Funding from Alpha-Omega is enabling us to work on a new level of artifact integrity for Packagist and Composer. Rather than just providing JSON metadata pointing at download URLs, Packagist.org will provide immutable artifact files, publish checksums and signatures. Composer will verify the packages it installs originate from