composer installs dev-master instead of the correct version

[michabbb]

hi there,

today i noticed something very strange, and i don´t know if it's a problem on my side or a bug or whatever...
i tried to install this package:

(Composer version 1.4.2, latest docker image)

composer --ignore-platform-reqs require "laravie/parser=~1.0"

and this ends up with the following dependencies:

illuminate/contracts                dev-master 1cc9ce9        The Illuminate Contracts package.
illuminate/support                  dev-master fcaaaeb        The Illuminate Support package.

when i use the same docker version inside my php container (php 5.6.30) i get these dependencies installed:

illuminate/contracts                5.4.x-dev 68569e8         The Illuminate Contracts package.
illuminate/support                  5.4.x-dev 6aa05cb         The Illuminate Support package.

and this is correct, so why does the docker version installes the dev-master versions instead of the correct versions ???

thanks for any help !

[crynobone]

You're using --ignore-platform-reqs which would ignore installed PHP version that you currently have on that docker. E.g: Docker is using PHP 5.6.x but due to --ignore-platform-reqs it accepts any dependencies that requests PHP 7.0.

This is not Docker problem.

[alcohol]

I'm sorry, but I will need a minimal composer.json that guarantees a reproducible scenario.

Aside from that, are you using the platform configuration to define your target php version? The composer containers generally use the latest PHP version. If your target platform is 5.6.30, I encourage you to define this in your composer.json:

  "config": {
    "platform": {
      "php": "5.6.30"
    }
  }

[michabbb]

@alcohol maybe my composer.json is wrong, would ne nice if you could check that and let me know....

{
    "name": "xxxxxxxxx",
    "config": {
        "secure-http": false
    },
    "minimum-stability": "dev",
    "require": {
        "php"        : ">=5.6",
        "ext-json"   : "*",
        "ext-soap"   : "*",
        "ext-curl"   : "*",
        "ext-mysqli" : "*",
        "laravie/parser": "~1.0"
    }
}

i removed the (hopefully) unimportant stuff because there are some private repos inside.
but at the end, this is my main composer.json. how do i have to change it ?

[alcohol]

Just add the config block I showed below your require block.

[alcohol]

See also https://getcomposer.org/doc/06-config.md#platform for more details.

[michabbb]

@alcohol thanks a lot, will test this !

[alcohol]

Actually you need to merge it with your existing config block. My bad, read over that one.

[michabbb]

@alcohol not working, still installs dev-master:

composer --ignore-platform-reqs require "laravie/parser=~1.0"           
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)                 
Package operations: 8 installs, 0 updates, 0 removals
  - Installing doctrine/inflector (dev-master fb0b68b): Cloning fb0b68b78e from cache
  - Installing symfony/polyfill-mbstring (dev-master 7c8fae0): Cloning 7c8fae0ac1 from cache
  - Installing symfony/translation (3.4.x-dev 62bb068): Cloning 62bb068e00 from cache
  - Installing nesbot/carbon (dev-master 926aee5): Cloning 926aee5ab3 from cache
  - Installing psr/container (dev-master 2cc4a01): Cloning 2cc4a01788 from cache
  - Installing illuminate/contracts (dev-master 1cc9ce9): Cloning 1cc9ce9a80 from cache
  - Installing illuminate/support (dev-master fcaaaeb): Cloning fcaaaeb49b from cache
  - Installing laravie/parser (dev-master 87fe17e): Cloning 87fe17e623 from cache

here´s the config part of my composer.json:

"config": {
        "secure-http": false,
        "platform": {
            "php": "5.6.30"
        }
    },

and i have to use --ignore-platform-reqs if this is the case.....

[alcohol]

I need a composer.json that lets me reproduce your scenario. Until I have that, I cannot help you any further.

