symfony/flex

Composer plugin for Symfony

Symfony Flex helps developers create Symfony applications, from the most simple micro-style projects to the more complex ones with dozens of dependencies.

flex's Issues

[Question] Should we improve discoverability of binaries?

The scenario is:

• I install a new package in my app
• The package contains some binaries that installs in bin/ or vendor/bin/

The problem is:

• How can I possibly know that the package installed those binaries? Maybe I'm missing some great script/command.

The possible solutions:

• Add a 1-line message for each installed binary. E.g.: // added bin/check.php
• Do nothing and rely on people reading the package docs or looking into bin/ dir themselves.

[Proposal] Simplify the default configuration of DoctrineBundle

This is the default config provided by Symfony Flex:

###> doctrine/doctrine-bundle ###
DB_DRIVER=pdo_mysql
DB_HOST=127.0.0.1
DB_PORT=
DB_NAME=symfony
DB_USER=root
DB_PASSWORD=
###< doctrine/doctrine-bundle ###

# /etc/packages/doctrine.yaml
doctrine:
    dbal:
        driver: "%env(DB_DRIVER)%"
        host: "%env(DB_HOST)%"
        port: "%env(DB_PORT)%"
        dbname: "%env(DB_NAME)%"
        user: "%env(DB_USER)%"
        password: "%env(DB_PASSWORD)%"
    # ...

But maybe now it's the perfect time to switch to the simpler and more modern DSN-based alternative (like we do in the Symfony Demo app: https://github.com/symfony/symfony-demo/blob/master/app/config/parameters.yml.dist#L20). The perceived complexity is reduced significantly:

###> doctrine/doctrine-bundle ###
DB_URL='mysql://[email protected]:3306/symfony'
###< doctrine/doctrine-bundle ###

# /etc/packages/doctrine.yaml
doctrine:
    dbal:
        url: "%env(DB_URL)%"
    # ...

Another improvement of DSN-based config is that switching from a database to another is easier. For example: switching to SQLite is as easy as changing the value of DB_URL. Before you had to comment/uncomment config options in /etc/packages/doctrine.yml:

###> doctrine/doctrine-bundle ###
DB_URL='sqlite:///%kernel.root_dir%/../var/data/symfony.sqlite'
###< doctrine/doctrine-bundle ###

[Proposal] Use "config/" instead of "etc/"

This is a controversial topic that is often discussed in the Symfony Slack chat. More and more people are saying that etc/ is not the best choice because it's not that easy to understand.

At first I ignored them, but this idea is growing more and more in me. Names are great when you can understand them without explanation: "etc/" requires explanation and it complicates the first experience with the framework; whereas "config/" requires no explanation and it's exactly what everybody expects.

Other popular projects use "config/" (Laravel, Rails) and it's pretty common in PHP world too (according to these stats: http://paul-m-jones.com/archives/6564)

[Question] Why are Composer extra options modified?

I was documenting the manifest.json format of Flex recipes and I found confusing that the special variables are %BIN_DIR%, %CONF_DIR%, etc. instead of their original names %bin-dir%, %conf-dir%. The same goes for your custom variables defined in the extra section of composer.json.

Is there any good reason to do this? Otherwise, I'd recommend to keep those variables unchanged because:

• It lowers the learning curve (I don't have to learn that to use bin-dir I must use instead BIN_DIR)
• It doesn't mangle the original var names (if a developer wants to use mY-BiN-dIr we should let them do that instead of lowercasing or uppercasing it ... to avoid the problems we had in Symfony when forcing lowercase service ids)
• Uppercasing them makes them look like env vars ... but they are not env vars.

[Question] Where should the old app/Resources/ contents live now?

I'm switching the Symfony Demo app to Symfony Flex. I don't know what's the new practice to store the old app/Resources/* contents.

For example, app/Resources/views/ are now templates/ but what about:

• Translation files:
  app/Resources/translations/ -> translations/ ?
• Overridden bundle templates, for example error pages:
  app/Resources/TwigBundle/views/Exception/ -> ??
• Web assets (it's common to store the sources of the assets in that dir)
  app/Resources/assets/ -> assets/ ?

[Question] The new workflow created by env vars

Here are some common scenarios for Symfony developers. Please, confirm that I got right the first one and please, tell me how to solve the other two. Thanks!

Check (in your local machine) if the app works in production

BEFORE

1. Browse app.php instead of app_dev.php

AFTER

1. Edit .env and change APP_ENV to prod and APP_DEBUG to 0
2. Reload index.php
3. Undo the .env changes to continue developing the app

---

Use a different database for tests

BEFORE

1. Edit app/config/config_test.yml and change the database parameters.

AFTER

???

---

Deploy the application to production

BEFORE

1. Use Incenteev Param Handler to create the production parameters.yml from
   the parameters.yml.dist
2. Check that app/config/config_prod.yml contains the right config.

