composer / ca-bundle

Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.

Dependency Management for PHP

Composer helps you declare, manage, and install dependencies of PHP projects.

See https://getcomposer.org/ for more information and documentation.

Installation / Usage

Download and install Composer by following the official instructions.

For usage, see the documentation.

Packages

Find public packages on Packagist.org.

For private package hosting take a look at Private Packagist.

Community

Follow @packagist or @seldaek on Twitter for announcements, or check the #composerphp hashtag.

For support, Stack Overflow offers a good collection of Composer related questions, or you can use the GitHub discussions.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project and its community you agree to abide by those terms.

Requirements

Latest Composer

PHP 7.2.5 or above for the latest version.

Composer 2.2 LTS (Long Term Support)

PHP versions 5.3.2 - 8.1 are still supported via the LTS releases of Composer (2.2.x). If you run the installer or the self-update command the appropriate Composer version for your PHP should be automatically selected.

Binary dependencies

• 7z (or 7zz)
• unzip (if 7z is missing)
• gzip
• tar
• unrar
• xz
• Git (git)
• Mercurial (hg)
• Fossil (fossil)
• Perforce (p4)
• Subversion (svn)

It's important to note that the need for these binary dependencies may vary depending on individual use cases. However, for most users, only 2 dependencies are essential for Composer: 7z (or 7zz or unzip), and git.

Authors

• Nils Adermann | GitHub | Twitter | [email protected] | naderman.de
• Jordi Boggiano | GitHub | Twitter | [email protected] | seld.be

See also the list of contributors who participated in this project.

Security Reports

Please send any sensitive issue to [email protected]. Thanks!

License

Composer is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

• This project's Solver started out as a PHP port of openSUSE's Libzypp satsolver.

ca-bundle's Issues

Homebrew OS X certificates are not loaded.

When using Homebrew's distro of OpenSSL, certificates are loaded from the certs.pem file (as addressed by #5), but they can also be placed in the /usr/local/etc/openssl/certs directory. It seems that using the latter method does not work with Composer.

I'm attempting to access a private Composer repository (built with Satis) secured via TLS with a certificate issued by a self-signed CA.

The error message I receive is:

The "https://<redacted>/packages.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Failed to enable crypto
failed to open stream: operation failed
https://<redacted> could not be fully loaded, package information was loaded from the local cache and may be out of date

Please forgive my naivety on the subject. I'm not sure exactly which project should be responsible for loading these certificates, but I believe the problem to be localised to composer/ca-bundle as I'm able to fetch the package.json file with file_get_contents() successfully using the same PHP binary.

Setting SSL_CERT_DIR to /usr/local/etc/openssl/certs, does solve this particular problem, but then the regular certs.pem file is not loaded, so the certificate for packagist.org can no longer be verified.

"Portable" `openssl.cafile` location fails to be detected properly on Windows

If the openssl.cafile location is used on Windows with a portable path like openssl.cafile = "\dev\xampp\apache\bin\curl-ca-bundle.crt", Composer will fail to properly detect and validate it, falling back to the bundled CA instead.

Note the backslashes and the lack of a drive letter (i.e. d:).

Such a setup is used by the portable version of XAMPP on Windows. It checks the folder on the currently active drive for the process.

If the configuration is changed to openssl.cafile = "d:\dev\xampp\apache\bin\curl-ca-bundle.crt" it seems to work correctly.

I'm not 100% sure this can or should be solved by Composer, but wanted to keep track of the issue here nevertheless.

See related issue where this was detected: wp-cli/package-command#104 (comment)

class CaBundle does not extends from class Bundle -> BundleInterface

Hi,

BundleInterface implements method getName():

    /**
     * Returns the bundle name (the class short name).
     *
     * @return string The Bundle name
     */
    public function getName();

The recipe adds an entry for CaBundle to bundles.php in Symfony.

https://github.com/symfony/http-kernel/blame/master/Kernel.php implements:

protected function initializeBundles()
    {
        // init bundles
        $this->bundles = [];
        foreach ($this->registerBundles() as $bundle) {
            $name = $bundle->getName();
            if (isset($this->bundles[$name])) {
                throw new \LogicException(sprintf('Trying to register two bundles with the same name "%s".', $name));
            }
            $this->bundles[$name] = $bundle;
        }
    }

Method getName() is not existing in composer/ca-bundle. This leads to
Attempted to call an undefined method named "getName" of class "Composer\CaBundle\CaBundle". on "dev" environment.

