Where do PHP Composer Packages Come From?

Question

When I run

$ composer.phar install

where do the packages that get installed come from?

I understand that Packagist is the default repository for PHP packages, and that lacking a different package in composer.json, this is where composer will look for packages.

However, what I'm not clear on is how Composer and Packagist interact.

• Does Composer download files directly from packagist.org

• Or does Composer get a git/svn/hg repository link from packagist and download the files from the repository directly?

• Or something else?

Answer 1

It depends on the contents of your composer.json file.

For example, if your composer.json contained simply

{
    "require": {
        "phpunit/phpunit": "3.8.*@dev"
    }
}

then composer searches packagist, and finds phpunit here:

https://packagist.org/packages/phpunit/phpunit

which tells composer to load phpunit from here:

https://github.com/sebastianbergmann/phpunit.git

If instead your composer.json contained

{
    "repositories": [
        {
            "type": "vcs",
            "url": "http://github.com/sebastianbergmann/phpunit"
        }
    ],
    "require": {
        "phpunit/phpunit": "3.8.*@dev"
    }
}

then composer will not look to packagist, but go directly to github to download the repo.

The packages registered on Packagist are usually the "authoritative" version of the package (not a fork), but I have found several instances where this is NOT the case, so you should check it to be sure you are pulling the package you expect.