composer/composer — pull request #2745 by padraic (2014-02-23 14:43:31+00:00)
Title: [WIP] SSL/TLS Support

This is a work in progress! Please do review and comment.

This PR is designed to do a few things:
1. The RemoteFilesystem class configures itself with default TLS options in line with PHP 5.6's adopted values if TLS protection has NOT been explicitly disabled by the user. This means Composer does everything possible to do HTTPS right - and let's the user shoulder the risk of disabling it.
2. Where any TLS option needs user input, e.g. a CA certificate file, we give them an error. They can now set a cafile option in config.json or pass a cafile option with value on CLI. If they can't/won't do that, they can resort to setting a disable-tls option in config.json or via CLI at their own risk. This is currently implemented for the self-update command only.
3. Leaves Composer free of the responsibility of distributing CA cert files. It's just not realistic to expect that when the user can just go off and download it themselves in a few seconds. We do check for local certs courtesy of some borrowed code from @EvanDotPro's SSlurp for Linux.

TODO:
1. Check all other commands and allow for disabling TLS on the command line.
2. Same as above for a CA certificate file.
3. Assess suitability of the current CN_match value setting. PHP matches it strictly, so some certs might have example.org but others www.example.org. A connection retry might be necessary to check host vs full domain.
4. The disable-tls checks should all default to off under PHP 5.6 since it does all this automatically from that version.
5. Assess Subject Alternative Names support. I'm poking @rdlowrey to see if it can be backported to at least PHP 5.4 (never will hit 5.3 which is almost EOL anyway). An intermediate fix would be to let the user (not the repository) define it in advance.
6. I've added unit tests - but no functional tests.
7. Documentation updates.

I'm hoping to complete the PR over the next week - but feel free to PR my fork (the tls-config branch).