Composer won't install packages hosted on Gerrit

Fremantle
2026 October 18 (Sunday), 11:11AM
· MediaWiki · Wikimedia · Git · Composer ·

When installing MediaWiki extensions with Composer, it can fail for extensions that are hosted on Gerrit. For example, here PluggableAuth is not able to be cloned from https://gerrit.wikimedia.org/r/mediawiki/extensions/PluggableAuth and is prompting for user credentials:

$ composer update -o --no-dev
Composer could not detect the root package (mediawiki/core) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version
> MediaWiki\Composer\VersionChecker::onEvent
Loading composer repositories with package information
Updating dependencies
Nothing to modify in lock file
Installing dependencies from lock file
Package operations: 50 installs, 6 updates, 7 removals
  - Syncing mediawiki/pluggable-auth (7.5.0) into cache
    Authentication required (gerrit.wikimedia.org):
      Username:

Providing a username and password here won't help, because the issue is that Varnish is returning 403:

$ curl -sI https://gerrit.wikimedia.org/r/mediawiki/extensions/PluggableAuth
HTTP/2 403 
date: Sun, 18 Oct 2026 02:59:51 GMT
server: Varnish
…

The fix is to conform to the WMF user agent policy, by setting Git's userAgent to something that identifies you (in .gitconfig):

[http]
	userAgent = "Your Wiki (you@example.org)"

Then the composer update works fine.

← Previous

My main RSS news feed: https://samwilson.id.au/news.rss
(or Wikimedia.rss, Fremantle.rss, OpenStreetMap.rss, etc. for topic feeds).
Email me at sam@samwilson.id.au or leave a comment below…