Talk:Requests for comment/Streamlining Composer usage

I'm not sure that I agree with any of the stated problems other than https://phabricator.wikimedia.org/T88211

• Double review seems theoretical
• Autoloader updates are automated by composer in either case
• Cross extension dependencies are not solved by automating Composer builds are they?

Am I incorrect in this analysis?

According to https://github.com/composer/composer/issues/38 it would appear that composer does have some rudimentary verification of downloaded tarballs, in the sense that packagist publishes an sha of the download and then composer verifies that the file downloaded from github matches that hash.