phar error: "vendor/composer/spdx-licenses/res/spdx-licenses.json" is not a file

Describe the bug Under certain circumstances, php satis.phar build throws an error:

In PackageRepository.php line 57:

  A repository of type "package" contains an invalid package definition: file_get_contents(phar:///***/satis/satis.phar/vendor/composer/spdx-licenses/res/spdx-lice  
  nses.json): Failed to open stream: phar error: "vendor/composer/spdx-licenses/res/spdx-licenses.json" is not a file in phar "/***/satis/satis.phar"                

  Invalid package definition:                                                                                                                                                     
  {"name":"onspli\/composer-test-package","license":"CAUSES_ERROR"}

To Reproduce satis.json:

{
  "name": "onspli/satis-test-repo",
  "homepage": "http://packages.example.org",
  "output-dir": "output",
  "repositories": [
    {
      "type": "package",
      "package": [
        {
          "name": "onspli/composer-test-package",
          "version": "dev-test",
          "license": "CAUSES_ERROR"
        }
      ]
    }
  ]
}

execute:

$ box compile
$ php satis.phar build

Expected behavior Successful build.

Proposed fix Add vendor/composer/spdx-licenses/res/*.json to box.json.

composer / satis

phar error: "vendor/composer/spdx-licenses/res/spdx-licenses.json" is not a file #918