Merge branch 'release/8.0.0'

ncreuschling · ncreuschling · commit d13af8962709 · 2017-10-18T09:49:15.000+02:00
* release/8.0.0:
  prepare release v8.0.0
  update dependencies.
  fix travis ci badge link
  apply real ssl security in http helper
  Update LICENSE file
  pin RuboCop to v0.46.0
  added dkdeploy logo
  set default for http_open_timeout to satify `cap doctor`
  define required Ruby version ~&gt; 2.1
  exclude Bundler's vendor directory from RuboCop run
  use correct branch names in badges
diff --git a/.rubocop.yml b/.rubocop.yml
@@ -2,8 +2,13 @@ AllCops:
   Exclude:
     - 'tmp/**/*'
     - 'spec/fixtures/application/htdocs/stylesheets/**/config.rb'
-    - 'Vagrantfile'
     - 'config/**/*'
+    - 'Vagrantfile'
+    - 'vendor/**/*'
+  TargetRubyVersion: 2.2
+  ExtraDetails: true
+  DisplayStyleGuide: true
+  DisplayCopNames: true
 GlobalVars:
   AllowedVariables: []
 MethodLength:
@@ -20,3 +25,7 @@ Metrics/AbcSize:
   Max: 30
 Style/SignalException:
   EnforcedStyle: only_raise
+Style/FormatStringToken:
+  Enabled: false
+Metrics/BlockLength:
+  Enabled: false
diff --git a/.travis.yml b/.travis.yml
@@ -2,11 +2,12 @@ sudo: false
 language: ruby
 cache: bundler
 rvm:
-  - 2.1
   - 2.2
+  - 2.3
+  - 2.4
 
 before_install:
-  - gem install bundler --version 1.12.5 --no-document
+  - gem install bundler --no-document
 
 script:
   - bundle exec rubocop
diff --git a/Berksfile.lock b/Berksfile.lock
@@ -18,6 +18,7 @@ GRAPH
     mysql (~> 6.1)
     mysql2_chef_gem (~> 1.0)
     php (~> 1.9)
+    ssl_certificate (~> 1.12.0)
   iis (4.1.7)
     windows (>= 1.34.6)
   mariadb (0.3.1)
@@ -49,6 +50,7 @@ GRAPH
     windows (>= 1.2.2)
   smf (2.2.8)
     rbac (>= 1.0.1)
+  ssl_certificate (1.12.0)
   windows (1.40.0)
     chef_handler (>= 0.0.0)
   xml (2.0.0)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,10 +2,26 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [8.0.0] - 2017-09-18
+### Summary
+
+- `:ssl_verify_mode` for server properties, which takes SSL verify_mode constants (`OpenSSL::SSL::VERIFY_NONE`)
+- `Dkdeploy::Php::Helpers::Http::http_get_with_redirect` gets arguments as options hash now
+- Vagrant 2.0.x support
+- rubocop upgrade to 0.50
+- ruby upgrade to 2.2
+- bundler upgrade
+- rake upgrade
+- dkdeploy-test_environment upgrade to 2.0
+- dkdeploy-core upgrade 9.0
+- Add dependencies for cucumber, rubocop, aruba and mysql2
+- remove SSL certificate bypassing in http helper #5
+
 ## [7.0.0] - 2016-07-01
 ### Summary
 
 - first public release
 
 [Unreleased]: https://github.com/dkdeploy/dkdeploy-php/compare/master...develop
+[8.0.0]: https://github.com/dkdeploy/dkdeploy-php/releases/tag/v8.0.0
 [7.0.0]: https://github.com/dkdeploy/dkdeploy-php/releases/tag/v7.0.0
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
@@ -2,6 +2,8 @@
 
 The dkdeploy core maintainers would like to recognize following contributors (in alphabetic order):
 
