{"action":"created","issue":{"url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/4","labels_url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/4/comments","events_url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/4/events","html_url":"https://github.com/TYPO3/CmsComposerPackageGenerator/issues/4","id":56273247,"number":4,"title":"Remove necessity to add typo3 user as maintainer on packagist","user":{"login":"helhum","id":904370,"avatar_url":"https://avatars.githubusercontent.com/u/904370?v=3","gravatar_id":"","url":"https://api.github.com/users/helhum","html_url":"https://github.com/helhum","followers_url":"https://api.github.com/users/helhum/followers","following_url":"https://api.github.com/users/helhum/following{/other_user}","gists_url":"https://api.github.com/users/helhum/gists{/gist_id}","starred_url":"https://api.github.com/users/helhum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/helhum/subscriptions","organizations_url":"https://api.github.com/users/helhum/orgs","repos_url":"https://api.github.com/users/helhum/repos","events_url":"https://api.github.com/users/helhum/events{/privacy}","received_events_url":"https://api.github.com/users/helhum/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-02-02T18:21:38Z","updated_at":"2015-02-03T22:13:31Z","closed_at":null,"body":"tl;dr I propose to just remove the section that proposes publishing TYPO3 CMS extensions on packagist.org from the composer.typo3.org website\r\n\r\nI don't know it this is the right place to put this as request, but since this repo is kind of related to composer.typo3.org I thought it might make sense here.\r\n\r\nMy major complaint is about the following advice on composer.typo3.org:\r\n`Add \"typo3\" as additional maintainer of your package on Packagist. This is required to have Gerrit's hook correctly triggering the update on Packagist.`\r\n\r\nWhile I understand the usefulness of a sync feature for git.typo3.org repos with packagist.org, I propose to nevertheless disable this feature or implement it differently. Here is why:\r\n\r\n* The typo3 user/maintainer on packagist is an official entity. It should only be associated with official packages (packages representing the TYPO3 product family or being part of it) This state should be reflected when visiting this URL: https://packagist.org/users/typo3/\r\n* The requirement to allow a foreign account to maintain (meaning delete, change URL ...)  someones package (for implementing a sync feature) is a security design flaw. Offering such a flawed \"concept\" IMHO harms the reputation of TYPO3\r\n* Promoting packagist.org as a repository for TYPO3 extensions/ packages (this for me includes third party Flow/ Neos packages) is wrong. I absolutely understand that we cannot provide an alternative right now, but we must rather sooner or later set up our own \"packagist\" which acts as repository for Flow/ Neos packages, (legacy) TER extensions and (new) TYPO3 CMS Extensions. We need this, because only then we (as a community) can offer \"premium\" services like cleaning out or hiding outdated or insecure packages.\r\n\r\nI know that the things I've written here would require quite a bit of planning and work. I'm happy to help here, but cannot promise something short term.\r\n\r\nBecause of that I propose to just remove the section that proposes publishing TYPO3 CMS extensions on packagist.org from the composer.typo3.org website.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/comments/72746787","html_url":"https://github.com/TYPO3/CmsComposerPackageGenerator/issues/4#issuecomment-72746787","issue_url":"https://api.github.com/repos/TYPO3/CmsComposerPackageGenerator/issues/4","id":72746787,"user":{"login":"cedricziel","id":418970,"avatar_url":"https://avatars.githubusercontent.com/u/418970?v=3","gravatar_id":"","url":"https://api.github.com/users/cedricziel","html_url":"https://github.com/cedricziel","followers_url":"https://api.github.com/users/cedricziel/followers","following_url":"https://api.github.com/users/cedricziel/following{/other_user}","gists_url":"https://api.github.com/users/cedricziel/gists{/gist_id}","starred_url":"https://api.github.com/users/cedricziel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cedricziel/subscriptions","organizations_url":"https://api.github.com/users/cedricziel/orgs","repos_url":"https://api.github.com/users/cedricziel/repos","events_url":"https://api.github.com/users/cedricziel/events{/privacy}","received_events_url":"https://api.github.com/users/cedricziel/received_events","type":"User","site_admin":false},"created_at":"2015-02-03T22:13:31Z","updated_at":"2015-02-03T22:13:31Z","body":"Basically @NamelessCoder summed it up very well.\r\n\r\nMy POV is that we desperately need to have easier access to 3rd party packages. (Which would also allow integrating proven components even into the core much, much easier.)"}}