupol:matrix.org
Maybe we can just skip the package if the package is not in require section. Not exactly because you need to know the whole tree to determine if a transitive dep is needed for a prod dependency or not | 21:30:12 |
| Pol | I'm now going to bed, I've worked in my house the whole day, the baseboards are almost done, I need to get some sleep | 21:30:25 |
| Pol | In reply to @tgerbet:matrix.org
Not exactly because you need to know the whole tree to determine if a transitive dep is needed for a prod dependency or not Indeed, I should have removed my answer, I wrote too quickly. | 21:30:48 |
| Jan Tojnar | I think I might have only used source in composition-c4 because I though that builtins.fetchGit does not require output hash but it does currently | 21:31:08 |
| tgerbet | In reply to @jtojnar:matrix.org
or we could just optimize the fetcher so that downloading dev dependencies is not pain For production env you do not want the dev deps. Some might do things that are fine in dev but sketchy for production if you have a mistake in your configuration. | 21:36:26 |
| tgerbet | The famous eval-stdin.php from PHPUnit comes to mind | 21:36:47 |
| tgerbet | * The famous eval-stdin.php from PHPUnit comes to my mind | 21:36:55 |
| Pol | yeah... true. | 21:37:42 |
| Jan Tojnar | tgerbet: but composer install already defaults to --dev so you will need to run composer install --no-dev anyway | 21:38:33 |
| tgerbet | Hum yes indeed 👍️ | 21:39:12 |
| Pol | Excellent Jan Tojnar | 22:32:00 |
| Pol | Tomorrow morning I will update everything | 22:32:19 |
| Jan Tojnar | tried optimizing the fetching in composition-c4 by fetching just a single commit (which Git supposedly allows) but Nix does not allow fetching commit refs – it will assume the ref is a head if it does not start with refs/ | 22:36:03 |
| Pol | I have an idea. | 22:41:02 |
| Pol | Oh no, forget it. | 22:41:11 |
| Pol | I went downstairs, I wanted to try what you did on nixpkgs :) | 22:43:30 |
