Use TUF to verify packages and metadata

[phenaproxima]

TODO

[davidstrauss]

I'm not familiar enough with Composer internals to comment on the integration architecture, but this looks like it should work exactly how we discussed.

Condolences on not being able to use Xdebug on the plugin. :-( I suspect this also means you can't use Composer plugins if you disable eval calls.

My only other thought on seeing this was how modern the PHP code is. In almost every sense, this is great, but I assume we must be setting a pretty high minimum PHP requirement for users. Yet, if that's what Composer does (use very modern PHP), maybe we don't have much choice?

[effulgentsia]

My only other thought on seeing this was how modern the PHP code is. In almost every sense, this is great, but I assume we must be setting a pretty high minimum PHP requirement for users. Yet, if that's what Composer does (use very modern PHP), maybe we don't have much choice?

Composer 2.0 supports PHP 5.3.2, but per composer/composer#9303, Composer 2.1 or 2.2 plans to set the minimum to PHP 7.1.3.

This plugin should probably explicitly set its PHP minimum to 7.1.3 in its composer.json and not use syntax beyond that. Or, if there are later PHP features that we really need, then let's open an issue to discuss raising that minimum to see if that's ok with the PHP projects that intend to use this.

[phenaproxima]

This plugin should probably explicitly set its PHP minimum to 7.1.3 in its composer.json and not use syntax beyond that.

Why? PHP-TUF itself requires PHP 7.2.5 or later (probably because of the Sodium dependency), so we should probably require the same minimum as PHP-TUF itself, no? Everything I did in this plugin assumes PHP 7.2 or later.

[effulgentsia]

Well, yeah, if PHP-TUF itself requires PHP 7.2.5, then that's an ok minimum for this plugin as well.

[effulgentsia]

I don't know if there's an issue where PHP minimum version was discussed, but TYPO3 10 and Joomla 4 require PHP 7.2, so we're good there.

PHP 7.1 has extended support in Zend Server until Jan. 2023, but that doesn't mean that we need to cater to that if there's a good reason why we need PHP 7.2, and it sounds like there is.

[phenaproxima]

PHP-TUF could theoretically use something like paragonie/sodium_compat if we wanted to support older versions, but PHP 7.2 has been unsupported for 4 months at this point anyway (according to https://www.php.net/eol.php), so IMHO it makes more sense to just stick with our existing minimums and bump them later when we need to.