AFTER

???

The .env is gone in production. Where do I configure the production values of
that config?

[Question] How can we avoid these warning messages?

If I remove the admin package, I see some confusing warning messages. This is easy to reproduce: just install and then uninstall admin without making any change:

$ composer req admin

...

$ composer rem admin

Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/console" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/framework-bundle" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Loading composer repositories with package information

...

It looks intimidating:

[Question] Can we improve the first time experience?

Currently, when you execute symfony new my_project, a new empty app is installed and when browsing the URL suggested by the installer, you see a "Welcome Page".

With Symfony Flex, the message is similar:

... but you browse that URL and ...

The first thing you see about Symfony is an error page. Not a good experience at all!

---

The solution is not that easy, because the "first time experience" varies a lot depending on what you want to do. The "Welcome Page" is a must if you are going to develop a normal web app ... but you don't need it if you are developing a console app or an API.

[Question] What about use flex local, without internet

Should be an official recipe, ok, I agreed with that. But in my case, to really use flex I will need to use it in local, with my satis repository. Can I do it? What I'll need to do for having a 172.0.0.1:8123/recipes with a local copy of the official recipe.
With this I could even have my own recipies without using the official repository.

[Bug] The "profiler" installation fails because of some "twig" error

In a fresh Symfony app created with Flex:

$ composer require profiler

Using version ^3.3@dev for symfony/web-profiler-bundle
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 4 installs, 0 updates, 0 removals
  - Installing symfony/var-dumper (dev-master b7864e4): Downloading (100%)
  - Installing twig/twig (2.x-dev 84dea31): Loading from cache
  - Installing symfony/twig-bridge (dev-master 8b7855d): Loading from cache
  - Installing symfony/web-profiler-bundle (dev-master 086d0a7): Downloading (100%)
    Detected auto-configuration settings for "symfony/web-profiler-bundle"
    Enabling the package as a Symfony bundle
    Setting configuration and copying files
Writing lock file
Generating autoload files
Executing script make cache-warmup [OK]
Executing script assets:install --symlink --relative %WEB_DIR% [KO]
 [KO]
Script assets:install --symlink --relative %WEB_DIR% returned with error code 1
!!
!!
!!
!!    [Symfony\Component\DependencyInjection\Exception\ServiceNotFoundException]
!!    The service "web_profiler.controller.profiler" has a dependency on a non-ex
!!    istent service "twig".
!!
!!
!!
!!

Installation failed, reverting ./composer.json to its original content.

[Bug] Error when installing Doctrine

$ composer req doctrine

Using version ^1.6@dev for doctrine/doctrine-bundle
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 11 installs, 0 updates, 0 removals
  - Installing doctrine/lexer (dev-master 83893c5): Loading from cache
  - Installing doctrine/inflector (dev-master 803a2ed): Loading from cache
  - Installing doctrine/collections (v1.4.0): Loading from cache
  - Installing doctrine/annotations (dev-master 54cacc9): Loading from cache
  - Installing doctrine/common (dev-master 5bd8542): Loading from cache
  - Installing symfony/doctrine-bridge (dev-master 919ca40): Downloading (100%)
  - Installing doctrine/doctrine-cache-bundle (1.3.0): Loading from cache
  - Installing symfony/console (dev-master 4dcfcc8): Loading from cache
    Detected auto-configuration settings for "symfony/console"
    Setting configuration and copying files
  - Installing doctrine/dbal (dev-master e0169b2): Loading from cache
  - Installing jdorn/sql-formatter (dev-master 7ef9b85): Loading from cache
  - Installing doctrine/doctrine-bundle (dev-master bdb5af6): Loading from cache
    Detected auto-configuration settings for "doctrine/doctrine-bundle"
    Enabling the package as a Symfony bundle
    Setting configuration and copying files
    Adding environment variable defaults
Writing lock file
Generating autoload files
Executing script make cache-warmup [OK]
Executing script assets:install --symlink --relative %WEB_DIR% [KO]
 [KO]
Script assets:install --symlink --relative %WEB_DIR% returned with error code 1
!!
!!
!!
!!
!!    [LogicException]
!!    To configure the ORM layer, you must first install the doctrine/orm package
!!
!!    .
!!
!!
!!
!!

Installation failed, reverting ./composer.json to its original content.

---

Maybe it's because DoctrineBundle puts doctrine/orm in require-dev instead of require? Is this a bug to fix in DoctrineBundle instead? See https://github.com/doctrine/DoctrineBundle/blob/master/composer.json

[Question] Don't delete files that have been modified?

