[PHP-DEV] [RFC] Policy on 3rd party code

On Tue, Oct 8, 2024, at 01:31, Jim Winstead wrote:

On Sun, Oct 6, 2024, at 12:33 PM, Mike Schinkel wrote:

Or, imagine a store where PHP could sell T-Shirts, plushies and more,

all to fund more core development?

I have a hard time imagining that this would ever be more than a rounding error compared to the sponsorships and individual contributions that the PHP Foundation currently relies on.

This is a rounding error that I really wish could appear on my desk. I’d happily purchase plushies, t-shirts, and (especially) coffee mugs. I can’t really contribute monetarily in any meaningful way, but purchasing little items like these would be awesome, and I can’t be the only one.

— Rob

On Wed, Oct 2, 2024, at 11:36 AM, Larry Garfield wrote:

Since Jim's RFC proposal was criticized for being too vague, I hereby
offer a somewhat more prescriptive policy proposal on using 3rd party
code. (With JIm's blessing.) It's still more heuristics than rules,
but I think that's the right approach generally. It also includes a
voting mechanism to resolve edge cases when they come up.

I'm sure we'll bikeshed it to death, but please keep an open mind about
the concept in the first place. PHP is more than just php-src, and
that's a good thing. We need to catch up with that reality, while at
the same time maintaining a reasonable neutrality about projects
Internals doesn't manage directly.

PHP: rfc:third-party-code

*Puts on trusty flame-retardant suit*

Some additional libraries that could probably be added to the list of pre-approved libraries for PHP tooling because they're already being used:

* michelf/php-markdown (used by main.php.net)
* phpmailer/phpmailer (used by main.php.net)
* squizlabs/php_codesniffer (used by news-web.php.net)
* symfony/dotenv (used by pecl.php.net)
* symfony/console (used by pecl.php.net)
* fzaninotto/faker (used by pecl.php.net)
* friendsofphp/php-cs-fixer (used by www.php.net)

The way that the "PHP documentation" section talks about third-party libraries feels strange, but there are also other third-party tools and services mentioned and that we may want to think about:

The documentation has a chapter on installing LiteSpeed which covers both the commercial version (LiteSpeed Web Server) and the open source version (OpenLiteSpeed Web Server). PHP: LiteSpeed Web Server/OpenLiteSpeed Web Server on Unix systems - Manual

Can we add a section on Caddy that is similar to the ones for Apache and NGINX?

What about FrankenPHP?

The instructions for installing macOS via packages has an example for Brew but not for MacPorts or Fink. PHP: Installation on macOS using third-party packages - Manual

There is a section in the Windows install docs that lists third-party packages but there's not even an example or explanation like there is for Brew on macOS: PHP: Third-party tools for installing PHP - Manual

There is a chapter on installing PHP on cloud providers that only includes three providers: PHP: Installation on Cloud Computing platforms - Manual

Could we add a section about Google Cloud?

Could we add a section about Oracle Cloud?

Could we add a section about STACKIT?

Could we add a section about Hetzner?

What about Laravel Cloud (when it launches)?

Jim

On Oct 7, 2024, at 7:31 PM, Jim Winstead <jimw@trainedmonkey.com> wrote:

What is currently blocking content that at least one unpaid volunteer* wants to contribute in a way that leverages the existing technical infrastructure is that there is vague, unwritten policy that we don’t mention third-party tools in the PHP documentation, except for all of the third-party tools that we already mention in the PHP documentation.

I am totally with you on this, and I apologize on my part if anything about what I said made people view it as an either-or proposition.

Instead, I intended comments were intended to be viewed as “Yes, and…”

On Sun, Oct 6, 2024, at 12:33 PM, Mike Schinkel wrote:

IOW, given that all the current infrastructure really supports are
static pages — without a gargantuan effort to write and maintain a
custom framework from scratch by unpaid volunteers — the resultant
website can only realistically be static pages.

Developing and maintaining the PHP websites is far from a gargantuan effort, as evidenced by how it is currently (and has long been) maintained on a very ad-hoc basis by a very small number of volunteers with some work that is now sponsored by the PHP Foundation. (I believe that amounts to maybe the equivalent of one full-time person.)

