bower package install failed #268

lan143 · 2016-12-19T09:18:59Z

Today, I ran into a problem when trying to update the packages through composer update. None of the packages Bower-Assets has not been found and update fails. But Bower the work. Log:

Installing yiisoft/yii2-app-basic (2.0.10)
  - Installing yiisoft/yii2-app-basic (2.0.10)
    Downloading: 100%

Created project in test
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Installing yiisoft/yii2-composer (2.0.4)
    Loading from cache

  - Installing swiftmailer/swiftmailer (v5.4.4)
    Loading from cache

  - Installing bower-asset/jquery (1.12.4)
    Downloading: Failed
    Failed to download bower-asset/jquery from dist: The "https://api.github.com/repos/bower-asset/jquery/zipball/a76fe112f860279382d9f6336fe040fd8f8aa13d" file could not be downloaded (HTTP/1.1 404 Not Found)
    Now trying to download from source
  - Installing bower-asset/jquery (1.12.4)
    Cloning a76fe112f860279382d9f6336fe040fd8f8aa13d
The authenticity of host 'github.com (192.30.253.112)' can't be established.
RSA key fingerprint is 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48.
Are you sure you want to continue connecting (yes/no)? yes


  [RuntimeException]
  Failed to clone https://github.com/bower-asset/jquery.git via https, ssh protocols, aborting.
  - https://github.com/bower-asset/jquery.git
    Cloning into '/home/triya/test/vendor/bower-asset/jquery'...
    remote: Invalid username or password.
    fatal: Authentication failed for 'https://github.com/bower-asset/jquery.git/'
  - git@github.com:bower-asset/jquery.git
    Cloning into '/home/triya/test/vendor/bower-asset/jquery'...
    Warning: Permanently added 'github.com,192.30.253.112' (RSA) to the list of known hosts.
    Permission denied (publickey).
    fatal: Could not read from remote repository.

    Please make sure you have the correct access rights
    and the repository exists.


create-project [-s|--stability STABILITY] [--prefer-source] [--prefer-dist] [--repository REPOSITORY] [--repository-url REPOSITORY-URL] [--dev] [--no-dev] [--no-custom-installers] [--no-scripts] [--no-progress] [--no-secure-http] [--keep-vcs] [--no-install] [--ignore-platform-reqs] [--] [<package>] [<directory>] [<version>]

Composer and assets plugin is latest version.

The text was updated successfully, but these errors were encountered:

jmmerino · 2016-12-19T09:47:05Z

Same here....

When I do a composer install, composer fails because a "bower-asset/XXX" dependency.

It fails with a message like this:

I checked out the repos in https://github.com/bower-asset and all of them are private or they have been removed.... Is there anything I'm missing?.

Yii2: v2.0.10
fxp/composer-asset-plugin: v1.2.2
composer.json:

