The problem with it thought is that it takes the one from Mozilla (as I understand it). From what I remember we had to use a different one (from Centos afaik) since the mozilla one missed a cert for AmazonS3 or so.

@brianteeman @Bakual since this is a maintenance task and we already have moved a lot of the other such tasks to node, I suggest to do something similar here. Also should be quite easy to implement, eg:

• grunt fetch-cacert which will do
• fetch the certs and store them in a tmp dir: https://github.com/twolfson/grunt-curl
• verify them
• move them to the appropriate folder

@dgt41 thats the entire point of this library

Automating that task certainly is a good idea, and the library from paragonie without doubt is a good one to use.
We just have to make sure the fetched cacert file actually works for us, because it didn't in the past. And I don't want to find that out after we released an update which would break the updater ?

I guess this library needs to be coupled with the https://github.com/joomla/joomla-cms/blob/staging/build/build.php and then somehow we need to keep track of this dependency

Moving it to node (and assuming that we'll use greenskeeper.io) that part will be automated. (this is already tested in the framework and custom-elements branches)