[michabbb]

@alcohol heres a composer.json where you can reproduce it:

{
  "name": "xxxxxxxxx/xxxx",
  "description": "test",
  "config": {
    "secure-http": false,
    "platform": {
      "php": "5.6.30"
    }
  },
  "minimum-stability": "dev",
  "require": {
    "php"        : ">=5.6",
    "ext-json"   : "*",
    "ext-soap"   : "*",
    "ext-curl"   : "*",
    "ext-mysqli" : "*",
    "laravie/parser": "~1.0"
  }
}

docker run --rm -it --tty -v /etc/localtime:/etc/localtime:ro -v /mnt/hgfs/data/test:/home/test --name php -w /home/test --volume $SSH_AUTH_SOCK:/ssh-auth.sock --env SSH_AUTH_SOCK=/ssh-auth.sock -v $HOME/.ssh:/root/.ssh -v /root/.composer:/root/.composer composer --ignore-platform-reqs update
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 9 installs, 0 updates, 0 removals
  - Installing doctrine/inflector (dev-master fb0b68b): Cloning fb0b68b78e from cache
  - Installing symfony/polyfill-mbstring (dev-master 7c8fae0): Cloning 7c8fae0ac1 from cache
  - Installing symfony/translation (3.4.x-dev 62bb068): Cloning 62bb068e00 from cache
  - Installing nesbot/carbon (dev-master 926aee5): Cloning 926aee5ab3 from cache
  - Installing psr/simple-cache (dev-master 753fa59): Cloning 753fa598e8 from cache
  - Installing psr/container (dev-master 2cc4a01): Cloning 2cc4a01788 from cache
  - Installing illuminate/contracts (dev-master 1cc9ce9): Cloning 1cc9ce9a80 from cache
  - Installing illuminate/support (dev-master fcaaaeb): Cloning fcaaaeb49b from cache
  - Installing laravie/parser (dev-master 87fe17e): Cloning 87fe17e623 from cache

composer show

doctrine/inflector        dev-master fb0b68b Common String Manipulations with regard to casing and singular/plural rules.
illuminate/contracts      dev-master 1cc9ce9 The Illuminate Contracts package.
illuminate/support        dev-master fcaaaeb The Illuminate Support package.
laravie/parser            dev-master 87fe17e XML Document Parser for PHP
nesbot/carbon             dev-master 926aee5 A simple API extension for DateTime.
psr/container             dev-master 2cc4a01 Common Container Interface (PHP FIG PSR-11)
psr/simple-cache          dev-master 753fa59 Common interfaces for simple caching
symfony/polyfill-mbstring dev-master 7c8fae0 Symfony polyfill for the Mbstring extension
symfony/translation       3.4.x-dev 62bb068  Symfony Translation Component

and as you see, the illuminate packages get installed as dev-master ;(

[alcohol]

That's because of "minimum-stability": "dev",. So I'm not sure why this is surprising to you?

[michabbb]

@alcohol excuse me, but i think you are wrong

and again: is use the same composer.json inside my php 5.6.30 docker and DO THE SAME:

composer update    
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 5 installs, 0 updates, 0 removals
    Now trying to download from source
  - Installing paragonie/random_compat (v2.0.10): Cloning 634bae8e91
  - Installing illuminate/contracts (5.4.x-dev 68569e8): Cloning 68569e8862
  - Installing doctrine/inflector (1.1.x-dev 90b2128): Cloning 90b2128806
  - Installing illuminate/support (5.4.x-dev 8090663): Cloning 80906634e6
  - Installing laravie/parser (dev-master 87fe17e): Cloning 87fe17e623

composer show

doctrine/inflector      1.1.x-dev 90b2128  Common String Manipulations with regard to casing and singular/plural rules.
illuminate/contracts    5.4.x-dev 68569e8  The Illuminate Contracts package.
illuminate/support      5.4.x-dev 8090663  The Illuminate Support package.
laravie/parser          dev-master 87fe17e XML Document Parser for PHP
paragonie/random_compat v2.0.10            PHP 5.x polyfill for random_bytes() and random_int() from PHP 7

so the docker-composer container AND my php-5.6.30 container us the same composer.json
and both have minimum-stability.

please explain me, why to i get 5.4.x-dev inside my php 5.6.3 container
and dev-master within the composer-docker ?? i don´t get it, sorry ;(((

even if minimum-stability is wrong, i get 2 different versions of packages installed here and for my understanding, both composers should do the same.

the only thing that differs here, is that i am calling the docker-composer with --ignore-platform-reqs
and the composer inside my php 5.6.30 container without.

