@naderman@phpc.social

Nils Adermann @naderman@phpc.social · Aug 07, 2026

Replying to @heiglandreas@phpc.social

@heiglandreas@phpc.social @kleisli@mastodon.social @OndrejMirtes@phpc.social @markusstaab@phpc.social @toflar@phpc.social No, you want SLSA build provenance attestations and in a perfect world a reproducible build: https://phpc.social/@naderman/117053334241906529

0

1

0

Nils Adermann @naderman@phpc.social · Aug 07, 2026

Replying to @markusstaab@phpc.social

@markusstaab@phpc.social @toflar@phpc.social yes, but how can I verify that this was indeed the source code used to build the binaries in the phar file and not some locally modified version Ondrej had on his malware infected laptop which added a backdoor?

1

0

Nils Adermann @naderman@phpc.social · Jul 31, 2026

Replying to @naderman@phpc.social

Thanks to Brian Fox and Sonatype: a key role in the Sustaining Package Registries Working Group as steward of Maven Central, and now sponsoring Composer & Packagist even though one of their products competes with our own Private Packagist. The infrastructure underneath both our products is shared, and we need to fund it together. That is where this needs to be heading: every major beneficiary contributing, like any other critical infrastructure they budget for. #php #phpc #composerphp

4

0

2

0

Nils Adermann @naderman@phpc.social · Jul 31, 2026

RE: https://phpc.social/@packagist/117008833006861501 We launched a formal sponsorship program for Composer & Packagist as a step toward more distributed funding of critical open source infrastructure. The long term goal: move from sponsorships to regular service subscriptions paid from engineering budgets. Credit to Aikido: they stepped up before we even had a program to offer, right when we realized how much security work was ahead of us, provided us funding, and got us onto this path.

Quoting

packagist @packagist@phpc.social

Composer & Packagist now have a formal sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia. Our costs are primarily staff: operations, support, emergency response, maintenance and development. We ask enterprises profiting from the PHP ecosystem to pay their fair share to keep our shared critical infrastructure available to all PHP developers. https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/ #php #phpc #composerphp

Open quoted post

7

1

3

0

Nils Adermann @naderman@phpc.social · Jul 29, 2026

Replying to @sebastian@phpc.social

@sebastian@phpc.social @edorian@phpc.social yeah Ondrej said he'll add an SBOM, which is a start. I'd rather also see SLSA build provenance attestations too.

0

1

0

Nils Adermann @naderman@phpc.social · Jul 29, 2026

Replying to @edorian@phpc.social

@edorian@phpc.social Yes to a degree, and we're working on alternatives to that. But this is adding another layer that makes it even harder and that tooling now has to learn about. I'm not saying it's wrong, it's just making our worker even harder and more complex and I don't know how to keep up with this anymore.

0

Nils Adermann @naderman@phpc.social · Jul 28, 2026

RE: https://phpc.social/@OndrejMirtes/116991095416961297 I both love and hate this: Has #composerphp now reached python wheel levels and we soon need analysis tools to figure out which C libraries containing which CVEs exactly were compiled into which extensions shipping inside which #php phar files in Composer packages? 😵‍💫

Quoting

Ondřej Mirtes @OndrejMirtes@phpc.social

Announcing PHPStan Turbo! Native PHP extension (PHP 8.3+) written in C++ that makes running PHPStan 10-30 % faster. The best part: If you update to PHPStan 2.2.6, you get it automatically. It ships with pre-built binaries for all the usual combos of OS:architecture:PHP.

Open quoted post

0

4

0

Nils Adermann @naderman@phpc.social · Jul 14, 2026

So I'm trying to contact a bunch of enterprises with SDKs on packagist to help with sponsorships. But what I'm finding instead is that their SDKs are mostly owned by ex-employee accounts with private email addresses or bouncing corporate emails. 😵‍💫

0

1

0

Nils Adermann @naderman@phpc.social · Jul 03, 2026

Replying to @stuherbert@mastodonapp.uk

@stuherbert@mastodonapp.uk should hopefully all be there by now? There were some issues with the new CDN and cache settings leading to a delay of showing these on the website.

0

Nils Adermann @naderman@phpc.social · May 06, 2026

Replying to @preinheimer@phpc.social

@preinheimer Yes absolutely and thank you for that! We just realize there are large users of Composer & Packagist who we'll never convince to subscribe to Private Packagist, and who should really participate in sustaining this free infrastructure too. (Curious why you're not using it though?) New sponsorships are really targetting a few large enterprise supporters, as opposed to smaller amounts.

2

0

Nils Adermann @naderman@phpc.social · May 06, 2026

RE: @openssf@social.lfx.dev

Open infrastructure isn't free. 🌱

Packagist/Composer signed a joint
OpenSSF letter with PyPI, crates, Maven, CPAN, etc on real cost of running package registries.

Packagist needs to finance staff, not just hardware and bandwidth. Contact me if your company's interested in joining our sponsorship program for its launch this month while we work on long term solutions.

#php #phpc #composerphp #softwaresupplychain #PreserveOpenSource #FreeSoftwareIsntFree #OpenSource #Sustainability

33

1

65

1

Nils Adermann @naderman@phpc.social · Mar 16, 2026

Meet me at @FOSSBackstage@floss.social today and tomorrow in Berlin! Let's talk about sustainable software package repository operation, supply chain security in open source and @thephpf@phpc.social

floss.social

FOSS Backstage (@FOSSBackstage@floss.social) - FLOSS.social

3

0

1

0

Nils Adermann @naderman@phpc.social · Mar 02, 2026

Loved the very engaged audience of a thousand people at #LaraconEU 2026 in Amsterdam today at my "Composer Deep Dive" talk! Proud to sponsor the event with Private Packagist / @packagist@phpc.social - Find me and chat about package management or @thephpf@phpc.social ! Slides: https://naderman.de/slippy/slides/2026-03-02-Laracon-EU-2026-Composer-Deep-Dive.pdf #laravel #laracon #php #composerphp

14

1

3

0

Nils Adermann @naderman@phpc.social · Dec 01, 2025

Back from our annual #SymfonyCon trip! Great experience celebrating 20 years of #Symfony with its community in Amsterdam. The @packagist@phpc.social booth was busy with discussions throughout the event, and my package manager security outlook talk sparked good conversations. See you in Warsaw 2026!

Slides: https://naderman.de/slippy/slides/2025-11-28-SymfonyCon-Amsterdam-2025-Package-Manager-Security-in-2025-Whats-Next.pdf

#php #composerphp