Recursive dependencies in packages from custom "package" repository not being installed #11993

jpwnetcraft · 2024-05-28T10:48:17Z

jpwnetcraft
May 28, 2024

Hi, I'm having some trouble with getting the dependencies of a package which isn't available in the packagist repository installed. Here's a minimal reproducible example:

$ cat composer.json
{
    "repositories": [
        {
            "type": "package",
            "package": {
                "name": "mediawiki/elastica",
                "version": "dev-c45dc17eabcdcba2608119886ab271c70ec85a16",
                "dist": {
                    "url": "https://github.com/wikimedia/mediawiki-extensions-Elastica/archive/c45dc17eabcdcba2608119886ab271c70ec85a16.zip",
                    "type": "zip"
                }
            }
        }
    ],
    "require": {
        "mediawiki/elastica": "dev-c45dc17eabcdcba2608119886ab271c70ec85a16"
    }
}

$ composer install --no-dev
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking mediawiki/elastica (dev-c45dc17eabcdcba2608119886ab271c70ec85a16)
Writing lock file
Installing dependencies from lock file
Package operations: 1 install, 0 updates, 0 removals
  - Installing mediawiki/elastica (dev-c45dc17eabcdcba2608119886ab271c70ec85a16): Extracting archive
Generating autoload files

$ ls vendor/
autoload.php  composer  mediawiki

In the case demonstrated above, composer install --no-dev does not install the dependencies in mediawiki/elastica's composer.json (https://github.com/wikimedia/mediawiki-extensions-Elastica/blob/c45dc17eabcdcba2608119886ab271c70ec85a16/composer.json), for example elasticsearch/elasticsearch. It only installs mediawiki/elastica itself.

I'd expect it to install those dependencies, like it would if mediawiki/elastica was available in the normal packagist repository. For example, if I try and install phpunit/phpunit, things work as I expect:

$ cat composer.json
{
    "require": {
        "phpunit/phpunit": "11.1.3"
    }
}

$ composer install --no-dev
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 26 installs, 0 updates, 0 removals
  - Locking myclabs/deep-copy (1.11.1)
  - Locking nikic/php-parser (v5.0.2)
  - Locking phar-io/manifest (2.0.4)
  - Locking phar-io/version (3.2.1)
  - Locking phpunit/php-code-coverage (11.0.3)
  - Locking phpunit/php-file-iterator (5.0.0)
  - Locking phpunit/php-invoker (5.0.0)
  - Locking phpunit/php-text-template (4.0.0)
  - Locking phpunit/php-timer (7.0.0)
  - Locking phpunit/phpunit (11.1.3)
  - Locking sebastian/cli-parser (3.0.1)
  - Locking sebastian/code-unit (3.0.0)
  - Locking sebastian/code-unit-reverse-lookup (4.0.0)
  - Locking sebastian/comparator (6.0.0)
  - Locking sebastian/complexity (4.0.0)
  - Locking sebastian/diff (6.0.1)
  - Locking sebastian/environment (7.1.0)
  - Locking sebastian/exporter (6.0.1)
  - Locking sebastian/global-state (7.0.1)
  - Locking sebastian/lines-of-code (3.0.0)
  - Locking sebastian/object-enumerator (6.0.0)
  - Locking sebastian/object-reflector (4.0.0)
  - Locking sebastian/recursion-context (6.0.0)
  - Locking sebastian/type (5.0.0)
  - Locking sebastian/version (5.0.0)
  - Locking theseer/tokenizer (1.2.3)
Writing lock file
Installing dependencies from lock file
Package operations: 26 installs, 0 updates, 0 removals
  - Installing sebastian/version (5.0.0): Extracting archive
  - Installing sebastian/type (5.0.0): Extracting archive
  - Installing sebastian/recursion-context (6.0.0): Extracting archive
  - Installing sebastian/object-reflector (4.0.0): Extracting archive
  - Installing sebastian/object-enumerator (6.0.0): Extracting archive
  - Installing sebastian/global-state (7.0.1): Extracting archive
  - Installing sebastian/exporter (6.0.1): Extracting archive
  - Installing sebastian/environment (7.1.0): Extracting archive
  - Installing sebastian/diff (6.0.1): Extracting archive
  - Installing sebastian/comparator (6.0.0): Extracting archive
  - Installing sebastian/code-unit (3.0.0): Extracting archive
  - Installing sebastian/cli-parser (3.0.1): Extracting archive
  - Installing phpunit/php-timer (7.0.0): Extracting archive
  - Installing phpunit/php-text-template (4.0.0): Extracting archive
  - Installing phpunit/php-invoker (5.0.0): Extracting archive
  - Installing phpunit/php-file-iterator (5.0.0): Extracting archive
  - Installing theseer/tokenizer (1.2.3): Extracting archive
  - Installing nikic/php-parser (v5.0.2): Extracting archive
  - Installing sebastian/lines-of-code (3.0.0): Extracting archive
  - Installing sebastian/complexity (4.0.0): Extracting archive
  - Installing sebastian/code-unit-reverse-lookup (4.0.0): Extracting archive
  - Installing phpunit/php-code-coverage (11.0.3): Extracting archive
  - Installing phar-io/version (3.2.1): Extracting archive
  - Installing phar-io/manifest (2.0.4): Extracting archive
  - Installing myclabs/deep-copy (1.11.1): Extracting archive
  - Installing phpunit/phpunit (11.1.3): Extracting archive
2 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
24 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

$ ls vendor/
autoload.php  bin  composer  myclabs  nikic  phar-io  phpunit  sebastian  theseer

Is this expected? Does anyone have any ideas for how this problem can be worked around?

$ composer --version
Composer version 2.7.2 2024-03-11 17:12:18
PHP version 8.2.15

are the composer/PHP versions I'm using.

Seldaek · 2024-05-29T11:08:08Z

Seldaek
May 29, 2024
Maintainer

In package repositories you have to specify all the package metadata in the repository definition. As you do not define any requires there are no requires processed.

So yes this is completely expected. The composer.json file is completely ignored in such a case.

SO it should look like:

{
    "repositories": [
        {
            "type": "package",
            "package": {
                "name": "mediawiki/elastica",
                "version": "dev-c45dc17eabcdcba2608119886ab271c70ec85a16",
                "dist": {
                    "url": "https://github.com/wikimedia/mediawiki-extensions-Elastica/archive/c45dc17eabcdcba2608119886ab271c70ec85a16.zip",
                    "type": "zip"
                },
                "require": {
                     // REQUIREMENTS HERE and all other relevant metadata should be copied.
                }
            }
        }
    ],
    "require": {
        "mediawiki/elastica": "dev-c45dc17eabcdcba2608119886ab271c70ec85a16"
    }
}```

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Recursive dependencies in packages from custom "package" repository not being installed #11993

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Recursive dependencies in packages from custom "package" repository not being installed #11993

Uh oh!

jpwnetcraft May 28, 2024

Replies: 1 comment

Uh oh!

Seldaek May 29, 2024 Maintainer

jpwnetcraft
May 28, 2024

Seldaek
May 29, 2024
Maintainer