# Composer with private repos

**URL:** <https://travis-ci.community/t/composer-with-private-repos/11930>\
**Category:** PHP\
**Tags:** composer\
**Created:** [August 3, 2021, 7:33pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930 "2021-08-03T19:33:27Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![elb98rm](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/elb98rm/32/6500_2.png) [@elb98rm](https://travis-ci.community/u/elb98rm)\
**Post date:** [August 3, 2021, 7:33pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/1 "2021-08-03T19:33:27Z")

</div>

I’m attempting to use a private repo in composer inside a travis build.  
On my local install (docker) this works as expected.

Currently in my `composer.json`:

```json
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/[organisation]/[repo]"
        }
    ]

```

I’ve attempted to follow the instructions within:

- [Private Dependencies GitHub - Travis CI](https://docs.travis-ci.com/user/private-dependencies/#api-token)

This includes adding:

```auto
before_install:
  - echo -e "machine github.com\n login $GITHUB_TOKEN" > ~/.netrc

```

I call the composer install via:

```auto
  - travis_retry composer self-update
  - travis_retry composer install

```

(those variables are defined)

Failed to download [organisation]/[repo] from dist: The “[https://api.github.com/repos/[organisation]/[repo]/zipball/851ecba22de6d5f7e6c37c75dcbc713256bef319](https://api.github.com/repos/%5Borganisation%5D/%5Brepo%5D/zipball/851ecba22de6d5f7e6c37c75dcbc713256bef319)” file could not be downloaded (HTTP/1.1 404 Not Found)

I have attempted this various ways.

I’ve also attemped the following (which was suggested in another thread):

```auto
before_install:
  - echo -e "machine github.com\n login $GITHUB_TOKEN" > ~/.netrc
  - git config --global credential.helper store
  - |
    git credential fill <<! | git credential approve
    url=https://github.com/
    username=$GITHUB_USERNAME
    password=$GITHUB_TOKEN
    !

```

Which gets me:

```bash
Package operations: 105 installs, 0 updates, 0 removals
  - Downloading [organisation]/[repo] (dev-staging 851ecba)
    Failed to download [organisation]/[repo] from dist: The "https://api.github.com/repos/[organisation]/[repo]/zipball/851ecba22de6d5f7e6c37c75dcbc713256bef319" file could not be downloaded (HTTP/1.1 404 Not Found)
    Now trying to download from source
  - Syncing [organisation]/[repo] (dev-staging 851ecba) into cache
                                                                               
  [RuntimeException]                                                           
  Failed to execute git clone --mirror -- 'git@github.com:[organisation]/[repo].git' '/home/travis/.cache/composer/vcs/git-github.com-[organisation]-[repo].git/'                                                            
                                                                               
  Cloning into bare repository '/home/travis/.cache/composer/vcs/git-github.com-[organisation]-[repo].git'...                                         
  Permission denied (publickey).                                               
  fatal: Could not read from remote repository.                                
                                                                               
  Please make sure you have the correct access rights                          
  and the repository exists.    

```

While this looks like a permissions issue I can’t seem to solve it. I’ve tried several variations, including using my own valid token… but I am at my whit’s end on this. Does anyone have any ways to sort or debug this?

Thanks  
Rick

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [August 5, 2021, 11:32pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/2 "2021-08-05T23:32:28Z")

</div>

I’m thinking to try and reconstitute the private SSH key once running inside Travis, so maybe lets try making a bash script that reads something like:

```bash
echo -n $id_rsa_{00..30} >> ~/.ssh/id_rsa_base64
base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config

```

You can obviously call the script whatever you want, for the sake of time I’m calling this `composer_fix.sh`.

Now you can just add in your `.travis.yml`:

```auto
before_script: chmod u+x composer_fix.sh 

```

It’s an outside the box _possible_ solution, but it could work. If it doesn’t please post back and I will get this working for you.

Montana Mendy  
Travis CI Staff

---

<div class="post-metadata">

**Author:** ![elb98rm](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/elb98rm/32/6500_2.png) [@elb98rm](https://travis-ci.community/u/elb98rm)\
**Post date:** [August 18, 2021, 9:54am UTC](https://travis-ci.community/t/composer-with-private-repos/11930/3 "2021-08-18T09:54:43Z")

</div>

Thanks for reviewing this Montana.  
The above fix didn’t help. ☹

I will raise a ticket to try to get support, but I’m surprised that such a simple thing is an issue with travis.

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [August 18, 2021, 2:43pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/4 "2021-08-18T14:43:53Z")

</div>

Another thing that comes to mind,

If you want to push via SSH, Travis needs to have access to the encrypted or as some colloquially say the _“private”_ part of the SSH key you originally generated.

I recommend you reading this:

> <https://github.com/dwyl/learn-travis/blob/master/encrypted-ssh-keys-deployment.md>

---

<div class="post-metadata">

**Author:** ![elb98rm](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/elb98rm/32/6500_2.png) [@elb98rm](https://travis-ci.community/u/elb98rm)\
**Post date:** [August 18, 2021, 3:08pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/5 "2021-08-18T15:08:14Z")

</div>

Ok… This document is about using an SSH key (specifically with respect to encrypting it).

I am asking about

- using github/packagist to install dependancies
- using token authentication (as is used everywhere else in all systems, including the live/production server).

This explains (one of the many methods of) how to do this:

- [Generate a GitHub Personal Access Token for Private Composer Packages · GitHub](https://gist.github.com/jeffersonmartin/d0d4a8dfec90d224d14f250b36c74d2f)

I’m following the methods explained in:

- [Private Dependencies GitHub - Travis CI](https://docs.travis-ci.com/user/private-dependencies/#api-token)

…

I’m unsure why the travis documentation doesn’t work. Are you able to help with this specifically?

---

<div class="post-metadata">

**Author:** ![Montana](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/montana/32/9566_2.png) [@Montana](https://travis-ci.community/u/Montana)\
**Post date:** [August 18, 2021, 3:17pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/6 "2021-08-18T15:17:50Z")

</div>

Hey @elb98rm,

Gotcha, thank you for clarifying - let me look into this a bit more and I’ll get a fix to you.

---

<div class="post-metadata">

**Author:** ![elb98rm](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/elb98rm/32/6500_2.png) [@elb98rm](https://travis-ci.community/u/elb98rm)\
**Post date:** [August 19, 2021, 2:29pm UTC](https://travis-ci.community/t/composer-with-private-repos/11930/7 "2021-08-19T14:29:56Z")

</div>

If it will help, I can provide a link to a private repo/private travis build to assist you.  
(PM/email)

---

<div class="post-metadata">

**Author:** ![elb98rm](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/elb98rm/32/6500_2.png) [@elb98rm](https://travis-ci.community/u/elb98rm)\
**Post date:** [August 31, 2021, 8:39am UTC](https://travis-ci.community/t/composer-with-private-repos/11930/8 "2021-08-31T08:39:34Z")

</div>

Just wanted to update this for the general public. After some help from the travis team, we found that there was a problem with a key.

However, there is to be a documentation update. Given a token named $GITHUB\_TOKEN

```auto
before_install:
  - composer config -g github-oauth.github.com "$GITHUB_TOKEN"
  - echo -e "machine github.com\n login $GITHUB_TOKEN" > ~/.netrc

```

This correctly logs you in to github.  
`