When does an extensions SQL import trigger..

andreherberth

Hi, this might be a very stupid question, but I am trying to figure out when an extension import SQL if needed?

Does it happen when activating it in the control panel?

luceos

Whenever an extension is enabled , see code. If you want to run migrations without re-enabling an extension simply run php flarum migrate.

andreherberth

Thanks for your reply.

What I want, is to create a small repository of "preinstalled" extensions which can be dropped into any installation.

I use Plesk to manage my own and my clients websites, and by accident I figured out I can install flarum without using shell login by copying the files from flarum/flarum into the server.

Plesk features, although somewhat limited, the ability to manage composer projects trough the panel itself, such as the initial install based on a composer.json file, update, and installing all dependencies listed for the project.

I can of course add the extensions the composer way, but I am trying to see how far I can go without actually using composer after the initial install.

luceos

If you circumvent the composer.json or composer.lock file by replacing the vendor folder you'd have a big issue if you actually do use the composer way, the directories of the extensions might still be there, but they will not be registered within composer (autoloader to be precise).

You could add some default packages within a preset composer.json or by running composer require automatically.

andreherberth

luceos True enough.

However, while I have not used composer that much, I am right to assume flarum only require it for install and update purposes?

So, in theory, I could "replace" composers functionality on one or more installs by using another fresh composer based flarum install to build and prepare any new extensions, and or updates to them. (Tedious manual labor that composer would do for me, but well, I am somewhat masochist.).

Composer is nice and well, but not nice and well enough to use composer for my own extensions, mainly because I strongly believe in having tight control over my dependencies !

TL: DR; Can't wait for the web installer.

Davis

andreherberth Composer is nice and well, but not nice and well enough to use composer for my own extensions, mainly because I strongly believe in having tight control over my dependencies !

You can do this just as easily with composer. Just specify a particular version in the composer.json. Composer was made for dependency control.

andreherberth

Davis If you use composer correctly,

Exactly my point! And what percentage of the overall non-developer usage of composer is used 100% correctly? Let's not forget all developers new to composer as well. Like me for one ?

andreherberth However, while I have not used composer that much, I am right to assume flarum only require it for install and update purposes?

As for using "re-releasing".
I based my brief scenario research on this: https://getcomposer.org/doc/04-schema.md#replace Which I heard rumors have been misused before on packagist.

Alas, it now seems to be fix. That's good at least ?

That said, composer is cancer(My personal opinion). And whether you say it's not, it has a security issues

because people use it wrongly, use it in a production environment, or don't vet/test things properly before pushing to production.

A stable release only available trough composer is just plain laziness on the developers part. (My opinion though)

In any case, it does not really matter.

This topic was for asking if something was possible, not why composer sucks or not. And I got my answer. My project in regards of breaking free from composer can continue. Except for that development install though ?

andreherberth

As I said in my previous reply:

(Tedious manual labor that composer would do for me, but well, I am somewhat masochist.).

And composer does NOT bring < tight control >.
It opens up so many potential security holes if used on a live production site I have nightmares just thinking about it! (Obviously excessively put though...)

A plausible scenario

One of my dependencies removes their software, basically breaking my composer release. (In which case I would have to include it in my own project manually anyway)

A more far fetched one,

I do think this could happen, although somewhat differently perhaps.

Imagine this:

Me, a good webdeveloper
Releases good extensions/plugins
builds community trust
other developers goes good on the security of my code.
Releases many updates, each good ones.

Then Blam

Re-release a version/releases a new one
Malicious code is well hidden, many update their sites without care.
Damage done

One example of malicious code:

Extension of the plugin/extensions JS library adding full keystroke/keydown/keyup logging, which could be sent to an external site.

I suddenly have passwords to many websites which was unlucky not to vet their updates.

Or I could give admin access, give myself database access, yes, just about anything really.

That said. Composer is a development tool, and I know this. No need pointing it out!

Davis

andreherberth Re-release a version/releases a new one

You can't rerelease a version and a new version wouldn't do anything if you choose not to update to it.

andreherberth And composer does NOT bring < tight control >.
It opens up so many potential security holes if used on a live production site I have nightmares just thinking about it! (Obviously excessively put though...)

If you use composer correctly, there's no security holes. You're supposed to run composer update on a testing machine and run composer install on a production machine to fetch the exact versions that were used on your testing machine.

Also it's worth noting that composer is a requirement of Flarum (as it stands). If you write extensions without using composer, they won't work. As for fetching dependancies via composer, GitHub repos can become very large by committing the vendor files.

0E800

Have you opened your Web browser lately?
Ain't nuttin' safe.

webeindustry

It sounds like your focus is off. Laziness is the key evil, not composer. Composer is just a tool. This reminds me of people who still argue docker as being a dev tool not meant for production. You just have to shoulder shrug these assumptions and move on.

andreherberth

Just because I have certain issues with one tool, does not mean I am left in the dark ages. I use docker on a daily basis, both as hobbyist, and as a freelancer. It is a great tool, and with the years, it's easy of use for end clients have drastically improved as well, with service providers focused around providing easy docker setups and so on.

The fact that I follow flarum, spending time exploring the possibility, be it with or without composer means to some extent that I at least try to follow latest "trends" in the development communities,

So: Ease of use trumps more features, and more power, almost every time.
(Just look at our technology history. So many better alternatives was left behind, as the winning alternative had better ease of use.)

Ease of use is also why everyone blindly accept companies to gather wast amounts of data about their lives, since the product is so easy to use (Facebook, twitter, google, name any big data company/product)

Which again leaves me at not providing an alternative to composer when you release a stable product, is just for the developers convenience. Composer is not easy to use for someone not initiated into the php development world.

This will be my last reply in this thread. You are right. My focus was off. the time I spent is this thread could have been focused elsewhere ?

0E800

I could be wrong but I felt like what you quoted Kulga (well, the last bit atleast) was his way of saving face by ending it with a joke. It's tough to pick out sarcasm and emotion when using text. That's why I try not to use ALLCAPS or bold when attempting to convey a feeling behind text.

I only say this as I don't want people with the best of intension's be misunderstood.

andreherberth
Try not to work with feelings. Nobody is attempting to challenge your manhood or your knowledge of computers.

Composer is the means by which flarum is installed. Thats just how it is. Tools are for tools. ?

Kulga

@andreherberth That said. Composer is a development tool, and I know this. No need pointing it out! ...
This will be my last reply in this thread. You are right. My focus was off. the time I spent is this thread could have been focused elsewhere ?

Pro's and Con's of composer have been brought up and your arguments are being heard and responded to in a manner I would consider civil. I also prefer hearing about why something is wrong as it brings insight into current setups, which I consider critical to any community / project.
However, inflammatory language as quoted above has no role here and I will cut it off if it crosses the line of constructive criticism to a hostile thread - something that is quickly approaching.

If we can move past that, I welcome continuing discussion of whether composer is the best choice for distributing or managing flarum.