removed self updater and extended installation documentation

[smoench]

Closes #173

[timglabisch]

i am 👎 because:

1. phive is not popular. Most deptrac users have to learn about phive.
2. phive is "under heavy development".
3. something like "--force-accept-unsigned" is the worst of all worlds in case of security.

are there any pros?

i would prefer providing a docker image.

feel free to overvote me.

[theofidry]

I personally feel like Deptrac is unnecessarily too opinionated about the way it is being installed, cf. the discussion about being installed as a Composer package.

That said, I agree with the current state of phive (as much as I appreciate the tool). So whilst I agree with adding an installation entry for it, I wouldn't put it as "recommended".

something like "--force-accept-unsigned" is the worst of all worlds in case of security.

@timglabisch I don't know if your comment was about the wording, but there is no security issue per se. It means your PHAR is not signed with a GPG key (as an artefact, not using the PHAR built-in signing feature which is useless) but it is downloading it over HTTPS still which is pretty much the only think you can do at that point.

i would prefer providing a docker image.

Side note, you can try $ box docker or $ box compile --with-docker, it will generate a boiler template Dockerfile for your PHAR.

[timglabisch]

I personally feel like Deptrac is unnecessarily too opinionated about the way it is being installed, cf. the discussion about being installed as a Composer package.

That said, I agree with the current state of phive (as much as I appreciate the tool). So whilst I agree with adding an installation entry for it, I wouldn't put it as "recommended".

👍

It means your PHAR is not signed with a GPG key (as an artefact, not using the PHAR built-in signing feature which is useless) but it is downloading it over HTTPS still which is pretty much the only think you can do at that point.

thanks for clarifying that.

[smoench]

I removed the recommendation for phive. Feel free to review again :)

[timglabisch]

i would prefer to keep the self-update until we've something better.

[smoench]

I think we should switch to tagged versions as we could easily updating dependencies and refactoring code. Using the latest master build for self updating would break people's pipelines. Yes, I'm using deptrac in my pipelines!

[smoench]

The self-updating mechanism will be replaced by #185 which will be available with the upcoming release.