This Flex behaviour is what I expect

1. composer req cli -> creates ./bin/console
2. Don't change ./bin/console contents
3. composer rem cli -> deletes ./bin/console

This Flex behavior is debatable

1. composer req cli -> creates ./bin/console
2. Make some changes in ./bin/console contents to customize it for my project
3. composer rem cli -> deletes my customized ./bin/console

My question

Should Flex check the md5 of the file contents before trying to delete them to see if they have been modified?

Whether this proposal is the right thing to do or not is debatable ... but for example Flex doesn't follow the same behavior with dirs:

1. composer req doctrine -> creates the empty src/Entity/ and src/Repository/ dirs
2. Create files in src/Entity/ but not in src/Repository/
3. composer rem doctrine -> removes src/Repository/ but maintains src/Entity/

Detect dirs better

Currently, Flex is using a weird way to detect directories to copy, it must have a trailing slash in the recipe path which hit me too.

What's wrong with is_dir()?

[Proposal] Generate a better default package name in composer.json

The info generated for composer.json is perfect for a proprietary project, except for the name property:

{
    "name": "symfony/skeleton",
    "type": "project",
    "license": "proprietary",
    "...": "...",
}

---

Maybe we can use the same logic as in the Symfony Installer to generate the best package name possible:

if (!empty($_SERVER['USERNAME'])) {
    $packageName = $_SERVER['USERNAME'].'/'.$projectName;
} elseif (true === extension_loaded('posix') && $user = posix_getpwuid(posix_getuid())) {
    $packageName = $user['name'].'/'.$projectName;
} elseif (get_current_user()) {
    $packageName = get_current_user().'/'.$projectName;
} else {
    // package names must be in the format foo/bar
    $packageName = $projectName.'/'.$projectName;
}

Return value of Symfony\Flex\Configurator::get() must be an instance of Composer\Configurator\AbstractConfigurator

When I execute this:

$ composer create-project symfony/skeleton:dev-temp flex-demo

I'm getting this error:

- Installing symfony/flex (dev-master 35ba40a):

  [Symfony\Component\Debug\Exception\FatalThrowableError]
  Type error: Return value of Symfony\Flex\Configurator::get() must be an instance of Composer\Configurator\AbstractConfigurator, instance of Symfony\Flex\Configurator\CopyFromRecipeConfigurator returned


Exception trace:
 () at /projects/flex-demo/vendor/symfony/flex/src/Configurator.php:79
 Symfony\Flex\Configurator->get() at /projects/flex-demo/vendor/symfony/flex/src/Configurator.php:52
 Symfony\Flex\Configurator->install() at /projects/flex-demo/vendor/symfony/flex/src/Flex.php:72
 Symfony\Flex\Flex->configurePackage() at n/a:n/a
 call_user_func() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:171
 Composer\EventDispatcher\EventDispatcher->doDispatch() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:116
 Composer\EventDispatcher\EventDispatcher->dispatchPackageEvent() at phar:///usr/local/bin/composer/src/Composer/Installer.php:605
 Composer\Installer->doInstall() at phar:///usr/local/bin/composer/src/Composer/Installer.php:223
 Composer\Installer->run() at phar:///usr/local/bin/composer/src/Composer/Command/CreateProjectCommand.php:188
 Composer\Command\CreateProjectCommand->installProject() at phar:///usr/local/bin/composer/src/Composer/Command/CreateProjectCommand.php:143
 Composer\Command\CreateProjectCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:267
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:846
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:191
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:227
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:122
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:100
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:54
 require() at /usr/local/bin/composer:24

Minor typo in "type must be symfony-bundle" error message

regiters -> registers

Confusing error message when something fails

$ composer req log

Using version ^3.0@dev for symfony/monolog-bundle
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Generating autoload files

Executing script make cache-warmup [OK]
Executing script assets:install --symlink --relative %WEB_DIR% [KO]
 [KO]
Script assets:install --symlink --relative %WEB_DIR% returned with error code 1
!!  Could not open input file: bin/console
!!
!!

Installation failed, reverting ./composer.json to its original content.

The last phrase is easy to understand -> Installation failed, reverting ./composer.json to its original content. but the overall error message is not:

• Only the composer.json has been reverted?
• Has any other change been made or reverted in my app because of this error?

[Question] Can we remove a confusing question asked after project installation?

This is probably something done by Composer, so we cannot change it, but:

This question is confusing:

Do you want to remove the existing VCS (.git, .svn..) history? [Y,n]? 

The problem is that it doesn't explain what are you deleting or the consequences of it:

• What history I'm deleting? (I've just created a new project, there's no history yet!)
• What happens if I remove this "history"? Will I lose something?
• What if I regret deleting it? Can I recover it?

[Minor] Some files contain an empty first line

It happens only on Makefile and .gitignore. I guess "fixing" this is not worth it, but I just wanted to mention it:

Integers in JSON

I had an issue in contrib#15 in which the validator says my JSON is invalid because it contains integers, but integers are valid in JSON.

