Additional repository kills Web Setup Wizard Component Manager performance

[fooman]

Steps to reproduce

1. Install Magento 2.1.0-rc1
2. Add a custom repository to your main composer.json
3. Navigate from the admin to the Web Setup Wizard
4. Open the Component Manager

Expected result

1. Component Manager is functional

Actual result

1. Component Manager never finishes loading the grid in a timely manner (tested with 10 minute timeout)

Cause

This code here https://github.com/magento/magento2/blob/2.1.0-rc2/setup/src/Magento/Setup/Model/PackagesData.php#L361 causes an avalanche of individual composer commands for every single package including Magento ones, if more than 1 repository is present

[pboisvert]

@tanya-soroka can you have the team investigate this one?

[vancoz]

Hi @fooman, currently Component Manager support only repo.magento.com, there is no way to add new repos via web interface or change it.

In case if you have only repo.magento.com in your composer.json - performance of the Component Manager will be good. In case if you will add custom repo - Component Manager switches to kind of "qa/debug" mode and it calls "composer info" for each installed component, of corse this kills performance.

Conclusion:

1. Component Manager supports only repo.magento.com right now;
2. Please use command line if you need to use one more repo or custom repo;

Also we will work with @tanya-soroka on story to improve it (internal ticket MAGETWO-54289).

Thank you.

[fooman]

@vancoz this ticket should remain open until a fix is available. It currently sounds like debug code that is used internally got shipped in the product.

Consider the following scenarios:

1.) I am a system integrator and I develop a custom extension for a client. The code is kept under version control in a separate repository. To install it I add a repository to my main composer.json

2.) I am a merchant and I develop a custom theme for my store. The code is kept under version control in a separate repository. To install it I add a repository to my main composer.json

3.) I am a merchant and want to install an open source extension which is only available on github. To install it I add a repository to my main composer.json.

Essentially anyone using Composer how it's meant to work will be kept from using the Component Manager due to this acknowledged limitation. My conclusion is that not addressing this will hurt Marketplace adoption.

[vancoz]

Hello @fooman, I agree, currently Component Manager does not support all this scenarios and our product team working on it. But I also can share my personal opinion, let's have a look from other side - Magento is responsible for Marketplace and what is stored in Marketplace, we do code check, we do make sure that extensions are secure etc. And we can't guarantee that extensions from other sources are safe to install.

In case of SI or developers - I think they should take this responsibility in case if they decide do share extensions in other way than Marketplace, and probably they should help merchants to install this extensions using command line (composer).

Btw, this is my personal opinion, and currently our PO team working on different scenarios and approach.

And thank you for your response, also feel free to comment or suggest what you think about that, we are community driven company and you response will impact our decision for sure.

[piotrekkaminski]

It's a typical use case to have more composer repositories defined and Magento needs to support this flow.

[magento-engcom-team]

Could you please let us know if the issue is still actual for versions 2.2.1? Thank you.

[magento-engcom-team]

Hi @fooman. Thank you for the report. We are moving your feature request to the special project. You can track this issue here: magento/community-features#42