Architecture: Interaction with non-dot org plugins as dependencies

[afragen]

Adding this as it came up often in the discussion on the Make Post

While this is probably out of scope, I can say that just using my PR it is possible to to include plugins not hosted in the WordPress.org repository simply using existing core filters and adding the slug in the Requires Plugins header.

[aristath]

I don't think we should disallow installing from 3rd-parties, but we should not add any extra filters etc to accommodate that scenario.
Both implementations don't change the installer's default behavior, so installing a plugin from a 3rd-party server will still be possible using the same methods that developers were always using 👍

[megphillips91]

installing from 3rd-parties

Seems like it is okay to work the one way but maybe not the other. In other words if I write a premium plugin (paid not on the repo) I could require a .org plugin...but maybe not the other way around. That could lead to some tricky stuff. I think that is an ethical slippery slope that could lead to 'spammy' behavior on requiring plugins.

What about 3rd party (premium) to 3rd party (premium)

This kind of raises another important consideration. Not sure what I think about that.

What do you guys think?

[afragen]

@megphillips91 I should work both ways. Requiring a premium plugin, or any non-dot org hosted plugin, will come with a few caveats.

1. The download link must be publicly available.
2. The developer will need to provide the integration to display non-dot org plugins for installation.

Take a closer look at the above image. It is my version of how dependencies would be organized. A separate tab/view would be available in the Plugin > Add New (plugin-install.php) page. That image is of that page and you will notice that those last 2 plugins are not in the dot org repository. This comes from my POC plugin and some additional coding to add non-dot org plugins.

I don't really want to get into specifics as my interpretation of how this should be coded may not be what the final version looks like but it certainly is possible. I have actually created a rather simple solution that would require a few other plugins, some premium, but it creates a rather low overhead solution.

[afragen]

If a non dot org dependency has a valid slug in the Requires Plugins header but there is no data for the dependency, a generic plugin card will be created. The requiring plugin will still be unable to be activated.

In the above, Git Updater has API data from an outside source and gravity-forms does not.