Composer switched to https only, packagist.org needs update

We encourage users to post events happening in the community to the community events group on https://www.drupal.org.
ducktape's picture
Posted by ducktape on March 17, 2016 at 12:26pm

About a month ago composer switched to https-only downloads.

This broke my composer-only setup, as it relied on "composer create-project drupal/drupal:8.0.5". The packagist.org package for drupal/drupal still has a http url, see https://packagist.org/packages/drupal/drupal
Locally I can fix that with the secure-http option, but it's not advised and it's also not possible on the devops platform I am using.

drupal/core looks to be ok, as it points the drupal-composer git repository.
drupal/drupal also exists on drupal-composer.org, but seems to only have the 8.0.0 (& 8.1.0) version.

I don't know who manages the packagist.org package, but maybe someone here does and can get that updated?

Comments

Afaik, Dries and webchick

Posted by webflo on March 17, 2016 at 12:47pm
webflo's picture

Afaik, Dries and webchick have access to the Packagist Account.

Thanks for the quick reply. I

Posted by ducktape on March 17, 2016 at 2:02pm
ducktape's picture

Thanks for the quick reply. I have created a ticket in the infrastructure issue queue, that should reach one of them.

It's not that composer

Posted by Mile23 on March 17, 2016 at 6:31pm
Mile23's picture

It's not that composer requires https, it's that it's a setting with the default ON. :-)

https://getcomposer.org/doc/06-config.md#secure-http

https://github.com/composer/composer/issues/4963

I have read that and that's

Posted by ducktape on March 18, 2016 at 2:39pm
ducktape's picture

I have read that and that's how I initially fixed my local builds.

My builds on Platform.sh however still suffer from the issue and while I could ask them so "fix" the composer config on their build servers, I don't think they will do that.

I temporarily fixed the platform.sh builds by using drupal-composer.org for the drupal/drupal 8.0.0 package, and then updating drupal core to 8.0.5 from packagist.org.