{
  "name": "yiisoft/yii2-app-advanced",
  "description": "Yii 2 Advanced Application Template",
  "keywords": [
    "yii2",
    "framework",
    "advanced",
    "application template"
  ],
  "homepage": "http://www.yiiframework.com/",
  "type": "project",
  "license": "BSD-3-Clause",
  "support": {
    "issues": "https://github.com/yiisoft/yii2/issues?state=open",
    "forum": "http://www.yiiframework.com/forum/",
    "wiki": "http://www.yiiframework.com/wiki/",
    "irc": "irc://irc.freenode.net/yii",
    "source": "https://github.com/yiisoft/yii2"
  },
  "minimum-stability": "stable",
  "require": {
    "php": ">=5.4.0",
    "yiisoft/yii2": "2.0.*",
    "yiisoft/yii2-swiftmailer": "*",
    "facebook/php-sdk-v4": "4.0.*",
    "google/apiclient": "2.1.0",
    "nickcv/yii2-mandrill": "*",
    "linslin/yii2-curl": "1.0.5",
    "yiisoft/yii2-twig": "~2.0.0",
    "yiisoft/yii2-jui": "~2.0.0.0",
    "kartik-v/yii2-widget-datetimepicker": "~1.4.2",
    "kartik-v/yii2-widget-select2": "*",
    "quaderno/quaderno": "1.*",
    "yiisoft/yii2-redis": "~2.0.0",
    "moonlandsoft/yii2-phpexcel": "*",
    "yiisoft/yii2-bootstrap": "~2.0.0",
    "stripe/stripe-php": "^3.13",
    "php-amqplib/php-amqplib": "^2.6",
    "hellogerard/jobby": "^3.0",
    "katzgrau/klogger": "dev-master",
    "league/oauth2-client": "^1.4",
    "guzzlehttp/guzzle": "^6.2",
    "mobiledetect/mobiledetectlib": "^2.8",
    "bazilio/yii2-newrelic": "~0.0.1",
    "frostealth/yii2-aws-s3": "~1.0@stable"
  },
  "require-dev": {
    "icanboogie/inflector": "*",
    "yiisoft/yii2-codeception": "*",
    "yiisoft/yii2-debug": "*",
    "yiisoft/yii2-gii": "*",
    "yiisoft/yii2-faker": "*",
    "flow/jsonpath": "*",
    "codeception/codeception": "~2.1 !=2.1.5 !=2.2.3 !=2.2.6 !=2.2.7",
    "codeception/specify": "*",
    "codeception/verify": "*",
    "deployphp/recipes": "~3.0",
    "site5/phantoman": "^1.1"
  },
  "autoload": {
    "psr-4": {
      "queue\\": "queue/src/"
    }
  },
  "config": {
    "process-timeout": 1800,
    "github-oauth": {
      "github.com": "XXXXXXX"
    }
  },
  "extra": {
    "asset-installer-paths": {
      "npm-asset-library": "vendor/npm",
      "bower-asset-library": "vendor/bower"
    }
  }
}

inacho · 2016-12-19T10:29:39Z

Same problem 😢

diegoparkingdoor · 2016-12-19T10:30:19Z

Same case here:

francoispluchino · 2016-12-19T10:37:30Z

It sounds like a problem with Packagist ! see https://packagist.org/search/?q=bower-asset, Now, Packagist references the virtual packages.

francoispluchino · 2016-12-19T11:11:19Z

I think I have found the problem. Since the v2.0 of Punycode.js, the bower.json file no longer exists. So the plugin does not replace the name in the download links. I am working on a fix of the problem.

francoispluchino · 2016-12-19T11:49:59Z

Only the 1.3.2 version of Punycode.js has a bug. But this is also the case for the 1.12.4 version of Jquery.

For the moment, add this constraint in your composer project file:

{
    "require": {
        "bower-asset/punycode": "^1.3.0 !=1.3.2",
        "bower-asset/jquery": "^1.12 !=1.12.4"
    }
}

rezident · 2016-12-19T11:54:28Z

I've had the same problem with jquery.inputmask 3.3.3

mrserg161 · 2016-12-19T11:58:04Z

bower-asset/jquery

rezident · 2016-12-19T12:00:08Z

My project requires Yii2. For its part, Yii2 requires this bad dependencies. We are waiting for fix composer asset plugin.

nadar · 2016-12-19T12:03:10Z

@rezident Maybe creating an issue on https://github.com/yiisoft/yii2 as there will be a lot of other users affected by this problem. Me as well. This is absolutely the downside of such frameworks relating to other library's and plugins.

jmmerino · 2016-12-19T12:03:38Z

@nadar yiisoft/yii2#13247 😉

francoispluchino · 2016-12-19T12:05:48Z

After removing my Composer caches, I confirm that the problem comes from Packagist. Composer downloads a list of repository providers in COMPOSER_HOME/repo/https---packagist.org/provider-bower-asset$jquery.json (for jquery).

