- Issue created by @phenaproxima
- 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺
Given Drupal core release managers have indicated this is a hard requirement … updating issue metadata accordingly.
This is AFAICT hard-blocked on #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged → too. Once 📌 Add a validator to check that PHP-TUF's Composer integration is present and configured correctly Fixed lands, this will be down to
PP-1. - Assigned to phenaproxima
- 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺
📌 Add a validator to check that PHP-TUF's Composer integration is present and configured correctly Fixed is in.
@phenaproxima Can we already get a patch/MR in place? 🤓
- 🇺🇸United States phenaproxima Massachusetts
Not until PHP-TUF (both the library and the plugin) are published on Packagist.
- 🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺
Right, but I mean an outline of a MR that shows which code would need to change. While it's still fresh in your head.
I would not expect this MR to pass obviously!
- last update
over 1 year ago Composer require failure - @phenaproxima opened merge request.
- Issue was unassigned.
- Status changed to Needs work
4 months ago 9:24am 14 September 2024 - 🇬🇧United Kingdom catch
https://packagist.org/packages/php-tuf/ should mean this is unblocked?
- 🇬🇧United Kingdom catch
I think this still might only be partially implemented in package_manager - we need to figure out exactly what's left to do here.
- 🇺🇸United States cmlara
Setting as postponed on upstream https://github.com/php-tuf/composer-integration/issues/127
As discovered in 📌 Manually test TUF-enabled Composer projects Active in even basic lab deployments the plug-in causes an excessive increase in memory consumption.