What I was thinking when I spoke of a “gargantuan effort” was if a team were to try to duplicate the functionality of a modern website vs. just maintaining the aging and minimal website that is currently php.net.

I think a proposal for the PHP project taking on something like centralized databases of “all” third-party packages also needs to come up with a very good rationale as to why that will turn out differently than how PEAR and PECL did.

That rationale is an easy one.

  1. First, both PEAR and PECL are package managers. I was proposing a directory. Directories are an order of magnitude easier to manage than a package manager.

  2. PECL was an extremely high bar as it was a package needed to be written in C, so we should just ignore that one.

  3. PEAR had huge friction because (from what I understand) it required approval from members of the PEAR Group to be included.

Let’s instead compare to examples that turned out very different from PEAR and PECL, and although are arguable also package managers it is their directory aspect that I am focusing on and that IMO has been a significant reason for their success:

The reason those three have been far more successful has a large amount to do with the fact that the directory is managed by all the individuals in the community with solutions to showcase and and not a small group of overworked and underpaid individuals, and especially not having gatekeepers who must scan everything and who have subjective approval for inclusion.

And ensuring against bad actors have obviously been effectively managed by these other projects.

Given all those factors I do not see a strong argument to compare the experience with PECL and PAIR to the idea of php.net hosting a directory of 3rd party solutions.

(And I think that “minus any objectively determined bad actors” is hand-waving away some extremely hard non-technical issues.)

While I would admit there may be some hand waving there, but to claim something is “extremely hard” without examples as a justification for not doing it is even more hand-wavy. Care to delineate at least of few of those extremely hard non-technical issues you envision to see if they are indeed extremely hard?

Or, imagine a store where PHP could sell T-Shirts, plushies and more,
all to fund more core development?

I have a hard time imagining that this would ever be more than a rounding error compared to the sponsorships and individual contributions that the PHP Foundation currently relies on.

Maybe, maybe not.

But that perspective obscures the point I was trying to make. It is entirely possible that soliciting an RFP for a website that could also help generate revenue would present the community with ideas that nobody here has even considered.

One this is for absolutely certain, though. Keeping the website as-is will certainly not generate any additional revenue.

For me I would rather bet on the potential for innovation than bet against it.

Frankly, I find your proposal dubious because it assumes that there is some body of “interested stakeholders” who are going to be able to come to an agreement on an RFP that can then be used to enable a unbiased, merit-based selection by a vote of the voting members.

Maybe. But there is find fault then it is to find a working solution.

What I was asking people to consider is “Would we want this?” If the answer is yes, they we can discuss those things you claim to be dubious to see if there are solutions.

Again, if we don’t look for solution we will absolutely never find any.

It assumes that somehow assembling all of the organizational infrastructure to enable outsourcing the technical infrastructure is solving the easy part of the problem.

It assumes that there is some need for non-static-pages with content that will somehow come pouring forth out of less-highly-skilled unpaid volunteers if only the technical infrastructure was taken care of for them.

No, that is not what it assumes.

What it assumes is that people can be rallied around an effort that is aspirational and the outcome can be an order of magnitude better result. Maintaining the existing website is not aspirational. Empowering the community to do so much more with the website could be aspirational.

So all I was asking was, “Is that a future people would like to see, or not?” If no, then never mind.

But if yes, why can we not explore how to make it happen?

-Mike

On Tue, Oct 8, 2024, at 8:48 PM, Mike Schinkel wrote:

On Oct 7, 2024, at 7:31 PM, Jim Winstead <jimw@trainedmonkey.com> wrote:

What is currently blocking content that at least one unpaid volunteer* wants to contribute in a way that leverages the existing technical infrastructure is that there is vague, unwritten policy that we don't mention third-party tools in the PHP documentation, except for all of the third-party tools that we already mention in the PHP documentation.

I am totally with you on this, and I apologize on my part if anything
about what I said made people view it as an either-or proposition.

Instead, I intended comments were intended to be viewed as "Yes, and..."