Problem after updating to 1.2.0 version

Weve updated this package to version 1.2.0 (it is in dependencies in bugnsag package that we use) after that we get error about. "open_basedir restriction in effect" in path "/etc/pki/tls/certs/ca-bundle.crt".

We use CentOS with CloudLinux and we did not have this problem in previous version of package (1.1.4) is that behavior expected - throwing exception when cannot get to the file?

If possible we would like not to change open_basedir path.

Thanks in advance.

Copying bundle outside of Phar

Currently, if this package is used from a Phar file, the implementer needs to manually copy the CA bundle outside of the Phar file in order for the bundle to work with curl. Composer, for instance, implements this functionality. It would be nice if that functionality could be moved into this package so that other users would not need to reimplement it.

Automatic updating of cacert.pem?

Currently the cacert.pem is not updated automatically and usually someone just opens a PR after the bundle is updated on https://curl.haxx.se/docs/caextract.html and I suppose there is a manual work needed to verify the diff.

I propose to do it somehow automatically - e.g. with Travis cron job. It can either download the .pem file from https://curl.haxx.se/docs/caextract.html or use the mk-ca-bundle tool to run the extraction during the build. It can also commit the extracted file (if it was changed). Afterwards only the tagging will be a manual action (maybe with some verification)

If you think it is a good idea, I can prepare it.

open_basedir restriction not handled

Version 1.3.0

The calls to "realpath()" in the new debug traces generated when a certificate is not readable/doesn't exist are throwing an error.
eg: realpath(): open_basedir restriction in effect. File(/etc/ssl/certs/ca-certificates.crt) is not within the allowed path(s).

vendor/composer/ca-bundle/src/CaBundle.php:371:
$logger->debug(sprintf('Checked CA file %s does not exist or it is not a file.', realpath($certFile)));
vendor/composer/ca-bundle/src/CaBundle.php:385:
$logger->debug(sprintf('Checked directory %s does not exist or it is not a directory.', realpath($certDir)));
vendor/composer/ca-bundle/src/CaBundle.php:399:
$logger->debug(sprintf('Checked file or directory %s is not readable.', realpath($certFileOrDir)));

Missing Changelog

This project is missing a CHANGELOG.md Do you think it is possible to add this file?

Attempted to call an undefined method named "getName" of class "Composer\CaBundle\CaBundle"

PHP Fatal error:  Uncaught Symfony\Component\Debug\Exception\UndefinedMethodException: Attempted to call an undefined method named "getName" of class "Composer\CaBundle\CaBundle". in /app/vendor/symfony/http-kernel/Kernel.php:430
Stack trace:
#0 /app/vendor/symfony/http-kernel/Kernel.php(130): Symfony\Component\HttpKernel\Kernel->initializeBundles()
#1 /app/vendor/symfony/framework-bundle/Console/Application.php(159): Symfony\Component\HttpKernel\Kernel->boot()
#2 /app/vendor/symfony/framework-bundle/Console/Application.php(65): Symfony\Bundle\FrameworkBundle\Console\Application->registerCommands()
#3 /app/vendor/symfony/console/Application.php(147): Symfony\Bundle\FrameworkBundle\Console\Application->doRun(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#4 /app/bin/console(38): Symfony\Component\Console\Application->run(Object(Symfony\Component\Console\Input\ArgvInput))
#5 {main}
  thrown in /app/vendor/symfony/http-kernel/Kernel.php on line 430