+- Jan Bergmann
+- Dimitri Ebert
 - Sascha Egerer
 - Christoph Gerold
 - Johannes Goslar
diff --git a/LICENSE b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2014-2016 dkd Internet Service GmbH, Frankfurt am Main (Germany), https://dkd.de/
+Copyright (c) 2014-2017 dkd Internet Service GmbH, Frankfurt am Main (Germany), https://dkd.de/
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
diff --git a/README.md b/README.md
@@ -1,7 +1,9 @@
+![dkdeploy::php](assets/dkdeploy-logo.png)
+
 # Dkdeploy::Php
 
-[![Build Status](https://api.travis-ci.org/dkdeploy/dkdeploy-php.svg?branch=master)](https://travis-ci.org/repositories/dkdeploy/dkdeploy-php)
-[![Gem Version](https://badge.fury.io/rb/dkdeploy-php.svg)](https://badge.fury.io/rb/dkdeploy-php) [![Inline docs](http://inch-ci.org/github/dkdeploy/dkdeploy-php.svg?branch=master)](http://inch-ci.org/github/dkdeploy/dkdeploy-php)
+[![Build Status](https://travis-ci.org/dkdeploy/dkdeploy-php.svg?branch=develop)](https://travis-ci.org/dkdeploy/dkdeploy-php)
+[![Gem Version](https://badge.fury.io/rb/dkdeploy-php.svg)](https://badge.fury.io/rb/dkdeploy-php) [![Inline docs](http://inch-ci.org/github/dkdeploy/dkdeploy-php.svg?branch=develop)](http://inch-ci.org/github/dkdeploy/dkdeploy-php)
 
 ## Description
 
@@ -11,7 +13,7 @@ This Rubygem `dkdeploy-php` ruby gem represents the extension of [Capistrano](ht
 
 Add this line to your application's `Gemfile`
 
-	gem 'dkdeploy-php', '~> 7.0'
+	gem 'dkdeploy-php', '~> 8.0'
 
 and then execute
 
diff --git a/Rakefile b/Rakefile
@@ -1,5 +1,2 @@
 task default: :spec
 require 'bundler/gem_tasks'
-
-require 'rspec/core/rake_task'
-RSpec::Core::RakeTask.new
diff --git a/Vagrantfile b/Vagrantfile
@@ -5,33 +5,26 @@ unless Vagrant.has_plugin?('vagrant-berkshelf')
   abort
 end
 
-unless Vagrant.has_plugin?('vagrant-omnibus')
-  puts "Please install vagrant plugin vagrant-omnibus first\n"
-  puts " vagrant plugin install vagrant-omnibus\n\n"
-  puts "Exit vagrant\n\n"
-  abort
-end
-
-Vagrant.require_version '>= 1.8.1'
+Vagrant.require_version '~> 2.0.0'
 chef_version = '12.9.41'
 
-Vagrant.configure('2') do |config|
+Vagrant.configure(2) do |config|
   domain = 'dkdeploy-php.dev'
   domain_second = 'second-dkdeploy-php.dev'
   ip_address = '192.168.156.181'
 
   config.vm.box = 'ubuntu/trusty64'
   config.vm.box_check_update = false
   config.berkshelf.enabled = true
-  config.omnibus.chef_version = chef_version
 
   config.vm.define('dkdeploy-php', primary: true) do |master_config|
     master_config.vm.network 'private_network', ip: ip_address
 
     # Chef settings
     master_config.vm.provision :chef_solo do |chef|
       chef.version = chef_version
-      chef.install = false # omnibus does it already
+      chef.install = true
+      chef.channel = 'stable'
       chef.log_level = :info
       chef.add_recipe 'dkdeploy-php'
       chef.json = {}
diff --git a/assets/dkdeploy-logo.png b/assets/dkdeploy-logo.png
diff --git a/config/vm/cookbooks/dkdeploy-php/metadata.rb b/config/vm/cookbooks/dkdeploy-php/metadata.rb
@@ -10,3 +10,4 @@
 depends 'apache2', '~> 3.2'
 depends 'php', '~> 1.9'
 depends 'apt', '~> 3.0'
+depends 'ssl_certificate', '~> 1.12.0'
diff --git a/config/vm/cookbooks/dkdeploy-php/recipes/default.rb b/config/vm/cookbooks/dkdeploy-php/recipes/default.rb
@@ -56,16 +56,22 @@
 # Apache
 include_recipe 'apache2'
 include_recipe 'apache2::mod_php5'
+include_recipe 'apache2::mod_ssl'
 
