I'm creating an open source PHP project that reuses other open source code instead of reinventing the wheel. I'm using composer to pull these projects into my vendor folder. What happens if these vendors delete their repository & all traces of their code from the internet? Now composer can't download the project. Should I fork every project I'm depending on, and depend on the fork? Seems like a pain, but the only 'safe' way to ensure the vendor can't delete things my project needs to run.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
I wouldn't start out with the assumption that the maintainer of a third-party library that you use will pull the rug from underneath you. It is far more common that a maintainer leaves a project abandoned on the net than that they actively remove it.
In the off-chance that a dependency of your project does get pulled off the net, chances are that you still have a local copy of the source code of that project somewhere in your build, test or deployment environment and you can use that to fork the project then and there.
OK, I'll play the devil's advocate here: forking in today's DVCS world is so cheap, and so low impact that yes, I would definitely fork. Aside from the possibility of the project owner executing a Mark Pilgrim and actively seeking to delete their online presence this has the added benefits of being able to work out things that appear to you to be bugs in the original project while still relying on an online repo (and all of the associated benefits thereunto) without issuing a pull request for your changes and also without having to update your vendor-relying code to point to your new fork when you decide that you need to fork to try to address an issue you've found.
In fact, I wouldn't rely on another project without forking it first - it protects you against all manner of possible chaos, and costs very little to maintain.
In addition, and this is somewhat github-specific, but one measure of the adoption of an open-source project is how many forks it has, so in one sense you're adding credence to the library you're consuming by saying "I think this library is important enough that I want my own fork."