adgoal-common/alerting                v1.13.1            Adgoal Alerting common library
adgoal-common/alerting-bundle         v1.13.1            Adgoal Alerting symfony bundle common library
adgoal-common/base                    v1.13.1            Adgoal Base common library
adgoal-common/command-bus             v1.13.1            Adgoal CommandBus common library
adgoal-common/error-reporting         v1.13.1            Adgoal ErrorReporting common library
adgoal-common/error-reporting-bundle  v1.13.1            Adgoal ErrorReporting symfony bundle
adgoal-common/fault-tolerance         v1.12.3            Adgoal Fault Tolerance common library
adgoal-common/guzzle-pack             v1.13.1            Adgoal Guzzle Pack common library
adgoal-common/monitoring              v1.13.1            Adgoal Monitoring component
adgoal-common/saga                    v1.13.1            Adgoal Saga common library
adgoal-common/task                    v1.13.1            Adgoal Task common library
adgoal-common/task-bundle             v1.13.1            Adgoal TaskBundle common library
adgoal-common/tracking-link-checker   v1.13.1            Adgoal Tracking Link Checker common libraries
adgoal/broadway-saga                  0.9.2              Proof-of-concept component providing saga functionality to broadway/broadway.
adgoal/dbal-fault-tolerance           v1.9.2             Auto reconnect on Doctrine MySql has gone away exceptions on doctrine/dbal
adgoal/guzzle-rewind-middleware       0.0.1              Adgoal GuzzleRewindMiddleware
adgoal/statsd-client-bundle           v1.9.0             Provides a statsd client and simple ready-to-use support for #Symfony2 Application
adgoal/statsd-php-client              v1.1               Statsd (Object Oriented) client library for PHP
amphp/amp                             v2.4.4             A non-blocking concurrency framework for PHP applications.
amphp/byte-stream                     v1.7.3             A stream abstraction to make working with non-blocking I/O simple.
beberlei/assert                       v3.2.7             Thin assertion library for input validation in business models.
behat/gherkin                         v4.6.2             Gherkin DSL parser for PHP 5.3
broadway/broadway                     2.2.1              Infrastructure and testing helpers for creating CQRS and event sourced applications.
broadway/broadway-bundle              0.4.2              Symfony bundle for broadway/broadway.
broadway/event-store-dbal             0.3.0              Event store implementation using doctrine/dbal
broadway/uuid-generator               0.4.0              UUID generator for broadway/broadway.
caseyamcl/guzzle_retry_middleware     v2.3.3             Guzzle middleware that handles HTTP Retry-After middleware
clue/stream-filter                    v1.4.1             A simple and modern approach to stream filtering in PHP
codeception/base                      3.1.0              BDD-style testing framework
codeception/phpunit-wrapper           7.8.0              PHPUnit classes used by Codeception
codeception/specify                   1.3.0              BDD code blocks for PHPUnit and Codeception
codeception/stub                      3.0.0              Flexible Stub wrapper for PHPUnit's Mock Builder
codeception/verify                    1.3.0              BDD assertion library for PHPUnit
composer/ca-bundle                    1.2.7              Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.
composer/semver                       1.5.1              Semver library that offers utilities, version constraint parsing and validation.
composer/xdebug-handler               1.4.1              Restarts a process without Xdebug.
doctrine/annotations                  1.10.2             Docblock Annotations Parser
doctrine/cache                        1.10.0             PHP Doctrine Cache library is a popular cache implementation that supports many different drivers such as redis, memcache, apc, mongodb and others.
doctrine/collections                  1.6.4              PHP Doctrine Collections library that adds additional functionality on top of PHP arrays.
doctrine/common                       2.13.0             PHP Doctrine Common project is a library that provides additional functionality that other Doctrine projects depend on such as better reflection support, persistence inte...
doctrine/dbal                         2.10.2             Powerful PHP database abstraction layer (DBAL) with many features for database schema introspection and management.
doctrine/doctrine-bundle              2.0.8              Symfony DoctrineBundle
doctrine/doctrine-cache-bundle        1.4.0              Symfony Bundle for Doctrine Cache
doctrine/doctrine-migrations-bundle   2.1.2              Symfony DoctrineMigrationsBundle
doctrine/event-manager                1.1.0              The Doctrine Event Manager is a simple PHP event system that was built to be used with the various Doctrine projects.