Validation says only "JSON files must be valid" so either documentation or validation needs to be fixed.

[Question] Remove more dependencies from new Symfony applications?

These are all the dependencies of a fresh Symfony app installed with Symfony Flex:

doctrine/cache               dev-master 0da649f           Caching library offering an object-oriented API for...
paragonie/random_compat      v2.0.10                      PHP 5.x polyfill for random_bytes() and random_int(...
psr/cache                    dev-master 78c5a01           Common interface for caching libraries
psr/container                dev-master b7ce3b1           Common Container Interface (PHP FIG PSR-11)
psr/log                      dev-master 4ebe3a8           Common interface for logging libraries
psr/simple-cache             dev-master 753fa59           Common interfaces for simple caching
symfony/cache                dev-master c9a100e           Symfony Cache component with PSR-6, PSR-16, and tags
symfony/class-loader         dev-master 2d60d55           Symfony ClassLoader Component
symfony/config               dev-master e068d79           Symfony Config Component
symfony/debug                dev-master 105f6a2           Symfony Debug Component
symfony/dependency-injection dev-master fab99da           Symfony DependencyInjection Component
symfony/dotenv               dev-master 56422dc           Registers environment variables from a .env file
symfony/event-dispatcher     dev-master 6813d5f           Symfony EventDispatcher Component
symfony/filesystem           dev-master 8de5137           Symfony Filesystem Component
symfony/finder               dev-master 851a876           Symfony Finder Component
symfony/flex                 dev-fix_configurator f7d1854
symfony/framework-bundle     dev-master ea46867           Symfony FrameworkBundle
symfony/http-foundation      dev-master 09aebc3           Symfony HttpFoundation Component
symfony/http-kernel          dev-master d95c776           Symfony HttpKernel Component
symfony/polyfill-mbstring    dev-master e79d363           Symfony polyfill for the Mbstring extension
symfony/polyfill-php56       dev-master 1dd42b9           Symfony polyfill backporting some PHP 5.6+ features...
symfony/polyfill-php70       dev-master 13ce343           Symfony polyfill backporting some PHP 7.0+ features...
symfony/polyfill-util        dev-master 746bce0           Symfony utilities for portability of PHP codes
symfony/routing              dev-master ad1dd8e           Symfony Routing Component
symfony/security-core        dev-master f4ca2ed           Symfony Security Component - Core Library
symfony/security-csrf        dev-master 46ad802           Symfony Security Component - CSRF Library
symfony/stopwatch            dev-master 13a61f2           Symfony Stopwatch Component
symfony/yaml                 dev-master bd17d50           Symfony Yaml Component

One of the main goals for Symfony 4 is to be as minimal as possible, so I don't know why these are installed:

• doctrine/cache
  (required by symfony/framework-bundle), see symfony/symfony#23131
• symfony/security-core and symfony/security-csrf (required by symfony/framework-bundle), see symfony/symfony#22715
• symfony/polyfill-php56 (required by symfony/security-*)
• symfony/polyfill-php70 (required by symfony/security-csrf)
• symfony/polyfill-util (required by symfony/security-core and symfony/polyfill-php56)
• symfony/stopwatch (required by symfony/framework-bundle)
• symfony/class-loader (required by symfony/framework-bundle)
• paragonie/random_compat (required by symfony/polyfill-php70)

Issue installing some bundles

The recipe says:

{
    "bundles": {
        "JavierEguiluz\\Bundle\\EasyAdminBundle\\EasyAdminBundle": ["all"]
    },
    "...": "..."
}

But when you execute:

$ composer req admin

Flex adds this to etc/bundles.php:

<?php

return [
    // ...
    'JavierEguiluz\Bundle\EasyAdminBundle\JavierEguiluzEasyAdminBundle' => ['all' => true],
];

And this makes the app fail:

Minor typo in "recipe is not needed" error message

"register" -> "registers"

[security] Secret should not be stored in environment variables

Secrets such as passwords and SSH keys must not be stored in environment variables. Basically, environment variables are often stored (unencrypted) in logs and displayed when an error occurs.
The Docker security team recently published a post explaining why storing secrets in env variables should be avoided: https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
They also released a tool to manage secrets.

Flex actually uses environment variables to store secrets (ex: the Doctrine recipe). It should use files or a system similar to the one introduced by Docker instead.

[Minor] Use 'https' for every symfony.com link

In the "What's Next" section of Flex, the link to Symfony Docs should use https

Allow Composer packages to ship their own recipes

If you're a package developer, you might want to opt-in to being Flex compatible. This way, you're shipping the recipe with the package, maintaining it there (each version might be different, but as they're together, they're in sync). Without this, you maintain your package in your own repo, but need to maintain a part of it somewhere else (in the recipes* repos). If you push a major release, you might have to wait for someone else to approve the PR, etc.

