Composer installs only what's in the require and require-dev blocks and not the dependencies when using local repository

Question

Under regular circumstances, if I delete the vendor folder and the composer.lock file, and then run composer install, it will re-install everything, including the dependencies for the packages in the require and require-dev block. But when I use composer install from my local repository, it only installs what's inside require and require-dev.

This is an example composer.json of a clean Laravel 9 project:

{
    "name": "laravel/laravel",
    "type": "project",
    "description": "The Laravel Framework.",
    "keywords": ["framework", "laravel"],
    "license": "MIT",    
    "require": {
        "php": "^8.0.2",
        "guzzlehttp/guzzle": "^7.2",
        "laravel/framework": "^9.19",
        "laravel/sanctum": "^3.0",
        "laravel/tinker": "^2.7"

    },
    "require-dev": {
        "fakerphp/faker": "^1.9.1",
        "laravel/pint": "^1.0",
        "laravel/sail": "^1.0.1",
        "mockery/mockery": "^1.4.4",
        "nunomaduro/collision": "^6.1",
        "phpunit/phpunit": "^9.5.10",
        "spatie/laravel-ignition": "^1.0"
    },
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "Database\\Factories\\": "database/factories/",
            "Database\\Seeders\\": "database/seeders/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "scripts": {
        "post-autoload-dump": [
            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
            "@php artisan package:discover --ansi"
        ],
        "post-update-cmd": [
            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
        ],
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ],
        "post-create-project-cmd": [
            "@php artisan key:generate --ansi"
        ]
    },
    "extra": {
        "laravel": {
            "dont-discover": []
        }
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true,
        "allow-plugins": {
            "pestphp/pest-plugin": true
        }
    },
    "minimum-stability": "dev",
    "prefer-stable": true
}

If I run composer install and set my local repository (add the following to composer.json):

"repositories": [ { "type": "composer", "url": "http://localhost/" } ],

it will install only the 11 packages defined above inside require and required-dev, but not their dependencies. Then it will throw an error about missing things:

> @php artisan vendor:publish --tag=laravel-assets --ansi --force

Fatal error: Uncaught Error: Class "Illuminate\Foundation\Application" not found

Why does this happen? My local repository should work because when I compare the 11 packages installed by my local repository to the same 11 packages when installed by Packagist, they are the same, so I know my local repository should have the correct packages

(And of course the local repository also contains the rest of the packages, not the these 11)

In case it's relevant, how is your local repository set up? Is it using Satis, or Private Packagist, or what? Does it just contain mirrors of public packages, or modified forks of them? — IMSoP, Aug 28 '22 at 11:05
Using Satis. My packages are zipped version of the original packages I took from `vendor`. But `satis.json` doesn't contain too much metadata, only name and version. You can see the json for each package from my previous post: https://stackoverflow.com/a/73497845/19815685 . I suspect I need to add much more data, they original `composer.json` data that was in each package. You think that is the issue? Or it could be something more simple? Because it's weird, the `composer.json` file still exists in the zipped package, just not in Satis config metadata — pileup, Aug 28 '22 at 11:50

pileup · Answer 1 · 2022-08-28T18:32:41.370

I found the solution, to anyone encounters this problem in the future: even though each package zip file contains the composer.json file, it's not enough, since Satis does not read from that file, instead it reads the metadata from your repository.

So it's important to setup your satis.json to include all metadata fields that are required for Composer to work, so called root fields.

In my case I only used require and autoload fields in satis.json, which caused the issue.

After adding all the fields necessary - require, autoload, conflict, replace, provide and suggest, everything worked!

Not all packages have all these fields, I wrote a script to add only the present fields

Composer installs only what's in the require and require-dev blocks and not the dependencies when using local repository

1 Answers1