Updating Kickstart within corporate firewall

[pandatrooper]

I'm looking for a solution that would help me upgrade my Kickstart developer portal without the use of composer.

Since we have strict corporate firewall that does not allow us to fetch dependencies from repositories outside the organisation, therefore I was looking for a solution which does not involve fetching various dependencies using composer. A solution exists from Drupal wherein I can updated the Drupal version manually. However, no such solution exists when it comes to Kickstart.

I considered a solution wherein composer can use the compay's protected repository for fetching the dependencies. However, since Drupal uses its own repository rather than packagist, so we had to abandon the plan as we could not find the Drupal's repos to fetch the files manually.

Please advice.

[cnovak]

I was going to suggest doing the composer commands from a local machine so that your prod environment does not have to reach the Internet, but it sounds like the whole company is locked down.

The Drupal.org packages are located at https://packages.drupal.org/8 from this page explaining Composer in Drupal, but I do not know anything about pulling external dependencies from Drupal.org into a private Composer repo.

[pandatrooper]

Thank Chris for the information ! Yes, none of our machines have the freedom to fetch dependencies from external sources be it directly or via a proxy. We managed to punch some holes in our firewall for the very initial setup using composer. However, that was a one time activity. Usually for dependencies like maven, npm etc. , we either download or mirror the relevant repos to an internal server after the stringent security approvals.

Therefore, we were hoping that the kickstart team could provide us the additional static files like that of Drupal.

[cnovak]

You are welcome. The static files should be available to mirror since they will be in Drupal's package repository or in packagist.org, we do not have any other repository of the dependencies. Is there any missing from those repos?

[gosunilgo]

@pandatrooper - Commenting on old PR, are do you have artifactory? sonatype-nexus? Packagist proxying via artifactory works great!

https://www.jfrog.com/confluence/display/JFROG/PHP+Composer+Repositories