Cannot install Horde Imap Client with composer

Question

I try to install Horde/Imap_Client, as documented here

In an empty directory, I create a composer.json file with the following content

{
    "repositories": [
        {
            "type": "pear",
            "url": "http://pear.horde.org"
        }
    ],
    "require": {
        "pear-pear.horde.org/Horde_Imap_Client": "*"
    }
}

I then download the composer executable and run the installation running the 2 following commands

curl -s http://getcomposer.org/installer | php
php composer.phar install

The download and installation process fails, on both Mac OS X and Ubuntu 14.04. The message I get is

Initializing PEAR repository http://pear.horde.org PEAR repository from http://pear.horde.org could not be loaded. Your configuration does not allow connection to http://http://pear.horde.org. See https://getcomposer.org/doc/06-config.md#secure-http for details. Installing dependencies (including require-dev) Your requirements could not be resolved to an installable set of packages.

Problem 1 - The requested package pear-pear.horde.org/horde_imap_client could not be found in any version, there may be a typo in the package name.

Potential causes: - A typo in the package name - The package is not available in a stable-enough version according to your minimum-stability setting see https://getcomposer.org/doc/04-schema.md#minimum-stability for more details.

Read https://getcomposer.org/doc/articles/troubleshooting.md for further common problems.

Is the Horde/Imap_Client deprecated or am I doing something wrong?

Answer 1

How much more verbose do you want the error?

Initializing PEAR repository http://pear.horde.org PEAR repository from http://pear.horde.org could not be loaded. Your configuration does not allow connection to http://http://pear.horde.org. See https://getcomposer.org/doc/06-config.md#secure-http for details.

Composer no longer allows installing packages from insecure sources out of the box. Regrettably the Horde PEAR repository does not support HTTPS at this time, so you can't go that way. The other way however is pretty clear in the documentation, just add this to your composer.json file:

    "config": {
      "secure-http": false
    }

So it looks like this:

{
    "repositories": [
        {
            "type": "pear",
            "url": "http://pear.horde.org"
        }
    ],
    "require": {
        "pear-pear.horde.org/Horde_Imap_Client": "*"
    },
    "config": {
        "secure-http": false
    }
}

Please do note that this disables all checks for secure communications completely. So you're opening the doors to install random code on your system via DNS poisoning, MitM attacks, you name them. The fundamental solution is to bug the Horde PEAR repository maintainers to add an SSL certificate to their repo.