A guide for SSH authed package fetches?

[rask]

I'm currently struggling with the following:

• Server with x amount of users, each can use SSH to log in
• Each user has a generated Satis repo in their home directory at ~/satis
• Each user has different PHP packages available and they should not be able to download packages from each others' package repos.

Generating the packages and creating the users is no problem. The problem arises with Composer:

How can I define a composer.json repositories configuration to fetch Satis packages from a certain users home directory under a certain directory? The following errors:

"repositories": [
    {
        "type": "composer",
        "url": "ssh2.sftp://packages.example.com:/home/username/satis",
        "options": {
            "ssh2": { "user": "username", "pubkey_file": "...", "privkey_file": "..." }
        }
    }
]

So does ssh2.sftp://packages.example.com/home/username/satis, ssh2.sftp://packages.example.com/satis and other variants. Every time the error is file could not be downloaded: failed to open stream: operation failed.

Any ideas how to make this work? Or is the users home directory root intended to be the actual Satis repository in order for this to work? Any pointers where to start debugging this?

ssh2.scp results in the same error.

[rask]

Haha, noob mistake: should be username instead of user in the ssh2 options block.

Changed that and now the server shows auth.log activity too. Same error still appearing. Need to check closer.

[alcohol]

Do you use any custom .ssh/config settings for the user running Composer?

[rask]

None, just a regular Linux user created with adduser, and a .ssh/authorized_keys file.

[ChrissiQ]

This is quite old, but I'm having this issue. I created a satis server, trying to setup composer to download packages through ssh. I tried adding the options block to the project's composer.json, and to satis.json, and combinations of either, or not at all.

I have no special configuration or anything, I just installed php-ssh2 and as far as I can tell it works correctly, it's listed in php extensions and the ssh.* streams are listed in php -i under "Registered PHP Streams". The command doesn't complain about the connection method anyway. I always get the same error:

The "ssh2.sftp://user@example.com:/home/user/packages/example.zip" file could not be downloaded: failed to open stream: operation failed

What I am looking to accomplish is getting composer to download private packages over ssh.

I've checked that the specified pubkey_file and privkey_file and username in the options block are set correctly, and I am able to ssh (and sftp) into the server and access the file with the same user and details.