Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

used installedRepo instead of lockedRepo, if possible #122

Closed
jkowalleck opened this issue Sep 11, 2021 · 1 comment · Fixed by #325
Closed

used installedRepo instead of lockedRepo, if possible #122

jkowalleck opened this issue Sep 11, 2021 · 1 comment · Fixed by #325
Labels
enhancement New feature or request idea
Milestone
v4

Comments

@jkowalleck
Copy link
Member

jkowalleck commented Sep 11, 2021 •
edited
Loading

fetching a project's components from the lock file is fine.
but it would be better to fetch them from composer's internal "installed" repository.
this is a locked repo that holds info of the actual installed components, like a component is installed as dist or src .... etc ...

the installedRepo is to be preferred over the lockedRepo.

implementation details:

  • see vendor/composer/installed.json - which is accessible via \Composer\Composer::getRepositoryManager()->getLocalRepository() as a \Composer\Repository\RepositoryInterface -
    usable just like the already used \Composer\Repository\LockArrayRepository
  • maybe related: Composer\InstalledVersions::getInstalledPackages()

might be related to #129
@jkowalleck jkowalleck added this to the v4 milestone Sep 11, 2021
@jkowalleck jkowalleck added the enhancement New feature or request label Sep 11, 2021
@jkowalleck jkowalleck mentioned this issue Oct 13, 2021
Closed
9 tasks
@jkowalleck jkowalleck changed the title used installedRepo instead of lockedRepo used installedRepo instead of lockedRepo, if possible Oct 13, 2021
@jkowalleck jkowalleck added the idea label Dec 1, 2021
@jkowalleck
Copy link
Member Author

unfortunately the implementation of the --omit dev workflow is not that easy to implement,
as the currently implementation.
not a low-hanging fruit -> needs to wait.

@jkowalleck jkowalleck mentioned this issue Mar 6, 2023
Merged
jkowalleck added a commit that referenced this issue Mar 11, 2023
@jkowalleck
v4 features (#250)
c93fa4c 
* BREAKING changes
  * Removed support for PHP `<8.0` ([#91] via [#250])
  * Removed support for PHP `<8.1` (via [#250])
  * Removed support for Composer `<2.3` ([#153] via [#250])
  * CLI
    * Removed deprecated composer command `make-bom`, call `composer CycloneDX:make-sbom` instead ([#293] via [#309])
    * Changed option `output-file` to default to `-` now, which causes to print to STDOUT (via [#250])
    * Removed option `exclude-dev` in favour of new option `omit` (via [#250])
    * Removed option `exclude-plugins` in favour of new option `omit` (via [#250])
    * Removed option `no-version-normalization` ([#102] via [#250])
  * SBOM results
    * Components' version is no longer artificially normalized ([#102] via [#250])
  * Dependencies
    * Requires `cyclonedx/cyclonedx-library:^2.0`, was `:^1.4.2` ([#128] via [#250])
* Changed
  * Evidence analysis prefers actually installed packages over lock file ([#122] via [#250])
  * Root component's versions is unset, if version detection fails ([#154] via [#250])
  * Composer packages of type "composer-installer" are treated as composer plugins (via [#250])
* Added
  * Evidence collection knows actually installed packages ([#122] via [#250])
  * SBOM results
    * Support for CycloneDX Spec v1.4 (via [#250])
    * might have `serialnumber` populated ([#279] via [#250])
    * might have `metadata.timestamp` populated ([#112] via [#250])
    * might have `metadata.tools[].tool.externalReferences` populated ([#171] via [#250])
    * might have `components[].component.author` populated ([#261] via [#250])
    * might have `components[].component.properties` populated according to [`cdx:composer` Namespace Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/composer.md) (via [#250])
  * CLI
    * New option `omit` (via [#250])
    * New switch `validate` to override `no-validate` (via [#250])
    * New switches `output-reproducible` and `no-output-reproducible` (via [#250])
* Misc
  * Added demo and reproducible continuous integration test "devReq" that is dedicated to composer's `require-dev` feature (via [#250])
  * Reworked demo setups to be more global-install like (via [#250])

[#91]:  #91
[#102]: #102
[#112]: #112
[#122]: #122
[#128]: #128
[#153]: #153
[#154]: #154
[#171]: #171
[#250]: #250
[#261]: #261
[#279]: #279
[#293]: #293
[#309]: #309
[#313]: #313

---------

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck mentioned this issue Mar 11, 2023
Merged
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request idea
Projects
None yet
Milestone
v4
Development

Successfully merging a pull request may close this issue.

feat: Prefer installed setups over lock files CycloneDX/cyclonedx-php-composer
1 participant
@jkowalleck