ya think I lost some hair. I thought about making a Q&A from it to help others but Im testing the plugin now to see if I can break it. Still looking at security implications regarding plugin best practices
@Rarst because it provides wordpress/wordpress... literally. If you install wp-downloader, on composer install you get wordpress/wordpress, even if wp-downloader does not require wordpress/wordpress. Because wordpress/wordpress is provided by wp-downloader.
Also using provide with vendor you don't own is how it is intended to be used, actually. If you look at packages that provide, for example, psr/log-implementation none of them own "psr" vendor.
@gmazzap the thing is wordpress/wordpress isn't actually a thing right now. you don't really get to define something in someone's namespace you don't control. if it was a thing then you could offer a replacement.
doesn't look good as for me. and likely to cause shit storm when someone from WP project notices.
In a better world there would be a wordpress/wordpress-implementation virtual package, and then wp-downloader, johnpbloch/wordpress, wordpress/wordpress, and maybe others, all would provide wordpress/wordpress-implementation.
Other packages could require wordpress/wordpress-implementation being satisfied when any of the packages above is installed.
By "providing" a package, you don't "create" it, nor you claim its ownership. If that would be true, when someone would try to push a package using that namespace, it would be blocked, because Packagist doesn't allow to push packages in a namespace owned by someone else. But right now, everyone can still push a package in wordpress/ namespace because no one claimed the ownership of that namespace.
When and if WordPress will decide to push to packagist, they will be perfectly allowed on doing that, and from that moment now one will be able to push to wordpress/ namespace. But still everyone will be able to "provide" things in wordpress/ namespace, because "providing" has nothing to do with "owning".
You're thinking too logically here. This is about politics and how it looks from the outside. For someone not in the know about composer and provider and alike it now looks like: 1. There is a package wordpress/wordpress 2. wp-downloader has something to do with it.
I can already see the headline "WordPress now on Packagist as wordpress/wordpress!!!11" Is that reasonable and fact-based? No, of course not. But still my gut says somebody will not like the looks of that.
@kraftner honestly, if somebody would be pissed off, I really don't care. As long as I did not break rules or copyrights, I am very fine and I live in peace. So, for me, I would just leave that as is. Butwecodemore is not my vendor, I received the permission to push there just before to push wp-downloader. What I do care is to avoid any, even minor, issue to @kaiser just because he trusted me on give me access on that vendor. So I will remove it, at least for now.