How to deploy a webapplication in a single phar file with composer?

Question

I intend to use single phar file with digital signature to deploy a web application. Combined this with event sourcing would make me very easy to follow release early, release often philosophy...

I am using composer as package manager. What I am uncertain:

• How to pack the vendors with my application into a single phar?
  I am not sure how composer installs a vendor, but I think it can install them as phar files as well. I found almost nothing about phar-s packed into other phars.
• Is composer's autoloader prepared to do that, or I have to do some modifications?
• Do I have to install composer on the server? (I have no CLI, and I have no rights to do that. Bad for me, yes.)
• How can I filter out automatically the tests and documentations of my application and its dependencies. (I want to have a small release package.)

Answer 1

To answer some of your questions:

1. Composer does not install .phar files as the dependencies. In fact, those common packages that do come as .phar file (namely PHPUnit) do offer .phar as an alternative to using Composer, which is mutually exclusive. So you'd simply run composer install, get a directory tree of your own files and vendor files, and can then add these all into the .phar file you are about to create.
2. Composer autoloader does use __DIR__ to know where it is, and where other files are relative from this constant. This should be compatible with .phar files.
3. You have to install Composer on the machine you intend to create the .phar files on.
4. Filtering unwanted files is the task of your build script that creates the .phar files. It is not the task of Composer.

Note that there are already libraries that help you creating .phar files. Have a look at kherge/box, for example.