*snip*

At this time, we're not looking for yes-ands in this thread. Please stop dragging it off topic into your own pet ideas. If you really want to push them, start new threads for them and leave this one alone.

--Larry Garfield

On 08.10.2024 at 01:31, Jim Winstead wrote:

What is currently blocking content that at least one unpaid volunteer* wants to contribute in a way that leverages the existing technical infrastructure is that there is vague, unwritten policy that we don't mention third-party tools in the PHP documentation, except for all of the third-party tools that we already mention in the PHP documentation.

* It's me, I'm the problem.

You can add me to the list. :slight_smile:

Christoph

On Wed, 2 Oct 2024 at 19:37, Larry Garfield <larry@garfieldtech.com> wrote:

Since Jim’s RFC proposal was criticized for being too vague, I hereby offer a somewhat more prescriptive policy proposal on using 3rd party code. (With JIm’s blessing.) It’s still more heuristics than rules, but I think that’s the right approach generally. It also includes a voting mechanism to resolve edge cases when they come up.

I’m sure we’ll bikeshed it to death, but please keep an open mind about the concept in the first place. PHP is more than just php-src, and that’s a good thing. We need to catch up with that reality, while at the same time maintaining a reasonable neutrality about projects Internals doesn’t manage directly.

https://wiki.php.net/rfc/third-party-code

Puts on trusty flame-retardant suit


Larry Garfield
larry@garfieldtech.com

I remember a while ago a discussion about bundling composer with PHP by default (and possibly dropping pear).
What ever happened with that?
As the first thing any dev does after setting up PHP, is install composer. As this RFC points out, almost every project modern uses composer to manage dependencies, and every Library, SDK and framework requires composer.
So i’d change this line in the RFC

We should use it, we should document it, we should promote it.
To
We should use it, we should document it, we should promote it, we should bundle it!

As I mentioned, it is basically a requirement nowadays to work in PHP unless you are doing something custom that doesnt require any dependencies, but then, is that person planning to release it to the public?
I am of no opinion of weather php devs internally should use composer, i have no skin in that game. But Documentation - Yes, Promotion - Yes, but does it really need it? Bundle it - Yes!

On Thu, Oct 24, 2024, at 01:57, fennic log wrote:

On Wed, 2 Oct 2024 at 19:37, Larry Garfield <larry@garfieldtech.com> wrote:

Since Jim’s RFC proposal was criticized for being too vague, I hereby offer a somewhat more prescriptive policy proposal on using 3rd party code. (With JIm’s blessing.) It’s still more heuristics than rules, but I think that’s the right approach generally. It also includes a voting mechanism to resolve edge cases when they come up.

I’m sure we’ll bikeshed it to death, but please keep an open mind about the concept in the first place. PHP is more than just php-src, and that’s a good thing. We need to catch up with that reality, while at the same time maintaining a reasonable neutrality about projects Internals doesn’t manage directly.

https://wiki.php.net/rfc/third-party-code

Puts on trusty flame-retardant suit

Larry Garfield

larry@garfieldtech.com

I remember a while ago a discussion about bundling composer with PHP by default (and possibly dropping pear).

What ever happened with that?

As the first thing any dev does after setting up PHP, is install composer. As this RFC points out, almost every project modern uses composer to manage dependencies, and every Library, SDK and framework requires composer.

So i’d change this line in the RFC

We should use it, we should document it, we should promote it.

To

We should use it, we should document it, we should promote it, we should bundle it!

As I mentioned, it is basically a requirement nowadays to work in PHP unless you are doing something custom that doesnt require any dependencies, but then, is that person planning to release it to the public?

I am of no opinion of weather php devs internally should use composer, i have no skin in that game. But Documentation - Yes, Promotion - Yes, but does it really need it? Bundle it - Yes!

There is nothing stopping packagers from bundling composer. In fact, install-php-extensions (https://github.com/mlocati/docker-php-extension-installer) can do it via @composer.

Debian packagers can recommend it via “recommends” and I believe the default settings will install it.

The main issue is that composer is updated fairly regularly and most package maintainers don’t have the time to keep up with it.

