The ComposerJsonProcessor class performs multiple operations on JSON:

• Translation of the downloaded list.json from the Packagist API into the JSON file containing links to all the projects/packages.
• Rewrite of the individual provider JSON files to point to the Nexus proxy repository instead of the actual upstream Git repository.

These are currently done by unmarshaling all the contents of the JSON files into memory as maps. For the time being this seems to work just fine, but a more parsimonious way to do this would be to parse the JSON using something like the JsonParser API rather than the ObjectMapper API that we're currently using.

(Sonatype employees can reference our internal NPM implementation for ideas here. In rare situations for NPM large JSON file could exhaust available memory when we used the ObjectMapper-based approach, which eventually convinced us to switch to the JsonParser for these kinds of operations.)

• What are you trying to do?
  Start nexus-repository-composer 0.0.2 on NXRM 3.16.1-02

• What feature or behavior is this required for?
  Creating a proxy composer repository

• How could we solve this issue? (Not knowing is okay!)
  Not sure

• Anything else?
  Following the installation instructions in the readme, I have:

• successfully built the jar file and copied it to the tmp folder

• enabled the nexus console

• installed the bundle

However, when I try to start the bundle it fails with the following error:
Error executing command: Error executing command on bundles: Error starting bundle 269: Unable to resolve org.sonatype.nexus.plugins.nexus-repository-composer [269](R 269.0): missing requirement [org.sonatype.nexus.plugins.nexus-repository-composer [269](R 269.0)] osgi.wiring.package; (&(osgi.wiring.package=org.apache.commons.compress.archivers)(version>=1.19.0)) Unresolved requirements: [[org.sonatype.nexus.plugins.nexus-repository-composer [269](R 269.0)] osgi.wiring.package; (&(osgi.wiring.package=org.apache.commons.compress.archivers)(version>=1.19.0))]

The provider files for NXRM-based proxy, hosted, and group repos rely on a somewhat "flattened" form of the provider files in order to facilitate lookup and group merging.

These work with the client but are nonstandard (though not invalid) with respect to normal Composer layouts, so we should ensure that we handle this special case once #22 is finished.

As a practical matter, we have two options:

1. Add a single level of indirection (i.e. introduce a single provider-includes file to store the content currently returned in the packages.json).
2. Handle situations where the "providers" section of the packages.json is populated (as it is for Nexus repos but not for most repos in the wild).

Option (1) would make NXRM seem more consistent with other upstream providers but option (2) would make it more robust in handling any other repos that use that same approach. I suspect option (2) would be the best choice here unless we encounter a reason to change the organization of the packages.json in NXRM.

I try to add new versions of my package on a hosted composer repo.
New versions don't appear on https://my.nexus/repository/composer_hosted/p/vendor/package.json ...
I only have my first package version.

Currently, I push a 1.0.0 version and few minutes after, I push 1.0.1, but json say :

{
  "packages": {
    "vendor/package": {
      "1.0.0": {
        "name": "vendor/package",
        "version": "1.0.0",
        "dist": {
          "url": "https://my.nexus/repository/composer_hosted/vendor/package/1.0.0/vendor/package-1.0.0.zip",
          "type": "zip",
          "reference": "xXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXx",
          "shasum": "xXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXx"
        },
        "time": "2018-10-01T12:39:52+00:00",
        "uid": 3251794098,
        "autoload": {
          "psr-4": {
            "Vendor\\Package\\": "src/"
          }
        },
        "authors": [
          {
            "name": "Me",
            "email": "[email protected]"
          }
        ],
        "description": "My package ..."
      }
    }
  }
}

Is anyone have same problem ?

Thanks for creating an issue! Please fill out this form so we can be
sure to have all the information we need, and to minimize back and forth.

• What are you trying to do?
  mvn clean package

• What feature or behavior is this required for?
  To get the .jar file.

• How could we solve this issue? (Not knowing is okay!)

• Anything else?

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled within 24 hours. If the build is successful this issue will be closed, otherwise the error message will be updated.

_{This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.}

Right now we have no format-specific search for Composer repositories. We should try to add this, with a selection of search-indexed format-specific fields based on what we come up with for #3 in terms of relevant metadata.

Note that I'm unsure we're doing this for the public R plugin either, so we may have some unknowns about how to:

• Register the elasticsearch-mapping.json file and any custom search code that may be required.
• Register the search UI component/form (e.g. SearchComposer) with Rapture (our own ExtJS-based UI framework).

Also pinging @DarthHater to see if he remembers if we don't have that for R, as it's been too long for me to remember the particulars (did we had a technical reason that might need us to look at our existing implementations?).

When releasing using the latest Orb: circleci-maven-release-orb: sonatype-nexus-community/[email protected]

the process fails during git push. Figure out why.

I`m trying ti install "geocoder-php/common-http": "4.0.0" through composer proxy.

I got an error:

Problem 1
- Installation request for geocoder-php/common-http 4.0.0 -> satisfiable by geocoder-php/common-http[4.0.0].
- geocoder-php/common-http 4.0.0 requires psr/http-message-implementation ^1.0 -> no matching package found.

After this error i`m trying to add "guzzlehttp/psr7" which implements Virutal package "psr/http-message-implementation" but error stays.

Everything works fine with original http://packagist.org

Can you please help to solve this issue or provide some fix for nexus composer?

Thank you.

• What are you trying to do?
  Prepare upgrade of Nexus to 3.16.2-01.

• What feature or behavior is this required for?
  Is this plugin ready for Nexus 3.16.2-01 ?

• How could we solve this issue?
  Not knowing

• Anything else?
  Coffee ?

With the PUT command via HTTP it is possible to send the zip file only, and the "dist" tag is generated automatically.
But here is a "source" tag which can be added as well, which should be supported via the "PUT" command in my opinion.
This will permit people to use the meta data via PUT command as a multi-part value to send the URL, type and the reference for the source code as well.
This will add the "source" tag automatically to the attributes of the package and will provide these fields via packages.json endpoint which is great for knowing the version corresponding in the composer repository is which version in the source control such as git with the reference tag.
I've implemented this feature for our own usage, but it might be a good idea to integrate it for other people as well.

I'll add a Pull Request for this feature shortly.
Thanks in advance.

I tried to use this plugin to connect to Packagist (ok) and to Drupal 8 composer repository (ko).

After a small investigation, the plugin tries to download the file packages/list.json and this file seems to be a specificity of packagist.org.

The packages.json file contains the links to the provider files. The provider files contains the list of the packages and their signatures.
The provider files are the ones used by composer.

