Great news, very excited about all the improvements that this work on artifact integrity will bring to Packagist and Composer.
Artifact integrity for Packagist and Composer 🔒
Alpha-Omega is funding artifact integrity for Packagist and Composer. Packagist will permanently store package artifacts and publish checksums, Sigstore signatures and build provenance attestations for Composer to verify. The…
Private PackagistArtifact integrity for Packagist and ComposerFunding from Alpha-Omega is enabling us to work on a new level of artifact integrity for Packagist and Composer. Rather than just providing JSON metadata pointing at download URLs, Packagist.org will provide immutable artifact files, publish checksums and signatures. Composer will verify the packages it installs originate from
commit a82f95c