silverstripe / sspak

Tool for managing bundles of db/assets from Silverstripe environments
http://silverstripe.github.io/sspak/
BSD 3-Clause "New" or "Revised" License
47 stars 34 forks source link

Audit multiple installation methods #92

Open emteknetnz opened 1 year ago

emteknetnz commented 1 year ago

There are supposed to be multiple ways to install sspak: a) composer.json b) composer global require silverstripe/sspak c) installation script - curl -sS http://silverstripe.github.io/sspak/install | php -- /usr/local/bin d) direct download - sudo mv sspak.phar /usr/local/bin/sspak

a) works to the best of my knowledge, though this should be confirmed

b) requires suffixing :dev-master i.e. composer global require silverstripe/sspak:dev-master. You also need to have ~/.config/composer/vendor/bin in your $PATH for it work seamlessly e.g. sspak <commands>

Some time ago, the binary in bin/sspak stopped being updated, presumably because a github token was revoked. That binary is now out of date, therefore c) and d) do not function as expected. This is very bad, since it means people may be installing an out of date version.

My personal recommendation is that we should remove options c) and d) and force the use of composer, which is the standard way to install all things php. This is my view simply because I do not want this silently breaking again. Others may have a different view though.

Acceptance criteria