Page MenuHomePhabricator

[Task] create mirror for our composer dependencies
Closed, DeclinedPublic

Description

Create a mirror for for our composer dependencies. This would be used by CI and possibly also for deployment and build purposes. While the most pressing issue is Github rate limiting us, it has the advantage that our infrastructure would be independent from Github and Packagist (except for pulling new versions when they are added in a Github maintained repositories).

Satis ( https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md ) is the software that can do this.

"When GitHub or BitBucket repositories are mirrored on your local satis" - https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md#downloads seems to imply it supports both mirroring of git repositories and creation of archives.

Event Timeline

JanZerebecki raised the priority of this task from to Needs Triage.
JanZerebecki updated the task description. (Show Details)

Last time I played with satis, it was just a packagist.org mirror, not a mirror of the actual archives. https://toranproxy.com/ looks more like what we need...

I played a bit with Satis ages ago. IIRC you can list the packages you want to install on the mirror and end up with a local/private composer server.

Feel free to set one up on labs so we can play with it? Can then be moved to production.

Another possibility would be to set up a proxy that would cache packages and/or make sure composer is used with --prefer-dist since the tarball ends up being cached locally and would be hold by the proxy.

JanZerebecki renamed this task from create mirror for for our composer dependencies to create mirror for our composer dependencies.Aug 17 2015, 3:34 PM
daniel added a subscriber: daniel.

Seems nice to have - until github or packagist go down for a couple of days, then this becomes critical...

JanZerebecki renamed this task from create mirror for our composer dependencies to [Task] create mirror for our composer dependencies.Sep 10 2015, 7:25 PM

Maybe with Diffusion we have tarballs available for all repos. Potentially we could then have composer to be pointed to it. I am not sure how much loads it would cause there though.

There is no resource/lead to move to provide our own repository of packages. We are relying on Github and https://packagist.org/ . MediaWiki extensions are probably usually downloaded on the Extension Distributor.

Maybe one day that idea will surface again, meanwhile there is little need to keep this task open.