问题
As far as I understand, Composer writes the list of the exact versions it installed into the composer.lock file.
The package reference attribute is used to store a specific commit number.
In some circumstances I see null values for reference attribute in my composer.lock file.
When does it happen? And what does it mean?
Thank you
回答1:
By searching an example to paste to respond to @xabbuh's question I noticed that the null reference is always related to a "type": "zip" package, like shown below:
"dist": {
"type": "zip",
"url": "https://repo.magento.com/archives/magento/module-catalog-widget/magento-module-catalog-widget-100.0.5.0.zip",
"~~,
"shasum": "9824758cc690316a64727f823d33d752c9218c32"
},
So I guess that the answer to my question is that being the repository bound to a zip package there isn't any commit to refer to.
来源：https://stackoverflow.com/questions/37069178/what-is-the-meaning-of-a-null-reference-in-composer-lock-file