Alpha-Omega funds Packagist and Composer artifact integrity

Funding from Alpha-Omega is enabling Packagist and Composer to implement a new level of artifact integrity, including immutable artifact storage, checksums, Sigstore signatures, build provenance attestations, and Trusted Publishing. These measures aim to protect users and maintainers against compromised accounts, untrusted repositories, and supply chain attacks. Future phases will introduce stricter publishing controls, hardware security keys, and transparency logs. Open article →