 # install apache2-utils. It is needed for the assets:add_htpasswd task
 package 'apache2-utils' do
   action :install
 end
 
+ssl_key_path = '/var/www/dkdeploy.key'
+ssl_cert_path = '/var/www/dkdeploy.pem'
+
 web_app 'dkdeploy-php.dev' do
   server_name 'dkdeploy-php.dev'
   server_aliases ['second-dkdeploy-php.dev']
   docroot '/var/www/dkdeploy/current/'
+  key_path ssl_key_path
+  cert_path ssl_cert_path
   template 'web_app.conf.erb'
 end
 
@@ -75,3 +81,13 @@
   mode '0770'
   action :create
 end
+
+ssl_certificate 'dkdeploy-php.dev' do
+  key_path ssl_key_path
+  key_mode 00755
+  cert_path ssl_cert_path
+  domain 'dkdeploy-php.dev'
+  organization 'dkdeploy'
+  email 'offical@example.com'
+  notifies :restart, 'service[apache2]'
+end
diff --git a/config/vm/cookbooks/dkdeploy-php/templates/default/web_app.conf.erb b/config/vm/cookbooks/dkdeploy-php/templates/default/web_app.conf.erb
@@ -26,3 +26,38 @@
   php_admin_value realpath_cache_ttl 0
   php_admin_value realpath_cache_size 0k
 </VirtualHost>
+
+<VirtualHost *:443>
+  ServerName <%= @params[:server_name] %>
+  ServerAlias <%= @params[:server_aliases].join(' ') %>
+  DocumentRoot <%= @params[:docroot] %>
+  RewriteEngine On
+
+  <Directory <%= @params[:docroot] %>>
+    Options FollowSymLinks
+    AllowOverride None
+    Require all granted
+  </Directory>
+
+  <Directory />
+  Options FollowSymLinks
+  AllowOverride None
+  </Directory>
+
+  <IfModule mod_ssl.c>
+    SSLEngine on
+    SSLCertificateFile <%= @params[:cert_path] %>
+    SSLCertificateKeyFile <%= @params[:key_path] %>
+  </IfModule>
+
+  LogLevel info
+  ErrorLog <%= node[:apache][:log_dir] %>/<%= @params[:name] %>-error.log
+  CustomLog <%= node[:apache][:log_dir] %>/<%= @params[:name] %>-access.log combined
+
+  RewriteEngine On
+  LogLevel info rewrite:trace2 alias:debug
+
+  # Deactivate php realpath cache
+  php_admin_value realpath_cache_ttl 0
+  php_admin_value realpath_cache_size 0k
+</VirtualHost>
diff --git a/dkdeploy-php.gemspec b/dkdeploy-php.gemspec
@@ -1,4 +1,3 @@
-# coding: utf-8
 lib = File.expand_path('../lib', __FILE__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'dkdeploy/php/version'
@@ -7,21 +6,25 @@ Gem::Specification.new do |spec|
   spec.name          = 'dkdeploy-php'
   spec.version       = Dkdeploy::Php::Version
   spec.license       = 'MIT'
-  spec.authors       = ['Lars Tode', 'Timo Webler', 'Kieran Hayes', 'Nicolai Reuschling']
-  spec.email         = ['lars.tode@dkd.de', 'timo.webler@dkd.de', 'kieran.hayes@dkd.de', 'nicolai.reuschling@dkd.de']
+  spec.authors       = ['Timo Webler', 'Nicolai Reuschling']
+  spec.email         = %w[timo.webler@dkd.de nicolai.reuschling@dkd.de]
   spec.description   = 'dkd PHP deployment tasks and strategies'
   spec.summary       = 'dkd php deployment tasks and strategies'
   spec.homepage      = 'https://github.com/dkdeploy/dkdeploy-php'
+  spec.required_ruby_version = '~> 2.2'
 
