When using packagist.com, Symfony flex unpack fails

[respinoza]

You also have to configure private packagist, for example, config.json looks like:

{
    "repositories": {
        "packagist.org": false,
        "redacted": {
            "type": "composer",
            "url": "https://repo.packagist.com/redacted/"
        }
    }
}

My composer.json:

{
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": "^7.1.3",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "symfony/console": "4.3.*",
        "symfony/dotenv": "4.3.*",
        "symfony/flex": "^1.2",
        "symfony/framework-bundle": "4.3.*",
        "symfony/orm-pack": "^1.0",
        "symfony/yaml": "4.3.*"
    },
    "config": {
        "preferred-install": {
            "*": "dist"
        },
        "sort-packages": true
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "App\\Tests\\": "tests/"
        }
    },
    "replace": {
        "paragonie/random_compat": "2.*",
        "symfony/polyfill-ctype": "*",
        "symfony/polyfill-iconv": "*",
        "symfony/polyfill-php71": "*",
        "symfony/polyfill-php70": "*",
        "symfony/polyfill-php56": "*"
    },
    "scripts": {
        "auto-scripts": {
            "cache:clear": "symfony-cmd",
            "assets:install %PUBLIC_DIR%": "symfony-cmd"
        },
        "post-install-cmd": [
            "@auto-scripts"
        ],
        "post-update-cmd": [
            "@auto-scripts"
        ]
    },
    "conflict": {
        "symfony/symfony": "*"
    },
    "extra": {
        "symfony": {
            "allow-contrib": false,
            "require": "4.3.*"
        }
    }
}

Output of composer diagnose:

Checking composer.json: OK
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com rate limit: OK
Checking disk free space: OK
Checking pubkeys: 
Tags Public Key Fingerprint: 57815BA2 7E54DC31 7ECC7CC5 573090D0  87719BA6 8F3BB723 4E5D42D0 84A14642
Dev Public Key Fingerprint: 4AC45767 E5EC2265 2F0C1167 CBBB8A2B  0C708369 153E328C AD90147D AFE50952
OK
Checking composer version: OK
Composer version: 1.8.5
PHP version: 7.3.5
PHP binary path: /usr/bin/php7.3

When I run this command:

composer unpack orm                                                                                         

I get the following output:

Restricting packages listed in "symfony/symfony" to "4.3.*"
Nothing to unpack

And I expected this to happen:

Unpack the extension

More on symfony/flex#502

Now, I checked why this is happening and noticed that when you use private packagist, it is added as a lazy-provider, the Flex unpack command uses the composer API findPackage (https://github.com/composer/composer/blob/master/src/Composer/Repository/ComposerRepository.php#L126) to match the requested package to be unpacked (orm in my example), the problem I see is that the hasProviders is returns true as it is a lazy provider but the getProviderNames return an empty array. There is a comment in the code where it says composer is unable to return providers when they are marked as lazy, as seen in https://github.com/composer/composer/blob/master/src/Composer/Repository/ComposerRepository.php#L253

Back in the Flex command for unpacking, as you can imagine, the provider names array is empty so it cannot find the package anywhere, no unpack happens.

I sincerely have no clue what is the solution to this bug/limitation from Composer is.

Any ideas?

For now a workaround is to remove the private packagist config to be able to unpack, not ideal but it works.

[naderman]

This was confirmed fix in flex itself: symfony/flex#502 (comment)