[alcohol]

I cannot tell, because one uses a reproducible composer.json and the other uses your private composer.json, which I do not have access to.

[michabbb]

@alcohol pardon, that makes absolutly no sense what you say. i posted my composer.json here 2 hours ago - how can you say you don´t have access to anything ??? i made my tests with exacat the same composer.json !!

[michabbb]

@crynobone i am forced to use -ignore-platform-reqs and even i ignore the platform requirements, composer should listen to the version of the packages composer.json - or am i wrong ? if a package composer.json says

"illuminate/support": "^5.1"

does ignore-platform-reqs leads to:

install "illuminate/support": "de-master" ???? that makes no sense to me, even if this is wanted ;(

[alcohol]

All of the following behave as expected.

With "minimum-stability": "dev",:

rob@thuis.robbast.nl /tmp/test > docker run -v $(pwd):/app composer install --ignore-platform-reqs
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 9 installs, 0 updates, 0 removals
  - Installing doctrine/inflector (dev-master fb0b68b): Cloning fb0b68b78e from cache
  - Installing symfony/polyfill-mbstring (dev-master 7c8fae0): Cloning 7c8fae0ac1 from cache
  - Installing symfony/translation (3.4.x-dev 62bb068): Cloning 62bb068e00 from cache
  - Installing nesbot/carbon (dev-master 926aee5): Cloning 926aee5ab3 from cache
  - Installing psr/simple-cache (dev-master 753fa59): Cloning 753fa598e8 from cache
  - Installing psr/container (dev-master 2cc4a01): Cloning 2cc4a01788 from cache
  - Installing illuminate/contracts (dev-master 7594609): Cloning 75946099f7 from cache
  - Installing illuminate/support (dev-master fcaaaeb): Cloning fcaaaeb49b from cache
  - Installing laravie/parser (dev-master 87fe17e): Cloning 87fe17e623 from cache
symfony/translation suggests installing symfony/config ()
symfony/translation suggests installing symfony/yaml ()
symfony/translation suggests installing psr/log (To use logging capability in translator)
illuminate/support suggests installing illuminate/filesystem (Required to use the composer class (5.2.*).)
illuminate/support suggests installing symfony/process (Required to use the composer class (~3.3).)
illuminate/support suggests installing symfony/var-dumper (Required to use the dd function (~3.3).)
Writing lock file
Generating autoload files

Without "minimum-stability": "dev",:

rob@thuis.robbast.nl /tmp/test > docker run -v $(pwd):/app composer install --ignore-platform-reqs
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 5 installs, 0 updates, 0 removals
  - Installing paragonie/random_compat (v2.0.10): Downloading (100%)         
  - Installing illuminate/contracts (v5.4.27): Downloading (100%)         
  - Installing doctrine/inflector (v1.2.0): Downloading (100%)         
  - Installing illuminate/support (v5.4.27): Downloading (100%)         
  - Installing laravie/parser (v1.2.0): Downloading (100%)         
paragonie/random_compat suggests installing ext-libsodium (Provides a modern crypto API that can be used to generate random bytes.)
illuminate/support suggests installing illuminate/filesystem (Required to use the composer class (5.2.*).)
illuminate/support suggests installing symfony/process (Required to use the composer class (~3.2).)
illuminate/support suggests installing symfony/var-dumper (Required to use the dd function (~3.2).)
Writing lock file
Generating autoload files

