make virtual packages discoverable

[lsmith77]

[15:29] <jack_> Hi, trying to install simple cms bundle but getting a composer error saying phpcr/phpcr-implementation package can not be found. Looking on packagist, this package doesn't exist. Is there a way to fix this?

[stof]

I think Composer would be a best place for it. It problem-solving output should search for such packages. (the composer show command may already be able to find implementations but I'm not sure)

[Seldaek]

So I found a decent improvement.. maybe not perfect yet since it doesn't show up in search results, but at least on pages like https://packagist.org/packages/doctrine/phpcr-odm the phpcr/phpcr-implementation require is now clickable (it wasn't before since no package is called like that) and it leads you to https://packagist.org/packages/phpcr/phpcr-implementation which lists provider packages for as long as no one publishes a package with that name.

[kingcrunch]

for as long as no one publishes a package with that name.

So actually that sounds like I for example can pretty easy take this over, right? 😱 Could it make sense to at least allow a different naming convention for virtual packages, like omitting the / (phpcr-implementation), so a) it is not bound to a vendor anymore and b) it can prevent conflicts with package names?

[lsmith77]

indeed would be nice to somehow prevent that important caveat

[Seldaek]

I see two ways to achieve this:

• omit the slash as @kingcrunch says. I kinda like it although I don't think we necessarily need to (or can..) enforce it, but if we try to migrate all packages to that I'm pretty confident new ones will follow the pattern. On the other hand we lose the namespacing thing.
• allow creating virtual packages by name only that would just prevent a new package from being registered. The potential downside is namesquatting but that's already technically possible so I'm not too worried. As this is just a UI thing right now there is no hijacking issue, it would just hide the virtual package provider listing package if someone creates a phpcr/phpcre-implementation package. It could also be mitigated by Add "ownership" of a vendor namespace #163

Just to put more data in the discussion, here's the current list of the (45) provided names across the board:

bear/framework
bear/template-engine
behat/mink-selenium2-driver
cdatazone/xmlseclibs
deferred-request-persister
dflydev/psr0-resource-locator-implementation
dflydev/psr0-resource-locator-implementation-service-provider
evert/sabredav
ext-imap
ext-mcrypt
ext-mongo
fzaninotto/faker
gushphp/gush-adapter
jackalope/jackalope-transport
jms/translation-bundle
lf4php/lf4php-impl
mcfedr/queue-driver
mcfedr/queue-driver-bundle
midgard/midcom
mouf/mvc.splash-implementation
mouf/utils.log.logger
openpsa/openpsa
patchwork/cssqueeze
payment/httpclient-implementation
pear/file_gettext
pear/http_request2
pear/php_parsergenerator
phpcr/phpcr-implementation
phpf/config
phpf/event
phpf/filesystem
phpf/http
phpf/util
pradosoft/prado
psr/log-implementation
sai/composer2rpm
sai/drupal2rpm
sai/pear2rpm
scaffold
sonata-project/admin-bundle-persistency-layer
swiftmailer/swiftmailer
trf4php/trf4php-impl
wp-composer
xabbuh/xapi-storage-implementation
yii-application

Of which 12 exist as packages:

behat/mink-selenium2-driver
evert/sabredav
fzaninotto/faker
jms/translation-bundle
pear/http_request2
phpf/config
phpf/event
phpf/filesystem
phpf/http
phpf/util
pradosoft/prado
swiftmailer/swiftmailer

Overall the second approach sounds more viable to me.

[stof]

@Seldaek Omitting the slash would have the same caveat: it would work as long as nobody publish a package using this vendor (as the page should then list the packages in this vendor)

Regarding the 12 existing clashes, they are probably related to a wrong choice between replace and provide

[Seldaek]

OK I figured a third way, which is now implemented: https://packagist.org/providers/phpcr/phpcr-implementation is under /providers and not /packages, so even if there is a clash the link from "Provides" will point you to the provider listing, and in search results you should get both provider listing and the original, e.g. https://packagist.org/search/?q=fzaninotto/faker