In a composer file, what does "reference" refer to?

Question

In my composer.lock file, I noticed that some packages have a reference value:

"dist": {
    "type": "zip",
    "url": "https://ftp.drupal.org/files/projects/paragraphs-8.x-1.1.zip",
    "reference": "8.x-1.1",
    "shasum": "c678e5704a98c6a0549e415412da081cfeb03a00"
},

And some just have null:

"dist": {
    "type": "zip",
    "url": "https://ftp.drupal.org/files/projects/redirect-8.x-1.0-alpha5.zip",
    "reference": null,
    "shasum": "927aa4c8d8b40b0cd2442bee86f2f386d25e53ca"
},

What does the value refer to? I thought it refers to a commit, but both of these are zip packages, where 1 has a reference and the other does not.

Answer 1

I have checked the code of both modules and read some articles. After a bit of research and discussing with JS developers, I came to know that 'reference' in the composer file denote the PHP library tag, branch or zip file. So for example, if I say my package reference is from "reference":"master" then this will pull the code from that repository every time I run the composer update command. Defining a reference is a way to omit the requirement of adding a composer file to the library itself. But if your library is already supporting the composer using a composer.json file within its own directory then you won't need to define the package in the composer file.

Now, let's come to both these modules. First, check the source tree of the Paragraph module at http://cgit.drupalcode.org/paragraphs/tree/?h=8.x-1.x, and you will notice that no composer.json file available there so we must need to define the reference parameter in composer file to tell the application to pick the correct source files. But on the other hand, if you see the code source tree of the redirect module at http://cgit.drupalcode.org/redirect/tree/, you will found a composer.json at the root of the file. This file will allow you to omit the reference parameter from your application composer.json file.

Also, I think if we don't define this parameter the latest will be pulled in and based on the above criteria composer.lock file gets updated upon composer install command to run.

Hope this will clear your doubts!