Advertising sustains the DA. Ads are hidden for members. Join today
Using Composer
- Using Composer in a Drupal project
- Composer in relation to Drush Make
- Using Composer to Install Drupal and Manage Dependencies
- Add a composer.json file
- Starting a Site Using Drupal Composer Project Templates
- Managing dependencies for a contributed project
- Managing dependencies for a custom project
- Preparing your site for Composer 2
- Tricks for using Composer in local development
- Troubleshooting Composer
- Using Drupal's Composer Scaffold
- Using packages.drupal.org
- Using packagist-signed.drupalcode.org
- Using the Lenient Composer Plugin
Using packagist-signed.drupalcode.org
Last updated on
2 May 2025
packagist-signed.drupalcode.org is a partial mirror of Packagist.org, including packages in the drupal/ and php-tuf/ namespaces. To provide additional security for Drupal’s automatic updates, signing metadata following The Update Framework (TUF) is generated.
It is maintained by the Drupal Association using Satis for mirroring and Rugged for TUF. Its code is on GitLab.com.
This service is relatively new and needs testing! Follow #3477553: [PP-1] Manually test TUF-enabled Composer projects to help test, and #3358504: Require PHP-TUF's Composer integration plugin for using packagist-signed and TUF by default.
Help improve this page
Page status: No known problems
You can:
You can:
- Log in, click Edit, and edit this page
- Log in, click Discuss, update the Page status value, and suggest an improvement
- Log in and create a Documentation issue with your suggestion