From b883e04303bbfe93da253616e6fe8617eeaf37b5 Mon Sep 17 00:00:00 2001 From: Andrew Bryant Date: Wed, 30 Sep 2026 17:39:14 -0400 Subject: [PATCH] package: strip composer-repository store path from runtime closure composer.lock and vendor/composer/installed.json record each package's "dist.url" as the store path of the build-time composer-repository mirror, which drags that whole ~570MB fixed-output derivation into the runtime closure even though it's just install provenance -- neither Laravel's package manifest (name/extra only) nor Composer's runtime InstalledVersions (reads installed.php, not this file) consult it. Cuts the package closure from ~1.75GB to ~1.18GB. Co-Authored-By: Claude Sonnet 5 --- package.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/package.nix b/package.nix index 987a381..3f792fe 100644 --- a/package.nix +++ b/package.nix @@ -3,6 +3,7 @@ , npmHooks , fetchFromGitHub , fetchNpmDeps +, jq , php82 , nodejs_22 , npm-lockfile-fix @@ -74,6 +75,7 @@ php82.buildComposerProject (finalAttrs: { pname = "${pname}-composer"; nativeBuildInputs = [ + jq nodejs_22 npmHooks.npmConfigHook npmHooks.npmBuildHook @@ -104,6 +106,17 @@ php82.buildComposerProject (finalAttrs: { # Remove JS/CSS build artifacts rm -rf $out/node_modules + # composer.lock and vendor/composer/installed.json record each package's "dist.url" as the + # store path of the composer-repository mirror it was installed from, which otherwise drags + # that whole (500+MB) fixed-output derivation into the runtime closure for no reason -- it's + # provenance metadata, not something Laravel's package manifest (which only reads + # name/extra) or Composer\InstalledVersions (which reads vendor/composer/installed.php, not + # this file) consult at runtime. + jq '(.packages[]?.dist.url) |= "removed"' $out/vendor/composer/installed.json > $out/vendor/composer/installed.json.tmp + mv $out/vendor/composer/installed.json.tmp $out/vendor/composer/installed.json + jq '(.packages[]?.dist.url, .["packages-dev"][]?.dist.url) |= "removed"' $out/composer.lock > $out/composer.lock.tmp + mv $out/composer.lock.tmp $out/composer.lock + rm -r $out/bootstrap/cache rm -rf $out/public/storage