The problem comes with the virtual packages referenced by many packages with provide and replace section.

francoispluchino · 2016-12-19T12:17:00Z

The problem is with the packages:

SilverFire · 2016-12-19T12:23:25Z

For those who faced this problem - try https://asset-packagist.org as an alternative.

cebe · 2016-12-19T12:25:08Z

@francoispluchino I see the problem but why does it only appear today? The package cebe/assetfree-yii2 exists on packagist for over 9 month now.

francoispluchino · 2016-12-19T12:25:53Z

@SilverFire You're going to have the same problem, Because the packages referenced in Packagist are retrieved before the others.

diegoparkingdoor · 2016-12-19T12:26:30Z

@cebe because I think that the fallback repo was github repo, and it disappeared today.

cebe · 2016-12-19T12:27:11Z

@diegoparkingdoor what is "fallback repo"? can you give more info or a link?

bizley · 2016-12-19T12:28:19Z

I confirm all works after switching to https://asset-packagist.org (bower-asset/jquery was the problem before).

francoispluchino · 2016-12-19T12:30:17Z

In the file COMPOSER_HOME/repo/https---packagist.org/provider-bower-asset$jquery.json:

{
  "packages": {
    "bower-asset\/jquery": {
      "1.12.4": {
        "name": "bower-asset\/jquery",
        "description": "Distribution repo for jQuery Core releases.",
        "keywords": [],
        "homepage": "",
        "version": "1.12.4",
        "version_normalized": "1.12.4.0",
        "license": [],
        "authors": [],
        "source": {
          "type": "git",
          "url": "https:\/\/github.com\/bower-asset\/jquery.git",
          "reference": "a76fe112f860279382d9f6336fe040fd8f8aa13d"
        },
        "dist": {
          "type": "zip",
          "url": "https:\/\/api.github.com\/repos\/bower-asset\/jquery\/zipball\/a76fe112f860279382d9f6336fe040fd8f8aa13d",
          "reference": "a76fe112f860279382d9f6336fe040fd8f8aa13d",
          "shasum": ""
        },
        "type": "library",
        "time": "2016-12-19T07:13:46+00:00",
        "uid": 1133121
      },
      //....
    }
  }
}

It's the source url and the dist url that are used.

cebe · 2016-12-19T12:31:18Z

why are these added there, the package is virtual on packagist, it should not have any source or dist urls.

cebe · 2016-12-19T12:31:32Z

is that something created by packagist.org?

cebe · 2016-12-19T12:36:57Z

might be. I did not find it on packagist however. https://packagist.org/providers/bower-asset/jquery

francoispluchino · 2016-12-19T12:38:24Z

@cebe https://packagist.org/search/?q=bower-asset

cebe · 2016-12-19T12:42:15Z

yes, it is on packagist as a virtual package because of my yii2-asset-free package. but that has been there since I created it.

bizley · 2016-12-19T13:03:03Z

@francoispluchino

vendor & composer.lock removed.
composer.json switched back to composer-asset-plugin.
composer cache cleared.
composer install: same problem with bower-asset/jquery.

So again:

vendor & composer.lock removed.
composer.json switched to https://asset-packagist.org
composer cache cleared.
composer install: all works.

cebe · 2016-12-19T13:14:41Z

Problem analysis, thanks to @alcohol from #composer-dev IRC channel on freenode!

Someone was able to create bower-asset/jquery package on packagist. Even though there is a
virtual package with that name and this newly registered version does not show up in the interface,
it has two versions listed in the package info json:
https://packagist.org/p/bower-asset/jquery%242fab1ac0b638d1cc9c9b51a810c84229e91af63a84e7f1c44cf3829aeca1107d.json

