To provide a reasonable out-of-the-box experience for tarball consumers, the various libraries needed by a MediaWiki install that are specified in the top level composer.json file should be either bundled directly into the tarball or made available as a single download that can be easily unpacked as $IP/vendor.

If the libraries are bundled directly in the tarball, the composer.lock that generated the vendor directory should be included as well to ease subsequent manual Composer interaction.