doctrine/inflector                    1.4.1              PHP Doctrine Inflector is a small library that can perform string manipulations with regard to upper/lowercase and singular/plural forms of words.
doctrine/instantiator                 1.3.0              A small, lightweight utility to instantiate objects in PHP without invoking their constructors
doctrine/lexer                        1.2.0              PHP Doctrine Lexer parser library that can be used in Top-Down, Recursive Descent Parsers.
doctrine/migrations                   2.2.1              PHP Doctrine Migrations project offer additional functionality on top of the database abstraction layer (DBAL) for versioning your database schema and easily deploying ch...
doctrine/orm                          v2.7.2             Object-Relational-Mapper for PHP
doctrine/persistence                  1.3.7              The Doctrine Persistence project is a set of shared interfaces and functionality that the different Doctrine object mappers share.
doctrine/reflection                   1.2.1              The Doctrine Reflection project is a simple library used by the various Doctrine projects which adds some additional functionality on top of the reflection functionality ...
enqueue/amqp-ext                      0.10.1             Message Queue Amqp Transport
enqueue/amqp-tools                    0.10.0             Message Queue Amqp Tools
enqueue/async-command                 0.10.0             Symfony async command
enqueue/dsn                           0.10.1             Parse DSN
enqueue/enqueue                       0.10.1             Message Queue Library
enqueue/enqueue-bundle                0.10.1             Message Queue Bundle
enqueue/fs                            0.10.1             Enqueue Filesystem based transport
enqueue/job-queue                     0.10.1             Job Queue
enqueue/null                          0.10.1             Enqueue Null transport
felixfbecker/advanced-json-rpc        v3.1.1             A more advanced JSONRPC implementation
felixfbecker/language-server-protocol v1.4.0             PHP classes for the Language Server Protocol
friendsofphp/php-cs-fixer             v2.16.3            A tool to automatically fix PHP code style
fzaninotto/faker                      v1.9.1             Faker is a PHP library that generates fake data for you.
guzzlehttp/guzzle                     6.5.3              Guzzle is a PHP HTTP client library
guzzlehttp/promises                   v1.3.1             Guzzle promises library
guzzlehttp/psr7                       1.6.1              PSR-7 message implementation that also provides common utility methods
hamcrest/hamcrest-php                 v2.0.0             This is the PHP port of Hamcrest Matchers
http-interop/http-factory-discovery   1.5.0              Utility to locate available HTTP factory implementations
http-interop/http-factory-guzzle      1.0.0              An HTTP Factory using Guzzle PSR7
illuminate/contracts                  v5.8.36            The Illuminate Contracts package.
illuminate/support                    v5.8.36            The Illuminate Support package.
jakub-onderka/php-console-color       v0.2              
jakub-onderka/php-console-highlighter v0.4               Highlight PHP code in terminal
jakub-onderka/php-parallel-lint       v1.0.0             This tool check syntax of PHP files about 20x faster than serial check.
jdorn/sql-formatter                   v1.2.17            a PHP SQL highlighting library
jean85/pretty-package-versions        1.2                A wrapper for ocramius/package-versions to get pretty versions strings
layershifter/tld-database             1.0.69             Database abstraction for Public Suffix List
layershifter/tld-extract              2.0.1              TLDExtract, library for extracting parts of domain, e.q. domain parser
layershifter/tld-support              1.1.1              Support package for TLDDatabase and TLDExtract
league/event                          2.2.0              Event package
league/tactician                      v1.0.3             A small, flexible command bus. Handy for building service layers.
league/tactician-bundle               v1.2.0             Bundle to integrate Tactician with Symfony projects
league/tactician-command-events       v0.6               Tactician Command Events
league/tactician-container            2.0.0              Tactician integration for any container implementing PSR-11
league/tactician-logger               v0.10.0            Adds PSR-3 logging support to the Tactician command bus
makasim/temp-file                     0.2.0              Temp file object
mockery/mockery                       1.3.1              Mockery is a simple yet flexible PHP mock object framework
monolog/monolog                       1.25.3             Sends your logs to files, sockets, inboxes, databases and various web services