"bower-asset/jquery": {

    "1.12.4": {
        "name": "bower-asset/jquery",
        "description": "Distribution repo for jQuery Core releases.",
        "keywords": [ ],
        "homepage": "",
        "version": "1.12.4",
        "version_normalized": "1.12.4.0",
        "license": [ ],
        "authors": [ ],
        "source": {
            "type": "git",
            "url": "https://github.com/bower-asset/jquery.git",
            "reference": "a76fe112f860279382d9f6336fe040fd8f8aa13d"
        },
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/bower-asset/jquery/zipball/a76fe112f860279382d9f6336fe040fd8f8aa13d",
            "reference": "a76fe112f860279382d9f6336fe040fd8f8aa13d",
            "shasum": ""
        },
        "type": "library",
        "time": "2016-12-19T07:13:46+00:00",
        "uid": 1133121
    },
    "dev-master": {
        "name": "bower-asset/jquery",
        "description": "Distribution repo for jQuery Core releases.",
        "keywords": [ ],
        "homepage": "",
        "version": "dev-master",
        "version_normalized": "9999999-dev",
        "license": [
            "Jquery"
        ],
        "authors": [ ],
        "source": {
            "type": "git",
            "url": "https://github.com/bower-asset/jquery.git",
            "reference": "7f3fb476862a87eff31d55d29fcbf1d7f28a576f"
        },
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/bower-asset/jquery/zipball/7f3fb476862a87eff31d55d29fcbf1d7f28a576f",
            "reference": "7f3fb476862a87eff31d55d29fcbf1d7f28a576f",
            "shasum": ""
        },
        "type": "library",
        "time": "2016-12-19T07:15:56+00:00",
        "uid": 1133122
    }

},

it is unclear to me how that package exists on packagist as the namespace is still free. There should be vendor name protection but I was just able to register https://packagist.org/packages/bower-asset/namespace-placeholder-xyz without failure.

SilverFire · 2016-12-19T13:18:16Z

@Seldaek is is possible to drop those packages from Packagist.org?

cebe · 2016-12-19T13:20:24Z

I just reported it to packagist here: composer/packagist#756

erikverheij · 2016-12-19T13:24:05Z

As a workaround I added the package to the replace section in my composer file.

"replace": {
    "bower-asset/jquery": "*",
},

Note that you'll have to make sure to include jquery manually if you need it. This is just a quick fix that may help you until the issue has been resolved.

francoispluchino · 2016-12-19T13:26:29Z

@erikverheij Maybe include a replacement of all asset packages from the plugin?

cebe · 2016-12-19T13:27:47Z

@francoispluchino as far as I see only the package that is advertised by packagist are affected, which are jquery and punycode so far.

francoispluchino · 2016-12-19T13:29:14Z

@erikverheij There is a problem with your solution:

{
  "require": {
    "bower-asset/jquery": "1.12.4"
  },
  "replace": {
    "bower-asset/jquery": "*"
  }
}

$ composer install --prefer-dist -v
Loading composer repositories with package information
Updating dependencies (including require-dev)
Adding VCS repository bower-asset/jquery
Reading bower.json of bower-asset/jquery (1.12.4)
Importing tag 1.12.4 (1.12.4.0)
Dependency resolution completed in 0.000 seconds
Analyzed 89 packages to resolve dependencies
Analyzed 72 rules to resolve dependencies
Nothing to install or update
Generating autoload files

The package is not installed.

cebe · 2016-12-19T13:32:07Z

The problem can be worked around by adding the following to your composer.json:

    "require": {
...
        "bower-asset/jquery": "<1.12.4",
        "bower-asset/punycode": "<1.3.2"
    },

This will exclude the versions that have been added wrongly to packagist and will allow the asset plugin to install the correct packages.

francoispluchino · 2016-12-19T13:34:29Z

@cebe This was my proposal, but the problem still exists after cleaning the cache.

cebe · 2016-12-19T13:35:11Z

it did work for me with clean cache here...

francoispluchino · 2016-12-19T13:46:15Z

@cebe It did not work for me with the full example of @jmmerino and my patch, because I forgot to add that of jquery. No comment...

Add that, solves the problem of my previous comment:

{
    "require": {
        "bower-asset/punycode": "^1.3.0 !=1.3.2",
        "bower-asset/jquery": "^1.12 !=1.12.4"
    }
}

But it will not fix the problem definitely. It is enough that the guy updates his package, or adds others, and the problem will continue.

cebe · 2016-12-19T13:48:42Z

Sure, this is just a workaround for now.

