Magento repository is used for packages instead of Mage-OS

[vpodorozh]

Preconditions and environment

• Mage-OS version: ANY when using gitlab repo installation
• Reproduced on both - released version and also develop version (github repo)
• Reproduced ONLY for packages that are managed in separate repository (e.g. https://github.com/mage-os/mageos-magento-zend-db )

Steps to reproduce

1. Install Mage-OS
2. Check composer.lock
3. Look for "name": "magento/zend-db",

Expected result

The repository URL and reference are pointing to the Mage-OS composer repo or GitHub repo.

{
            "name": "magento/zend-db",
            "version": "1.16.1",
            "source": {
                "type": "git",
                "url": "https://mirror.mage-os.org/packages/magento/magento-zend-db.zip",
                "reference": "475addb06c0a417b2fd18effe5966bd3aa929b7b"
            },
            ...
}

Actual result

The repository URL and reference are pointing to the Magento composer repo or GitHub repo.

{
            "name": "magento/zend-db",
            "version": "1.16.1",
            "source": {
                "type": "git",
                "url": "https://github.com/magento/magento-zend-db.git",
                "reference": "475addb06c0a417b2fd18effe5966bd3aa929b7b"
            },
            ...
}

Additional information

No response

Release note

No response

Triage and priority

• Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.

[fballiano]

I can confirm what described by @vpodorozh is true.

@rhoerr @sprankhub do you also think this should be solved?

[sprankhub]

Would be nice, but I am not sure if this is (easily) possible. It probably has something to do with Composer repository priorities. As long as the right version is used, I don't see a big issue, though. If Adobe at one point took down the GitHub repositories, I think Composer would actually fall back to the mage-os repositories 🤔

[rhoerr]

I think this is by nature of the composer.json and composer.lock files packaged in the repository for contributor installs.

We could conceivably update those to point to Mage-OS mirror or equivalents where possible, but I suspect it would cause a lot of merge conflicts. Any change to the composer files upstream would require manual action to rebuild and reconcile on our part, unless we worked it into the merge-upstream action in some way.