roots/bedrock-ansible — pull request #12 by fullyint (2014-06-08 22:21:47+00:00)
Title: Add option to install priv packages via deploy key

This enables Composer to optionally install private packages using deploy keys instead of [Satis](https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md). It could be useful if someone has made a [private plugin into a composer package](http://roots.io/wordpress-plugins-with-composer/) or wants to [install a paid plugin](http://discourse.roots.io/t/best-way-to-install-private-paid-plugins-with-composer/1045) that they have uploaded to a private repo.

The code uploads a private key. Then it adds the private repos' hosts to the known\_hosts file to prevent the prompt that asks "Are you sure you want to continue connecting" to the new host. This prompt is hidden in the context of 'vagrant up' and thus would cause the play 'Install Dependencies with Composer' to hang forever.

**A couple details.** The play 'Add new hosts to known\_hosts' first tests whether the host's hash is already in known\_hosts. If not, it concatenates that host's hash onto known\_hosts (inspired by [ysawej](http://serverfault.com/a/366751)). The `flush_known_hosts` option added to `group_vars/all` is to be used with the 'vagrant provision' command on the occasion that a host changes its public key, causing authentication warnings (e.g., about potential man-in-the-middle attacks) that in turn cause Composer to fail in installing dependencies.

**Caveats.** I've only tested with private projects on BitBucket. I haven't tried [Satis](https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md), and maybe it's always a better choice.