Global Composer installation without commiting binary to version control?

[caendesilva]

Hey! I'm looking at distribution a compiled binary via Packagist, to be installed as a global Composer package. It seems like the documented way of doing this, but it also seems like this requires the compiled binary to be committed to the version control (judging by how the installer is set up).

Is there an alternative way of doing this? I initially thought that this would use the latest release binary from GitHub Releases. Is that something that could be possible?

[owenvoke]

Hi @caendesilva, just moved this to Discussions as I think it's more relevant here.

Unfortunately this isn't possible (unlike with package managers such as npm) as the GitHub repository (or tarball) is the thing that is downloaded by Composer. The only real way around this is to either:

• Have a single repository, that contains both source and the compiled Phar.
  This approach is used by projects such as Expose (source / dist) and the Laravel Zero installer (source / dist)
• Have 2 repositories (a source and a dist) which means that these files are stored separately.
  This approach is used by projects such as PHPStan (source / dist) and Rector (source / dist).

[caendesilva]

Thanks for the reply, @owenvoke! That makes sense, and I understand the limitation. It feels wrong to me to commit binaries to version control, but it was fairly easy to upgrade my action to do so (https://github.com/hydephp/cli/pull/37/files).

Hopefully this discussion can help others wondering about the same issue!

[caendesilva]

Somewhat related, just want to post here for others. If you're getting "SHA1 signature could not be verified: broken signature" on the committed binary, add the following to your .gitattributes

builds/* binary