— Rob

On Wed, Oct 23, 2024, at 6:57 PM, fennic log wrote:

I remember a while ago a discussion about bundling composer with PHP by
default (and possibly dropping pear).
What ever happened with that?
As the first thing any dev does after setting up PHP, is install
composer. As this RFC points out, almost every project modern uses
composer to manage dependencies, and every Library, SDK and framework
requires composer.
So i'd change this line in the RFC

We should use it, we should document it, we should promote it.

To

We should use it, we should document it, we should promote it, we should bundle it!

As I mentioned, it is basically a requirement nowadays to work in PHP
unless you are doing something custom that doesnt require any
dependencies, but then, is that person planning to release it to the
public?
I am of no opinion of weather php devs internally should use composer,
i have no skin in that game. But Documentation - Yes, Promotion - Yes,
but does it really need it? Bundle it - Yes!

Bundling Composer with PHP is an entirely different question with a host of additional concerns to consider, like whether the Composer maintainers would even want that. Let's please stay focused on the topic at hand.

--Larry Garfield

On 24 Oct 2024, at 03:27, Larry Garfield <larry@garfieldtech.com> wrote:

Bundling Composer with PHP is an entirely different question with a host of additional concerns to consider, like whether the Composer maintainers would even want that. Let's please stay focused on the topic at hand.

--Larry Garfield

I think the multiple deviations from the topic suggests the policy changes don’t go far enough. In contrast, I also think the people that wants bigger changes are more likely to not have a vote and have felt how much the PHP project makes it difficult to receive contributions.

On Wed, Oct 2, 2024, at 1:36 PM, Larry Garfield wrote:

Since Jim's RFC proposal was criticized for being too vague, I hereby
offer a somewhat more prescriptive policy proposal on using 3rd party
code. (With JIm's blessing.) It's still more heuristics than rules,
but I think that's the right approach generally. It also includes a
voting mechanism to resolve edge cases when they come up.

I'm sure we'll bikeshed it to death, but please keep an open mind about
the concept in the first place. PHP is more than just php-src, and
that's a good thing. We need to catch up with that reality, while at
the same time maintaining a reasonable neutrality about projects
Internals doesn't manage directly.

PHP: rfc:third-party-code

*Puts on trusty flame-retardant suit*

An update here. I have converted the RFC into a PR against the policies repo. (Thanks to Derick for his help in dealing with RST format.)

It's essentially the same as the last RFC text, though I split up the approved lists to make it easier to add to in the future. I also added an exceptions mechanism for Dokuwiki.

The RFC itself has been updated to be basically just a placeholder stub for the PR. The vote will be basically "merge this PR? Y/N."

Absent any more feedback, I will call a vote on it in a week or so.

--Larry Garfield

On Thu, Oct 24, 2024, at 12:02 PM, Larry Garfield wrote:

On Wed, Oct 2, 2024, at 1:36 PM, Larry Garfield wrote:

Since Jim's RFC proposal was criticized for being too vague, I hereby
offer a somewhat more prescriptive policy proposal on using 3rd party
code. (With JIm's blessing.) It's still more heuristics than rules,
but I think that's the right approach generally. It also includes a
voting mechanism to resolve edge cases when they come up.

I'm sure we'll bikeshed it to death, but please keep an open mind about
the concept in the first place. PHP is more than just php-src, and
that's a good thing. We need to catch up with that reality, while at
the same time maintaining a reasonable neutrality about projects
Internals doesn't manage directly.

PHP: rfc:third-party-code

*Puts on trusty flame-retardant suit*

An update here. I have converted the RFC into a PR against the
policies repo. (Thanks to Derick for his help in dealing with RST
format.)

Add a policy page on third party code usage. by Crell · Pull Request #10 · php/policies · GitHub

It's essentially the same as the last RFC text, though I split up the
approved lists to make it easier to add to in the future. I also added
an exceptions mechanism for Dokuwiki.

The RFC itself has been updated to be basically just a placeholder stub
for the PR. The vote will be basically "merge this PR? Y/N."

Absent any more feedback, I will call a vote on it in a week or so.

