PHP 7.4 fixes

[ramereth]

• Set workdir as a library so this works on EL8
• PHP 7.4 fixes
• Move phpCAS module to composer

[tillkamppeter]

I have one question here:

Most of the code contained in this repo, especially after your PHP 7.4 migration seem to be copies of third-party libraries (I assume that you did not write ~70000 lines of code in such a short time). Is it really required to carry them in our repo? Can one not just mention them as dependencies in the documentation and tell the user to install them in order to use our code?

There are several disadvantages of such code copies:

• The repo gets huge
• If the added library has a new upstream release we would have to replace it in our code
• Even worse if the upstream library has a security bug

And even more a maintenance nightmare it gets if you did small changes in the copied library code ...

[ramereth]

@tillkamppeter the additional code I added is the output of the composer install so it's vendored libraries. We could in theory move this out of the repository and just keep the composer.json/lock files if you prefer and then do the composer install via our configuration management system on the system itself. Let me know how you'd like to proceed.

[ramereth]

@tillkamppeter can we please get this merged soon?

[tillkamppeter]

@tillkamppeter the additional code I added is the output of the composer install so it's vendored libraries. We could in theory move this out of the repository and just keep the composer.json/lock files if you prefer and then do the composer install via our configuration management system on the system itself. Let me know how you'd like to proceed.

What are "vendored libraries"? Is it not possible to make foomatic-db-webapp installable on arbitrary servers with a lower amount of copied (and perhaps slightly modified, where it is not clear what got modified) code which this way gets maintained independently at two places (here and at the original place)?

Would be the "just keep the composer.json/lock files" way then not be the better way?

[ramereth]

@tillkamppeter the additional code I added is the output of the composer install so it's vendored libraries. We could in theory move this out of the repository and just keep the composer.json/lock files if you prefer and then do the composer install via our configuration management system on the system itself. Let me know how you'd like to proceed.

What are "vendored libraries"? Is it not possible to make foomatic-db-webapp installable on arbitrary servers with a lower amount of copied (and perhaps slightly modified, where it is not clear what got modified) code which this way gets maintained independently at two places (here and at the original place)?

Would be the "just keep the composer.json/lock files" way then not be the better way?

Yes it would be better to just have the composer files here and have our config management do the install part on the server. I'll work on updating this PR to reflect that and also update our config management to handle that.

In the meantime, I've rebased this with master to account for removing test.php as requested since production is still pointed at this branch.