FAIR Package Management for TYPO3

Bringing Federated Extension Distribution to the TYPO3 Ecosystem

TYPO3 would like to leverage the FAIR model and architecture for distributing TYPO3 Extensions. Using FAIR, TYPO3 would become more robust, expanding available options for indexing, browsing, and installing available extensions, providing a means of federating the hosting of TYPO3 Extensions and establishing a scalable platform for the growth of the CMS and its ecosystem.

The FAIR Package Management for TYPO3 project offers significant benefits. For TYPO3, implementing the FAIR Protocol allows for installing extensions from multiple sources (Composer, TER, and individual repositories with FAIR Beacon), providing stronger supply-chain compliance and verification through FAIR’s checks and labeling. For FAIR, adding TYPO3 support widens its implementation beyond the WordPress ecosystem, strengthening the protocol and broadening its appeal by working closely with the TYPO3 community.

Technical Approach

The project integrates FAIR’s federated architecture with TYPO3’s extension ecosystem through four key components:

1. Client-Side Integration: Enable TYPO3 to browse and install packages served through FAIR Aggregators, either within TYPO3 core or as an extension.
2. Aggregator Population Pipeline: Ingest TYPO3 extensions from existing Composer sources and TER, parse metadata from composer.json and ext_emconf.php, manage DIDs (Decentralized Identifiers), and serve packages to AspireCloud.
3. AspireCloud Extension: Extend the FAIR Aggregator to support TYPO3-specific labels and taxonomies for filtering and sorting packages.
4. Tailor Enhancement: Extend TYPO3’s Tailor CLI to manage submissions to FAIR Aggregators with cryptographically signed metadata documents.

Target Audience

PHP Developers (TYPO3 Experience)
Build the TYPO3 client-side integration, work with ext_emconf.php parsing, and implement the extension browsing/installation UI within TYPO3.

Backend / API Developers
Design and implement the aggregator population pipeline, including the Discovery Scanner, Metadata Parser, and Aggregator Updater components.

Security / Cryptography Enthusiasts
Work on DID utilities, ED25519 signature verification, and cryptographic signing workflows for the FAIR Protocol integration.

DevOps / Infrastructure Engineers
Set up scheduled tasks for index updates, CI/CD integration for Tailor, and infrastructure for the TYPO3 FAIR Aggregator instance.

FAIR Protocol Contributors Extend AspireCloud to support TYPO3 taxonomies and ensure protocol compatibility across CMS ecosystems.

Hackathon Goals

1. Implement TYPO3 client-side support for FAIR
   Create the ability to browse and install packages served through FAIR within TYPO3, supporting FAIR Aggregator(s) as an extension source within TYPO3 core or as a standalone extension.
2. Build the FAIR Package Aggregator population pipeline
   Populate a FAIR Package Aggregator with TYPO3 extensions from existing Composer sources and TER:
   • Discovery Scanner: Ingest extension listings, remove duplicates, index by TYPO3 Extension Key
   • Metadata Parser: Extract and parse composer.json and ext_emconf.php to populate FAIR-formatted metadata
   • DID Utilities: Verify DIDs to their source, register new DIDs for packages without them
   • Aggregator Updater: Verify metadata completeness and serve to AspireCloud
3. Extend AspireCloud for TYPO3 taxonomies
   Add support for labels and taxonomies used by TYPO3 extensions, enabling proper filtering and sorting of packages within the aggregator.
4. Extend TYPO3 Tailor for FAIR submission
   Enable Tailor to manage submissions to a FAIR Aggregator in addition to TER, with cryptographically signed metadata documents per the FAIR Protocol. Add DID Manager tooling to assist developers in their publishing workflows.

Stretch Goals

• Policy Engine support for labels
  Build on work from the 2025 CloudFest USA Hackathon to implement policy-based filtering and trust decisions based on package labels.
• Extended package validation (FAIR Forge)
  Incorporate static code scans and other security checks prior to publishing any release, strengthening supply-chain security.