Given these realities:
- A user should be able to use Composer to install extensions if they want to, but nobody should be forced to use it
- Most extensions do not have a valid composer.json file, nor want to add one.
- Most extensions are not on Packagist.org (and you could certainly argue that they shouldn't be).
- Most extensions do not use git tagging (which is required by Packagist.org to determine the version).
- If an extension is not on Packagist.org, a user must manually specify the VCS repository in their composer.json
A Wikimedia Composer Repository should be created which resolves all of the issues above.
This is similar to what Drupal.org has done for the Drupal extensions: