6

As some of you may know, a huge fiasco happened a month ago with NPM

As of now, Magento 2 composer.json file includes a lot of external resources (details on the Magento 2 GitHub)

What if one of those external resources gets removed by the author and in case of possible harm, what can we do to prevent that ?

6

It's not that bad. composer show -it shows a huge tree, but if you leave out the repositories hosted by Magento itself and the PHP extension requirements, the external requirements are:

  1. Composer itself

  2. Frameworks

    • Zend Framework
    • Symfony
  3. Others

    • braintree/braintree_php
    • justinrainbow/json-schema
    • seld/jsonlint
    • monolog/monolog
    • psr/log
    • oyejorge/less.php
    • pelago/emogrifier
    • phpseclib/phpseclib
    • tedivm/jshrink
    • tubalmartin/cssmin

The big frameworks are not going to go away any time soon and other than in the node.js world, there is no trend to depend on countless micropackages, so that the removal of one unremarkable package breaks many applications and frameworks. The Zend Framework has no external dependencies at all and symfony only a few (listed above).

But the question is still valid:

What if one of those external resources gets removed by the author and in case of possible harm, what can we do to prevent that ?

I don't know if Magento has anything like that in place, but if you want to insure yourself from this situation, you can always use Toran Proxy Private Packagist to maintain your own mirror of packages from packagist, github etc.

  • You can also us Satis (an open source alternative to Toran) to mirror the Composer repositories. Alan Storm has a nice writeup about that here: alanstorm.com/… – Erik Hansen Apr 19 '16 at 18:29
3

it's definetely possible. If they are not already doing it, Magento could mirror all needed Packages on repo.magento.com.

Although not sure what's the legal situation here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.