You could allow for packages to ship their own Symfony recipes, maybe directly inside composer.json? It could work like this:

1. developer Dave decides to create a new Symfony bundle
2. he develops it completely and adds composer.json to it
3. he wishes to be compatible with Symfony Flex too so he adds a block to composer.json with the recipe
4. packagist.org sees that the package has additional information and notifies Flex API server about it, this could abstracted with tags in composer.json and supporting tag subscription notifications in packagist.org
5. user installs the bundle, gets the benefits of Flex without Dave pushing his recipes to recipes* repos

This might be already possible somehow, but I didn't find a reference to it. This would also mean recipes-contrib would become (mostly) obsolete because maintainers would be able to ship their own recipes, the only use case for contrib would be adding recipes to bundles where you might not be able to add recipes directly, for example with unmaintained or uncooperative projects. Recipes repo would stay in place mostly for curation purposes (as in, enumerating quality packages and providing aliases for them).

[Bug] Error when installing "form" package

In a fresh Symfony app, I install form without problems:

$ composer require form

Using version ^3.3@dev for symfony/form
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 6 installs, 0 updates, 0 removals
  - Installing symfony/inflector (dev-master 3b19c08): Loading from cache
  - Installing symfony/property-access (dev-master 65b1197): Loading from cache
  - Installing symfony/options-resolver (dev-master 5edcb71): Loading from cache
  - Installing symfony/intl (dev-master dc7b5a5): Loading from cache
  - Installing symfony/polyfill-intl-icu (dev-master 2d6e2b2): Loading from cache
  - Installing symfony/form (dev-master 38a1f33): Downloading (100%)
Writing lock file
Generating autoload files
Executing script make cache-warmup [OK]
Skipping "assets:install --symlink --relative web" (needs symfony/console to run).

However, if I install cli afterwards, I see this error (I made no change in the app between the installation of "form" and "cli"):

$ composer req cli

Using version ^3.3@dev for symfony/console
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Installing symfony/console (dev-master 1030e32): Loading from cache
    Detected auto-configuration settings for "symfony/console"
    Setting configuration and copying files
Writing lock file
Generating autoload files
Executing script make cache-warmup [OK]
Executing script assets:install --symlink --relative %WEB_DIR% [KO]
 [KO]
Script assets:install --symlink --relative %WEB_DIR% returned with error code 1
!!
!!
!!    [Symfony\Component\DependencyInjection\Exception\LogicException]
!!    Form support cannot be enabled as the Translation component is not installe
!!    d.
!!
!!
!!
!!

Installation failed, reverting ./composer.json to its original content.

[Question] Should "doctrine" also create an empty "src/Repository/" dir?

When installing "doctrine" an empty src/Entity/ dir is created in the app. Should we do the same with src/Repository/ given that it's a best practice to store entities and repositories separated?

[Bug] Binaries are not copied when installing "requirements-checker"

If I install this:

$ composer req requirements-checker

No files are copied neither into my-project/bin/ nor my-project/vendor/bin/ or my-project/web/ even if the related recipe says:

{
    "copy-from-package": {
        "bin/check.php": "%BIN_DIR%/check.php",
        "web/check.php": "%WEB_DIR%/check.php"
    },
    "composer-scripts": {
        "%BIN_DIR%/check.php": "php-script"
    }
}

The my-project/bin/ dir doesn't exist because I haven't installed the cli dependency yet, but my-project/web/ exists, so the my-project/web/check.php file should have been created.

Makefile on windows

Since windows (yes, i know, it's terrible for PHP development) by default won't work with Makefile. I get this error after installation:

Executing script make cache-warmup [KO]
 [KO]
Script make cache-warmup returned with error code 1
!!  'make' is not recognized as an internal or external command,
!!  operable program or batch file.
!!
!!

Of course, temporary fix is to remove: "auto-scripts" in compsoer.json and running by hand Makefile written commands.

[Minor] Better separate the tasks of Makefiles?

Of course you never look into Makefile contents ... unless you are curious or some error happens and you want to see what's being executed. Nevertheless, I wonder if we could add a \n between tasks to make them more readable.

This image tries to explain the problem I see:

[Question] Do you plan to add full type hints and return types?

It'd be nice to replace most/all PHPdocs.

Error installing mtdowling/jmespath.php

I've encountered an error while requiring the aws/aws-sdk-php that depends on mtdowling/jmespath.php. Output:

  - Installing mtdowling/jmespath.php (2.4.0) Loading from cache

Installation failed, reverting ./composer.json to its original content.


  [Composer\Downloader\TransportException]
  The 'https://symfony.sh/m/mtdowling/jmespath.php/2.4.0' URL could not be accessed: HTTP/1.1 400 Bad Request

I had to install it with --no-plugins composer flag enabled.
Maybe the server is not accepting a package name containing a dot?