myclabs/deep-copy                     1.9.5              Create deep copies (clones) of your objects
nesbot/carbon                         2.34.2             An API extension for DateTime that supports 281 different languages.
netresearch/jsonmapper                v2.1.0             Map nested JSON structures onto PHP classes
nette/bootstrap                       v2.4.6             ? Nette Bootstrap: the simple way to configure and bootstrap your Nette application.
nette/di                              v2.4.16            💎 Nette Dependency Injection Container: Flexible, compiled and full-featured DIC with perfectly usable autowiring and support for all new PHP 7.1 features.
nette/finder                          v2.5.2             🔍 Nette Finder: find files and directories with an intuitive API.
nette/neon                            v3.0.1             🍸 Nette NEON: encodes and decodes NEON file format.
nette/php-generator                   v3.3.4             🐘 Nette PHP Generator: generates neat PHP code for you. Supports new PHP 7.4 features.
nette/robot-loader                    v3.1.1             ? Nette RobotLoader: high performance and comfortable autoloader that will search and autoload classes within your application.
nette/utils                           v2.5.4             🛠 Nette Utils: lightweight utilities for string & array manipulation, image handling, safe JSON encoding/decoding, validation, slug or strong password generating etc.
nikic/php-parser                      v4.4.0             A PHP parser written in PHP
ocramius/package-versions             1.5.1              Composer plugin that provides efficient querying for installed package versions (no runtime IO)
ocramius/proxy-manager                2.2.3              A library providing utilities to generate, instantiate and generally operate with Object Proxies
openlss/lib-array2xml                 1.0.0              Array2XML conversion library credit to lalit.org
paragonie/random_compat               v9.99.99           PHP 5.x polyfill for random_bytes() and random_int() from PHP 7
pdepend/pdepend                       2.7.1              Official version of pdepend to be handled with Composer
phar-io/manifest                      1.0.3              Component for reading phar.io manifest information from a PHP Archive (PHAR)
phar-io/version                       2.0.1              Library for handling version information and constraints
php-amqplib/php-amqplib               v2.7.2.1           Formerly videlalvaro/php-amqplib.  This library is a pure PHP implementation of the AMQP protocol. It's been tested against RabbitMQ.
php-cs-fixer/diff                     v1.3.0             sebastian/diff v2 backport support for PHP5.6
php-http/client-common                2.1.0              Common HTTP Client implementations and tools for HTTPlug
php-http/discovery                    1.7.4              Finds installed HTTPlug implementations and PSR-7 message factories
php-http/guzzle6-adapter              v2.0.1             Guzzle 6 HTTP Adapter
php-http/httplug                      2.1.0              HTTPlug, the HTTP client abstraction for PHP
php-http/message                      1.8.0              HTTP Message related tools
php-http/message-factory              v1.0.2             Factory interfaces for PSR-7 HTTP Message
php-http/promise                      v1.0.0             Promise used for asynchronous HTTP requests
phpdocumentor/reflection-common       2.1.0              Common reflection classes used by phpdocumentor to reflect the code structure
phpdocumentor/reflection-docblock     5.1.0              With this component, a library can provide support for annotations via DocBlocks or otherwise retrieve information that is embedded in a DocBlock.
phpdocumentor/type-resolver           1.1.0              A PSR-5 based resolver of Class names, Types and Structural Element Names
phpmd/phpmd                           2.8.2              PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD.
phpoption/phpoption                   1.7.3              Option Type for PHP
phpspec/prophecy                      v1.10.3            Highly opinionated mocking framework for PHP 5.3+
phpstan/phpdoc-parser                 0.3.5              PHPDoc parser with support for nullable, intersection and generic types
phpstan/phpstan                       0.11.6             PHPStan - PHP Static Analysis Tool
phpstan/phpstan-mockery               0.11.3             PHPStan Mockery extension
phpstan/phpstan-phpunit               0.11.2             PHPUnit extensions and rules for PHPStan
phpstan/phpstan-symfony               0.11.5             Symfony Framework extensions and rules for PHPStan
phpunit/php-code-coverage             6.1.4              Library that provides collection, processing, and rendering functionality for PHP code coverage information.
phpunit/php-file-iterator             2.0.2              FilterIterator implementation that filters files based on a list of suffixes.
