How to use Composer repositories in required package?

Question

I have two code repositories. They both have composer.json files (see below). The first composer.json file is required by the second composer.json file, with the former stored remotely on bitbucket.

I have run both composer.json files locally: the first file passes and downloads the vendors as I would expect; the second file, which calls the first file, does not and I get this error:

Problem 1
- The requested package timeago/timeago could not be found in any version, there may be a typo in the package name.
Problem 2
- The requested package prettify/prettify could not be found in any version, there may be a typo in the package name.

Now, if I remove all repositories from the first file, and their corresponding entries in requires, then all works as expected and the files are downloaded. So, I think the problem lies with the repositories section in the first file somehow. Any ideas?

Here are my two composer files:

File one:

"repositories": {
    "prettify/prettify": {
        "type": "package",
        "package": {
            "name": "prettify",
            "version": "dev-master",
            "source": {
                "url": "http://google-code-prettify.googlecode.com",
                "type": "svn",
                    "reference": "svn/trunk"
            }
        }
    },
    "timeago/timeago": {
        "type": "package",
        "package": {
            "name": "timeago",
            "version": "dev-master",
            "source": {
                "url": "https://github.com/rmm5t/jquery-timeago.git",
                "type": "git",
                    "reference": "master"
            }
        }
    },
    "require": {
        "timeago": "dev-master",
        "prettify": "dev-master",
    }
}

File two:

"require": {
    "vendor/project": "master"
},

Answer 1

If you use private repositories mentioned in the composer.json of a dependency of your main package, you have to repeat them there.

Alternatively you can set up an instance of Satis to create the necessary metadata from all the private repositories you use, and simply link this instead.

Composer will NOT recursively scan repositories for further links to other repositories, because that would lead to infinite scan times and really poor performance, and ultimately to undecidable problems as well, so whatever package you are using has to either only use Packagist as a source, or must mention the source for all packages that should override or add to Packagist.

Having one single Satis instance that acts as a complete map of all your private repositories will really ease the process.