[Question] Why are assets enabled by default?

If I create a Symfony app with Flex and then install the cli package to access to Symfony commands, I see the following:

$ ./bin/console

Symfony 3.3.0-DEV (kernel: src, env: dev, debug: true)

Usage:
  command [options] [arguments]

...

Available commands:
  about                   Displays information about the current project
  help                    Displays help for a command
  list                    Lists commands

 assets
  assets:install          Installs bundles web assets under a public web directory

 cache
  ...

Why is assets:install command enabled? I didn't expect to see it unless I enable/install assets support explicitly.

[Proposal] Minor change in the default commented routing config

Using a DefaultController is very common for Symfony developers. Making this change will make the config ready to use just by uncommenting it.

---

Before:

#index:
#    path: /
#    defaults: { _controller: "App\\Controller\\SomeController::index" }

After:

#index:
#    path: /
#    defaults: { _controller: "App\\Controller\\DefaultController::index" }

[Bug] Asset symlinks are not removed when removing packages

How to reproduce:

1. $ composer req admin
2. web/bundles/easyadmin symlink is created pointing at ../vendor/[...]/public/
3. $ composer rem admin
4. web/bundles/easyadmin symlink still exists

[Question] Why differentiate copy-from-recipe and copy-from-package?

At first I thought that recipes were just manifest.json files at the project's root dir. But then we have two separate configurators to copy contents from packages and recipes.

My questions:

• Why can't we have only copy-from-package?
• Where are the recipes stored?
• Can the community create their own recipes? If so, where will they store the contents? (I guess that in the same Composer package, so why is copy-from-recipe needed?
• Where are the "core recipes" stored? For example, will the framework-bundle recipe be stored publicly on https://github.com/symfony/symfony/tree/master/src/Symfony/Bundle/FrameworkBundle or privately on Flex servers? At first I thought that Flex servers would only take care of curating dependencies, managing the aliases defined, etc.

[Proposal] Implement a "Did you mean?" feature

If you don't provide a valid alias (e.g. "server" for "symfony/web-server-bundle") or Symfony package name (e.g. "monolog-bundle" for "symfony/monolog-bundle") or a Composer package name (e.g. "fabpot/flex"), you see this error:

$ composer req sec

  [InvalidArgumentException]
  Could not find package sec at any version for your minimum-stability (dev).
  Check the package spelling or your minimum-stability

This is what I expected:

$ composer req sec

  [InvalidArgumentException]
  Could not find package "sec". Did you mean: "security" or "security-checker"?

In practice:

• This would only work when the user input doesn't contain a "/". Otherwise they are trying to install a Composer package and we should not fix them (e.g. "sec" -> did you mean "security"? but "foo/sec" -> Composer error)
• This would only show the 2 or 3 best alternatives.
• If we don't want to easily disclose the available aliases, this would only work if the user typed at least 3 chars (to avoid typing "a" to get those aliases, then "b", etc.)

[Proposal] Consider making the database charset configurable

Right now the charset is hardcoded as UTF8:

# /etc/packages/doctrine.yml
doctrine:
    dbal:
        # ...
        charset: UTF8

This is of course a wise default value ... but lately is more and more common to have to change this config value to utf8mb4, because that's the value needed by MySQL to store emojis correctly 😱

If #18 is considered, making this value configurable would be easy:

# Before
###> doctrine/doctrine-bundle ###
DB_URL='mysql://[email protected]:3306/symfony'
###< doctrine/doctrine-bundle ###

# After
###> doctrine/doctrine-bundle ###
DB_URL='mysql://[email protected]:3306/symfony?charset=utf8'
###< doctrine/doctrine-bundle ###

Flex tries to inspect vendor/ after Composer has already removed the package

Basically this:

$ SYMFONY_ENDPOINT=https://symfony.sh/r/contrib/15 composer remove dkarlovi/symfony-flex-docker
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 0 updates, 1 removal
  - Removing dkarlovi/symfony-flex-docker (0.1.3)
    Auto-unconfiguring "dkarlovi/symfony-flex-docker"
    Removing configuration and files

Removal failed, reverting ./composer.json to its original content.

                                                                                                                                         
  [UnexpectedValueException]                                                                                                             
  RecursiveDirectoryIterator::__construct(/home/dado/Development/symfony-skeleton/vendor/dkarlovi/symfony-flex-docker/.infra/): failed   
  to open dir: No such file or directory                                                                              

[Proposal] Recipe for private repositories

Using a server (https://symfony.sh) to define the Recipes is an excellent initiative for open-source packages, allowing to create an automatic configuration for Symfony even if the author of the package didn't include / doesn't wish to include this configuration. It is a practice more and more used, in particular in the world of javascript, like TypeScript type definitions for example.

