Configure Push Credentials

Upload artifact files to the Composer Artifact Registry via the cnb REST API. For how to obtain CNB_TOKEN, refer to Creating an Access Token.

Configure .netrc to Automatically Load Push Credentials When Using curl Commands

echo -e "\nmachine composer.cnb.cool\nlogin cnb\npassword <CNB_TOKEN>" >> ~/.netrc

Or Directly Specify Push Credentials in the curl Command

curl -ucnb:<CNB_TOKEN> https://composer.cnb.cool/xxx... -T <PATH_TO_FILE>

Configure Pull Credentials

1. Add the Artifact Registry address to the global config.json (usually located at ~/.composer/config.json). For how to obtain CNB_COMPOSER_URL, refer to Obtaining the Artifact Registry Address.

# Disable the default official source
composer config repos.packgist false -g
# Use cnb source
composer config repos.cnb composer <CNB_COMPOSER_URL> -g

2. Add credentials to the global auth.json (usually located at ~/.composer/auth.json).

composer config http-basic.composer.cnb.cool cnb <CNB_TOKEN> -g

Push Artifacts

Local Command Line Push

1. Paste the following content into composer.json to avoid packaging authentication information and dependencies.

{
    "archive": {
        "exclude": ["auth.json", "composer.lock", "vendor"]
    }
}

2. Navigate to the package directory and package the Composer artifact.

composer archive -f zip --file package

3. Publish to CNB.

Note:

1. For how to obtain CNB_COMPOSER_URL, refer to Obtaining the Artifact Registry Address.
2. <vendor>/<package>/<version> should be replaced with the corresponding values for the current package, e.g., monolog/monolog/3.8.1.

curl --netrc "<CNB_COMPOSER_URL>upload/<vendor>/<package>/<version>" -T package.zip

Push in Cloud Native Build

1. Paste the following content into .cnb.yaml.

Note:

1. Replace CNB_COMPOSER_URL. For how to obtain it, refer to Obtaining the Artifact Registry Address.
2. <vendor>/<package> should be replaced with the corresponding values for the current package, e.g., monolog/monolog.

$:
  tag_push:
    - docker:
        image: docker.cnb.cool/examples/language/php-8.4
      stages:
        - name: Configure Authentication Credentials
          script: echo -e "machine composer.cnb.cool\nlogin cnb\npassword ${CNB_TOKEN}" > ~/.netrc
        - name: Package Composer Artifact
          script: composer archive -f zip --file package
        - name: Publish to CNB
          script: curl --netrc -T package.zip "<CNB_COMPOSER_URL>upload/<vendor>/<package>/${CNB_BRANCH}"

2. Paste the following content into composer.json to avoid packaging authentication information and dependencies.

{
    "archive": {
        "exclude": ["auth.json", "composer.lock", "vendor"]
    }
}

3. Submit a Tag to trigger Cloud Native Build. Note: The Tag value will be used as the artifact version number. Please use Semantic Versioning.

Push in Cloud Native Development

1. Paste the following content into composer.json to avoid packaging authentication information and dependencies.

{
    "archive": {
        "exclude": ["auth.json", "composer.lock", "vendor"]
    }
}

2. Paste the following content into .cnb.yaml. After submitting to the code repository, click the "Cloud Native Development" button in the upper right corner of the code repository page to enter the development environment.

$:
  vscode:
    - docker:
        image: docker.cnb.cool/examples/language/php-8.4
      services:
        - vscode
        - docker

3. After entering the development environment, execute the following command in the command line to configure authentication credentials.

echo -e "machine composer.cnb.cool\nlogin cnb\npassword ${CNB_TOKEN}" > ~/.netrc

4. Package the Composer artifact.

composer archive -f zip --file package

5. Publish to CNB.

Note:

1. For how to obtain CNB_COMPOSER_URL, refer to Obtaining the Artifact Registry Address.
2. <vendor>/<package>/<version> should be replaced with the corresponding values for the current package, e.g., monolog/monolog/3.8.1.

curl --netrc -T package.zip "<CNB_COMPOSER_URL>upload/<vendor>/<package>/<version>"

Use Artifacts

Pull Artifacts

After configuring credentials as described in Configure Pull Credentials, use the following command to pull artifacts.

# Example with monolog/monolog
composer require monolog/monolog

Delete Artifacts

Composer does not provide a delete command. Refer to Deleting an Artifact Registry.

FAQ

Q1: Upload Artifact Error - No Permission

Example:

curl --netrc <CNB_COMPOSER_URL>upload/monolog/monolog/3.8.0 -T monolog.zip
{"errcode":16,"errmsg":"not authorized"}

Solution:

Refer to Creating an Access Token and Configure Push Credentials to correctly configure credentials.

Q2: Upload Artifact Error - Invalid Version Format

Example:

curl --netrc <CNB_COMPOSER_URL>upload/monolog/monolog/xxx3.8.0 -T monolog.zip
{"errcode":3,"errmsg":"validate [Version:xxx3.8.0] failed"}

Solution:

Use Semantic Versioning.

Q3: About Composer 1.x

The official source stopped supporting Composer 1.x on August 1, 2025.

The cnb Composer Artifact Registry also recommends using Composer 2.x or later versions of the command line.

If you are using Composer 1.x, you can update to the latest stable version of Composer 2.x via the composer self-update command.