packagist-mirror's Introduction

Alibaba Cloud Packagist Mirror

Alibaba Cloud Packagist Mirror is an open source system that Alibaba Cloud helps PHP developers speed up the installation of Composer dependent packages. Welcome to use Alibaba Cloud Packagist Mirror.

Quick Start

To run the system, create a packagist.yml file in the root directory of the project, and configure the following options:

For security, please do not add the packagist.yml file to version control.

REDIS_ADDR: "address:port"
REDIS_PASSWORD: "password"
REDIS_DB: 0

OSS_ACCESS_KEY_ID: "OSS AccessKeyID"
OSS_ACCESS_KEY_SECRET: "OSS AccessKeySecret"
OSS_ENDPOINT: "OSS endpoint, such as oss-cn-hangzhou.aliyuncs.com"
OSS_BUCKET: "Bucket"

# Unlimited to request dist
GITHUB_TOKEN: "GitHub token, such as: 6a023b828b17*****0ab5tgj6ddb3f0ccb3d30e0"

REPO_URL: "Synchronization source address, such as https://mirrors.aliyun.com/composer/"
API_URL: "Change monitoring API address, such as: https://packagist.org/"
MIRROR_URL: "Mirror website, such as https://developer.aliyun.com/composer/"
DIST_URL: "Download address of zip package, such as https://mirrors.aliyun.com/composer/dists/"
PROVIDER_URL: "Provider prefix"

BUILD_CACHE: "true"

API_ITERATION_INTERVAL: 5
USER_AGENT: "Alibaba Cloud"

Architecture

Contribution

Welcome to participate in the development and make PHP community more prosperous together. Please read contribution guide before submitting pull request.

Issue

Submit Issue, problems that do not meet the guidelines may be closed immediately.

Release notes

Detailed changes to each version are documented in release notes.

References

License

Apache-2.0

packagist-mirror's People

Contributors

Stargazers

Watchers

packagist-mirror's Issues

同学，您这个项目引入了43个开源组件，存在1个漏洞，辛苦升级一下

检测到 aliyun/packagist-mirror 一共引入了43个开源组件，存在1个漏洞

漏洞标题：go-yaml < 2.2.8拒绝服务漏洞
缺陷组件：gopkg.in/[email protected]
漏洞编号：CVE-2019-11254
漏洞描述：gopkg.in/yaml.v2是go语言中用于处理yaml格式的包。
在2.2.8之前的版本中，处理恶意的yaml数据时，会导致CPU资源耗尽。
漏洞由Kubernetes开发者在fuzz测试中发现并提交修复补丁。
国家漏洞库信息：https://www.cnvd.org.cn/flaw/show/CNVD-2020-35519
影响范围：(∞, 2.2.8)
最小修复版本：2.2.8
缺陷组件引入路径：github.com/aliyun/packagist-mirror@->github.com/stretchr/[email protected]>gopkg.in/[email protected]

另外还有几个漏洞，详细报告：https://mofeisec.com/jr?p=a5fbc0