However, the repositories symfony/recipes and symfony/recipes-contrib are public, and require approval to add or modify their manifests and their configurations (manual and strict for official, semi-automatic if I understood correctly for contrib). This approach is therefore not suitable for private packages.

Questions are beginning to be asked about this on the Medium Symfony 4: Contributing Recipes, With an approach to create a private server, And asking the question about opening the source code of symfony.sh to create this private server.

I'm not against this approach quite the opposite, it sounds like creating a Satis server for Composer. However, it would be simpler/quicker to add the manifest and configurations to a dedicated directory in the repository. Just like Composer, that we can add repositories that are not referenced in Packagist or a Satis private server by using the VCS Repository. But unlike the VCS Repositories of Composer, the performance are not impacted, quite the opposite (no HTTP request).

The path to the Recipe directory might will have a default value (./recipe/ or other), with a possibility to change this value in the composer.json file with the extra.symfony.recipe-path key (or another name). If this directory exists in the repository with the manifest.json file, in this case, no request is done on the symfony.sh server.

This approach can be easily implemented given that the automatic configuration is performed just after the installation of the dependency and added just before the search of recipe on the symfony.sh server (in Symfony\Flex\Flex::filterPackageNames().

To summarize the workflow after the installation of package:

1. Check the presence of the key extra.symfony-recipe-path in composer.json file of package
2. Get the real path of package recipe
3. Check if the manifest.json file is present and valid
4. If package recipe is valid, install the automatic configuration from package source code
5. Else, search recipe in symfony.sh server and install the automatic configuration from remote recipe if recipe is present on the server (the current behavior)

What do you think?

Docker support

Hi,

I've created an alternative Symfony skeleton with Docker support: https://github.com/dunglas/symfony-docker-skeleton
It's basically the API Platform Docker setup tuned to support Flex.

It works, but some minimal modifications can be done to some recipes to ease the install (expect some PRs soon).

Main differences with the standard skeleton are:

• It doesn't use the Dotenv component (Docker has a builtin support of .env files)
• In dev mode, the front controller can be accessed from the host

It's probably possible to go one step further and to automatically add required services with a Configurator (e.g: add a Redis image to docker-compose.yml when installing predis/predis).

Is it something you may include into Flex?

Composer version requirement

After testing, it seems that Flex is compatible with Composer 1.3.1+ (I had an error with 1.3.0 when installing symfony/stopwatch, not sure it comes from composer though, and installing any bundle with 1.2 didn't work).

How can we tell, when installing Flex, that the user needs to upgrade its composer version if it's not compatible?

Unexpected error message when the package name is not found

This works perfect:

But I wasn't expecting this error:

[Question] Make MicroKernel a first-class citizen?

In previous Smyfony versions, microkernel was a questionable feature, added without much enthusiasm and implemented as a trait.

But in the new Symfony paradigm, the microkernel is a central part of it. Why not make it a real PHP class instead of a trait?

---

Before:

use Symfony\Component\HttpKernel\Kernel as BaseKernel;

class Kernel extends BaseKernel
{
    use MicroKernelTrait;

    // ...
}

After:

use Symfony\Component\HttpKernel\MicroKernel;

class Kernel extends MicroKernel
{
    // ...
}

The "https://pr16.contrib.flex.symfony.com/m/makasim/temp-file/0.2.0" file could not be downloaded.

I am playing with the recipe I created. Got the next error:

The dependency is next: enqueue/fs-pack -> enqueue/fs -> makasim/temp-file

 [Composer\Downloader\TransportException]                                                                                                                                                         
  The "https://pr16.contrib.flex.symfony.com/m/makasim/temp-file/0.2.0" file could not be downloaded: Peer certificate CN=`symfony.com' did not match expected CN=`pr16.contrib.flex.symfony.com'  
  Failed to enable crypto                                                                                                                                                                          
  failed to open stream: operation failed  

Steps to reproduce:

1. Create project

$ composer create-project symfony/skeleton:3.3.x-dev enqueue-demo-bug; 
$ cd enqueue-demo-bug;

2. Require pack

$ SYMFONY_ENDPOINT=https://pr16.contrib.flex.symfony.com/ composer req enqueue/fs-pack -vv

Here's the composer output:

$SYMFONY_ENDPOINT=https://pr16.contrib.flex.symfony.com/ composer req enqueue/fs-pack -vv
Using version ^0.3.0@dev for enqueue/fs-pack
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Dependency resolution completed in 0.143 seconds
Analyzed 6862 packages to resolve dependencies
Analyzed 176258 rules to resolve dependencies
Dependency resolution completed in 0.000 seconds
Package operations: 8 installs, 0 updates, 0 removals
Installs: makasim/temp-file:0.2.0, enqueue/psr-queue:dev-master 05bb674, enqueue/fs:dev-master 598cbba, enqueue/null:dev-master f971acf, ramsey/uuid:dev-master 446df35, enqueue/enqueue:dev-master a758bfc, enqueue/enqueue-bundle:dev-master 88a0957, enqueue/fs-pack:dev-master 8e277b5
  - Installing makasim/temp-file (0.2.0): Loading from cache Extracting archive
    REASON: enqueue/fs-pack 0.3.x-dev requires makasim/temp-file ^0.2 -> satisfiable by makasim/temp-file[0.2.0].


