Making WordPress Composer FAIR  ## Metadata - Author: [[Chris Reynolds]] - Full Title: Making WordPress Composer FAIR - Category: #articles - Document Note: --- tags: - #composer - #fair - #wordpress Author: [Speaker not explicitly named in video] Source: YouTube Reference: [Making WordPress Composer FAIR](https://www.youtube.com/watch?v=nj3CABHavlY) date created: 2025-07-18 12:05 --- # Title: Making WordPress Composer FAIR ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical validity](#-logical-validity) - [🔍 DARVO Analysis Prompt](#-darvo-analysis-prompt) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: This video outlines the current limitations and future opportunities for integrating the FAIR (Federated and Independent Repositories) protocol with Composer in WordPress plugin management. The speaker explains how the FAIR plugin currently works, why it's important for package trust and security, and proposes a hypothetical project: a FAIR-based alternative to WP Packagist. They emphasize the importance of cryptographic signatures, decentralization, and the shift toward plugin developers managing their own package sources. --- ## 📖 Main Content: ### 🗒️ Notes - [00:00-00:26](https://www.youtube.com/watch?v=nj3CABHavlY&t=0) - Composer currently lacks full FAIR support. - Manual setup required to access the FAIR plugin via Git repo. - Composer install grants access to plugin, not infrastructure. - [00:47-01:14](https://www.youtube.com/watch?v=nj3CABHavlY&t=47) - FAIR plugin opts users into a protocol replacing WordPress.org infra. - Benefits: security layers, cryptographic package signing. - [01:16-01:46](https://www.youtube.com/watch?v=nj3CABHavlY&t=76) - Aspireress is the current FAIR mirror. - It signs packages on behalf of developers using WordPress.org as base. - [02:15-03:13](https://www.youtube.com/watch?v=nj3CABHavlY&t=135) - 3 Composer strategies: 1. Packagist (e.g., Yoast, Pantheon) 2. GitHub/git repos 3. WP Packagist - Wackagist gets source from WordPress.org SVN. - [03:38-04:02](https://www.youtube.com/watch?v=nj3CABHavlY&t=218) - If a dev doesn't provide a composer source, users fall back to WordPress.org. - Supply chain risks persist. - [04:14-05:01](https://www.youtube.com/watch?v=nj3CABHavlY&t=254) - Proposal: create a FAIR-based WP Packagist. - Could default to Aspireress but allow repo-based hierarchy. - Community involvement encouraged. --- ## 📖 References: - [FAIR protocol](https://fair.pm) - [GitHub FAIR package manager discussion](https://github.com/fair-pm/discussions) - [WP Packagist](https://wpackagist.org/) - [Composer](https://getcomposer.org/) --- ## 🗣️ Paraphrase: **Original:** “From a high level, fair is an infrastructural replacement for WordPress.org.” **Paraphrased:** FAIR is intended to serve as a decentralized infrastructure alternative to WordPress.org. **Original:** “There should be a fair-based model for composer packagist.” **Paraphrased:** The speaker suggests a FAIR-powered registry similar to WP Packagist for secure, decentralized Composer usage. --- ## 📰 Newsletter: **🔧 WordPress Plugin Management, Reimagined** Tired of Composer installs that rely too heavily on WordPress.org? This week, we're exploring a powerful video breaking down how the FAIR protocol (Federated and Independent Repositories) could transform Composer-based WordPress plugin management. 🎯 ➡️ Learn how the current FAIR plugin works, why cryptographic signing matters, and what it would take to stand up a decentralized "FAIR Packagist." 💡 Developers: Want greater trust and security in your plugin delivery? FAIR might just be your new best friend. 👉 [Watch the video](https://www.youtube.com/watch?v=nj3CABHavlY) 💬 Join the conversation on [GitHub Discussions](https://github.com/fair-pm/discussions) --- ## ✅ Action Items: - Promote cryptographic signing of Composer-distributed plugins. - Investigate internal FAIR-compliant repo use at GoDaddy. - Add Composer + FAIR into curriculum or workshops. - Guide contributors on FAIR’s trust hierarchy. - Support FAIR Packagist GitHub proposal. --- ## 🧪 Hypotheses: - FAIR adoption will improve plugin trust and security. - Developers prefer decentralized publishing to SVN reliance. ### 📊 Methodology: - Developer surveys. - Speed and security benchmarks: FAIR vs WP Packagist. ### ❓ Questions: - What’s blocking broader FAIR adoption? - Can FAIR integrate with existing WP workflows easily? ### 🔮 Future Research: - Usability testing for FAIR plugin integration. - GitHub automation tools for FAIR-compatible releases. ### 💡 Implications: - Major shift in WP plugin dev practices. - Decentralized, dev-owned update authority. --- ## 🧠 Learning Styles Assessment: - **Visual**: Needs visual architecture diagrams. - **Aural**: Strong—delivered via video. - **Verbal**: Clear, real-world examples. - **Kinesthetic**: Suggest hands-on setup guide. - **Logical**: Excellent repo comparisons. - **Social**: Invites community participation. - **Solitary**: Encourages self-exploration. - **Naturalistic**: Not addressed. --- ## 📊 Accessibility Assessment: - Lacks a complete video transcript. - Improve screen reader compatibility with a markdown/HTML version. - Suggest adding captions and audio descriptions. --- ## 🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment: - Neutral tone and accessible language. - Missing cultural and global representation. - Add gender-neutral phrasing where applicable. - Could segment video or transcript for neurodivergent users. --- ## ✅ Logical validity: - ✅ Sound reasoning: Composer fallback risks are clearly explained. - ✅ Valid causal chain: FAIR → signed sources → trust. - ⚠️ Mild appeal to emotion in contrasting trust (Aspireress vs. WP.org), but argument holds. --- ## 🔍 DARVO Analysis Prompt: No DARVO behaviors detected. The speaker offers constructive critique and system improvements, not blame or victimization reversals. --- ## 🔍 SEO Evaluation: - ✅ Keywords: FAIR, Composer, WP