Where do PHP Composer Packages Come From?

composer-php, php

Solution

It depends on the contents of your `composer.json` file.

For example, if your `composer.json` contained simply

{
    "require": {
        "phpunit/phpunit": "3.8.*@dev"
    }
}

then composer searches packagist, and finds phpunit here:

https://packagist.org/packages/phpunit/phpunit

which tells composer to load phpunit from here:

https://github.com/sebastianbergmann/phpunit.git

If instead your `composer.json` contained

{
    "repositories": [
        {
            "type": "vcs",
            "url": "http://github.com/sebastianbergmann/phpunit"
        }
    ],
    "require": {
        "phpunit/phpunit": "3.8.*@dev"
    }
}

then composer will not look to packagist, but go directly to github to download the repo.

The packages registered on Packagist are usually the "authoritative" version of the package (not a fork), but I have found several instances where this is NOT the case, so you should check it to be sure you are pulling the package you expect.

Problem

When I run ``` $ composer.phar install ``` where do the packages that get installed come from? I understand that Packagist is the default repository for PHP packages, and that lacking a different package in `composer.json`, this is where composer will look for packages. However, what I'm not clear on is how Composer and Packagist interact. Does Composer download files directly from `packagist.org` Or does Composer get a git/svn/hg repository link from `packagist` and download the files from the repository directly? Or something else?

Original source