Installation failed, reverting ./composer.json to its original content.

                                                                                                                                                                                                   
  [Composer\Downloader\TransportException]                                                                                                                                                         
  The "https://pr16.contrib.flex.symfony.com/m/makasim/temp-file/0.2.0" file could not be downloaded: Peer certificate CN=`symfony.com' did not match expected CN=`pr16.contrib.flex.symfony.com'  
  Failed to enable crypto                                                                                                                                                                          
  failed to open stream: operation failed                                                                                                                                                          
                                                                                                                                                                                                   

Exception trace:
 () at phar:///usr/local/bin/composer/src/Composer/Util/RemoteFilesystem.php:482
 Composer\Util\RemoteFilesystem->get() at phar:///usr/local/bin/composer/src/Composer/Util/RemoteFilesystem.php:101
 Composer\Util\RemoteFilesystem->getContents() at /Users/makasim/projects/symfony/enqueue-demo-bug/vendor/symfony/flex/src/Downloader.php:107
 Symfony\Flex\Downloader->fetchFile() at /Users/makasim/projects/symfony/enqueue-demo-bug/vendor/symfony/flex/src/Downloader.php:91
 Symfony\Flex\Downloader->get() at phar:///usr/local/bin/composer/src/Composer/Plugin/PluginManager.php(195) : eval()'d code:257
 Symfony\Flex\Flex_composer_tmp0->getPackageRecipe() at phar:///usr/local/bin/composer/src/Composer/Plugin/PluginManager.php(195) : eval()'d code:205
 Symfony\Flex\Flex_composer_tmp0->filterPackageNames() at phar:///usr/local/bin/composer/src/Composer/Plugin/PluginManager.php(195) : eval()'d code:127
 Symfony\Flex\Flex_composer_tmp0->configurePackage() at n/a:n/a
 call_user_func() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:171
 Composer\EventDispatcher\EventDispatcher->doDispatch() at phar:///usr/local/bin/composer/src/Composer/EventDispatcher/EventDispatcher.php:116
 Composer\EventDispatcher\EventDispatcher->dispatchPackageEvent() at phar:///usr/local/bin/composer/src/Composer/Installer.php:605
 Composer\Installer->doInstall() at phar:///usr/local/bin/composer/src/Composer/Installer.php:223
 Composer\Installer->run() at phar:///usr/local/bin/composer/src/Composer/Command/RequireCommand.php:180
 Composer\Command\RequireCommand->execute() at /Users/makasim/projects/symfony/enqueue-demo-bug/vendor/symfony/flex/src/Command/RequireCommand.php:35
 Symfony\Flex\Command\RequireCommand->execute() at phar:///usr/local/bin/composer/vendor/symfony/console/Command/Command.php:267
 Symfony\Component\Console\Command\Command->run() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:846
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:191
 Symfony\Component\Console\Application->doRun() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:227
 Composer\Console\Application->doRun() at phar:///usr/local/bin/composer/vendor/symfony/console/Application.php:122
 Symfony\Component\Console\Application->run() at phar:///usr/local/bin/composer/src/Composer/Console/Application.php:100
 Composer\Console\Application->run() at phar:///usr/local/bin/composer/bin/composer:54
 require() at /usr/local/bin/composer:24

Weird behavior when installing Monolog support

I've installed monolog by typing composer require log. Monolog, the bridge and the bundle are in the vendors, but the bundle has not been automatically registered.

[Bug] Can't load routing via annotations

If I uncomment this in the default /etc/routing.yaml:

controllers:
    resource: ../src/Controller/
    type: annotation

And create a src/Controller/DefaultController.php with the appropriate annotations, I see this error:

---

But this should work after this change: symfony/symfony#21231

Better explain in the README the dangers of using Flex

This phrase is a bit scary:

[...] it can delete some of your files [...]

Maybe we can limit the scope of that phrase? E.g. "it can delete some of your config files stored in app/config/ ?

[Question] Is the auto port detection lost in Symfony Flex?

In the "What's Next" section of Flex, the message says to browse http://localhost:8000

But what if that port is already in use? Have we lost the nice feature introduced in Sf 3.3 to autoselect the first available port? (This will be available if you install WebServerBundle ... but the "first time experience" could be worse than before).