Btw, I have registered:

to reserve the vendor namespaces on packagist, when composer/packagist#756 gets fixed, this should prevent such issues form happening in the future.

francoispluchino · 2016-12-19T13:55:31Z

@cebe With your proposal, reserved only one package name with vendor name, is enough to reserve the vendor name?

francoispluchino · 2016-12-19T14:28:51Z

Packagist is now cleaned. And the install is ok. Thanks to @cebe and @Seldaek.

rezident · 2016-12-19T14:31:57Z

@francoispluchino I confirm it! Thank you very much!

francoispluchino · 2016-12-19T14:34:04Z

@cebe Maybe transfert the github repositories bower-asset/namespace-placeholder-xyz and npm-asset/namespace-placeholder-xyz to @fxpio.

cebe · 2016-12-19T14:37:37Z

With your proposal, reserved only one package name with vendor name, is enough to reserve the vendor name?

@francoispluchino yes, see composer/packagist#163 (comment)

cebe · 2016-12-19T14:38:57Z

@francoispluchino I am trying to register the names on github as well. Contacted github about https://github.com/bower-asset and @SilverFire has registered https://github.com/npm-asset

will add you as owner too when it is done.

SilverFire · 2016-12-19T14:40:24Z

For the case I've registered bower-asset and npm-asset users on Packagist.org as well

cebe · 2016-12-19T14:41:30Z

For the case I've registered bower-asset and npm-asset users on Packagist.org

afaik, that does not help anything as user names on packagist have no special purpose.

SilverFire · 2016-12-19T14:56:05Z

Yes, I know that. That's why I've said "just for case"

francoispluchino added bug and removed bug labels Dec 19, 2016

francoispluchino self-assigned this Dec 19, 2016

francoispluchino added the bug label Dec 19, 2016

francoispluchino added this to the 1.2.3 milestone Dec 19, 2016

nadar mentioned this issue Dec 19, 2016

Composer dependency problem yiisoft/yii2#13247

Closed

This was referenced Dec 19, 2016

You break the compatibility of fxp/composer-asset-plugin cebe/assetfree-yii2#4

Closed

You break the compatibility of fxp/composer-asset-plugin yidas/yii2-composer-bower-skip#1

Closed

cebe mentioned this issue Dec 19, 2016

A bug with virtual packages composer/packagist#756

Closed

francoispluchino closed this as completed Dec 19, 2016

francoispluchino added the external label Dec 19, 2016

francoispluchino removed their assignment Dec 19, 2016

francoispluchino removed this from the 1.2.3 milestone Dec 19, 2016

bower package install failed #268

bower package install failed #268

Comments

lan143 commented Dec 19, 2016 • edited

jmmerino commented Dec 19, 2016

inacho commented Dec 19, 2016

diegoparkingdoor commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

rezident commented Dec 19, 2016

mrserg161 commented Dec 19, 2016

rezident commented Dec 19, 2016

nadar commented Dec 19, 2016

jmmerino commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

SilverFire commented Dec 19, 2016 • edited

For those who faced this problem - try https://asset-packagist.org as an alternative.

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

diegoparkingdoor commented Dec 19, 2016

cebe commented Dec 19, 2016 • edited

bizley commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

cebe commented Dec 19, 2016

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

bizley commented Dec 19, 2016

cebe commented Dec 19, 2016

SilverFire commented Dec 19, 2016 • edited

cebe commented Dec 19, 2016

erikverheij commented Dec 19, 2016 • edited

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

rezident commented Dec 19, 2016

francoispluchino commented Dec 19, 2016

cebe commented Dec 19, 2016

cebe commented Dec 19, 2016 • edited

SilverFire commented Dec 19, 2016 • edited

cebe commented Dec 19, 2016

SilverFire commented Dec 19, 2016

lan143 commented Dec 19, 2016 •

edited

SilverFire commented Dec 19, 2016 •

edited

cebe commented Dec 19, 2016 •

edited

SilverFire commented Dec 19, 2016 •

edited

erikverheij commented Dec 19, 2016 •

edited

cebe commented Dec 19, 2016 •

edited

SilverFire commented Dec 19, 2016 •

edited