1.0.0-alpha12

Adds a slight performance improvement (#120).

1.0.0-alpha11

This fixes a horrendous performance bug which was slowing Composer down to, like, slower-than-Composer-1 speeds. 😱 (#119)

With this release, the plugin still does slow Composer down a tad, but it doesn't download anywhere near as much unnecessary junk as it previously did, and performance is actually reasonable now. 😅 Phew! Happy Friday.

1.0.0-alpha10

This plugin will now be installed and activated as early as possible when Composer is operating, so that it can verify as many downloads as it can. Maximum protection! (#116)

For reporting and metrics, this version will also send an X-PHP-TUF header to TUF-protected repositories, containing the version of the plugin, and the supporting PHP-TUF library. (#115)

Oh, and we're doing a little more testing too. (#114)

1.0.0-alpha9

The releases come fast and furious! This one updates PHP-TUF to 0.1.5 (#112), and improves the documentation in our code (#80). Oh, and we're now testing our compatibility with Drupal pretty broadly (#113).

1.0.0-alpha8

Metapackages are no longer validated by TUF, because by design they don't install any code of their own into a project. Note that metapackages' Composer metadata is still validated. (#111)

1.0.0-alpha7

This release brings a performance improvement (#91) and a new tuf:protect command to make it easy to set this plugin up in your project (#110). Oh, and some under-the-hood cleanup.

1.0.0-alpha6

This release drops support for Composer <2.6, updates the PHP-TUF library, and removes our development dependency on Python.

1.0.0-alpha5

Another month, another alpha. This time with some important improvements:

• #89 fixed some serious performance problems. It's still not awesome, mostly due to Composer making a lot of unnecessary requests (which is an upstream problem; see composer/composer#11704), but this is a big improvement. There was also #87, which reduced unnecessary network traffic.
• #86 removed an old hard-coded assumption that was getting in the way of real-world use.
• #88 and #84 fixed problems that broke integration with packages.drupal.org.
• #90 made testing a tad easier. 😎

1.0.0-alpha4

Fixes #83, which allows TUF metadata to be loaded from a different place than the Composer metadata. They still have to "agree", but this can be useful for testing set-ups, and certain real-world situations.

1.0.0-alpha3

Just a little maintenance release, adopting upstream changes from the PHP-TUF library.

There is one advancement: the dependency on the Guzzle HTTP client has been dropped (#77). Hooray for fewer dependencies! 🎉