A small, zero-dependency Go library for the Composer ecosystem: read and manipulate Composer files, query or host a Composer repository, and generate SBOMs from lock files.

• Read, modify and write composer.json while preserving the formatting Composer expects and any fields the library does not model.
• Read composer.lock to inspect locked packages.
• Read and write auth.json for registry credentials.
• Query composer-type repositories (packagist.org, Satis, Private Packagist) over Composer's V2 protocol — versions, requirements, dist/source, search and security advisories.
• Serve your own repository over the same protocol and wire types, in the style of net/http.
• Generate a CycloneDX 1.7 JSON Software Bill of Materials from a Composer lock (github.com/shyim/go-composer/sbom submodule).

The library only depends on the Go standard library.

go get github.com/shyim/go-composer

The CycloneDX SBOM helpers live in a separate module so consumers can pull them independently:

go get github.com/shyim/go-composer/sbom@sbom/vX.Y.Z

This repository is a multi-module workspace (go.work lists . and ./sbom). Local development and CI use the workspace so sbom always sees the checked-out parent module; published consumers resolve a versioned require against the root module instead.

package main

import (
	"log"

	"github.com/shyim/go-composer"
)

func main() {
	c, err := composer.ReadJson("composer.json")
	if err != nil {
		log.Fatal(err)
	}

	c.AddPackage("monolog/monolog", "^3.0")

	if err := c.Save(); err != nil {
		log.Fatal(err)
	}
}

The library covers several use-cases; each has a focused guide:

• Working with composer.json — read, modify and write; dependencies, repositories and config; the extra section.
• Reading composer.lock — inspect locked packages.
• Working with auth.json — registry credentials and the supported authentication methods.
• Querying repositories — the client: a single repository, multi-repository sets, search, security advisories and auth.
• Serving a repository — the server: the Provider interface and the optional search/advisory capabilities.
• Generating a CycloneDX SBOM — turn a composer.lock into a Software Bill of Materials.

Full API documentation is available on pkg.go.dev.

MIT