I've updated the composer plugin with new commands options:

            ->addOption('only-repo', 'r', InputOption::VALUE_NONE, 'Generate only the repository, without the manifest file "packages.json".')
            ->addOption('only-manifest', 'm', InputOption::VALUE_NONE, 'Generate only the manifest "packages.json", without the repository.')
            ->addOption('only-print-manifest', 'p', InputOption::VALUE_NONE, 'Print the manifest for a given arbitrary repository directory.');

The package installation procedure is now reduced to:

    # Remove "packages-dev" entries
    jq '."packages-dev" = []' composer.lock > newComposer.lock
    mv newComposer.lock composer.lock
    # Remove "require-dev" dependencies
    jq '."require-dev" = {}' composer.json > newComposer.json
    mv newComposer.json composer.json

    mkdir -p .repo

    # Create the manifest for the local repository
    COMPOSER_PROCESS_TIMEOUT=0 \
    COMPOSER_CACHE_DIR=/dev/null \
    COMPOSER_HOME="${composerVendorCache}/.composer" \
    composer --no-ansi build-local-repo -p $composerVendorCache > .repo/packages.json

    # Configure composer to use the local repository
    composer config repo.packagist false
    composer config repo.composer '{"type": "composer", "url": "file://'"$PWD"'/.repo/packages.json"}'

    # Merge the composer overrides to avoid randomly generated class names
    jq '. * input' "composer.json" "${composerOverrides}/composer.override.json" > newComposer.json
    mv newComposer.json composer.json

    echo "Finished composerInstallConfigureHook"

In reply to @drupol:matrix.org
So today I'm going to test stuff and see how we can get rid of that composer update command before the install. If you have any clue, please let me know.

In reply to @drupol:matrix.org
The fix has been committed to drupol/composer-local-repo-plugin: https://github.com/drupol/composer-local-repo-plugin/commit/9e1144ba0f3e98442bbfc955edd148be281c4148 and in the PR: https://github.com/NixOS/nixpkgs/compare/58fed5f92032c4e51286d08a76d9d2bab5443ecb..2d49300918ee738fa8f2e9d086647539493bb879

In reply to @drupol:matrix.org
Basically, the idea is that Composer is able to download a package from dist or source attribute (see relevant part of the code https://github.com/composer/composer/blob/main/src/Composer/Downloader/DownloadManager.php#L143). In fossar/composition-c4, we only handle source. I guess it would not be complicated to fix this. I just don't have enough knowledge in Nix to do it... I'm still trying :D

I am only providing a single variant since otherwise fetchComposerDeps would have to store both, possibly doubling+ the output size.

I can only use source in composition-c4 because builtins.fetchGit works without an output hash, whereas builtins.fetchTarball would require it even without restricted evaluation mode. It is not a problem for you since you use FOD so you are already specifying the output hash.

In reply to @jtojnar:matrix.org
I do not see the motivation for https://github.com/drupol/composer-local-repo-plugin/commit/9e1144ba0f3e98442bbfc955edd148be281c4148