A Composer repository and Packagist proxy

Add the box as a repository, turn Packagist off, and save the login once for the machine:

composer config repositories.company composer https://packages.example.com/composer
composer config repositories.packagist.org false
composer config --global http-basic.packages.example.com your-user-name "$REPO_TOKEN"

The upstream is https://repo.packagist.org. Rules are written on names like monolog/monolog or symfony/*, and take composer.json constraints like ^3.0 or >=1.2 <2.0.

The metadata composer reads lists only allowed releases. Each release names one exact commit: the box fetches that commit's zip once (from codeload.github.com for GitHub, so there is no API rate limit to hit), checks it against any shasum the metadata gives, keeps and scans it, and points composer at the kept copy. The git source is taken out of every release, so composer cannot fall back to a clone and get round the checks.

A composer.lock made before the switch still points at GitHub. Run composer update once through the box and commit the new lock file. The Check page can also review a composer.lock or composer.json against the rules before anyone installs.

What applies, and what does not

Rules, the kill switch, quarantine, cooling off (Packagist gives a publish time for each release), malware scanning (the OSV known malicious check included), license policy from composer.json, requests, auto approve and safe version resolution all apply. Advisories come from OSV's Packagist feed.

Honest limits: branches like dev-main are not releases and are not served, so a package pinned to a branch has to move to a tag. Private packages are not published here. Typosquat checks, provenance checks and the tree walk are not offered for Composer.