The packages/list.json has the list of the available packages of packagist.org but it looks like it's not used at all by composer, nor it's provided by Drupal 8's repository.

To solve this issue, we should :

• update the method generatePackagesJson in the class ComposerProxyFacetImpl to only use the providers
• don't use the constant PROVIDER_JSON in the ComposerProxyFacetImpl class, instead use the value provided by the packages.json file
• handle the case when a provider is not available anymore (it seems to be the case for old versions of providers)

Some technical details

The entry point is the packages.json file.
Examples :

• for Packagist : https://packagist.org/packages.json
• for Drupal : https://packages.drupal.org/8/packages.json

The packages.json file contains a providers-url and a provider-includes entries.

The providers-includes entry list all the files containing the list of repositories.
Examples :

• for Packagist : p/provider-2018-01$%hash%.json with hash 9e9bb7cf12c2f46329fde5008d3ce061405ff7d1e88150e64e98fc4df8b46b7b that will be transformed to https://packagist.org/p/provider-2018-01$9e9bb7cf12c2f46329fde5008d3ce061405ff7d1e88150e64e98fc4df8b46b7b.json
• for Drupal : drupal/provider-2018-1$%hash%.json with hash f0bc8344a8c5af51478a86cc24911a2e36441b92a88085f534445b2531aabb7b that will be transformed to https://packages.drupal.org/8/drupal/provider-2018-1$4d04d5677c5045740aa28bd346e9889c2bd0d5ea23a2c71ef132585be9952777.json

The providers-url contain the format to use to download the description of a specific package.
The required informations (%package% and %hash%) are available in the provider file described above.
Examples :

• for Packagist : /p/%package%$%hash%.json, with the package faustbrian/ark-symfony and its hash 52b4cbe41a74b0c787f853f9c5522caa764c4e20fe660ade907af46d35f5c0f2 : https://packagist.org/p/faustbrian/ark-symfony$52b4cbe41a74b0c787f853f9c5522caa764c4e20fe660ade907af46d35f5c0f2.json
• for Drupal : /8/%package%$%hash%.json, with the package drupal/token and its hash 0e905c202a67a1b2a08bbd6da858b8af93c01ec6d06dd8f3488b318acfe5680c : https://packages.drupal.org/8/drupal/token$0e905c202a67a1b2a08bbd6da858b8af93c01ec6d06dd8f3488b318acfe5680c.json

@TheBay0r has noticed that there may be issues with regenerating provider-level metadata when uploading a new build of an existing package and version. Details are part of the comments thread in PR #14 and would have entered the codebase as part of PR #18.

• What are you trying to do?
  I just want to download a .jar file.

• What feature or behavior is this required for?
  A release workflow.

• How could we solve this issue? (Not knowing is okay!)
  Idk, but since you are running each commit through Travis anyway, shouldn't there be release files?

• Anything else?
  Nope

I encounter an issue with nexus and composer, where it seems that the autoload.php can't be created correctly when the dependencies are hosted on nexus. If only the composer-proxy is used, the autoload.php works fine. When I have dependencies from composer-hosted the autoload.php doesn't seem to include the dependencies correctly.

I tried to have a look at the autoload-documentation, but I couldn't really figure out what is the problem here. Especially since autoloading is working fine, when the same dependency is pulled via github/vcs.

What I saw, also the composer.lock looks completely different, depending on if the hosted repository is used or just vcs + composer-proxy. Also I noticed, when I use vcs I have to install 59 dependencies. Using composer-hosted just installs 52 dependencies

Below I'll show you how the structure in the composer.lock is different
Without composer-hosted the structure in the composer.lock looks like this:

{
	"name": "{vendor}/{package}",
	"version": "…",
	"source": {
		"type": "git",
		"url": "{url}",
		"reference": "{sha}"
	},
	"dist": {
		"type": "zip",
		"url": "{url}",
		"reference": "{sha}",
		"shasum": ""
	},
	"require": {
		{lot's of dependencies}
	},
	"require-dev": {
		{more dependencies}
	},
	"suggest": {
		{other dependencies}
	},
	"type": "library",
	"autoload": {
		"psr-0": {
			…
		}
	},
	"license": [
		…
	],
	"authors": [{
		…
	}],
	"description": "…",
	"time": "…"
}

Below here you'll see how the same package information looks in the composer.lock when retrieved from composer-hosted:

{
	"name": "{vendor}/{package}",
	"version": "…",
	"dist": {
		"type": "zip",
		"url": "{url}",
		"reference": null,
		"shasum": null
	},
	"type": "library",
	"time": "…"
}

Not having the source part seems to be fine, since this missing in all public / proxied repositories the same case. But missing out on all other sections seems to be critical.

I hope this information is useful. If you need anything else, I'm happy to support you!

In order to recover from abnormal situations such as corrupted or deleted JSON metadata files (such as provider JSON files), we should add a rebuild task for Composer metadata to the list of scheduled tasks. This would be similar in principle to other scheduled tasks for other formats.

Note: It may be useful, for performance reasons on very large hosted repositories, to parameterize the task by vendor and project to limit the scope of the rebuild. However, it is not necessary to meet this requirement (i.e. I expect we'll have far more significant scaling issues in other ways before we reach that threshold in a periodic rebuild task).

• What are you trying to do?
  Assign a cleanup policy like described here: https://help.sonatype.com/repomanager3/cleanup-policies

• What feature or behavior is this required for?
  Remove no longer necessary packages to ease storage requirements

• How could we solve this issue? (Not knowing is okay!)
  Here is where someone implemented it for the Conan repository type:
  sonatype-nexus-community/nexus-repository-conan#80

We should implement group repositories once we have proxy and hosted working for Composer.

Some things to consider:

• How will we merge the various providers/indexes in a meaningful way? (This should be easier given how we've "flattened" the structure for proxy repository JSON, and if we do something similar for hosted, that should make life a lot easier as well.)
• How will we reference the archive files in a group repository consistently? (If we've done a good job with our url layout we shouldn't have a problem with this.)

The tree view in Nexus 3 depends on browse nodes that are produced by browse node generators for each format.

The ComposerBrowseNodeGenerator is currently a pass-through that inherits the default behavior from ComponentPathBrowseNodeGenerator. We should evaluate if this representation actually makes sense for Composer, and if not, we should determine what would make sense and implement that instead.

