Composer uses HTTP for at least self-updates and fetching package descriptions from packagist.org. (Upstream bug: [[ https://github.com/composer/composer/issues/1074 | #1074 ]], POC: [[ https://github.com/Stype/packagistproxy | packagistproxy ]]) This creates vulnerabilities as Composer is integrated into our processes at several levels:
* [[ https://www.mediawiki.org/wiki/Extension:ExtensionDistributor | ExtensionDistributor ]] uses it to build tarballs
* [[ https://www.mediawiki.org/wiki/MediaWiki-Vagrant | MediaWiki-Vagrant ]] uses it to install extensions
* `mediawiki/vendor` is maintained by Composer; the results of Composer runs go through manual code review which would probably catch any tampering but still a risk
* Jenkins uses Composer to run tests, might use it for checking out the code in the future (T90303)
To address these vulnerabilities, we need the ability to to restrict requests to HTTPS and check certificates in Composer, and if that can't be made default, we need a global option to enable it, and we need to ensure that option is set in all the above mentioned environments.
----
**See also:**
* {T105638}
** [[ https://www.mediawiki.org/wiki/Requests_for_comment/Streamlining_Composer_usage#Package_integrity | risk evaluation for Composer ]]
* [[ https://github.com/EvanDotPro/composer/commit/8cff84008fd4375549dbbeecc67523ee12d9c383 | HTTPS patch for Composer ]] (misses the configuration part)
* [[ https://github.com/composer/composer/pull/4056 | #4056 ]]: disable HTTP connections in Composer