How to handle two teams, one without Satis, one with (and a composer.lock)

[allan-simon]

We have two teams

• one in a country where internet is fast enough to require a Satis (also they're mostly doing remote-work so there's not one LAN in which we can set up a Satis for them)
• one in China were everything which is not hosted in China is slow as hell, unreliable, sometimes blocked in Which we have a satis

As this is a end-user project, we're using a composer.lock, however if I understand correctly, the composer.lock contains information on where the packages have been downloaded, which mean that if we commit it, then people from the other team will got problem when doing their composer install , right ?

of course one solution would be not to commit the composer.lock, but I guess it's far from being optimal

[SvenRtbg]

I think you are a candidate for using Toran Proxy instead of Satis.

[allan-simon]

The question being that I didn't see a specific feature in Toran Proxy that would fix that? as it seems to be a "problem" in the composer.lock keeping the exact url rather than just a hash + reliying on composer.json or other "machine-specific" conf to know where to look for packages. (like what apt and dpkg does more or less)