   spec.files         = `git ls-files`.split($/)
   spec.executables   = spec.files.grep(%r{^bin\/}) { |f| File.basename(f) }
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)\/})
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'bundler', '~> 1.12.5'
-  spec.add_development_dependency 'rake', '~> 11.2'
-  spec.add_development_dependency 'rubocop', '~> 0.40'
-  spec.add_development_dependency 'dkdeploy-test_environment', '~> 1.0'
+  spec.add_development_dependency 'bundler'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'cucumber', '~> 2.4'
+  spec.add_development_dependency 'rubocop', '~> 0.50.0'
+  spec.add_development_dependency 'aruba', '~> 0.14.1'
+  spec.add_development_dependency 'mysql2', '~> 0.3'
+  spec.add_development_dependency 'dkdeploy-test_environment', '~> 2.0'
 
-  spec.add_dependency 'dkdeploy-core', '~> 8.0'
+  spec.add_dependency 'dkdeploy-core', '~> 9.0'
 end
diff --git a/features/php.feature b/features/php.feature
@@ -42,3 +42,18 @@ Feature: Test tasks for namespace 'php'
 		And I extend the development capistrano configuration from the fixture file server_with_faulty_domain_configuration.rb
 		When I run `cap dev php:clear_opcache`
 		Then the exit status should not be 0
+
+	Scenario: Clear APC via HTTPS
+		Given a directory named "temp"
+		And I extend the development capistrano configuration from the fixture file server_with_ssl.rb
+	    And I inject the root SSL certificate
+		When I run `cap dev php:clear_apc_cache`
+		Then the exit status should be 0
+		And the output should contain "200 - OK"
+
+	Scenario: Clear APC via HTTPS and failing SSL certificate
+		Given a directory named "temp"
+		And I extend the development capistrano configuration from the fixture file server_with_ssl.rb
+		When I run `cap dev php:clear_apc_cache`
+		Then the exit status should not be 0
+		And the output should contain "certificate verify failed"
diff --git a/features/support/step_definitions/steps.rb b/features/support/step_definitions/steps.rb
@@ -1,6 +1,7 @@
 require 'erb'
 require 'ostruct'
 
+include Dkdeploy::TestEnvironment::Constants # to get access to test_app_path method
 # Creates an empty doctrine migration with a given migration version and basic content
 #
 # @yieldparam migration_version [String] the 14 digits migration number
@@ -13,3 +14,13 @@ def context_object.binding_for_erb
   empty_doctrine_migration_template = ERB.new File.read(empty_doctrine_migration_template_path)
   write_file file_path, empty_doctrine_migration_template.result(context_object.binding_for_erb)
 end
+
+Given(/^I set relative to current path the environment variable "(.*)" to "(.*)"/) do |variable, value|
+  set_environment_variable(variable.to_s, test_app_path + value.to_s)
+end
+
+# injects the self-signed certificate into environment variables to simulate a valid certificate
+Given('I inject the root SSL certificate') do
+  steps 'When I run `cap dev utils:download_file[../../../dkdeploy.pem]`
+         Given I set relative to current path the environment variable "SSL_CERT_FILE" to "/temp/dkdeploy.dkdeploy-php.dev.pem"'
+end
diff --git a/lib/capistrano/dkdeploy/php.rb b/lib/capistrano/dkdeploy/php.rb
@@ -21,5 +21,9 @@
 
     set :remote_opcache_file_name, 'opcache_reset.php'
     set :local_opcache_file, File.join(__dir__, '..', '..', '..', 'vendor', 'opcache_reset.php')
+
+    # timeouts for Net::HTTP
+    set :http_open_timeout, nil
+    set :http_read_timeout, 60
   end
 end
diff --git a/lib/dkdeploy/php/helpers/http.rb b/lib/dkdeploy/php/helpers/http.rb
@@ -18,39 +18,40 @@ def call_file_on_server(filename, server)
           web_server_port = domain_scheme == 'https' ? 443 : 80
           # Use server configuration, if exists
           web_server_port = server.fetch(:web_server_port) if server.properties.respond_to?(:web_server_port)
+          ssl_verify_mode = server.properties.respond_to?(:ssl_verify_mode) ? server.fetch(:ssl_verify_mode) : OpenSSL::SSL::VERIFY_PEER
 
           url = URI.parse("#{domain_scheme}://#{domain}").merge("/#{filename}")
           url.port = web_server_port
           info "Call URL #{url}"
 
