Composer无法下载Flex recipes JSON文件：404与curl 200正常的矛盾问题

今日启动旧Symfony Flex项目（已删除本地Docker容器、镜像及缓存），容器入口点的Composer本应自动安装依赖但失败。跳过依赖安装手动操作时发现：Composer无法下载recipes的index.json文件，然而用curl却能成功获取。

Composer更新日志 #

# composer update symfony/flex

In CurlDownloader.php line 623:

  The "https://raw.githubusercontent.com/symfony/recipes-contrib/flex/main/index.json" file could not be downloaded (HTTP/2 404 )


update [--with WITH] [--prefer-source] [--prefer-dist] [--prefer-install PREFER-INSTALL] [--dry-run] [--dev] [--no-dev] [--lock] [--no-install] [--no-audit] [--audit-format AUDIT-FORMAT] [--no-autoloader] [--no-suggest] [--no-progress] [-w|--with-dependencies] [-W|--with-all-dependencies] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--prefer-stable] [--prefer-lowest] [-i|--interactive] [--root-reqs] [--] [<packages>...]

Curl请求结果 #

# curl -IL --http2 https://raw.githubusercontent.com/symfony/recipes/flex/main/index.json
HTTP/2 200
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "cbf7d5d470e448beeb667739f56cc627eb271aa54de7d1a46d10eb8ee72ddc36"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: D29A:D902:9C967E:ACDA5B:63B2C9F7
accept-ranges: bytes
date: Mon, 02 Jan 2023 13:47:19 GMT
via: 1.1 varnish
x-served-by: cache-fra-eddf8230085-FRA
x-cache: HIT
x-cache-hits: 1
x-timer: S1672667240.634749,VS0,VE1
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
x-fastly-request-id: aac3282f232b3395c82294f6b70b799be6586a24
expires: Mon, 02 Jan 2023 13:52:19 GMT
source-age: 74
content-length: 73467

Composer诊断结果 #

# composer diagnose
Checking composer.json: WARNING
require.symfony/one-signal-notifier : exact version constraints (6.1.x-dev) should be avoided if the package follows semantic versioning
Checking platform settings: OK
Checking git settings: OK git version 2.38.2
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com oauth access: The oauth token for github.com seems invalid, run "composer config --global --unset github-oauth.github.com" to remove it
Checking disk free space: OK
Checking pubkeys: FAIL
Missing pubkey for tags verification
Missing pubkey for dev verification
Run composer self-update --update-keys to set them up
Checking composer version: OK
Composer version: 2.5.1
PHP version: 8.1.13
PHP binary path: /usr/local/bin/php
OpenSSL version: OpenSSL 3.0.7 1 Nov 2022
cURL version: 7.86.0 libz 1.2.13 ssl OpenSSL/3.0.7
zip: extension present, unzip present, 7-Zip not available

解决方法 #

• 移除无效的GitHub OAuth令牌：

  composer config --global --unset github-oauth.github.com
  

• 更新Composer验证公钥：

  composer self-update --update-keys
  

• 清除Composer缓存并启用contrib配方源：

  composer clear-cache
  composer config extra.symfony.allow-contrib true
  

• 强制更新Symfony Flex以修复配方源配置：

  composer require symfony/flex --no-update
  composer update symfony/flex
  

内容的提问来源于stack exchange，提问作者Krystian