3 ms·

> And in that cause you can scp your repo somewhere and change your origin and move on. If you happen to have - god forbid - a php app that pulls dependencies

> And in that cause you can scp your repo somewhere and change your origin and move on. If you happen to have - god forbid - a php app that pulls dependencies via composer you have a hard dependency on github since composer pulls practically all code from GH. I don't consider that a good idea, but that's how it currently is. [No, I don't do php and only sometimes have to clean up the resulting fallout]

structural 12y ago
If particular frameworks want to tie themselves to a single server/host, that's their problem, and is specifically not a problem with any of Github, git or DVCSes generally. You really cannot stop all people from being idiots all of the time.
ksenzee 12y ago
That's not a hard dependency, it's a sensible default that you should be overriding if you're running composer install as part of your deployment process instead of including composer's vendor directory in your repo. Documentation: https://getcomposer.org/doc/05-repositories.md https://getcomposer.org/doc/05-repositories.md
- Xylakant 12y ago
  Practically all packages use git sources. Yes, you can vendor them - congratulations, you just kicked the can down the road and moved the issue to the build step. The issue exists for other languages as well - maven/mavencentral, ruby/rubygems.org - but only composer depends on github very much. I don't like that but it's not like the other solutions are much better.
  - mercurial 12y ago
    Many companies mirror maven, so having mavencentral go down is not a big issue. Does composer make it possible to deploy a mirror of its dependencies?
    - Xylakant 12y ago
      You can use your own repository, so at least in theory that should be possible. I haven't done that in practice, so I can't comment any further.
    - ksenzee 12y ago
      Yes, certainly: https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md https://getcomposer.org/doc/articles/handling-private-packag...
erikb 12y ago
I would bet its dependency is git not github.

structural 12y ago

If particular frameworks want to tie themselves to a single server/host, that's their problem, and is specifically not a problem with any of Github, git or DVCSes generally. You really cannot stop all people from being idiots all of the time.

ksenzee 12y ago

That's not a hard dependency, it's a sensible default that you should be overriding if you're running composer install as part of your deployment process instead of including composer's vendor directory in your repo. Documentation: https://getcomposer.org/doc/05-repositories.md https://getcomposer.org/doc/05-repositories.md

Xylakant 12y ago
Practically all packages use git sources. Yes, you can vendor them - congratulations, you just kicked the can down the road and moved the issue to the build step. The issue exists for other languages as well - maven/mavencentral, ruby/rubygems.org - but only composer depends on github very much. I don't like that but it's not like the other solutions are much better.
- mercurial 12y ago
  Many companies mirror maven, so having mavencentral go down is not a big issue. Does composer make it possible to deploy a mirror of its dependencies?
  - Xylakant 12y ago
    You can use your own repository, so at least in theory that should be possible. I haven't done that in practice, so I can't comment any further.
  - ksenzee 12y ago
    Yes, certainly: https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md https://getcomposer.org/doc/articles/handling-private-packag...

erikb 12y ago

I would bet its dependency is git not github.