composer/composer — pull request #1092 by EvanDotPro (2012-09-10 01:20:34+00:00)
Title: Fix MITM vulnerability for issue #1074 - Needs review

### Disclaimer: I am not a security expert. This PR is mostly common sense, but should still be reviewed by the community before being merged, especially those well-versed in security.

This PR contains the following security fixes, and attempts to address [issue #1074](https://github.com/composer/composer/issues/1074):

- Self-update and packagist are now forced to use SSL.
- This ntroduces a hard dependency on the openssl extension when using
self-update or packagist. Users should not be using either without
utilizing a proper SSL connection anyway.
- Keeps a trusted CA bundle file in the composer home directory.
- Attempts to copy over the operating system CA bundle if available.
- Upon encountering an untrusted certificate, the user is prompted if
they would like to trust the certificate and the CA in the future. If
they choose yes, the root CA for that cert is added to the CA bundle
in the composer home directory.
- Expired certificates generate an extra warning and prompt.
- Invalid common names generate an extra warning and prompt.