phpunit/php-text-template             1.2.1              Simple template engine.
phpunit/php-timer                     2.1.2              Utility class for timing
phpunit/php-token-stream              3.1.1              Wrapper around PHP's tokenizer extension.
phpunit/phpunit                       7.5.20             The PHP Unit Testing framework.
psr/cache                             1.0.1              Common interface for caching libraries
psr/container                         1.0.0              Common Container Interface (PHP FIG PSR-11)
psr/http-client                       1.0.0              Common interface for HTTP clients
psr/http-factory                      1.0.1              Common interfaces for PSR-7 HTTP message factories
psr/http-message                      1.0.1              Common interface for HTTP messages
psr/log                               1.1.3              Common interface for logging libraries
psr/simple-cache                      1.0.1              Common interfaces for simple caching
queue-interop/amqp-interop            0.8.1             
queue-interop/queue-interop           0.8.0              Promoting the interoperability of MQs objects. Based on Java JMS
ralouphie/getallheaders               3.0.3              A polyfill for getallheaders.
ramsey/uuid                           3.9.3              Formerly rhumsaa/uuid. A PHP 5.4+ library for generating RFC 4122 version 1, 3, 4, and 5 universally unique identifiers (UUID).
roave/security-advisories             dev-master 885e8b1 Prevents installation of composer packages with known security vulnerabilities: no API, simply require it
sebastian/code-unit-reverse-lookup    1.0.1              Looks up which function or method a line of code belongs to
sebastian/comparator                  3.0.2              Provides the functionality to compare PHP values for equality
sebastian/diff                        3.0.2              Diff implementation
sebastian/environment                 4.2.3              Provides functionality to handle HHVM/PHP environments
sebastian/exporter                    3.1.2              Provides the functionality to export PHP variables for visualization
sebastian/global-state                2.0.0              Snapshotting of global state
sebastian/object-enumerator           3.0.3              Traverses array structures and object graphs to enumerate all referenced objects
sebastian/object-reflector            1.1.1              Allows reflection of object attributes, including inherited and non-public ones
sebastian/recursion-context           3.0.0              Provides functionality to recursively process PHP variables
sebastian/resource-operations         2.0.1              Provides a list of PHP built-in functions that operate on resources
sebastian/version                     2.0.1              Library that helps with managing the version number of Git-hosted PHP projects
sensiolabs/security-checker           v5.0.3             A security checker for your composer.lock
sentry/sdk                            2.1.0              This is a metapackage shipping sentry/sentry with a recommended http client.
sentry/sentry                         2.3.2              A PHP SDK for Sentry (http://sentry.io)
sentry/sentry-symfony                 3.5.1              Symfony integration for Sentry (http://getsentry.com)
slam/php-cs-fixer-extensions          v1.19.4            Slam extension of friendsofphp/php-cs-fixer
slevomat/coding-standard              5.0.4              Slevomat Coding Standard for PHP_CodeSniffer complements Consistence Coding Standard by providing sniffs with additional checks.
squizlabs/php_codesniffer             3.5.5              PHP_CodeSniffer tokenizes PHP, JavaScript and CSS files and detects violations of a defined set of coding standards.
symfony/asset                         v4.4.8             Symfony Asset Component
symfony/browser-kit                   v4.4.8             Symfony BrowserKit Component
symfony/cache                         v4.3.11            Symfony Cache component with PSR-6, PSR-16, and tags
symfony/cache-contracts               v1.1.7             Generic abstractions related to caching
symfony/config                        v4.4.8             Symfony Config Component
symfony/console                       v4.4.8             Symfony Console Component
symfony/css-selector                  v4.4.8             Symfony CssSelector Component
symfony/debug                         v4.3.7             Symfony Debug Component
symfony/dependency-injection          v4.4.8             Symfony DependencyInjection Component
symfony/doctrine-bridge               v4.3.11            Symfony Doctrine Bridge
symfony/dom-crawler                   v4.4.8             Symfony DomCrawler Component
symfony/dotenv                        v4.4.8             Registers environment variables from a .env file