Per Dan in #48 submitting a new issue --
Issues with how zip is being stored/retrieved (not conforming to expect behavior). Test is currently commented out and marked todo per Jeffry

I was trying to run a script that would create a typical triangle of composer repositories.
I uploaded the following script

  "name":"composer",
  "type":"composer",
  "content":"repository.createComposerHosted('composer-hosted');
repository.createComposerProxy('composer-proxy','https://packagist.org'); repository.createComposerGroup('composer',['composer-proxy','composer-hosted'])"
}

If we choose type composer, no language engine is found, according to this message

{
  "name" : "composer",
  "result" : "Missing engine for language: composer"
}

If we change the type to something else, that exists, exception hints a missing implementation of
No signature of method: org.sonatype.nexus.script.plugin.internal.provisioning.RepositoryApiImpl.createComposerHosted()

I would like to automate creating of all my repositories, one if which is composer.
It is possible this functionality already exists, in which case documentation is all that's needed.

I sincerely hope this is something that is not out of your hands

After I build a nexus server by execute commands as follows, I cannot find Composer repository choise in supported repository list after I clicked "Create repository" button.

git clone https://github.com/sonatype-nexus-community/nexus-repository-composer.git
cd nexus-repository-composer && git checkout composer-parent-0.0.7
docker build -t nexus-repository-composer-007 .
mkdir /nexus3_data_007/
chmod a+rw -R /nexus3_data_007/
docker run -d -p 9081:8081 --name nexus-repository-composer-007 -v /nexus3_data_007:/nexus-data nexus-repository-composer-007

Then visit
http://localhost:9081/#admin/repository/repositories and login nexus.
I cannot find Composer repository choise in supported repository list after "Create repository" button was clicked .

• What are you trying to do?

See package hashes in the packages.json file, so Composer can utilize its local caching.

• What feature or behavior is this required for?

Running Composer while using the Nexus repository config breaks caching, which makes updating packages quite a bit slower.

• How could we solve this issue? (Not knowing is okay!)

This appears to be caused by missing hashes in the packages.json file:

{"providers-url":"https://example.com/repository/proxy-composer-packagist/p/%package%.json","providers":{"lukexf/simplelinkshortener":{"sha256":null},"dubroquin/search-engine":{"sha256":null},"solu-admin/languages-crud":{"sha256":null},"idoheo/string-generator":{"sha256":null},"gilberg-vrn/php-foursquare":{"sha256":null},"phpf/httputil":{"sha256":null},"highsolutions/feed":{"sha256":null},"fut/connectors":{"sha256":null},"aminkt/yii2-appcache":{"sha256":null},"overblog/mediawiki":{"sha256":null},"org/cotailored_base_drush_commands":{"sha256":null},"drdplus/person":{"sha256":null},"d-scribe/laravel-apidoc-generator":{"sha256":null},"yellow/yellowdemo-php":{"sha256":null},"fahad19/sitemaps":{"sha256":null},"frosas/misc-bundle":{"sha256":null},"ekyna/cms-bundle":{"sha256":null},"mikejw/elib-base":{"sha256":null},"bogdik/yii2-chosen":{"sha256":null},"ttree/fusion-documentfinder":{"sha256":null},"maikuolan/sfs-mass-ip-checker":{"sha256":null},"armezit/m2-wfpc":{"sha256":null},"silverstripe/legacydatetimefields":{"sha256":null},"abraovic/mysql-querybuilder":{"sha256":null},"klisl/laravel-statistics":{"sha256":null},"andremyid/activitylog":{"sha256":null},"artemmelnik/laravelshoppingcart":{"sha256":null},"sanpi/assetic":{"sha256":null},"adamdburton/nanoftpd":{"sha256":null},"imxiangli/yii2-ladda":{"sha256":null},"folkevil/moloquent-menus":{"sha256":null},"bitandblack/font-loader":{"sha256":null},"reason-digital/virgin-money-giving-api":{"sha256":null},"appel/copy-notes":{"sha256":null},"coreshop/bankwire":{"sha256":null},"artpar/omnipay-payuindia":{"sha256":null},"honey-comb/translations":{"sha256":null},"uchi-pro/api-client":{"sha256":null},"twodudes/simpleorm":{"sha256":null},"keboola/ex-generic-moduleinterface":{"sha256":null},"vanquyet/yii2-banner":{"sha256":null},"k9606/kxcel":{"sha256":null},"docomoinnovations/cloud_orchestrator":{"sha256":null},"bramceulemans/php-project":{"sha256":null},"gaohua/urlscanner":{"sha256":null},"kappa/tester":{"sha256":null},"alksily/memory":{"sha256":null},"programarivm/hello-world-bundle":{"sha256":null},"marissen/magento2-module-better-order-incrementing":{"sha256":null},"batmahir/oauth2-api":{"sha256":null},"los/request-id":{"sha256":null},"voximplant/phpsdk":{"sha256":null},"kuborgh/csv-bundle":{"sha256":null},"sudeep/formparse":{"sha256":null},"hosannahighertech/yii2-oauth2-server":{"sha256":null},"madewithlove/illuminate-psr-cache-bridge":{"sha256":null},"intrepidity/healthcheck":{"sha256":null},"awang/weapp-sdk":{"sha256":null},"yb/umsdk":{"sha256":null},"gcworld/formsystem":{"sha256":null},"mhochm/laravel-jadephp":{"sha256":null},"mthaml/silex-mthaml":{"sha256":null},"spacedmonkey/built-in-taxos-cpt":{"sha256":null},"onethirtyone/repository-pattern":{"sha256":null},"doetech/diedump":{"sha256":null},"chbiel/jenkins-php-api":{"sha256":null},"wyrihaximus/react-parallel":{"sha256":null},"coreshop/menu-bundle":{"sha256":null},"openeyes/oph-le-intravitrealinjection":{"sha256":null},"maragonha/openboleto":{"sha256":null},"jimmyjs/laravel-csv":{"sha256":null},"markdegroot/omnipay-ideal":{"sha256":null},"gamringer/php-json-pointer":{"sha256":null},"simplonlua/lua-calculator-bundle":{"sha256":null},"neos/utility-objecthandling":{"sha256":null},"lightair/easycurl":{"sha256":null},"svilborg/laravel-gitlab-ci-cmd":{"sha256":null},"protos/build":{"sha256":null},"bantenprov/proposal":{"sha256":null},"stuttter/wp-term-meta":{"sha256":null},"l0wskilled/alice-bundle-odm":{"sha256":null},"johnpitcher/public-vendor":{"sha256":null},"lukewaite/laravel-queue-aws-batch":{"sha256":null},"alescx/forum":{"sha256":null},"typo3/cms-fluid-styled-content":{"sha256":null},"lunfel/october-translatable-trait":{"sha256":null},"semyonchetvertnyh/omnipay-paysera":{"sha256":null},"loborec/yii-shortcuts":{"sha256":null},"robphilp/validator":{"sha256":null}

This somehow forces Composer to look up package metadata every time it runs, for every package. While the plugin holds up and CI uses cached deps, this makes local developer updates rather painful.

