Cannot access a private repository in gem-fury

Question

I've setup a private composer repository via gem-fury, but when I'm trying to download one of the packages (using composer-require) I receive the following error:

  [Composer\Downloader\TransportException]
  The 'https://s3.amazonaws.com:443/gemfury/gems/[SOME_STRING]/[VENDOR][PACKAGE]_[VERSION]_zip?Signature=SIGNATURE&Expires=1481739039&AWSAccessKeyId=[AWS_ACCESS_KEY]' URL could not be accessed: HTTP/1.1 400 Bad Request

P.S. I know that the authentication worked because composer does receive the package.json file (the latest version is recognized)

Any help would be appretiated

There are no proxies on my end (tried two computers in the office and one remote server) — Eyal, Dec 14 '16 at 20:40

score 1 · Accepted Answer · answered Feb 07 '17 at 09:43

Short answer: You may see this issue if you are using auth.json to store your Gemfury token. At this time, the only way to work around this issue is to embed the token directly into your repository URL in composer.json.

Long answer: The reason it doesn't work is due to a bug in Composer CLI. In that particular use-case, when Composer acts on Gemfury's redirect from your private php.fury.io repo to a secure S3 download, it includes the Authorization header with your Gemfury token. This header conflicts with S3's authentication model, and results in a 400 Bad Request response.

Resending Authorization header on a redirect from one host to another is a fairly significant security concern, and I recommend you reset your Gemfury token and stop using auth.json authentication method until this issue is resolved.

Thanks, we ended up switching to another service. – Eyal Feb 07 '17 at 09:59 — Eyal, Feb 07 '17 at 09:59
Is there any intention to solve this issue anytime soon? – Amir May 28 '17 at 07:25 — Amir, May 28 '17 at 07:25

Cannot access a private repository in gem-fury

1 Answers1