How to correctly require a specific commit in Composer so that it is available for dependent packages?

Question

I have a foo/foo-lib library that requires defines a specific commit from GitHub:

 { "name": "foo/foo-lib", "repositories": [ { "type": "vcs", "url": "https://github.com/KnpLabs/Gaufrette.git" } ], "require": { "knplabs/gaufrette": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e" } } 

and it works fine:

 $ composer update Loading composer repositories with package information Updating dependencies (including require-dev) - Updating knplabs/gaufrette dev-master (2633721 => 2633721) Checking out 2633721877cae79ad461f3ca06f3f77fb4fce02e Generating autoload files 

but when I need this library in another project:

 { "name": "bar/bar-app", "repositories": [ { "type": "vcs", "url": "ssh://git.example.com/foo-lib" } ], "require-dev": { "foo/foo-lib": "dev-master" } } 

it gives a dependency error:

 Your requirements could not be resolved to an installable set of packages. Problem 1 - Installation request for foo/foo-lib dev-master -> satisfiable by foo/foo-lib[dev-master]. - foo/foo-lib dev-master requires knplabs/gaufrette dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e -> no matching package found. 

So, my question is: how to correctly require specific commit from GitHub in my library to be available in dependent packages?

Answer 1

You will need to explicitly require the Gaufrette library with this hash with the dev flag both in your library and in your application. Something like this should work in the composer.json application:

 { "name": "bar/bar-app", "repositories": [ { "type": "vcs", "url": "ssh://git.example.com/foo-lib" } ], "require-dev": { "foo/foo-lib": "dev-master", "knplabs/gaufrette": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e" } } 

From the documentation :

If one of your dependencies has a dependency on an unstable package, you also need to explicitly specify it, as well as its sufficient number of stability flags.

The documentation also states that you will need to include the repository for Gaufrette in your bar/bar-app Composer file, although it does not seem to be necessary in this case. I'm not sure why.

Answer 2

Here's how you do it on the command line:

 composer update knplabs/gaufrette:dev-master#2633721 --with-dependencies 

You don't have to use the whole hash, a seven-character hash seems to do the trick. As mentioned above, your project must support dev - what it will complain about if it is not already installed. Also use --with-dependencies to get any dependencies of the one you are updating.

Answer 3

If you make changes to the Git repository by forking, make sure you use the package name that is actually defined in the composer.json package’s own file - so even though I forked the package to my own joshuapaling github account and the package is now located at https://github.com/joshuapaling/Cake-Resque.git , which did not affect the name of the package at all, from the point of view of composers.

Stupid mistake - but I'm new to the composer, and at first it was incomprehensible! So, I hope this helps someone else with the same problem.