Christophe Coevoet

@Seldaek is this really closed by the search improvements ? I don't see the relation to it

Installing composer through apt will install the version available in the APT repository you are using. These repositories are not maintained by the composer team (which is why they are...

Given that the main composer repository (packagist.org) does not store the code but only the metadata, would TUF work there ? Developers are **not** uploading packages to packagist.org. And users...

@pierrejoye the issue is that it would force Composer to hardcode a list of extensions provided by the core (and it could still be wrong in case of package managers...

how are available extensions known by Composer ? Does pecl.php.net support the Composer protocol to expose packages ? Does it require a special repository implementation ? Or does it need...

@pierrejoye the PlatformRepository providing the info about the platform itself needs to be able to know the version of installed extensions, otherwise you cannot use the version in the constraint....

@slbmeh the PearRepository is a huge performance killer, because the PEAR protocol is just not adapter for Composer needs, required a huge number of requests to fetch the necessary data....

This will be harder than in Yarn though, because our composer.lock file is a JSON file, but a merge conflict makes it unparseable, and so would require to build a...

@vierlex how would that work ? The previous discussion concluded that things are much easier to handle when implement a git merge driver than when trying to resolve conflicts after...

> Imo these files could also be more slim, I think the version number is really the only relevant piece of information, right? Perhaps if it was downloaded from an...