• Anything else?

Running Nexus OSS 3.21.2-03 with the plugin (0.0.5 from master) loaded semi-permanently. Not seeing any errors in the server logs. This seems related to #64, since the Packagist composer.json seems to include a zipball URL and hash.

I was trying to build the DockerFile but was unable to do so because the jar file created by the intermediate container could not be copied into the final container.

I was able to resolve this issue by changing COPY instruction from:
COPY --from=build /nexus-repository-composer/target/nexus-repository-composer-${COMPOSER_VERSION}.jar ${TARGET_DIR}

into:
COPY --from=build /nexus-repository-composer/nexus-repository-composer/target/nexus-repository-composer-${COMPOSER_VERSION}.jar ${TARGET_DIR}

Composer projects contain metadata in their composer.json files (https://getcomposer.org/doc/04-schema.md). In other formats we would extract this information when proxying or hosting an artifact, and the information would be included in the format attributes and search attributes.

We are currently not extracting any of this information and should write a general-purpose extractor for this information and store the extracted information. For the proxy implementation this operation should be relatively straightforward since we will only be extracting content from the downloaded source archive rather than a .phar file (which is somewhat different from a .zip or .tar). We'll worry about handling .phar files later if we have to.

Note that this JSON is different than the provider JSON that constitutes an index for purposes of Composer.

Thanks for creating an issue! Please fill out this form so we can be
sure to have all the information we need, and to minimize back and forth.

• What are you trying to do?

Add Magento composer repository to nexus.

I get an error from composer :

[Composer\Downloader\TransportException]
  The "https://<my_domain>/repository/composer-magento/packages.json" file could not be downloaded (HTTP/1.1 503 Service Unavailable)

From nexus side :

2019-11-15 09:47:01,450+0000 INFO  [qtp1645437026-137287]  org.sonatype.nexus.repository.httpclient.internal.HttpClientFacetImpl - Repository status for composer-magento changed from READY to AUTO_BLOCKED_UNAVAILABLE until 2019-11-15T09:47:41.449Z - reason Unauthorized for https://repo.magento.com
2019-11-15 09:47:01,452+0000 WARN  [qtp1645437026-137287]  org.sonatype.nexus.repository.composer.internal.ComposerProxyFacetImpl - Exception org.sonatype.nexus.repository.proxy.ProxyServiceException: HTTP/1.1 401 Unauthorized checking remote for update, proxy repo composer-magento failed to fetch packages.json with status line HTTP/1.1 401 Unauthorized, content not in cache.

• What feature or behavior is this required for?

Mutualize repository and access to modules.

• How could we solve this issue? (Not knowing is okay!)

Don't know

• Anything else?

• What are you trying to do?
  Currently, only the package version is part of the path name. The actual reference hash is not. This causes issues if the version is rewritten (can, but should not happen) or if a branch is used (not that uncommon for development packages, especially internal ones)

• What feature or behavior is this required for?
  Download the exact version that is required from the composer.lock as referenced by the hash, not the package version

• How could we solve this issue? (Not knowing is okay!)
  Rewrite all URLs so that the reference hash is used instead of the package version.
  For example, if I require elendev/nexus-composer-push from packagist, the download url is <github-url>/repos/Elendev/nexus-composer-push/zipball/9dc7d473eb0f28adb5caf829575b90d3010a59af.
  While the same requirement using this plugin currently yields <repository-url>/elendev/nexus-composer-push/0.1.3/elendev-nexus-composer-push-0.1.3.zip

There is currently no implementation for Composer hosted. We should determine the best way to implement this in a way that makes sense for the Nexus Repository Manager and user expectations.

For Composer a typical expectation is that the index is exactly that, and there are links to Git repositories that store the actual content (for example, the way Packagist works). This is a reasonable assumption for proxy but is insufficient for hosted since the actual artifacts are not being hosted by the repository manager in such a scenario (see the Bower implementation for confusion regarding this very issue).

A strawman proposal:

• Have a way to upload a .phar, .tar., or .zip file to an endpoint in a hosted repository. Store that as the actual "artifact". (Note that we should investigate how useful storing .phar archives will be in this case relative to the additional complexity.)
• Extract the metadata to figure out where the file goes in terms of the overall list of packages/structure.

If anyone from the greater community has feedback or suggestions, we're listening.

Hello there!
During the last couple of days I encountered the Problem that the package.json (e.g. /p/symfony/symfony.json in the composer-proxy is different from the one available in composer-group.

We are missing a couple of keys. The ones we are struggling at the moment are especially include-path and replace. But according to the schema.json we are still lacking a couple more. I tried to update the ComposerJsonProcessor in my branch kununu#2 in the hope to fix it "quickly". But sadly that seem to not have any effect. Maybe I did something wrong or misunderstood how it works?

Help would be appreciated 🙂

• What are you trying to do?
  Sending a DELETE request instead of an PUT request to delete the previously created artifact

• What feature or behavior is this required for?
  Remove artifacts that are no longer required and should no longer be available to download

• How could we solve this issue?

  • Adding a route for the DELETE request, supporting the same url as the PUT request
  • Delete the artifact that would have been created if it where a PUT request
  • Update package.json so requesting it leads to an error

We currently have no unit tests for this project (an unfortunate result of being done effectively overnight as a proof of concept). We should add tests for proxy before we proceed much further, otherwise we have no safety in terms of guarding against regressions.

• Unit tests can be added to improve some of the coverage, but won't be particularly helpful in testing the entire plugin end-to-end.
• Integration tests are somewhat of a challenge as our integration test infrastructure is part of the private testsuite and cannot be reused in a public plugin. Perhaps we can come up with an alternative or perhaps one of our other test frameworks developed for per-format testing can somehow be used here instead. (If we can't do this, we can break this out as a separate issue and tackle it independently.)

This may be the sort of task that's more suited for someone internal to Sonatype given our experience with our testing patterns.

Thanks for creating an issue! Please fill out this form so we can be
sure to have all the information we need, and to minimize back and forth.

• What are you trying to do?

