[FIXED] What does the composer "provide" do?

Issue

I'm using Laravel + VueJS to recreate a POS system from work. I needed to install sped-nfe package to work with it on a system for work. This package requires many other packages in order to function properly, like ext-curl, ext-soap, ext-json.

As per instructions, I added

"nfephp-org/sped-nfe" : "^5.0"

to my composer.json. When I ran composer install or composer update, the following error ocurred:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - nfephp-org/sped-nfe[v5.0.100, ..., v5.0.122] require ext-soap * -> it is missing from your system. Install or enable PHP's soap extension.
    - Root composer.json requires nfephp-org/sped-nfe ^5.0 -> satisfiable by nfephp-org/sped-nfe[v5.0.100, ..., v5.0.122].

To enable extensions, verify that they are enabled in your .ini files:
    - C:\laragon\bin\php\php-7.4.19-Win32-vc15-x64\php.ini
You can also run `php --ini` inside terminal to see which files are used by PHP in CLI mode.

I'm using Windows and I'm not authorized to modify our local server nor the actual server, I was getting frustrated trying to find a solution to my problem - almost every answer would tell me to modify my php.ini or install curl with sudo apt-get - I arbitrarily decided to add the following lines to my composer.json:

"provide": {
    "ext-curl":"*",
    "ext-soap":"*"
},

Et voilà, composer update and composer install were working smoothly. What's bothering me is, according to the composer documentation,

provide

Map of packages that are provided by this package. This is mostly useful for implementations of common interfaces. A package could depend on some virtual package e.g. psr/logger-implementation, any library that implements this logger interface would list it in provide. Implementors can then be found on Packagist.org.

Using provide with the name of an actual package rather than a virtual one implies that the code of that package is also shipped, in which case replace is generally a better choice. A common convention for packages providing an interface and relying on other packages to provide an implementation (for instance the PSR interfaces) is to use a -implementation suffix for the name of the virtual package corresponding to the interface package.

I am not providing this package, I simply wanted to require it but ended up putting it differently. Also, I've tried requiring it, but the error was still there. Was this a good solution to my problem or should I do it differently?

Is there anything about this that I should worry?

Can someone explain the 'provide' syntax for me?

Solution

If you add a package or a PHP extension to the provide section, you tell composer that your package itself or the external system setup "provides" this one. The dependency resolver is fine with this.

This does not check further whether this dependency is actually properly resolved or not. Composer relies on your statement that this is not a lie ;) So, if you only add this to the section without properly providing that package, you cannot be sure that your application works properly.

In your example: the package you want to install requires the SOAP extension. It won't work properly without it. If you cannot install that extension on your server, you should not use this package.

Answered By - Nico Haase

Answer Checked By - Terry (PHPFixing Volunteer)