Satis, how to archive require dependencies?

Question

I'm trying to set up my own satis server for all my composer packages. Many packages have dependencies to something like phpunit or phpmd. I want to create archives of all these dependencies in my satis. But satis only create archives from the given repositories and is not including the dependencies.

Any idea how I can fix this?

Here is my satis.json

{
  "name": "My satis repository",
  "homepage": "http://satis.example.com",
  "repositories": [
    {
      "url": "git@github.com:<user>/<repository>.git",
      "type": "vcs"
    }
  ],
  "require-all": true,
  "require-dependencies": true,
  "require-dev-dependencies": true,
  "archive": {
    "directory": "dist",
    "format": "zip",
    "skip-dev": true
  }
}

Answer 1

There is no easy way to fetch all package versions of a private repository with Satis and mirror all dependencies as well.

This is due to the fact, that at some point the mirror would end up trying to fetch the whole content of Packagist.

To mirror all dependencies of your packages in Satis you may decide between two different approaches:

A) Add repository sources and require all own packages

Satis has connections to Packagist disabled by default. So you have to add Packagist as repository. If you add your repositories without requiring a specific version of your package, then Satis will switch to the »require-all« mode (“No explicit requires defined, enabling require-all”). This would then try to fetch all package versions of your repository and all package versions on Packagist. Boom. This will fail. So require specific packages to prevent the »require-all« mode.

1. Add your repository
2. Set requiring dependencies (require-dependencies: true, require-dev-dependencies: true)
3. Add Packagist as repository source (Satis disables packagist.org by default)
4. Disable the require-all flag
5. Require all your own packages to avoid that Satis switches to »require-all« mode

So your satis.json should look like this:

{
  "name": "My satis repository",
  "homepage": "http://satis.example.com",
  "repositories": {
    "packagist": {
      "type": "composer",
      "url": "https://packagist.org/"
    },
    "my-repo": {
      "url": "git@github.com:<user>/<repository>.git",
      "type": "vcs"
    }
  },
  "require": {
    "mycompany/package-foo": "^1.1",
    "mycompany/package-bar": "*"
  },
  "require-all": false,
  "require-dependencies": true,
  "require-dev-dependencies": true,
  "archive": {
    "directory": "dist",
    "format": "zip",
    "skip-dev": true
  }
}

Source: https://github.com/composer/satis/issues/296

Btw: Fetching all these dependencies from several repositories may lead to a memory limit error. Composer suggests to raise the memory limit when running Satis like this:

php -d memory_limit=2GB ./bin/satis build satis.json web

B) Install two Satis instances - one four your own packages, one to mirror all dependencies

If you have a lot of packages in your repository, but only a few dependencies, then this apprach will save you some time to write down requirements (eg. 100 packages in your company, but only 5 dependencies to third party packages).

1. Add your repository
2. Set »require-all« to fetch all package versions in your repository

This satis.json should look like this:

{
  "name": "My package repository",
  "homepage": "http://packages.example.com",
  "repositories": {
    "my-repo": {
      "url": "git@github.com:<user>/<repository>.git",
      "type": "vcs"
    }
  },
  "require-all": true,
  "archive": {
    "directory": "dist",
    "format": "zip",
    "skip-dev": true
  }
}

This wont fetch dependencies. These need to be added manually in another Satis instance.

1. Add another Satis.json to mirror all dependencies
2. Add Packagist as repository
3. Require all desired dependent packages only

This satis.json should look like this:

{
  "name": "My mirror repository",
  "homepage": "http://mirror.example.com",
  "repositories": {
    "packagist": {
      "type": "composer",
      "url": "https://packagist.org/"
    }
  },
  "require": {
    "acme/some-package-foo": "*",
    "johndoe/some-package-bar": "*"
  },
  "require-all": false,
  "require-dependencies": true,
  "require-dev-dependencies": true,
  "archive": {
    "directory": "dist",
    "format": "zip",
    "skip-dev": true
  }
}

Be aware that mirroring all dependencies will take a long, long time.

Source: http://tech.m6web.fr/composer-installation-without-github.html

Answer 2

When Satis searches for packages it tries to resolve all required packages from the listed repositories. Just define them individually in your satis.json.

(Could also be a bug, because manually defining the dependencies is tedious and defeats the require-dependencies directive. Consider reporting it over at the Satis issues tracker.)

Answer 3

You can list all packages (including nested dependencies) from composer.lock :

grep "\"name\":.*/.*" composer.lock