Handling of shadow dependency related to suggested extensions

[cedric-anne]

I work on a application that propose optional features that are only used when the corresponding extension is installed.

The following piece of code generates a SHADOW_DEPENDENCY error:

if (\extension_loaded('posix') && \posix_geteuid() === 0) {
    // ...
}

I can mark this error as ignored using either ignoreErrorsOnExtensionAndPaths() or ignoreErrorsOnExtension(), but it does not permit to target explicitely a precise code line to ignore. If in the future a contributor adds another usage of a function of the same extension, but without the proper check, it would not be detected.

The ideal solution for this use case, IMHO, would be to have a // @composer-dependency-analyser-ignore shadow-dependency comment that could be added on the corresponding line code to ignore this specific line only.

[clxmstaab]

I wonder whether the analyzer should instead take "suggested extensions" from composer.json into account and do not emit "shadow dependency" errors for lines related to suggested extensions

[cedric-anne]

I wonder whether the analyzer should instead take "suggested extensions" from composer.json into account and do not emit "shadow dependency" errors for lines related to suggested extensions

The problem with this solution is that the code may be unsafe and trigger errors when the extension is not installed. For instance, if the code does not check the availability of the extension (with extension_loaded()) or the the availability of the function (with function_exists()), then a "shadow dependency" error should be emited to warn about a potential issue.

[staabm]

just today stumbled over a related thing:

                if (function_exists('posix_getuid')) {
                    throw new Exception('Unable to create dir as user "' . posix_getuid() . '"');
                }

composer-dependency-analyser should not error about a shadow dependency but allow to leave ext-posix as a suggested dependency