The best way to bundle dependencies in an application

For a while, there has been an ongoing debate over the best way to bundle dependencies with a PHP application. Traditionally, dependencies are simply included in the source code. phpDocumentor does this with packages like HTML_TreeMenu (from pear.php.net), Cezpdf, and Smarty.

This leads to the inevitable problem of extreme difficulty updating the dependencies. phpDocumentor bundles an extremely old version of HTML_TreeMenu for this reason, which denies power users the option of taking advantage of bugfixes or new versions.

Until now, the only other alternative was to simply use PEAR's package.xml to specify dependencies on the packages. However, this opens up problems because if an upgrade breaks the dependency's interaction with the application, you're stuck.

There is, however, a very elegant solution that combines the strengths of both. First of all, taking advantage of PEAR 1.4.0's new config-create command, the application developer can create a PEAR installation internal to the application.

$ pear config-create /path/to/application/pear myapp.pear.ini
$ pear install --nodeps DepPackage1 DepPackage2

Then, using PEAR_PackageFileManager, the files of the dependencies can be added to the package.xml of the application, essentially bundling them. This is old news. The innovation is that now a post-installation script can be used to set up the PEAR install on the end-user machine. The post-installation script would only need to use PEAR/Command/Config.php to customize the configuration file for the application, and PEAR/Command/Install.php to call the install command with --nodeps and --register-only options to create a customized registry for the existing dependencies.

Then, either through a plugin in the application or through the actual pear command, the end-user could upgrade the dependencies for the application without needing to upgrade the application itself. This also has the added advantage that any bugs/patches the user applies to dependencies can be maintained in a private .tgz of the dependency. After application upgrade, simply upgrade to the patched dependency version using the pear command.

In a future post, I may post actual code that can be used to do this - it's incredibly simple, less than 100 lines of actual code is needed for either the custom installer or the post-install script, all it needs is a working PEAR 1.4.0 installation.