With "minimum-stability": "dev", "prefer-stable": true,:

rob@thuis.robbast.nl /tmp/test > docker run -v $(pwd):/app composer install --ignore-platform-reqs
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 5 installs, 0 updates, 0 removals
  - Installing paragonie/random_compat (v2.0.10): Downloading (100%)         
  - Installing illuminate/contracts (v5.4.27): Downloading (100%)         
  - Installing doctrine/inflector (v1.2.0): Downloading (100%)         
  - Installing illuminate/support (v5.4.27): Downloading (100%)         
  - Installing laravie/parser (v1.2.0): Downloading (100%)         
paragonie/random_compat suggests installing ext-libsodium (Provides a modern crypto API that can be used to generate random bytes.)
illuminate/support suggests installing illuminate/filesystem (Required to use the composer class (5.2.*).)
illuminate/support suggests installing symfony/process (Required to use the composer class (~3.2).)
illuminate/support suggests installing symfony/var-dumper (Required to use the dd function (~3.2).)
Writing lock file
Generating autoload files

[michabbb]

@alcohol if "prefer-stable": true is the key, than i guess all my problems are solved, i will check that.
meanwhile: thanks a lot for your help and patience !!! 🤕

[alcohol]

It's very difficult to understand why you are not seeing the same results. You do mention you are also using a custom container, but if the composer version inside of that is identical, and the composer.json is exactly as described here, then both containers should give you the same result (please make sure you are using a clean build context on each attempt though).

[michabbb]

@alcohol as explained, the differnece is that in my own container i don´t use ignore-platform-reqs but i will check that, because thats the only test i didn´t do till now... if i get the same dev-master versions in my php 5.6.30 contanier then, we have identical versions and than it's proven that ignore-platform-reqs makes the difference here... will check that in detail....

[michabbb]

@alcohol okay here is a detailed overview of different configs and what happens:

version 1:

• docker container
• command: update
• composer.json

RESULT:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - The requested PHP extension ext-soap * is missing from your system. Install or enable PHP's soap extension.
  Problem 2
    - The requested PHP extension ext-mysqli * is missing from your system. Install or enable PHP's mysqli extension.

version 2:

• docker container
• command: update --ignore-platform-reqs
• composer.json

RESULT:

Installing illuminate/support (dev-master fcaaaeb)

version 3:

• php 5.6.30 container with same composer version
• command: update
• composer.json

RESULT:

Installing illuminate/support (5.4.x-dev 8090663)

version 4:

• php 5.6.30 container with same composer version
• command: update --ignore-platform-reqs
• composer.json

RESULT:

Installing illuminate/support (dev-master fcaaaeb)

version 5 = version 2 with

• prefer-stable: true
• ignore-platform-reqs

RESULT:

Installing illuminate/support (v5.4.27)

version 6 = version 4 with

• prefer-stable: true
• ignore-platform-reqs

RESULT:

Installing illuminate/support (v5.4.27)

so after this, it´s proven, that my problem is the "not understanding" how ignore-platform-reqs
works, i have to admit, i never had the need to use that key. i saw this the first time, when i started using the docker container, i'm afraid.

so end result: both docker versions work the same, the is no problem with docker, no problem with the container... prefer-stable: true makes absolutly sense! BUT i still feel stupid, because i don´t fully understand why ignore-platform-reqs takes dev-master instead of the correct version. even the php version gets ignored (which is okay) - why does this automatically mean to take the latest package version if a composer.json says: "please take ^5.x" - this is the part i really don´t understand.
which makes sense: that ignore-platform-reqs ignores a "platform" config.

if someone is able to explain me this ignore-platform-reqs thing in my special case, i would be super happy, i guess i don´t see the forest because of all these trees (like we say in my language). otherwise i guess i will ask stackoverlow ;)

[michabbb]

if i understand the need to implement the key ignore-platform-reqs correct: it has been created to give developers the possibility to run composer on a different host that, for example, has a different php version or missing php extensions, which makes absolutly sense, no question. but if this causes the instalation of different package versions dev-master instead of v5.4 i don´t get it, and then this whole thing is broke to me... but again... i guess i don´t understand why this should make sense (for the developers of composer)....

[alcohol]

Hmm.. difficult to say. In a container, it is probably best to be installing based on locked versions in your .lock file anyway though, and not do a fresh install/update.

[michabbb]

I created an issue in the composer repo, I am curious, what they say...

[michabbb]

if someone want´s to learn from composer, follow the new issue ;)