FAIR Package Management for TYPO3  🔗 **Source:** [FAIR Package Management for TYPO3](https://share.snipd.com/episode/469c354c-048f-4484-9268-dfb5d215ceb7) ## Highlights - **FAIR Is Platform Agnostic By Design** - FAIR is a platform-agnostic protocol for distributing digital goods with a federated, independent governance model. - Brent explained it began to address WordPress supply-chain risk but was designed from the start to work for any digital bit across systems. Transcript: Brent Is an acronym, of course. It stands for Federated and Independent Repositories. So, it is a system of updating software or distributing digital goods, essentially. So, a software supply chain that is distributed rather than being controlled by one sort of monolithic entity. So it has a governance structure that keeps it independent. Kareem Maruki Right. And FAIR originally was made to solve the problem of supply chain risk around WordPress. So what was interesting was since roughly January of 2025 through June of 2025, there was a lot of development around the first prototype and working proof of concept of FAIR. And then from June towards the end of the year of 2025, it really became production ready and was tested at scale, had security audits, and did a lot of good work towards being available As an alternative way to maintain WordPress. ([Time 0:01:40](https://share.snipd.com/snip/35ce33ca-7746-4951-bca2-894f3b3f102a)) - **FAIR Emerged From WordPress Supply Chain Crisis** - FAIR started as a response to WordPress supply-chain drama and quickly moved from prototype to production with audits and scale testing in 2025. - Kareem described rapid development from January to year-end 2025, culminating in security audits and production readiness. Transcript: Kareem Maruki Right. And FAIR originally was made to solve the problem of supply chain risk around WordPress. So what was interesting was since roughly January of 2025 through June of 2025, there was a lot of development around the first prototype and working proof of concept of FAIR. And then from June towards the end of the year of 2025, it really became production ready and was tested at scale, had security audits, and did a lot of good work towards being available As an alternative way to maintain WordPress. Brent Yes. Kareem Maruki And its ecosystem, right? Brent Yeah, and it's important to say that although WordPress was sort of some drama there that was the impetus to get started with FAIR, when we designed the FAIR protocol and implemented The first working versions, we made it to be platform agnostic. So it can work with WordPress. But from the very outset, we said, well, let's design this to just work for anything. And then we'll just add in the little WordPress bits. And then if we need for a different platform or for a different system, if we need to add in a few other little augmentations, we'll do that. But its design is to work for any kind of digital bit. Kareem Maruki Well, yes. And that was the concept from the very beginning. When Yost and I posited the possibility of FAIR, we wanted it to try and be as agnostic as possible. Brent Yeah. Because it was not only technical independence. It's also a supply chain management, risk management strategy. Right. Kareem Maruki So once we were in that development phase, that's when we started talking about, well, do we do things the WordPress way or using Laravel and other tools? Do we make sure it's agnostic? ([Time 0:02:12](https://share.snipd.com/snip/189e436e-5e9b-463c-ab3e-822e3d6df1f7)) - **Typo3 Migrated 8,700 Extensions Into FAIR** - Typo3 moved its entire extension repository into FAIR and made FAIR a Composer plugin to fetch packages from multiple sources. - Benny reported migrating ~8,700 extensions into a FAIR-compatible format and adding a Composer plugin (experimental) to unify installs. Transcript: Benny Of all, I need to go back a little bit. I think back in 2017, we started with this composer mode, maybe earlier. And we had a separate domain, composer.type3 And it served as a similar infrastructure as packages, the main platform for all composer-based installations natively. And it was built as a wrapper for our plugins and extensions to be used. And it turned out we had a lot of workarounds, and it's just our ecosystem, our plugins. And we, inside the core, we migrated towards a more standardized way of dealing with the Composer manifest JSON file to actually become native Composer based. So we're actually, we could delete Composer type03.org because we're now using the global system that everybody else uses with Symfony and Laravel out of the box. But we have still the classic, the non-composer mode for our installations out there, and we want them to also make use of that. And with that, in this week's outcome, we made it possible to move all the packages that we have on our extension repository moved into FAIR. ([Time 