Composer 需要来自 gitlab 的私有存储库 ssh 被忽略

Question

I'm trying to pull a private repository from gitlab with composer without any success.

This is what I have in my composer.json file under repositories:

"repositories": [
  {
     "type": "vcs",
     "url": "git@gitlab.com:the-vendor/dashboard-api.git"
  }
]

When I clone the project like this: git@gitlab.com:the-vendor/dashboard-api.git manually, everything works fine.

Now when I require the project like so:

"require": {
  "the-vendor/dashboard": "dev-orchestrate"
}

I also tried: "dev-main", "dev-main@dev", "dev-orchestrate@dev".

And run: composer update the-vendor/dashboard I get the following error:

Failed to download the-vendor/dashboard-api:The "https://gitlab.com/api/v4/projects/joij%2Fdashboard-api" file could not be downloaded (HTTP/2 404 ):
{"message":"404 Project Not Found"}
Your credentials are required to fetch private repository metadata (git@gitlab.com:the-vendor/dashboard-api.git)
A token will be created and stored in "/root/.composer/auth.json", your password will never be stored
To revoke access to this token you can visit https://gitlab.com/-/profile/personal_access_tokens
Username:

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

I'm not sure what to make of this. Composer should be able to clone the project through ssh. But instead I get that vague 404 and then I have to give my username and password.

I also tried this:

"repositories": [
  {
     "type": "git",
     "url": "git@gitlab.com:the-vendor/dashboard-api.git"
  }
]

But then it behaves as if there is no "repositories" in the composer json at all, and I get this error:

Problem 1
    - Root composer.json requires the-vendor/dashboard, it could not be found in any version, there may be a typo in the package name.

Potential causes:
 - A typo in the package name
 - The package is not available in a stable-enough version according to your minimum-stability setting
   see <https://getcomposer.org/doc/04-schema.md#minimum-stability> for more details.
 - It's a private package and you forgot to add a custom repository to find it

Read <https://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.

This is the composer.json of the dashboard-api:

{
    "name": "the-vendor/dashboard",
    "type": "project",
    "description": "TheVendor Dashboards",
    "keywords": ["framework", "laravel"],
    "license": "proprietary",
    "require": {
        "php": "^8.1",
        "elasticsearch/elasticsearch": "v7.17.0",
        "guzzlehttp/guzzle": "^7.2",
        "laravel/framework": "^9.2",
        "laravel/sanctum": "^2.14.1",
        "laravel/tinker": "^2.7",
        "ext-pdo": "*"
    },
    "require-dev": {
        "fakerphp/faker": "^1.9.1",
        "laravel/sail": "^1.0.1",
        "mockery/mockery": "^1.4.4",
        "nunomaduro/collision": "^6.1",
        "phpunit/phpunit": "^9.5.10",
        "phpspec/prophecy": "1.15.0",
        "spatie/laravel-ignition": "^1.0"
    },
    "autoload": {
        "psr-4": {
            "TheVendor\\Dashboard\\": "app/",
            "Database\\Factories\\": "database/factories/",
            "Database\\Seeders\\": "database/seeders/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "scripts": {
        "post-autoload-dump": [
            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
            "@php artisan package:discover --ansi"
        ],
        "post-update-cmd": [
            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
        ],
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ],
        "post-create-project-cmd": [
            "@php artisan key:generate --ansi"
        ]
    },
    "extra": {
        "laravel": {
            "providers": [
                "TheVendor\\Dashboard\\Providers\\AppServiceProvider",
                "TheVendor\\Dashboard\\Providers\\ESClientServiceProvider",
                "TheVendor\\Dashboard\\Providers\\ESCreateIndexesServiceProvider"
            ],
            "dont-discover": []
        }
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true
    },
    "minimum-stability": "dev",
    "prefer-stable": true
}

I wonder if anyone knows what I'm missing.

Answer 1

Alright! I found the problem. There is no need to go for an auth.json with an API Token. This is where I went wrong:

The main branch had a different package name! The branch I was trying to pull had the right one, but if the main composer.json has a different package name you get this error:

Root composer.json requires the-vendor/dashboard, it could not be found in any version, there may be a typo in the package name.

Once you have that, and require the package like this:

"require": [
    "the-vendor/dashboard": "dev-orchestrate"
]

With this in the root of composer.json

"repositories": [
   {
       "type": "git",
       "url": "git@gitlab.com:the-vendor/dashboard-api.git"
   }
]

It will simply use ssh to clone the private repository