|
|
|
|
|
|
by BrianHenryIE
626 days ago
|
|
|
* Composer is one file. It's a .phar (as described by @az09mugen) * I think in typical use, Composer is installing via Packagist.org, which is typically pointed at a GitHub repo, and it is the repo's zip file that is downloaded to your computer. You can look in composer.lock and see `"type": "zip"` throughout * It definitely has some sort of hash verification in the PostFileDownloadEvent class. I've never used it to know if it would satisfy your need Similarly, WP CLI is a .phar file which can then install additional packages. It's really just using Composer under the hood. |
|
|