Proposed workflow for Composer + module download on cheap hosting / FTP

Currently in D7, people can download core and modules as zip files and upload them to a cheap hosting via FTP.
(They can also use the module downloader, but I think I never used this myself, so no idea if this even works :) Afaik you need to give write permissions to www-data which I like to avoid.)

In Drupal 8, if you have modules that introduce composer dependencies in addition to those in core, you need to run composer update with the CLI. This is going to be difficult for the cheap hosting + FTP scenario. Especially with #2380389: Use a single vendor directory in the root → .

One solution is to run Composer locally and copy the changes to the server with FTP. But some people might not even be comfortable with that.

Other considerations:

• We don't want to ask for extensive file write permissions for www-data, if we can avoid it.
• Module upload with zip in D7 is not a comfortable thing, let's be honest about that. Those poor souls have a hard life already now. I think they even need to work with zip files for module *updates*. Ouch.

Proposed solution

Let core require composer, so it can download composer libraries.

Create a module with a UI to configure a "contrib module download wishlist". This can be used for new modules, and also for module updates.

Once you are happy with the wishlist, the module can:

• Determine the combined Composer dependencies for core + the wishlist modules.
• Warn about conflicts.
• Maybe this means to generate (*) a combined composer.json file.
• Download (*) the modules and the Composer packages.
• Reduce the downloaded stuff to those files that are modified.

(*) The composer.json and the downloaded stuff can go into on of:

• The private files directory.
• A separate web-writable download directory.
• A zip file to download.

So far this leaves the existing site completely untouched.

Now the user can copy this stuff over the existing source files manually, and take responsibility for any permission changes.

This workflow enables Composer, and is more comfortable (imo) than what those people currently do in D7.

The module could be introduced in core in 8.1.*, or it could even live in contrib.. although for this we would need a core version with Composer included.
But we might want a proof-of-concept implementation soon, to reduce the fear factor of issues like #2380389: Use a single vendor directory in the root →

Caveat: Afaik, in some cases Composer needs stuff like git to download dependencies that are not on Packagist. But we might find a way to work around that.