I'd like to allow a user only to read and browse certain versions of a package (version 1.0.* and 2.*).
I created the following content selector and a privilege on the composer repository with "browse,read" actions.

format == "composer" and path =~ "^vendor/package/(1\.0\..*|2\..*)"

The preview on the content selector shows me the correct packages.
When I log into the user with that privilege, he can access the composer repository in the Browse view but it does not show any packages.

I haven't tried reading the package via Composer yet, will try.

• What feature or behavior is this required for?

Access control to packages

• How could we solve this issue? (Not knowing is okay!)

No idea, as I don't know how Nexus plugins work.

• Anything else?

I'm currently running Nexus 3.24.0-02 with the latest master of this repository (0d1eb84).
Before I was running with Nexus 3.20 (and commit 6727417 of this repository) - it also didn't work there.

Hi, Thanks a lot for this great package.
I've just figured out that I have the same issue that mentioned here:
#17
I've updated my Nexus to version 3.18.1 from version 3.11.0, but on both versions I had the same issues with autoload and require in composer.lock.
I see You mentioned that You solved this here :
#18
But even having last version of Nexus it haven't solved this issue.
Thanks.

• What are you trying to do?

Build the project from the master branch.

• What feature or behavior is this required for?

To get the .jar binaries of the project!

• How could we solve this issue? (Not knowing is okay!)

Fix Maven project dependencies.

• Anything else?

Here is my maven stdout:

[INFO] Scanning for projects...
Downloading from rso-snapshots: https://repository.sonatype.org/content/repositories/snapshots/org/sonatype/nexus/plugins/nexus-plugins/3.19.1-01/nexus-plugins-3.19.1-01.pom
Downloading from central: https://repo.maven.apache.org/maven2/org/sonatype/nexus/plugins/nexus-plugins/3.19.1-01/nexus-plugins-3.19.1-01.pom
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.sonatype.nexus.plugins:composer-parent:0.0.2: Could not transfer artifact org.sonatype.nexus.plugins:nexus-plugins:pom:3.19.1-01 from/to rso-snapshots (https://repository.sonatype.org/content/repositories/snapshots): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target and 'parent.relativePath' points at wrong local POM @ line 14, column 11
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project org.sonatype.nexus.plugins:composer-parent:0.0.2 (/tmp/nexus-repository-composer/pom.xml) has 1 error
[ERROR]     Non-resolvable parent POM for org.sonatype.nexus.plugins:composer-parent:0.0.2: Could not transfer artifact org.sonatype.nexus.plugins:nexus-plugins:pom:3.19.1-01 from/to rso-snapshots (https://repository.sonatype.org/content/repositories/snapshots): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target and 'parent.relativePath' points at wrong local POM @ line 14, column 11 -> [Help 2]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException

@jlstephens89 has developed an integration test framework suitable for use in open source projects that are not part of the main codebase for Nexus Repository Manager.

We should write some basic integration tests for proxy, hosted, and group using the framework, particularly to guard against regressions now that the final form is starting to take shape.

I'm trying to use this repo on a docker file and make different release for different version of nexus.
It's too important to have release tag. because I could fetch the specific tag and build that.

Please use semantic versioning

• What are you trying to do?
  I've uploaded a ZIP archive using composer archive --format=zip then curl -v --user '...' --upload-file ... as documented here: https://github.com/sonatype-nexus-community/nexus-repository-composer/blob/master/docs/COMPOSER_USER_DOCUMENTATION.md#user-content-publishing-composer-packages

The issue is that my package has dependencies listed in the require part of its composer.json file. Those dependencies are not present in the plugin's generated JSON.
The consequence is that I can't require my module in an other project without having to explicitly require all of its dependencies.

• What feature or behavior is this required for?
  Having private hosted packages.

• How could we solve this issue? (Not knowing is okay!)
  I think we just have to add the require part of the archive's composer.json file into the generated json.

• Anything else?
  Nope, thank you for your work !

ComposerProxyFacetImpl has at least one TODO entry regarding more robust logging/error-handling when the list.json is mapped into a list of packages suitable for Composer.

We should clean that up, and while doing so, evaluate the rest of the implementation to see if there is other outstanding technical debt carried over from the proof-of-concept.

• What are you trying to do?
  I am trying to use the current 0.0.2 with Nexus OSS >3.19.0-01.

• What feature or behavior is this required for?
  Using your plugin with an up-to-date version of Nexus OSS.

• How could we solve this issue? (Not knowing is okay!)
  I think, that the dependency for jline got unpublished somehow. I could not find the place in the diff between 3.18.01-01 and 3.19.0-01 though.

• Anything else?
  The error message during the docker build is the following:

Downloaded from rso-public-grid: https://repository.sonatype.org/content/groups/sonatype-public-grid/org/codehaus/groovy/groovy-eclipse-batch/2.4.3-01/groovy-eclipse-batch-2.4.3-01.jar (15 MB at 7.4 MB/s)
[INFO] Changes detected - recompiling the module!
[INFO] Using Groovy-Eclipse compiler to compile both Java and Groovy files
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR : 
[INFO] -------------------------------------------------------------
[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java:[35,15] 1. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java (at line 35)
	import static jline.internal.Preconditions.checkNotNull;
	              ^^^^^
The import jline cannot be resolved

[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java:[56,21] 2. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java (at line 56)
	this.eventManager = checkNotNull(eventManager);
	                    ^^^^^^^^^^^^
The method checkNotNull(EventManager) is undefined for the type ComposerHostedMetadataFacetImpl

[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java:[32,15] 3. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java (at line 32)
	import static jline.internal.Preconditions.checkNotNull;
	              ^^^^^
The import jline cannot be resolved

[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java:[111,30] 4. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java (at line 111)
	this.composerJsonExtractor = checkNotNull(composerJsonExtractor);
	                             ^^^^^^^^^^^^
The method checkNotNull(ComposerJsonExtractor) is undefined for the type ComposerFormatAttributesExtractor

