How do I appropriately require a certain commit in Composer so that dependant packages can access it?

Problem

I have a library called foo/foo-lib that requires a specific GitHub commit:

{
    "name": "foo/foo-lib",
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/KnpLabs/Gaufrette.git"
        }
    ],
    "require": {
        "knplabs/gaufrette": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e"
    }
}

and it works perfectly:

$ composer update
Loading composer repositories with package information
Updating dependencies (including require-dev)                                 
  - Updating knplabs/gaufrette dev-master (2633721 => 2633721)
    Checking out 2633721877cae79ad461f3ca06f3f77fb4fce02e

Generating autoload files

However, when I need that library for another project:

{
    "name": "bar/bar-app",
    "repositories": [
        {
            "type": "vcs",
            "url": "ssh://git.example.com/foo-lib"
        }
    ],
    "require-dev": {
        "foo/foo-lib": "dev-master"
    }
}

It results in a dependency error:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Installation request for foo/foo-lib dev-master -> satisfiable by foo/foo-lib[dev-master].
    - foo/foo-lib dev-master requires knplabs/gaufrette dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e -> no matching package found.

Such here’s my question: how do I properly require a certain GitHub commit in my library so that it’s available in dependant packages?

Asked by Maciej Sz

Solution #1

You’ll need to use a dev flag in both your library and your application to explicitly require the Gaufrette library at that hash. Something around these lines should work in composer.json:

{
    "name": "bar/bar-app",
    "repositories": [
        {
            "type": "vcs",
            "url": "ssh://git.example.com/foo-lib"
        }
    ],
    "require-dev": {
        "foo/foo-lib": "dev-master",
        "knplabs/gaufrette": "dev-master#2633721877cae79ad461f3ca06f3f77fb4fce02e"
    }
}

From the documentation:

The instructions also proposes including the Gaufrette repository in your bar/bar-app Composer file, although it doesn’t appear that this was essential in this situation. I’m not sure why this is.

Answered by Chris

Solution #2

On the command line, you can do it like this:

composer update knplabs/gaufrette:dev-master#2633721 --with-dependencies

You don’t have to use the entire hash; a seven-character hash appears to suffice. As previously said, your project will require dev support, which it will complain about if it is not already configured. Also, use —with-dependencies to acquire any of the one you’re updating’s dependencies.

Answered by powpow12

Solution #3

The package name is actually defined in the package’s own composer.json file – so even though I’d forked the package to my own joshuapaling github account, and the package was now residing at the URL https://github.com/joshuapaling/Cake-Resque.git, that had had no influence on the package’s name from composers perspective.

It was a silly mistake, but I’m new to composer, and it wasn’t obvious at first! So, I hope this helps someone else who is having a similar issue.

Answered by Gayan Kalhara

Post is based on https://stackoverflow.com/questions/21314381/how-to-correctly-require-a-specific-commit-in-composer-so-that-it-would-be-avail