There were more existing 3rd-party dependencies that should probably be added to the policy text:

https://news-web.php.net/php.internals/125769

Two I missed were JpGraph and Parsedown which are used by web-doc. (Currently by side-loading JpGraph and having an old copy of Parsedown committed to web-doc, I would hope to move those out as Composer dependencies if we decide to allow that.)

Jim

Hello :slight_smile:

On Sun, Oct 27, 2024 at 3:28 AM Jim Winstead <jimw@trainedmonkey.com> wrote:

There were more existing 3rd-party dependencies that should probably be added to the policy text:

php.internals: Re: [RFC] Policy on 3rd party code

Two I missed were JpGraph and Parsedown which are used by web-doc. (Currently by side-loading JpGraph and having an old copy of Parsedown committed to web-doc, I would hope to move those out as Composer dependencies if we decide to allow that.)

Jim

First, I want to extend my gratitude to all who keep this effort
running, your efforts are truly appreciated and much needed! :slight_smile:

I've been following this thread and, while I understand the historical
context and some of the off-topic discussions, I find myself a bit
puzzled.

Historically, the restrictions on what could be used for the php-web,
php-doc, and other codebases were primarily about ensuring that
mirrors could operate using a stock PHP setup without additional
dependencies like database servers. Over time, some services couldn't
adhere to these restrictions, leading to various exceptions. It is
important to note that php.net no longer has an official mirror
program (see PHP: Mirroring The PHP Website).

Historically, the restrictions on what can be used for the php-web,
php-doc, etc code base at large was about the mirrors (, for any of
these services, could use it by using a stock PHP without anything
else, be database servers etc. Some services obviously could not do
it with these restrictions and 'exceptions' have appeared along the
way. php.net does not have an official mirror program anymore (see
PHP: Mirroring The PHP Website), though mirrors still advertise
themselves at PHP: Information About This PHP Mirror Site

The principle that "php.net does not do promotional content" was, and
still is, about avoiding explicit promotions of specific companies,
products, or individuals. For example, all mirrors were listed in one
place, and links/ads/etc from our homepage were never allowed. This is
the context behind the stance of not promoting non-php.net entities.

Regarding the tools we use in php.net projects, we already leverage a
wide range of tools, services, and libraries, both PHP-based and
otherwise. These can be seen in our repositories and elsewhere. Given
that we no longer rely on a mirror network program per se, I don't see
the issue with relaxing some of these strict rules. Doing so could
make life easier and more enjoyable for maintainers, and likely
improve the codebase by reducing the "Not Invented Here" syndrome or
making things easier to maintain.

Composer, for instance, has always wanted to remain independent from
php.net, which is perfectly understandable. However, does this mean we
can't use it? That seems like an overreaction in today's PHP
development ecosystem. While it's true that anything can be done using
a stock PHP setup without dependencies, this approach has not been
ideal for many areas for quite some time. It is most certainly valid
as well for many other tools or libraries.

Last but not least, it might be a good thing (tm) to maintain a simple
list of the tools we use and their purposes. This wouldn't be
promotional but rather informative, helping everyone understand the
current state of our toolset, improving transparency.

best,
--
Pierre

@pierrejoye | http://www.libgd.org

On Sat, Oct 26, 2024, at 3:24 PM, Jim Winstead wrote:

There were more existing 3rd-party dependencies that should probably be
added to the policy text:

php.internals: Re: [RFC] Policy on 3rd party code

Two I missed were JpGraph and Parsedown which are used by web-doc.
(Currently by side-loading JpGraph and having an old copy of Parsedown
committed to web-doc, I would hope to move those out as Composer
dependencies if we decide to allow that.)

Jim

I have updated the pre-approved list to include everything we're currently using for PHP Tooling, and added a few of them to the other lists as well. (List both Psalm and PHPStan, list both CS-Fixer and CodeSniffer, etc.) For JPGraph, it looks like the original is abandoned and there's a zillion forks, so I listed the one that is by far most popular on Packagist.

Since folks may have opinions on these lists, I'll give it a few more days before calling the vote in case someone wants to weigh in.

The link again is: Add a policy page on third party code usage. by Crell · Pull Request #10 · php/policies · GitHub

--Larry Garfield