[ERROR] Found 4 errors and 0 warnings.
[INFO] 5 errors 
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  06:45 min
[INFO] Finished at: 2019-10-10T12:02:36Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.3:compile (default-compile) on project nexus-repository-composer: Compilation failure: Compilation failure: 
[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java:[35,15] 1. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java (at line 35)
[ERROR] 	import static jline.internal.Preconditions.checkNotNull;
[ERROR] 	              ^^^^^
[ERROR] The import jline cannot be resolved
[ERROR] 
[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java:[56,21] 2. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerHostedMetadataFacetImpl.java (at line 56)
[ERROR] 	this.eventManager = checkNotNull(eventManager);
[ERROR] 	                    ^^^^^^^^^^^^
[ERROR] The method checkNotNull(EventManager) is undefined for the type ComposerHostedMetadataFacetImpl
[ERROR] 
[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java:[32,15] 3. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java (at line 32)
[ERROR] 	import static jline.internal.Preconditions.checkNotNull;
[ERROR] 	              ^^^^^
[ERROR] The import jline cannot be resolved
[ERROR] 
[ERROR] /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java:[111,30] 4. ERROR in /nexus-repository-composer/src/main/java/org/sonatype/nexus/repository/composer/internal/ComposerFormatAttributesExtractor.java (at line 111)
[ERROR] 	this.composerJsonExtractor = checkNotNull(composerJsonExtractor);
[ERROR] 	                             ^^^^^^^^^^^^
[ERROR] The method checkNotNull(ComposerJsonExtractor) is undefined for the type ComposerFormatAttributesExtractor
[ERROR] 
[ERROR] Found 4 errors and 0 warnings.
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
The command '/bin/sh -c cd /nexus-repository-composer/; sed -i "s/3.13.0-01/${NEXUS_VERSION}-${NEXUS_BUILD}/g" pom.xml;     mvn clean package;' returned a non-zero code: 1

I have attached the Dockerfile to reproduce this issue (Dockerfile-broken.zip) and the last known working version (Dockerfile-last-known-working.zip).
Dockerfile-broken.zip

Dockerfile-last-known-working.zip

Hi.
Any chance that plugin works with Sonatype Nexus 3.19.1-01?

I use nexus-repository-composer-0.0.2.jar at https://hub.docker.com/r/sonatype/nexus3 docker images .
I config composer-proxy find this exception.

java.lang.NullPointerException: null
at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:882)
at org.sonatype.nexus.repository.composer.internal.ComposerProxyFacetImpl.generatePackagesJson(ComposerProxyFacetImpl.java:164)
at org.sonatype.nexus.repository.composer.internal.ComposerProxyFacetImpl.store(ComposerProxyFacetImpl.java:106)
at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.doGet(ProxyFacetSupport.java:263)
at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.lambda$1(ProxyFacetSupport.java:237)
at org.sonatype.nexus.common.io.CooperatingFuture.performCall(CooperatingFuture.java:122)
at org.sonatype.nexus.common.io.CooperatingFuture.call(CooperatingFuture.java:64)
at org.sonatype.nexus.common.io.ScopedCooperationFactorySupport$ScopedCooperation.cooperate(ScopedCooperationFactorySupport.java:99)
at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.get(ProxyFacetSupport.java:228)
at org.sonatype.nexus.repository.proxy.ProxyHandler.handle(ProxyHandler.java:50)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at org.sonatype.nexus.repository.storage.UnitOfWorkHandler.handle(UnitOfWorkHandler.java:39)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at org.sonatype.nexus.repository.view.handlers.ContentHeadersHandler.handle(ContentHeadersHandler.java:45)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at org.sonatype.nexus.repository.http.PartialFetchHandler.handle(PartialFetchHandler.java:59)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at org.sonatype.nexus.repository.view.handlers.ConditionalRequestHandler.handle(ConditionalRequestHandler.java:72)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at org.sonatype.nexus.repository.cache.NegativeCacheHandler.handle(NegativeCacheHandler.java:56)
at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
at com.sonatype.nexus.clm.internal.FirewallContributedHandler.handle(FirewallContributedHandler.java:87)

Perhaps create an Issue in this project to track adding a "-SNAPSHOT" suffix to versioning (as was done in another project).

Originally posted by @bhamail in #47

referencing:
FWIW, I'd like to encourage we start using a "-SNAPSHOT" suffix on the version numbers. (I've updated the nexus-format-archetype to do this).
The ORB we use for releasing will handle versions like 0.0.1-SNAPSHOT. One downside is you have to remember to manually bump the version to the next development SNAPSHOT after doing a release.

Originally posted by @bhamail in sonatype-nexus-community/nexus-repository-apk#1

Hello, I'm trying to use the composer plugin through a reverse proxy.
The packages.json file contains option "providers-url":"http://localhost:8081/nexus/repository/composer-packagist/p/%package%.json"
But the providers-url must contain address a proxy server.

Hi，I install Sonatype Nexus Repository ManagerOSS 3.22.1-02 throw docker command list as follow：
docker exec -it nexus-repository-composer /bin/bash

Then create a proxy repository for packagist, But I found that I cannot require another version of the same component.
The kar version I used is 0.0.4

My proxy repository setting is as follow:
name:composer-central
format:composer
type:proxy
Location of the remote repository being proxied:
https://packagist.org/
"Auto-block outbound connections on the repository if remote peer is detected as unreachable/unresponsive " is ticked
"How long (in minutes) to cache artifacts before rechecking the remote repository. Release repositories should use -1." is set -1
"How long (in minutes) to cache metadata before rechecking the remote repository" is set -1
"How long to cache the fact that a file was not found in the repository (in minutes)" is set 0

My operation steps is as follows:
composer require andler_yangming/composer_test:v0.0.7
Component is successfully installed.

then I execute command as follow to require another version
composer require andler_yangming/composer_test:v0.0.8

But I got following response

[InvalidArgumentException]
Could not find package andler_yangming/composer_test in a version matching v0.0.8

The new version 0.0.8 cannot be imported unless I click "invalid cache" in repository management page
Is there a bug in the nexus-repository-composer plugin or my configuration is wrong？
Thank you very much.

Sorry for deleting the issue template but this is not a bug nor feature request report. It has to do with the status of the plug-in.

Are there any discussions going on with the core team for this plug-in to integrate the official list of release packaged plug ins ? And if yes do you have any idea when ?

Thanks in advance for your response.

Hey everybody!

I'm not sure if it is related with me experimenting with #14 or if it was already part of #12. But it just happened that when I'm trying to call the packages.json of the composer-hosted repository I receive a 500.

The only other thing I did other than upgrading to #14, was publishing a couple more packages to the repository. It also happened, that I published some packages multiple times with the same version, expecting the initial version to be overwritten. Maybe that is causing the duplicate key violation?

In the meanwhile I reverted to latest master and the issue still persists.

