{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/2291","repository_url":"https://api.github.com/repos/composer/composer","labels_url":"https://api.github.com/repos/composer/composer/issues/2291/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/2291/comments","events_url":"https://api.github.com/repos/composer/composer/issues/2291/events","html_url":"https://github.com/composer/composer/issues/2291","id":20048172,"number":2291,"title":"Make it possible to build without downloading composer.phar","user":{"login":"weierophinney","id":25943,"avatar_url":"https://avatars.githubusercontent.com/u/25943?v=3","gravatar_id":"","url":"https://api.github.com/users/weierophinney","html_url":"https://github.com/weierophinney","followers_url":"https://api.github.com/users/weierophinney/followers","following_url":"https://api.github.com/users/weierophinney/following{/other_user}","gists_url":"https://api.github.com/users/weierophinney/gists{/gist_id}","starred_url":"https://api.github.com/users/weierophinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weierophinney/subscriptions","organizations_url":"https://api.github.com/users/weierophinney/orgs","repos_url":"https://api.github.com/users/weierophinney/repos","events_url":"https://api.github.com/users/weierophinney/events{/privacy}","received_events_url":"https://api.github.com/users/weierophinney/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/composer/composer/labels/Feature","name":"Feature","color":"02e10c"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/composer/composer/milestones/4","html_url":"https://github.com/composer/composer/milestones/Nice%20To%20Have","labels_url":"https://api.github.com/repos/composer/composer/milestones/4/labels","id":119020,"number":4,"title":"Nice To Have","description":"Not urgent/critical features, tasks or bugs that are considered good things to work on","creator":{"login":"Seldaek","id":183678,"avatar_url":"https://avatars.githubusercontent.com/u/183678?v=3","gravatar_id":"","url":"https://api.github.com/users/Seldaek","html_url":"https://github.com/Seldaek","followers_url":"https://api.github.com/users/Seldaek/followers","following_url":"https://api.github.com/users/Seldaek/following{/other_user}","gists_url":"https://api.github.com/users/Seldaek/gists{/gist_id}","starred_url":"https://api.github.com/users/Seldaek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Seldaek/subscriptions","organizations_url":"https://api.github.com/users/Seldaek/orgs","repos_url":"https://api.github.com/users/Seldaek/repos","events_url":"https://api.github.com/users/Seldaek/events{/privacy}","received_events_url":"https://api.github.com/users/Seldaek/received_events","type":"User","site_admin":false},"open_issues":97,"closed_issues":219,"state":"open","created_at":"2012-05-13T10:21:25Z","updated_at":"2016-04-13T13:32:42Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2013-09-25T15:15:16Z","updated_at":"2016-04-13T13:32:42Z","closed_at":"2016-04-13T13:32:42Z","body":"From a security perspective, I'm a bit reluctant to download the `composer.phar` file in order to install dependencies so that I can then build... `composer.phar`. Right now, there's no way for a developer to verify sources before building.\r\n\r\nIdeally, the project should provide a shell script or similar for fetching required dependencies, or a set of instructions so that developers can manually fetch and install dependencies and set up autoloading."},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/209442222","html_url":"https://github.com/composer/composer/issues/2291#issuecomment-209442222","issue_url":"https://api.github.com/repos/composer/composer/issues/2291","id":209442222,"user":{"login":"Seldaek","id":183678,"avatar_url":"https://avatars.githubusercontent.com/u/183678?v=3","gravatar_id":"","url":"https://api.github.com/users/Seldaek","html_url":"https://github.com/Seldaek","followers_url":"https://api.github.com/users/Seldaek/followers","following_url":"https://api.github.com/users/Seldaek/following{/other_user}","gists_url":"https://api.github.com/users/Seldaek/gists{/gist_id}","starred_url":"https://api.github.com/users/Seldaek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Seldaek/subscriptions","organizations_url":"https://api.github.com/users/Seldaek/orgs","repos_url":"https://api.github.com/users/Seldaek/repos","events_url":"https://api.github.com/users/Seldaek/events{/privacy}","received_events_url":"https://api.github.com/users/Seldaek/received_events","type":"User","site_admin":false},"created_at":"2016-04-13T13:32:42Z","updated_at":"2016-04-13T13:32:42Z","body":"We improved the installer quite a bit so that you can now verify you get the right installer / composer.phar at least. Of course you still have to trust us, but that's gonna be the case either way IMO, so closing."}}