GitHub
05/11/2023, 3:47 PMcomposer install
time via a composer plugin. see #279 for detail
Some users may be restricted from the packages they install, fetching out to other sources to download required binaries.
We have seen the same issues for users in Pact-JS, whereby binaries were fetched in a post-install script, but some users have these disabled due to supply chain worries.
There are a couple of options
• Embed the binary packages directly in the source distributable
• Either makes a large bundle supporting every arch
• Separate packages, per arch, keeping the bundles as small as possible but fully self contained
• Download necessary binaries on install (as per current behaviour introduced in this pr)
• For users that cannot or chose not to run pre or post install scripts, we should allow them to download the binaries directly (via existing means) and the language implementation allow the user to configure where their binaries reside.
• Pact-Go uses the mechanism described above, whereby the user is expected to download the platform specific binary, and make it executable on the path.
Thoughts and considerations welcome from users of the pact-php package, as I am not sure what is most important to you, when it comes to the additional sources required to make pact-php work (be it the ruby or rust backed core)
pact-foundation/pact-php