Composer

Replace Packagist with the Package Firewall's Composer repository and put the credentials in auth.json.


Repository URL	`https://packages.vulnetix.com/composer`
Ecosystem ID	`composer`
Plan	Add-on
Mode	filter: Packagist v2 metadata is filtered
Cooldown	yes
Default mirror	`https://repo.packagist.org`

Automatic setup

vulnetix package-firewall composer

This writes two whole files under ~/.composer/, backing up existing ones to .vulnetix.bak.

~/.composer/config.json:

{
  "repositories": {
    "packagist.org": false,
    "vulnetix": {
      "type": "composer",
      "url": "https://packages.vulnetix.com/composer"
    }
  }
}

~/.composer/auth.json:

{
  "http-basic": {
    "packages.vulnetix.com": {
      "password": "YOUR_API_KEY",
      "username": "YOUR_ORG_UUID"
    }
  }
}

Composer reads credentials only from auth.json (or config.http-basic). http-basic at the top of config.json is ignored and gives 401.

Manual equivalent

composer config --global repositories.packagist.org false
composer config --global repositories.vulnetix composer https://packages.vulnetix.com/composer
composer config --global http-basic.packages.vulnetix.com "$VULNETIX_ORG_ID" "$VULNETIX_API_KEY"

Use and verify

composer config --global --list | grep -i vulnetix
composer clear-cache
composer require monolog/monolog