Post #4100130
2026-07-15 04:43 UTC
2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems.
A review of Composer and Packagist: what PHP does well, what it can learn, and who owns our infrastructure.
https://phpunit.expert/articles/composer-and-packagist-under-supply-chain-stress.html?ref=mastodon
Replies (1)
-
@jacques@mastodon.chester.id.au 2026-07-25 20:35
@sebastian@phpc.social fascinating read. I’m especially impressed by the breadth of events kept in the transparency log. I pitched this for sigstore in a RubyGems context several years ago, with an eye to creating a shared event format for multiple ecosystems. Do you or other packageist maintainers participate in the OpenSSF Secure Repos working group? If not I think everyone would gain from adding PHP’s perspectives and experiences