>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3477553. --> Reported by: [ergonlogic](https://www.drupal.org/user/368613) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Postponed on <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-1"><a href="https://www.drupal.org/project/infrastructure/issues/3579174" title="Status: Active">#3579174: [meta] Diagnose issues related to TUF-enabled projects</a></span>.</p> <p>We'd like to have the community start to test TUF via Composer directly (i.e. not via Automatic Updates). We'd also like to gather some real-world data about how much TUF metadata is being downloaded, and how is scales with the number of Drupal packages installed.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>First off, thank you for helping to test the new TUF-secured infrastructure on drupal.org. By doing so, you are helping to ensure the stability of these new systems, and providing valuable feedback that will guide future plans for improvements.</p> <p>Before you start, you'll need a Drupal project where you can run Composer at the command-line. Ideally, you can test this on one or more existing projects, because we're looking for feedback on real-world scenarios. If not, see the <a href="https://www.drupal.org/docs/getting-started/installing-drupal/get-the-code">Drupal installation documentation</a> for how to get set up.</p> <p>The first step is to add the PHP-TUF Composer Integration Plugin, and authorize Composer to run it. From the root of your project, run the following:</p> <pre>composer config allow-plugins.php-tuf/composer-integration true<br>composer require php-tuf/composer-integration:dev-main --dev</pre><p>To provide the root of trust for TUF verifications, download the initial root metadata for these two repos:</p> <pre>mkdir tuf<br>curl -o tuf/packages.drupal.org.json https://packages.drupal.org/8/metadata/1.root.json<br>curl -o tuf/packagist-signed.drupalcode.org.json https://packagist-signed.drupalcode.org/metadata/1.root.json</pre><p>Next, you will need to configure Composer to enable TUF protection for the Drupal package repository:</p> <pre>composer tuf:protect https://packages.drupal.org/8</pre><p>Then, add the signed repository for Drupal core (and related projects) and enable TUF protection for it too:</p> <pre> <br>composer config repositories.drupal-core composer https://packagist-signed.drupalcode.org<br>composer tuf:protect https://packagist-signed.drupalcode.org</pre><p>Finally, update Composer dependencies:</p> <pre>composer -vv update</pre><p>You should see the following in the output:</p> <blockquote><p> [TUF] Packages from <a href="https://packages.drupal.org/8">https://packages.drupal.org/8</a> are verified by TUF. This may impact performance.<br> [TUF] Packages from <a href="https://packagist-signed.drupalcode.org">https://packagist-signed.drupalcode.org</a> are verified by TUF. This may impact performance.<br> Authenticity of packages from <a href="https://asset-packagist.org">https://asset-packagist.org</a> are not verified by TUF.<br> Authenticity of packages from <a href="https://repo.packagist.org">https://repo.packagist.org</a> are not verified by TUF. </p></blockquote> <p>If you see any errors, please immediately <a href="https://www.drupal.org/node/add/project-issue/infrastructure?component=Packaging">file a bug report</a> on the "drupal.org infrastructure" project, using the "Packaging" component.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>We're trying to gather some performance metrics as well. If you'd like to help with this, please follow the steps below, and report the results.</p> <p>First, we'd like to know how many Drupal packages (modules, themes, etc.) your project is using:</p> <pre>$ composer show | grep drupal/ | wc -l<br>&nbsp; 15</pre><p>Second, we'd like to know how much TUF metadata was downloaded to cover those packages.</p> <pre>$ du -sh vendor/composer/tuf<br>2.9M vendor/composer/tuf</pre><p>To report the results, add a comment below. This can be as simple as:</p> <blockquote><p> Packages: 15<br> TUF metadata: 2.9M </p></blockquote> <p>Thank you again for helping to test the new TUF-secured infrastructure on drupal.org.</p>