0:07:18](https://share.snipd.com/snip/6085d3d2-d9f8-4266-ac54-4c1910b98e13)) - **Use FAIR To Unify Multiple Distribution Modes** - Do adopt FAIR to unify disparate distribution systems instead of maintaining separate package repositories per install mode. - Benny showed how FAIR lets classic non-Composer Typo3 installs and Composer-based installs use the same federated repositories. Transcript: Benny I think back in 2017, we started with this composer mode, maybe earlier. And we had a separate domain, composer.type3 And it served as a similar infrastructure as packages, the main platform for all composer-based installations natively. And it was built as a wrapper for our plugins and extensions to be used. And it turned out we had a lot of workarounds, and it's just our ecosystem, our plugins. And we, inside the core, we migrated towards a more standardized way of dealing with the Composer manifest JSON file to actually become native Composer based. So we're actually, we could delete Composer type03.org because we're now using the global system that everybody else uses with Symfony and Laravel out of the box. But we have still the classic, the non-composer mode for our installations out there, and we want them to also make use of that. And with that, in this week's outcome, we made it possible to move all the packages that we have on our extension repository moved into FAIR. And FAIR become a Composer plugin to also fetch the data from all sources. So it's basically merging everything together we've wanted for a long time. That's wonderful. Wonderful. Kareem Maruki So as we sit here and we're recording this, we are four hours from the end of the hackathon. What do you hope to accomplish? Benny What do you hope to be able to announce on stage? In general, I would say... About the outcome of this weekend, yes. The outcome of this weekend is like we wanted to make sure, we wanted to see if the FAIR protocol is really so robust in a way that we can actually make use of it. Before, we had our own bubble, and now what we've accomplished so far is actually take all of our extensions and bring it into a FAIR compatible format. At the same time, modify our core system to also fetch data from a FAIR compatible repository, any repository. And this way, it's really the federated approach that we can now dock into any kind of system. And it doesn't matter if it from typo3.org or from any other platform. Obviously, we only currently only support type of three extensions, but that's a different topic because it can be any kind of digital goods. But we're talking the same language. ([Time 0:07:21](https://share.snipd.com/snip/b15b35fc-fbbc-47d8-af4e-f6ff6e50b7a1)) - **Global Mirroring With Aspire Cloud Improves Resilience** - FAIR packages will be browsable at fair.pm and indexed in Aspire Cloud with mirrored hosts in Germany and Canada for resilience. - Brent announced a new EU Aspire Cloud mirror plus the existing North America mirror to improve global robustness. Transcript: Brent And and on the fair side yeah we're we'll we'll be able to um to browse typo 3 packages at fair.pm on the website uh and download them from there if you wanted to do something manually because They'll all be indexed in Aspire Cloud, which will also have a new Aspire Cloud mirror running, hosted in the EU in Germany, as well as the one that's hosted in North America in Canada. So we'll have two, you know, sort of global hosts mirroring, talking to each other. ([Time 0:12:00](https://share.snipd.com/snip/cf8188d7-8279-4c4d-b406-f1023b5a0e8d)) - **FAIR Can Serve Any Platform Not Just PHP** - FAIR is not limited to PHP CMSs and can distribute any digital goods across languages and platforms. - Benny suggested JavaScript-based platforms could adopt FAIR since it defines an exchange format, not a language binding. Transcript: Benny And it's not like PHP related or anything, right? Because it's a format, exchange format or like how to hold these kinds of digital goods. So, yes, I think more CMSs should adopt it. It might be interesting to look into other platforms that might be, you know, that maybe are JavaScript based or something like that, that could utilize FAIR as well and see where we Get there. ([Time 0:13:20](https://share.snipd.com/snip/c13c8e9b-1835-423e-bdd0-15088b59853a)) - **Extend FAIR Into ERP And Other Systems** - Try using FAIR to extend package ecosystems beyond CMSs into ERP and other systems to share digital goods across domains. - Kareem noted his team could bring non-CMS packages into FAIR to support ERP customers and broader ecosystems. Transcript: Kareem Maruki So the way the architecture is running now, we could actually start bringing in packages that actually didn't have to do with WordPress or Type 03 to support ERP customers and that ecosystem. Yeah, absolutely. Great. All right. So with that being said, back to Bob. Thank you so much. ([Time 0:14:30](https://share.snipd.com/snip/51a76bed-94b1-4144-a224-eab2093a3517))