@naderman@phpc.social

· 2mo ago

RE: https://phpc.social/@OndrejMirtes/116991095416961297 I both love and hate this: Has #composerphp now reached python wheel levels and we soon need analysis tools to figure out which C libraries containing which CVEs exactly were compiled into which extensions shipping inside which #php phar files in Composer packages? 😵‍💫

Quoting

Ondřej Mirtes

@OndrejMirtes@phpc.social

Announcing PHPStan Turbo! Native PHP extension (PHP 8.3+) written in C++ that makes running PHPStan 10-30 % faster. The best part: If you update to PHPStan 2.2.6, you get it automatically. It ships with pre-built binaries for all the usual combos of OS:architecture:PHP.

Open quoted post

phpc.social

15

21

3

0

Nils Adermann @naderman@phpc.social

· 5mo ago

RE: @openssf@social.lfx.dev

Open infrastructure isn't free. 🌱

Packagist/Composer signed a joint
OpenSSF letter with PyPI, crates, Maven, CPAN, etc on real cost of running package registries.

Packagist needs to finance staff, not just hardware and bandwidth. Contact me if your company's interested in joining our sponsorship program for its launch this month while we work on long term solutions.

#php #phpc #composerphp #softwaresupplychain #PreserveOpenSource #FreeSoftwareIsntFree #OpenSource #Sustainability

social.lfx.dev

OpenSSF: "Open Infrastructure Is Not Free. Part II is here.…" - social.lfx.dev

33

2

65

1

Nils Adermann @naderman@phpc.social

· 2mo ago

So I'm trying to contact a bunch of enterprises with SDKs on packagist to help with sponsorships. But what I'm finding instead is that their SDKs are mostly owned by ex-employee accounts with private email addresses or bouncing corporate emails. 😵‍💫

11

4

0

Nils Adermann @naderman@phpc.social

· 2mo ago

Replying to

@markusstaab@phpc.social @toflar@phpc.social yes, but how can I verify that this was indeed the source code used to build the binaries in the phar file and not some locally modified version Ondrej had on his malware infected laptop which added a backdoor?

4

9

1

0

Nils Adermann @naderman@phpc.social

· 2mo ago

Replying to

Thanks to Brian Fox and Sonatype: a key role in the Sustaining Package Registries Working Group as steward of Maven Central, and now sponsoring Composer & Packagist even though one of their products competes with our own Private Packagist. The infrastructure underneath both our products is shared, and we need to fund it together. That is where this needs to be heading: every major beneficiary contributing, like any other critical infrastructure they budget for. #php #phpc #composerphp

4

0

2

0

Nils Adermann @naderman@phpc.social

· 2mo ago

Replying to

@edorian@phpc.social Yes to a degree, and we're working on alternatives to that. But this is adding another layer that makes it even harder and that tooling now has to learn about. I'm not saying it's wrong, it's just making our worker even harder and more complex and I don't know how to keep up with this anymore.

4

1

0

Nils Adermann @naderman@phpc.social

· 7mo ago

Loved the very engaged audience of a thousand people at #LaraconEU 2026 in Amsterdam today at my "Composer Deep Dive" talk! Proud to sponsor the event with Private Packagist / @packagist@phpc.social - Find me and chat about package management or @thephpf@phpc.social ! Slides: https://naderman.de/slippy/slides/2026-03-02-Laracon-EU-2026-Composer-Deep-Dive.pdf #laravel #laracon #php #composerphp

phpc.social

PHP Community on Mastodon

14

1

3

0

Nils Adermann @naderman@phpc.social

· 2mo ago

Replying to

@heiglandreas@phpc.social @kleisli@mastodon.social @OndrejMirtes@phpc.social @markusstaab@phpc.social @toflar@phpc.social No, you want SLSA build provenance attestations and in a perfect world a reproducible build: https://phpc.social/@naderman/117053334241906529

phpc.social

Nils Adermann: "@kleisli@mastodon.social @OndrejMirtes @markussta…" - PHP Community on Mastodon

1

0

Nils Adermann @naderman@phpc.social

· 2mo ago

Replying to

@sebastian@phpc.social @edorian@phpc.social yeah Ondrej said he'll add an SBOM, which is a start. I'd rather also see SLSA build provenance attestations too.

1

0

Nils Adermann @naderman@phpc.social

· 10mo ago

Back from our annual #SymfonyCon trip! Great experience celebrating 20 years of #Symfony with its community in Amsterdam. The @packagist@phpc.social booth was busy with discussions throughout the event, and my package manager security outlook talk sparked good conversations. See you in Warsaw 2026!

Slides: https://naderman.de/slippy/slides/2025-11-28-SymfonyCon-Amsterdam-2025-Package-Manager-Security-in-2025-Whats-Next.pdf

#php #composerphp

phpc.social

PHP Community on Mastodon

12

0

8

0

Nils Adermann @naderman@phpc.social

· 3mo ago

Replying to

@stuherbert@mastodonapp.uk should hopefully all be there by now? There were some issues with the new CDN and cache settings leading to a delay of showing these on the website.

1

0

Nils Adermann @naderman@phpc.social

· 5mo ago

Replying to

@preinheimer Yes absolutely and thank you for that! We just realize there are large users of Composer & Packagist who we'll never convince to subscribe to Private Packagist, and who should really participate in sustaining this free infrastructure too. (Curious why you're not using it though?) New sponsorships are really targetting a few large enterprise supporters, as opposed to smaller amounts.

2

0

Nils Adermann @naderman@phpc.social

· 6mo ago

Meet me at @FOSSBackstage@floss.social today and tomorrow in Berlin! Let's talk about sustainable software package repository operation, supply chain security in open source and @thephpf@phpc.social

3

1

0