How does the Composer trick with re-defining the packagist repo work?

Question

In the issue (#3156) discussion "composer is very slow" on the Composer GitHub page is suggested to

re-define the packagist repo with a https:// url in the global config using:

$ composer config --global repo.packagist composer https://packagist.org

That should work around the downgrade issue, but it'd be interesting to resolve it of course.

~~It really brings a appreciable speed boost.~~ I've just tested this for Zend Framework 2 (see test below).

How does it work? (Why does disabling of the allow_ssl_downgrade option make the process faster?)

EDIT

I run composer create-project zendframework/zendframework combining two factors: cache and the re-defining the packagist repo with turning allow_ssl_downgrade off. I got following results for the resulting four cases:

Default configs:

config: default ([repositories.packagist.url] https?://packagist.org, [repositories.packagist.allow_ssl_downgrade] true)
cache: empty (composer clear-cache)
result: 3m38s

config: default ([repositories.packagist.url] https?://packagist.org, [repositories.packagist.allow_ssl_downgrade] true) 
cache:  not empty
result: 54s

config: changed ([repositories.packagist.url] https://packagist.org)
cache:  empty (composer clear-cache)
result: 3m34s

config: changed ([repositories.packagist.url] https://packagist.org)
cache:  not empty
result: 56s

Summary: The "trick" with disabling allow_ssl_downgrade brings no speed boost.

Nevertheless it would be nice to know: What does the allow_ssl_downgrade option actually do? (What does this "downgrading" mean? What are the advantages and disadvantages?)

score 1 · Accepted Answer · edited Feb 28 '16 at 10:31

Because the second time you run composer create-project zendframework/zendframework it took everything from composer's cache instead of downloading it again!

You can see that it outputs something like the following where it say Loading from cache if you run it a second time:

Installing zendframework/zendframework (2.5.2)
  - Installing zendframework/zendframework (2.5.2)
    Loading from cache

Make sure to run composer clear-cache between your tests to get reliable results.

EDIT//

If we have a look into Composer's source code we can find this line:

if ($this->allowSslDowngrade) {
    $this->url = str_replace('https://', 'http://', $this->url);
}

If allowSslDowngrade = true
The main file is retrieved over https (see here) the rest over http because that's a way faster. The integrity of the other files are checked via the sha256, which should be sufficient protection against MITM attacks.

If allowSslDowngrade = false
Everything is retrieved over https

The differences in your measurements might be the result of varying Internet speed or server cpu/network load or something.

@automatix I edited my answer hope this makes it clear for you — Pᴇʜ, Nov 20 '15 at 07:32

score 0 · Answer 2 · answered Nov 19 '15 at 13:59

0

Did you actually clear your cache in between? Because that would also significantly decrease the install time on a second run.

I was not able to create such a big difference by changing the configuration and clearing the cache in between.

answered Nov 19 '15 at 13:59

alcohol

22,596
4
23
21

Yes, it's a good point. I performed the test again and updated the question. – automatix Nov 19 '15 at 16:22

How does the Composer trick with re-defining the packagist repo work?

2 Answers2

EDIT//