symfony/event-dispatcher              v4.4.8             Symfony EventDispatcher Component
symfony/event-dispatcher-contracts    v1.1.7             Generic abstractions related to dispatching event
symfony/filesystem                    v4.4.8             Symfony Filesystem Component
symfony/finder                        v4.4.8             Symfony Finder Component
symfony/flex                          v1.6.3             Composer plugin for Symfony
symfony/framework-bundle              v4.3.11            Symfony FrameworkBundle
symfony/http-foundation               v4.4.8             Symfony HttpFoundation Component
symfony/http-kernel                   v4.3.11            Symfony HttpKernel Component
symfony/inflector                     v5.0.8             Symfony Inflector Component
symfony/mime                          v5.0.8             A library to manipulate MIME messages
symfony/monolog-bridge                v4.4.8             Symfony Monolog Bridge
symfony/monolog-bundle                v3.5.0             Symfony MonologBundle
symfony/options-resolver              v5.0.8             Symfony OptionsResolver Component
symfony/orm-pack                      v1.0.8             A pack for the Doctrine ORM
symfony/phpunit-bridge                v5.0.8             Symfony PHPUnit Bridge
symfony/polyfill-ctype                v1.17.0            Symfony polyfill for ctype functions
symfony/polyfill-intl-idn             v1.17.0            Symfony polyfill for intl's idn_to_ascii and idn_to_utf8 functions
symfony/polyfill-mbstring             v1.17.0            Symfony polyfill for the Mbstring extension
symfony/polyfill-php70                v1.17.0            Symfony polyfill backporting some PHP 7.0+ features to lower PHP versions
symfony/polyfill-php72                v1.17.0            Symfony polyfill backporting some PHP 7.2+ features to lower PHP versions
symfony/polyfill-php73                v1.17.0            Symfony polyfill backporting some PHP 7.3+ features to lower PHP versions
symfony/polyfill-uuid                 v1.17.0            Symfony polyfill for uuid functions
symfony/process                       v5.0.8             Symfony Process Component
symfony/property-access               v5.0.8             Symfony PropertyAccess Component
symfony/property-info                 v5.0.8             Symfony Property Info Component
symfony/routing                       v4.4.8             Symfony Routing Component
symfony/security-core                 v5.0.8             Symfony Security Component - Core Library
symfony/serializer                    v5.0.8             Symfony Serializer Component
symfony/serializer-pack               v1.0.3             A pack for the Symfony serializer
symfony/service-contracts             v1.1.8             Generic abstractions related to writing services
symfony/stopwatch                     v5.0.8             Symfony Stopwatch Component
symfony/translation                   v4.3.11            Symfony Translation Component
symfony/translation-contracts         v1.1.7             Generic abstractions related to translation
symfony/validator                     v4.3.11            Symfony Validator Component
symfony/var-exporter                  v4.4.8             A blend of var_export() + serialize() to turn any serializable data structure to plain PHP code
symfony/yaml                          v4.4.8             Symfony Yaml Component
symplify/better-phpdoc-parser         v5.4.16            Slim wrapper around phpstan/phpdoc-parser with format preserving printer
symplify/coding-standard              v5.4.16            Set of Symplify rules for PHP_CodeSniffer and PHP CS Fixer.
symplify/easy-coding-standard         v5.4.16            Use Coding Standard with 0-knowledge of PHP-CS-Fixer and PHP_CodeSniffer.
symplify/package-builder              v5.4.16            Dependency Injection, Console and Kernel toolkit for Symplify packages.
theseer/tokenizer                     1.1.3              A small library for converting tokenized PHP source code into XML and potentially other formats
vimeo/psalm                           3.11.4             A static analysis tool for finding errors in PHP applications
vlucas/phpdotenv                      v3.4.0             Loads environment variables from `.env` to `getenv()`, `$_ENV` and `$_SERVER` automagically.
webmozart/assert                      1.8.0              Assertions to validate method input/output with nice error messages.
webmozart/glob                        4.1.0              A PHP implementation of Ant's glob.
webmozart/path-util                   2.3.0              A robust cross-platform utility for normalizing, comparing and modifying file paths.
zendframework/zend-code               3.4.1              Extensions to the PHP Reflection API, static code scanning, and code generation
zendframework/zend-eventmanager       3.2.1              Trigger and listen to events within a PHP application

