Composer is getting package signing after 14 years
PHP's dependency manager is rolling out cryptographic signatures. The timing matters more than the tech.
Composer is adding cryptographic package signing. Publishers can now sign packages with GPG or Sigstore. Packagist verifies the signatures before serving downloads. The feature went live in May 2026. The timing is what caught my attention. Composer launched in 2012. PyPI added signing in 2013. npm in 2016. Maven had it from the start. PHP’s ecosystem ran on trust for 14 years while every other major language moved to cryptographic verification. The mechanics are standard: publishers generate a key, sign their releases, upload the signature alongside the package. Composer checks the signature against a known public key before install. If the signature fails, the install aborts. Same pattern as apt-get, same pattern as Docker Content Trust. What changed is the supply chain threat model became impossible to ignore. The xz backdoor in March 2024 scared everyone. SolarWinds before that. Dependency confusion attacks keep working because most package managers still default to “download whatever matches the name”. Packagist is also requiring two-factor authentication for maintainers of popular packages. That stops the “steal credentials, push malicious version” attack that hit npm’s event-stream in 2018. The combination of 2FA and signing means an attacker needs both your password and your signing key, which is a much harder problem. The signing is optional for now. Publishers have to opt in. That means most packages will ship unsigned for years while adoption crawls upward. The real win is when Composer makes verification mandatory for packages above a certain download threshold, which the blog post does not commit to yet. I checked three Laravel packages I use. None are signed. That will be the pattern for months. The infrastructure exists but the behaviour has not shifted.
Source: An Update on Composer and Packagist Supply Chain Security