WordPress resists heavily, but PHP will make it fast :)

@Rarst let's just keep it below 100

A modern Composer workflow with WordPress

I had to argue with author on twitter to get John's core package mentioned...

I've met him, he's speaking at wpleeds before/after me on the subject

did a lightning talk about it at the phpnw user group

well, "argue" is a strong word maybe :) but I am a little tired that people still repeat satis concoction for core while much better (and more likely to actually be used) package now exists :)

2k installs a month too :)

I haven’t used Composer for serious projects so far. What I don’t quite get: How does it integrate with my Git based workflow where everything is under version control and pushed per Git?

dependencies are not in git, composer install after checkout from git on deploy

So if any of the dependencies is compromised, I cannot see it locally?

define compromised?

hacked

well, you are looking at same dependencies locally, right?

Maybe. How can I verify that?

you can configure Composer to "prefer" version control. then it will only checkout specific commits (captured in composer.lock)

I am not sure on top of my head if it records commit hash for tags / handles tags moved... usually when someone moves tags it tends to break composer in first place :D

That doesn’t sound as if it saves time.

well if you are verifying every single thing you are downloading maybe automation is just not your thing :)

nothing prevents you form committing dependencies into git too, people just rarely do it because it's wasteful

but if you need that - knock yourself out :)

What I usually do: put WP, plugins and the theme under different local repos, update each part (each plugin) separately and look at the diff. Then I decide to push to remote or to roll back.

plus some integration tests, of course

I vaguelly remember dist zips are hashed too (so they won't match if modified), but fuzzy on details

if you are doing it unlike everyone else then solutions for everyone else won't fit well :)

Trust is not a factor in my deployment.

see above — version control, hashed archives and stuff. I think you are hardly the first paranoid package consumer

I think we are too quick to close jump on more theoretical questions lately (like wordpress.stackexchange.com/q/159567/847 ) thought it being short and somewhat poor didn't help it

@toscho thats still how our setup works

only composer pulls down and sets up the initial repository in the appropriate place

any hack as such would have to get around github and the rest

I have no idea what that means == primarily opinion-based

and we can set up our lock file with a known configuration, if a client then deploys and the remote has been hacked, the lock file has all the commit hashes it wants and there's a mismatch

and the composer install fails

@TomJNowell does that work with the complete installation under one repo, or do you use multiple repos per project?

@toscho each dependency has its own repo, there's a primary repo that has composer.json and whatever scaffolding/documentation, additional bits necessary. Sometimes we include a plugin in that repository for simplicities sake. We tend to install Core using WP CLI or subversion

the whole domain mapping vs subdirectory installs thing kind of killed our ability to use John P Blochs installer, since composer does not play well with nested packages

There is a ticket to get domain mapping into the WP core. It works already partially.

there's talk of a major overhaul to multisite in 4.1

fingers crossed it is all pulled in and sorted properly

yeah, like for every version since 3.0

makes a mental note to check for horrible explosions on windows in case of

last time they touched multisite my htaccess had c:/ paths in it

Does anyone have a good example for a Decorator Pattern in PHP that works without extending abstract classes?

@kaiser who force to use abstact classes?

@kaiser gist.github.com/Giuseppe-Mazzapica/a10494a23b799cedfc37

why would one want to use something like that?

ah wrappers

silly hyper abstract names

hmmm has anybody ever had a use of an object pool pattern in PHP?

I fiddle with super-ultra-amateur game engine design from time to time and object pooling is immensely useful to work around costly JS garbage collection - but never had a reason to use it in PHP. Seems mostly applicable to applications that run continuously rather than serving single requests...

I've seen memory pools in C++ code

^ Aye! Again, most likely a continuously running application. In my CSC coursework we built pooling structures in C and Java. It seems to be primarily useful as a memory-management technique, which is something we usually don't deal with in PHP... Creating object pools for single requests would likely reduce performance rather than improving it! I'm assuming there must be libs out there for it, but I'm willing to get they're more intended for CGI scripts.

Still I would be interested to know if they are ever applied to single-request serving scripts!

More likely that the PHP interpreter itself is pooling things in the background...

@boscho more likely interning

@TomJNowell which is itself a specific application of pooling :P . Couldn't tell you though - never glanced at PHP source. But I feel like PHP tends to value speed over memory consumption, wherein interning would slow things down more than other alternatives. I feel interning is counter to the pass-by-value nature of most of the STDLIB, too. No clue though - just wild speculation at this point.

it's a flywheel pattern

:O

Aaaand I just fell out of my depth. Will be reading up on some more patterns, and maybe opening the PHP source if I get feeling frisky :)

wiki.php.net/rfc/performanceimprovements

there has been work done

@TomJNowell thanks for the link

cant say if that patch was merged or not

Nonetheless gets me started with some insight into PHP's internals

@TomJNowell Status: Implemented in 5.4