Certificate of maps.googleapis.com not trusted when fallback to Mozilla CA bundle is used

Following code will echo SSL certificate problem: unable to get local issuer certificate when fallback to Mozilla CA bundle is used (e.g. on Windows). I think it is the same problem as here.

$curl = curl_init("https://maps.googleapis.com");
curl_setopt($curl, CURLOPT_CAINFO, \Composer\CaBundle\CaBundle::getSystemCaRootBundlePath());
$result = curl_exec($curl);

if ($result === FALSE) {
    echo curl_error($curl);
}

Is there any way to solve this? Is Mozilla bundle insufficient or is really Google using weak/untrusted cert?

Ca-bundle missed new versions of Homebrew OSx

My Homebrew installs openssl with the following configuration:

➜  composer git:(d8aef3af) openssl version -d
OPENSSLDIR: "/usr/local/etc/[email protected]"

This path isn't included by default.
Does it make sense to add this path before https://github.com/composer/ca-bundle/blob/master/src/CaBundle.php#L94 ?

Or other option it is execute openssl version -d and add this path even automatically

Any ideas?

Logs for unreadable/non-existent certificates

Hello,

These days I have been dealing with issues around Composer which ended up being an issue with the certificates making Composer unable to download packages.

Is it possible to add more logs, in verbose mode, for giving more information whether the selected cafile exists and is readable? Or to be more precise, to tell us that the file does not exist or it can't be read.
Since it already gives information whether the found certificate is valid, it feels incomplete when there is no information when it fails to find or read the file. It would be really helpful while debugging such issues.

I didn't know where Composer is looking for certificates so I had to check how exactly Composer works to get to the point that it uses ca-bundle package where I could see the actual paths that it's checking, in order to get to a conclusion.

Thank you.

CA bundle of OpenSSL on Mac OS X not included in CA bundle paths

I've installed PHP 5.6 and OpenSSL using Homebrew on my Mac (El Capitan).

The OpenSSL bundle is located at /usr/local/etc/openssl/cert.pem which is not included in the list of CA bundle paths.

Can you please add it to the list?

My current work around is to use the openssl.cafile ini configuration setting.

Error on composer require

Hello everyone,
I reach an error when installing ca-bundle.

Thanks for your job

Consider using openssl_get_cert_locations

It should be considered using http://php.net/openssl_get_cert_locations on newer versions (PHP 5.6+).

Possible implementation.

[PHP 8.4] Implicit nullable parameter type fixes

The recent change merged to PHP 8.4 will emit a deprecation notice in PHP 8.4 when it encounters a type declaration that has a default value = null without declaring the type as nullable.

We have composer/class-map-generator#5, composer/composer#11888, and composer/pcre#19 changing such instances in the rest of the composer/* packages, but this is the only one we cannot change immediately because this package supports PHP 5, which has no nullable type support.

Opening this issue to see if we can create a separate version requiring PHP >= 7.1, so we can use the nullable types. The alternatives would be empty/no-op objects (such as a no-op LoggerInterface implementation), but it will be a salty BC break either way. We also have the option to not fix it right away (it's a deprecation notice after all), but we will have to change it in the next major version in the future.

Thank you.