Stacktrace:

2018-04-12 08:01:28,375+0000 WARN  [qtp1963253024-61] stefan.schacherl org.sonatype.nexus.repository.httpbridge.internal.ViewServlet - Failure servicing: GET /repository/composer-hosted/packages.json
java.lang.IllegalStateException: Duplicate key {sha256=null}
	at java.util.stream.Collectors.lambda$throwingMerger$0(Collectors.java:133)
	at java.util.HashMap.merge(HashMap.java:1254)
	at java.util.stream.Collectors.lambda$toMap$58(Collectors.java:1320)
	at java.util.stream.ReduceOps$3ReducingSink.accept(ReduceOps.java:169)
	at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382)
	at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
	at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
	at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708)
	at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499)
	at org.sonatype.nexus.repository.composer.internal.ComposerJsonProcessor.buildPackagesJson(ComposerJsonProcessor.java:121)
	at org.sonatype.nexus.repository.composer.internal.ComposerJsonProcessor.generatePackagesFromComponents(ComposerJsonProcessor.java:110)
	at org.sonatype.nexus.repository.composer.internal.ComposerHostedFacetImpl.getPackagesJson(ComposerHostedFacetImpl.java:65)
	at org.sonatype.nexus.transaction.TransactionalWrapper.proceedWithTransaction(TransactionalWrapper.java:56)
	at org.sonatype.nexus.transaction.TransactionInterceptor.invoke(TransactionInterceptor.java:54)
	at org.sonatype.nexus.repository.composer.internal.ComposerHostedDownloadHandler.handle(ComposerHostedDownloadHandler.java:47)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.storage.UnitOfWorkHandler.handle(UnitOfWorkHandler.java:39)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ContentHeadersHandler.handle(ContentHeadersHandler.java:44)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.http.PartialFetchHandler.handle(PartialFetchHandler.java:55)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ConditionalRequestHandler.handle(ConditionalRequestHandler.java:72)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.assetdownloadcount.internal.AssetDownloadCountContributedHandler.handle(AssetDownloadCountContributedHandler.java:53)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.HandlerContributor.handle(HandlerContributor.java:67)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ExceptionHandler.handle(ExceptionHandler.java:44)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.security.SecurityHandler.handle(SecurityHandler.java:52)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context$proceed.call(Unknown Source)
	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:113)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:117)
	at org.sonatype.nexus.repository.composer.internal.ComposerRecipeSupport$_closure1.doCall(ComposerRecipeSupport.groovy:110)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:93)
	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325)
	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:294)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1022)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1087)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1022)
	at groovy.lang.Closure.call(Closure.java:414)
	at org.codehaus.groovy.runtime.ConvertedClosure.invokeCustom(ConvertedClosure.java:54)
	at org.codehaus.groovy.runtime.ConversionHandler.invoke(ConversionHandler.java:124)
	at com.sun.proxy.$Proxy157.handle(Unknown Source)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.TimingHandler.handle(TimingHandler.java:46)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context.start(Context.java:114)
	at org.sonatype.nexus.repository.view.Router.dispatch(Router.java:63)
	at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:52)
	at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:43)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.dispatchAndSend(ViewServlet.java:211)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.doService(ViewServlet.java:173)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.service(ViewServlet.java:126)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
	at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:286)
	at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:276)
	at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:181)
	at com.google.inject.servlet.DynamicServletPipeline.service(DynamicServletPipeline.java:71)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:112)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
	at org.sonatype.nexus.security.SecurityFilter.executeChain(SecurityFilter.java:85)
	at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
	at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
	at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
	at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
	at org.sonatype.nexus.security.SecurityFilter.doFilterInternal(SecurityFilter.java:101)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.repository.httpbridge.internal.ExhaustRequestFilter.doFilter(ExhaustRequestFilter.java:71)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.sonatype.nexus.licensing.internal.LicensingRedirectFilter.doFilter(LicensingRedirectFilter.java:108)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:97)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:68)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.EnvironmentFilter.doFilter(EnvironmentFilter.java:102)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.HeaderPatternFilter.doFilter(HeaderPatternFilter.java:98)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.google.inject.servlet.DynamicFilterPipeline.dispatch(DynamicFilterPipeline.java:104)
	at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135)
	at org.sonatype.nexus.bootstrap.osgi.DelegatingFilter.doFilter(DelegatingFilter.java:73)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1629)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:175)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:530)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:347)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:256)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:382)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:708)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:626)
	at java.lang.Thread.run(Thread.java:748)

What are you trying to do?
I am trying to proxy the private repo https://updates.ez.no/ttl

https://updates.ez.no/ttl/packages.json

{
    "packages": [],
    "includes": {
        "include/all$b48dd9ea8d0e45a2d2032c902f86ffbefd2fad9c.json": {
            "sha1": "b48dd9ea8d0e45a2d2032c902f86ffbefd2fad9c"
        }
    }
}

What feature or behavior is this required for?
proxy a private composer repo

How could we solve this issue? (Not knowing is okay!)
Do not know.

Anything else?
Yes .. Packagist works for me. It looks like that is a problem with repositories with http auth. Maybe the error is not with http auth maybe it is related to the json formatting and the keyword "includes"

I can provide the username and password if needed.

Also I had configured a group repository including this private one. When accessing the group one i show this error in the logs

