{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/5600","repository_url":"https://api.github.com/repos/composer/composer","labels_url":"https://api.github.com/repos/composer/composer/issues/5600/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/5600/comments","events_url":"https://api.github.com/repos/composer/composer/issues/5600/events","html_url":"https://github.com/composer/composer/issues/5600","id":171185116,"number":5600,"title":"require-dev package repository options do not get copied into composer.lock","user":{"login":"john-whitley","id":7869527,"avatar_url":"https://avatars.githubusercontent.com/u/7869527?v=3","gravatar_id":"","url":"https://api.github.com/users/john-whitley","html_url":"https://github.com/john-whitley","followers_url":"https://api.github.com/users/john-whitley/followers","following_url":"https://api.github.com/users/john-whitley/following{/other_user}","gists_url":"https://api.github.com/users/john-whitley/gists{/gist_id}","starred_url":"https://api.github.com/users/john-whitley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/john-whitley/subscriptions","organizations_url":"https://api.github.com/users/john-whitley/orgs","repos_url":"https://api.github.com/users/john-whitley/repos","events_url":"https://api.github.com/users/john-whitley/events{/privacy}","received_events_url":"https://api.github.com/users/john-whitley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-15T14:46:35Z","updated_at":"2016-08-16T07:41:48Z","closed_at":null,"body":"Firstly, thanks for all your hard work on the composer tool - it is a really valuable part of our environment.\r\n\r\n**Summary**\r\n\r\nI believe I have uncovered an edge case issue - `\"require-dev\"` packages do not get the required `\"transport-options\"` section in the `composer.lock` file, necessary when hosting an internal composer repository with specific ssl requirements.  I propose a choice of fixes for this, but humbly request review of the proposals from the composer maintainers.\r\n\r\n**Background**\r\n\r\nAt work, we have a large (10<n<100) number of git repositories that have distinct responsibilities, allowing for correct reuse without having to have everything everywhere (composer is good at this! - thank you).  Without going into the detail of all of them, we have some we intend for production, and some we intend for development environments only (examples include our in-house coding standards via code-sniffer; internal test helpers; etc.).\r\n\r\nTo help us manage our dependencies, we host all our internal libraries on an internal satis server.  We use https with the satis server, and have configured this with an self-signed ssl certificate - we don't use letsencrypt as the satis server is protected by firewalls, so lets encrypt cannot verify the service; neither do we want to pay for a signed certificate.\r\n\r\n**Problem discovery**\r\n\r\nWe have successfully configured the `composer.json` with the necessary ssl options in the `\"options\"` section of the `\"repository\"` section, and these transfer into the `composer.lock` file in the `\"transport-options\"` section associated with the correct packages; which is the correct and expected behaviour.\r\n\r\nWhen we attempt the same with the `\"require-dev\"` packages, this transfer into the `composer.lock` `\"transport-options\"` section does not happen.\r\n\r\nWe have edited `composer.lock` to include the `\"transport-options\"` section, and this proof-of-concept implementation fixes our https error for `\"require-dev\"` packages, so we believe that it is acceptable to have the `\"transport-options\"` section within a `\"require-dev\"` `composer.lock` entry.\r\n\r\nI investigated the composer code and believe that this is caused by the call to use a new `\\Composer\\Package\\Loader\\ArrayLoader` instance without setting the `loadOptions` argument to true: the call is from `src/Composer/Installer.php` line 631, which relies on a new `\\Composer\\Package\\Loader\\ArrayLoader` instance on line 628.  This new instance does not set the `loadOptions` setting in the constructor.\r\n\r\n**Proposed solutions**\r\nI have implemented and tested two solutions:\r\n\r\n1. Set the loadConfig flag in the instance creation in `\\Composer\\Package\\Loader\\ArrayLoader` on line 628.\r\n2. Alter the default value to loadConfig to true in `\\Composer\\Package\\Loader\\ArrayLoader` on line 32\r\n\r\nI have implemented both choices to prove them before writing this: both solutions pass the (possibly naive) tests:\r\n- the phpunit tests pass\r\n- fix our problem of the `\"transport-options\"` in the `\"require-dev\"` packages\r\n\r\nI am very happy to create a pull request to fix this issue, but please could a maintainer let me know if there is a composer preference on implementation.\r\n\r\nMany thanks in advance!"},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/240027029","html_url":"https://github.com/composer/composer/issues/5600#issuecomment-240027029","issue_url":"https://api.github.com/repos/composer/composer/issues/5600","id":240027029,"user":{"login":"alcohol","id":21414,"avatar_url":"https://avatars.githubusercontent.com/u/21414?v=3","gravatar_id":"","url":"https://api.github.com/users/alcohol","html_url":"https://github.com/alcohol","followers_url":"https://api.github.com/users/alcohol/followers","following_url":"https://api.github.com/users/alcohol/following{/other_user}","gists_url":"https://api.github.com/users/alcohol/gists{/gist_id}","starred_url":"https://api.github.com/users/alcohol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alcohol/subscriptions","organizations_url":"https://api.github.com/users/alcohol/orgs","repos_url":"https://api.github.com/users/alcohol/repos","events_url":"https://api.github.com/users/alcohol/events{/privacy}","received_events_url":"https://api.github.com/users/alcohol/received_events","type":"User","site_admin":false},"created_at":"2016-08-16T07:41:48Z","updated_at":"2016-08-16T07:41:48Z","body":"Please just submit your PR, it will be easier to comment there (should we have any remarks) :-)"}}
{"actor":{"display_login":"alcohol"}}