-          http_get_with_redirect url
+          http_get_with_redirect url: url, verify_mode: ssl_verify_mode
         end
 
         # Sends a get request that handles redirects
         #
         # @param url [URI]
         # @param limit [Integer] defines how many redirects are allowed
+        # @param verify_mode [OpenSSL::SSL::verify_mode] ssl verify mode, setting to VERIFY_NONE disables certificate check
         # @return [NET::HTTPResponse]
-        def http_get_with_redirect(url, limit = 5)
+        def http_get_with_redirect(url:, limit: 5, verify_mode: OpenSSL::SSL::VERIFY_PEER)
           limit = Integer(limit)
           raise ArgumentError, 'limit cannot be negative' if limit < 0
           raise 'too many HTTP redirects' if limit.zero?
           # configure Net::HTTP
           http = Net::HTTP.new(url.host, url.port)
-          http.open_timeout = fetch :http_open_timeout, nil
-          http.read_timeout = fetch :http_read_timeout, 60
+          http.open_timeout = fetch :http_open_timeout
+          http.read_timeout = fetch :http_read_timeout
           if url.scheme == 'https'
             http.use_ssl = true
-            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+            http.verify_mode = verify_mode
           end
           request = Net::HTTP::Get.new(url.path) # build request
-          # call url
-          response = http.request(request)
+          response = http.request(request) # call url
           if response.is_a? Net::HTTPRedirection
             # Does not handle multiple redirects. Code/idea from http://stackoverflow.com/a/7210600/1796645
             location = URI.parse(response.header['location'])
             info "redirected to #{location}"
-            response = http_get_with_redirect(location, limit - 1)
+            response = http_get_with_redirect(url: location, limit: limit - 1, verify_mode: verify_mode)
           end
           response
         end
diff --git a/lib/dkdeploy/php/tasks/composer.rake b/lib/dkdeploy/php/tasks/composer.rake
@@ -24,7 +24,7 @@ namespace :composer do
       begin
         # run composer status
         invoke 'composer:local:run', :status
-      rescue
+      rescue SSHKit::StandardError
         run_locally do
           command = SSHKit::Command.new :composer, :status, '-v', *default_arguments
           error I18n.t('tasks.composer.local.check_status.failure', command: command.to_s, scope: :dkdeploy)
diff --git a/lib/dkdeploy/php/tasks/db.rake b/lib/dkdeploy/php/tasks/db.rake
diff --git a/lib/dkdeploy/php/tasks/php.rake b/lib/dkdeploy/php/tasks/php.rake
diff --git a/lib/dkdeploy/php/version.rb b/lib/dkdeploy/php/version.rb
diff --git a/spec/fixtures/application/config/deploy/dev.rb b/spec/fixtures/application/config/deploy/dev.rb
diff --git a/spec/fixtures/capistrano/configuration/server_with_faulty_domain_configuration.rb b/spec/fixtures/capistrano/configuration/server_with_faulty_domain_configuration.rb
diff --git a/spec/fixtures/capistrano/configuration/server_with_ssl.rb b/spec/fixtures/capistrano/configuration/server_with_ssl.rb
diff --git a/spec/fixtures/capistrano/configuration/server_with_valid_domain.rb b/spec/fixtures/capistrano/configuration/server_with_valid_domain.rb

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-Copyright (c) 2014-2016 dkd Internet Service GmbH, Frankfurt am Main (Germany), https://dkd.de/`
	`1`	`+Copyright (c) 2014-2017 dkd Internet Service GmbH, Frankfurt am Main (Germany), https://dkd.de/`
`2`	`2`
`3`	`3`	`Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:`
`4`	`4`