2018-08-15 01:00:48,704+0000 INFO  [qtp1870042037-220]  admin org.sonatype.nexus.repository.httpclient.internal.HttpClientFacetImpl - Repository status for ezsystems-bul changed from READY to AVAILABLE - reason n/a for n/a
2018-08-15 01:00:49,094+0000 WARN  [qtp1870042037-220]  admin org.sonatype.nexus.repository.httpbridge.internal.ViewServlet - Failure servicing: GET /repository/composer-all/packages.json
java.lang.NullPointerException: null
	at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:882)
	at org.sonatype.nexus.repository.composer.internal.ComposerProxyFacetImpl.generatePackagesJson(ComposerProxyFacetImpl.java:164)
	at org.sonatype.nexus.repository.composer.internal.ComposerProxyFacetImpl.store(ComposerProxyFacetImpl.java:106)
	at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.doGet(ProxyFacetSupport.java:222)
	at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.lambda$1(ProxyFacetSupport.java:209)
	at org.sonatype.nexus.repository.proxy.Cooperation$CooperatingFuture.download(Cooperation.java:262)
	at org.sonatype.nexus.repository.proxy.Cooperation.download(Cooperation.java:194)
	at org.sonatype.nexus.repository.proxy.Cooperation.cooperate(Cooperation.java:93)
	at org.sonatype.nexus.repository.proxy.ProxyFacetSupport.get(ProxyFacetSupport.java:201)
	at org.sonatype.nexus.repository.proxy.ProxyHandler.handle(ProxyHandler.java:49)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.storage.UnitOfWorkHandler.handle(UnitOfWorkHandler.java:39)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ContentHeadersHandler.handle(ContentHeadersHandler.java:44)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.http.PartialFetchHandler.handle(PartialFetchHandler.java:59)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ConditionalRequestHandler.handle(ConditionalRequestHandler.java:72)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.cache.NegativeCacheHandler.handle(NegativeCacheHandler.java:56)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.assetdownloadcount.internal.AssetDownloadCountContributedHandler.handle(AssetDownloadCountContributedHandler.java:53)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at com.sonatype.nexus.clm.internal.QuarantineContributedHandler.handle(QuarantineContributedHandler.java:69)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.HandlerContributor.handle(HandlerContributor.java:67)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ExceptionHandler.handle(ExceptionHandler.java:44)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.security.SecurityHandler.handle(SecurityHandler.java:52)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context$proceed$0.call(Unknown Source)
	at org.sonatype.nexus.repository.composer.internal.ComposerRecipeSupport$_closure1.doCall(ComposerRecipeSupport.groovy:110)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98)
	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325)
	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:264)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1099)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034)
	at groovy.lang.Closure.call(Closure.java:418)
	at org.codehaus.groovy.runtime.ConvertedClosure.invokeCustom(ConvertedClosure.java:54)
	at org.codehaus.groovy.runtime.ConversionHandler.invoke(ConversionHandler.java:124)
	at com.sun.proxy.$Proxy229.handle(Unknown Source)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.TimingHandler.handle(TimingHandler.java:46)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context.start(Context.java:114)
	at org.sonatype.nexus.repository.view.Router.dispatch(Router.java:64)
	at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:52)
	at org.sonatype.nexus.repository.group.GroupHandler.getAll(GroupHandler.java:181)
	at org.sonatype.nexus.repository.group.GroupHandler.getAll(GroupHandler.java:149)
	at org.sonatype.nexus.repository.composer.internal.ComposerGroupMergingHandler.doGet(ComposerGroupMergingHandler.java:52)
	at org.sonatype.nexus.repository.group.GroupHandler.handle(GroupHandler.java:93)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.assetdownloadcount.internal.AssetDownloadCountContributedHandler.handle(AssetDownloadCountContributedHandler.java:53)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at com.sonatype.nexus.clm.internal.QuarantineContributedHandler.handle(QuarantineContributedHandler.java:69)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.HandlerContributor.handle(HandlerContributor.java:67)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.ExceptionHandler.handle(ExceptionHandler.java:44)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.security.SecurityHandler.handle(SecurityHandler.java:52)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context$proceed$0.call(Unknown Source)
	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:47)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:116)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:120)
	at org.sonatype.nexus.repository.composer.internal.ComposerRecipeSupport$_closure1.doCall(ComposerRecipeSupport.groovy:110)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98)
	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325)
	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:264)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1099)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034)
	at groovy.lang.Closure.call(Closure.java:418)
	at org.codehaus.groovy.runtime.ConvertedClosure.invokeCustom(ConvertedClosure.java:54)
	at org.codehaus.groovy.runtime.ConversionHandler.invoke(ConversionHandler.java:124)
	at com.sun.proxy.$Proxy229.handle(Unknown Source)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.handlers.TimingHandler.handle(TimingHandler.java:46)
	at org.sonatype.nexus.repository.view.Context.proceed(Context.java:80)
	at org.sonatype.nexus.repository.view.Context.start(Context.java:114)
	at org.sonatype.nexus.repository.view.Router.dispatch(Router.java:64)
	at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:52)
	at org.sonatype.nexus.repository.view.ConfigurableViewFacet.dispatch(ConfigurableViewFacet.java:43)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.dispatchAndSend(ViewServlet.java:210)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.doService(ViewServlet.java:172)
	at org.sonatype.nexus.repository.httpbridge.internal.ViewServlet.service(ViewServlet.java:126)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
	at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:286)
	at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:276)
	at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:181)
	at com.google.inject.servlet.DynamicServletPipeline.service(DynamicServletPipeline.java:71)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:112)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:118)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
	at org.sonatype.nexus.security.SecurityFilter.executeChain(SecurityFilter.java:85)
	at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
	at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
	at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
	at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
	at org.sonatype.nexus.security.SecurityFilter.doFilterInternal(SecurityFilter.java:101)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.repository.httpbridge.internal.ExhaustRequestFilter.doFilter(ExhaustRequestFilter.java:80)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.sonatype.nexus.licensing.internal.LicensingRedirectFilter.doFilter(LicensingRedirectFilter.java:108)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:97)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:68)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.EnvironmentFilter.doFilter(EnvironmentFilter.java:101)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at org.sonatype.nexus.internal.web.HeaderPatternFilter.doFilter(HeaderPatternFilter.java:98)
	at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
	at com.google.inject.servlet.DynamicFilterPipeline.dispatch(DynamicFilterPipeline.java:104)
	at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:135)
	at org.sonatype.nexus.bootstrap.osgi.DelegatingFilter.doFilter(DelegatingFilter.java:73)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1634)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1317)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1219)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:175)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:531)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680)
	at java.lang.Thread.run(Thread.java:748)

Thanks for creating an issue! Please fill out this form so we can be
sure to have all the information we need, and to minimize back and forth.

• What are you trying to do?
  We created a composer repository to store our release packages, so we disable redeploy on it to prevent overwrite the previous release.

• What feature or behavior is this required for?
  New release page could be uploaded and the json in "p" directory should be updated. However, only the first version in the json file.

• How could we solve this issue? (Not knowing is okay!)

• Anything else?

The proof-of-concept implementation assumes that all dist urls point to a Github repository. Packagist also supports Bitbucket as a first class citizen via webhooks (https://packagist.org/about) so we should likely support that as a minimum before calling this "done."

Supporting Bitbucket would also match existing user expectations from similar formats (e.g. for Bower, which has a similar index mechanism that also points to Git repositories, we consider Github and Bitbucket support to meet our internal "definition of done" for that format).

If you're a Sonatype employee, consult the Bower implementation for ideas on how to do this. If you're not but you want to work on this, feel free to ping us for ideas on where to get started on this issue.

• What are you trying to do?
  Download the .kar file from The Central Repository as suggested by Easiest Install - Option 2.

• What feature or behavior is this required for?
  Setting up a containerized Nexus instance with the nexus-repository-composer plugin without having to compile it from source.

• How could we solve this issue? (Not knowing is okay!)
  Have a .kar file in the repository alongside the .jar, sources.jar, etc.
  or
  Have more detailed instructions how to get a .kar file from there if it is already possible