plugin security. - ⚠️ Meta description missing. - ✅ Strong linking structure. - ⚠️ No schema or Open Graph tags (transcript context). - ⚠️ No alt-text (video content only). --- ## 🎯 Conclusion: The FAIR protocol has the potential to fundamentally improve trust, decentralization, and supply chain security in WordPress plugin distribution. A FAIR-based Packagist could become a cornerstone in modern Composer workflows—if the community and infrastructure rise to meet the opportunity. - Summary: I want to use Composer on all of my WordPress projects. However, today, using Federated and Independent Repositories (FAIR) is unreachable for those of us who use WordPress with Composer. In this video, I talk about why that is and what we can do about it. - URL: https://www.youtube.com/watch?v=nj3CABHavlY As is not infrequently the case, I was thinking about Composer this week. I was thinking about Composer in the context of fair federated and independent repositories and the fact that today fair doesn't really support composerbased WordPress. You can install the fair plugin via composer, although you do need to manually add the git repository to do that. But using composer just gives you access to the fair plugin. It doesn't give you access to the fair infrastructure. Don't get me wrong, there are things the fair plug-in does beyond hook into the fair protocol, things that I actually wanted in this context when I was installing it, but hooking into the fair protocol is about 80 to 90% the point of using the plugin. From a high level, fair is an infrastructural replacement for WordPress.org. When you install the fair plugin, you're opting into using this new protocol. The protocol itself supports things like additional layers of security and checks to ensure that the source of your package updates is authoritative and uniquely cryptographically signed by the developer of those packages whether they be WordPress themes, plugins or WordPress core itself. Today what that means is that updates are coming from a server maintained by a community project called Aspireress. Aspireress maintains an independent mirror of WordPress.org and Aspireress is cryptographically signing the packages that it gets from WordPress.org on behalf of those developers. In other words, by using the current implementation of fair today, you are saying I trust Aspireress more than I trust WordPress.org. In the future, I expect plug-in developers to stand up their own fair repositories with cryptographically signed manifests for their packages that can be found across a fair protocol such that the source of truth is their source, their repository above and beyond Aspireress or any other fair powered mirror. What does that mean for composer? Well, to use composer with WordPress today, you have three options for installing packages. If the plug-in developer happened to publish the package on packagist which is the default repository for composer packages then you can use the packages repository natively by just going composer require vendor name plug-in name or whatever. An example of this is Yoast or Pantheon systems. We maintain our own uh packages versions of our plugins. If the plug-in developer didn't publish on packages but has a GitHub or other public git repository, you can add that repository to your composer JSON as a source and pull updates that way. If neither of these options exist, the publisher does not have a public git repository and did not publish on packagist, you can use the WordPress community project WP packagist. Wackagist is just a wordpress.org or mirror for composer like adding an individual public project git repository to your composer JSON file you need to have wp packages.org as a repository source in your composer file once you do you can run composer require wp packages plugin or wp packages theme and the plugin or theme name to install the plugin or theme and wackagist itself becomes the vendor in this case but the actual source files are still coming from wordpress.org org, specifically the WordPress.org SVN. In this model, if I want the developer to be the source of truth, I have two options that are entirely dependent on whether the developer has actually done the leg work to support a composer-based install. Either they put it up on packages or they have a public Git repository. If they have neither of these things, I'm probably going to be using W packages, which is fine except that it's subject to risk in the supply chain security if WordPress.org itself is ever compromised as a source. So the benefit of saying I trust Aspireress more than I trust WordPress.org is lost. I'm still getting my packages indirectly from WordPress.org. So what's the solution? Well, I believe there should be a fair-based model for composer packagist, a fair packagist, if you will. In this case, a project essentially identical to WP packagist could be stood up that uses a fair repository like Aspireress as the source rather than WordPress.org. Maybe this repository could also be connected more generally to the fair protocol so that queries for packages search those uniquely identifiable sources of truth that are spread disperately across the internet for individual plugins or themes assuming those repositories exist before falling back or defaulting to Aspireress or some other fair-based mirror. This is hypothetical. A solution does not exist. But if you agree with me or have other thoughts, I encourage you to comment on this discussion thread in the fair package manager discussion board on GitHub. In the meantime, I'm going to continue to look for and personally support publishing WordPress packages on packages or using GitHub repositories when available. But I will still be subject to sourcing updates for everything else from WordPress.org or SVN and miss out on the benefits of the fair protocol., Making WordPress Composer FAIR, Chris Reynolds, 01k0f4rxenv9v2bmk5vvnfk49y.