Merging VCS repository override of published package fails #95
Description
First reported by @ghprod in #71 (comment)
composer.json:
{ "require": { "wikimedia/composer-merge-plugin": "dev-master" }, "config": { "preferred-install": "dist" }, "extra": { "merge-plugin": { "include": "composer.local.json" } } } composer.local.json:
{ "repositories": [ { "type": "vcs", "url": "https://github.com/ghprod/laravel-menu" } ], "require":{ "lavary/laravel-menu": "dev-master#956e50f" } } Result:
$ composer -vvv update [...snip...] Loading plugin Wikimedia\Composer\MergePlugin [merge-plugin] Loading composer.local.json... [merge-plugin] Adding vcs repository github.com/ghprod/laravel-menu [merge-plugin] Merging lavary/laravel-menu Loading composer repositories with package information [...snip...] Downloading https://api.github.com/repos/ghprod/laravel-menu Downloading https://api.github.com/repos/ghprod/laravel-menu/contents/composer.json?ref=master Downloading https://api.github.com/repos/ghprod/laravel-menu/commits/master Downloading https://api.github.com/repos/ghprod/laravel-menu/tags?per_page=100 Downloading https://api.github.com/repos/ghprod/laravel-menu/git/refs/heads?per_page=100 [...snip...] Reading composer.json of lavary/laravel-menu (master) Downloading https://api.github.com/repos/ghprod/laravel-menu/contents/composer.json?ref=956e50fbf0d99b2804539069b012ad52b4851dd2 Downloading https://api.github.com/repos/ghprod/laravel-menu/commits/956e50fbf0d99b2804539069b012ad52b4851dd2 [...snip...] Downloading http://packagist.org/p/lavary/laravel-menu%24cb8432bd74b707af0300352a1d49742389810f45e5646550e5dca3a823fe4c55.json [...snip...] Analyzed 1426 packages to resolve dependencies Analyzed 1200 rules to resolve dependencies [...snip...] - Installing lavary/laravel-menu (dev-master bebce99) Downloading https://api.github.com/repos/lavary/laravel-menu/zipball/bebce996ef08cf911da0139c30a2da03a2768326 The installed revision (bebce99) is the head of the dev branch of the project as listed on Packagist. The alternate VCS repository was not used.
If the require for "lavary/laravel-menu" is moved to composer.json, results are slightly different but still not correct. In that case the logs report:
- Installing lavary/laravel-menu (dev-master 956e50f) Downloading https://api.github.com/repos/lavary/laravel-menu/zipball/956e50f This download is still from the wrong repository in this case and the files fetched from GitHub are not not actually for the desired hash.
If the "repositories" are moved to composer.json instead, the new output is:
- Installing lavary/laravel-menu (dev-master 956e50f) Downloading https://api.github.com/repos/ghprod/laravel-menu/zipball/956e50fbf0d99b2804539069b012ad52b4851dd2 This is the desired result for all three tests.
I think the issue here is the order that the repositories are added to Composer\Repository\RepositoryManager. It may take an upstream patch to fix this properly.