search

sonatype-nexus-community / bach

Dependency vulnerability auditor for PHP
Apache License 2.0
14 stars 15 forks source link

requirements adjusted to php7.1.3 #29

Open jkowalleck opened 3 years ago

jkowalleck commented 3 years ago

attempt to fix #28

how this patch was created

  1. deleted existing composer.lock file
  2. adjusted version ranges in composer.json
  3. added config.platform.php:7.1.3 to composer.json in reflection of the lowest supported php version (7.1.3)
  4. ran composer install in docker image circleci/php:7.1 with the project mounted into it this generated a new composer.lock file

how this patch was tested

php7.1 (lowest supported)

preamble:

ran the following in docker image circleci/php:7.1 with the project mounted into it (bash -c 'docker run -it -u3434:"$(id -u)" -v "$(pwd):/app" -w /app circleci/php:7.1 /bin/bash')

  1. ran composer validate
  2. ran composer install
  3. ran php bach composer composer.json

php8 (highest supported)

ran the following in docker image circleci/php:7.1 with the project mounted into it (bash -c 'docker run -it -u3434:"$(id -u)" -v "$(pwd):/app" -w /app circleci/php:8.0 /bin/bash')

  1. ran composer validate
  2. ran composer install
  3. ran php bach composer composer.json

result: php exited with 255; got lots of errors.on depricate messages and so on.

conclusion: it is impossible to support php7.1 and php8 at the same time, while pinning versions with a composer.lock which is pretty upsetting.

possible solutions:

jkowalleck commented 3 years ago

Hello @bhamail ,

i am trying to sort out the root of issue #28 my local tests did work. to have it tested on CircleCI i added this PR.

CircleCI was not triggered. Could you trigger CircleCI to run n this PR?

bhamail commented 3 years ago

CircleCI was not triggered. Could you trigger CircleCI to run n this PR?

I'm guessing CI didn't trigger due to the "draft" status of the PR. Could you try change the "draft" status? I promise not to commit it until all is ready. ;)

PS: Thanks for you work on this!

Also, have you tried running a "local CI" build, as per: CI Notes

circleci config process .circleci/config.yml > .circleci/local-config.yml && circleci local execute -c .circleci/local-config.yml --job 'build_and_test-1'

It uses dockers, all the way down.

jkowalleck commented 3 years ago

CircleCI was not triggered. Could you trigger CircleCI to run n this PR?

I'm guessing CI didn't trigger due to the "draft" status of the PR. Could you try change the "draft" status? I promise not to commit it until all is ready. ;)

Understandable assumption. But this PR was a non-draft the time I created it. converted it to DRAFT state, when i saw that the CI did not run properly. This was done to prevent issues like #25 which was merged to master (without CU running?) and broke the master.

Also, have you tried running a "local CI" build, as per: CI Notes

circleci config process .circleci/config.yml > .circleci/local-config.yml && circleci local execute -c .circleci/local-config.yml --job 'build_and_test-1'

not at the moment i created the initial PR. had trouble setting up CircleCI locally on my ubuntu, and i dont see a reason :-/

bhamail commented 3 years ago

Hm. I can't manually fire a CI build for this PR and it appears this PR has never yet triggered a CI build. Odd! I've posted an issue to the CircleCI support folks to try and figure out why this PR is not triggering builds. (Your other PR's triggered fine).

Meanwhile, would you like to share the problem you hit setting up the CircleCI CLI on ubuntu? Maybe we could get that working (and add the fixes to our CI docs for others). I can at least verify that running a local build on my Mac has reliably reproduced the memory related failure.

For what it's worth, I ran the php8 test (build_and_test-1) locally using this branch, and it fails - I'm guessing due to incompatible changes between php 7 and 8:

$ circleci config process .circleci/config.yml > .circleci/local-config.yml && circleci local execute -c .circleci/local-config.yml --job 'build_and_test-1'

...

Scan status: 3 vulnerabilities found.
        [Low Threat] [CVE-2019-9942]  Information Exposure
        [Medium Threat] CWE-200: Information Exposure
        [Critical Threat] [CVE-2018-13818]  Improper Control of Generation of Code ("Code Injection")
......                                                              6 / 6 (100%)

Time: 1.05 seconds, Memory: 6.00 MB

OK (6 tests, 9 assertions)
====>> ./vendor/bin/phpcs -n --standard=PSR2 ./app/
  #!/bin/bash -eo pipefail
./vendor/bin/phpcs -n --standard=PSR2 ./app/
====>> php bach composer composer.json

  #!/bin/bash -eo pipefail
php bach composer composer.json

Deprecated: Method ReflectionParameter::getClass() is deprecated in /home/circleci/project/vendor/illuminate/container/Container.php on line 853

Call Stack:
    0.0001     397584   1. {main}() /home/circleci/project/bach:0
    0.0095    2447528   2. LaravelZero\Framework\Application->make($abstract = 'Illuminate\\Contracts\\Console\\Kernel', $parameters = ???) /home/circleci/project/bach:33
    0.0095    2447528   3. LaravelZero\Framework\Application->make($abstract = 'Illuminate\\Contracts\\Console\\Kernel', $parameters = []) /home/circleci/project/vendor/laravel-zero/foundation/src/Illuminate/Foundation/Application.php:756
    0.0095    2447528   4. LaravelZero\Framework\Application->resolve($abstract = 'Illuminate\\Contracts\\Console\\Kernel', $parameters = [], $raiseEvents = ???) /home/circleci/project/vendor/illuminate/container/Container.php:615
    0.0095    2447904   5. LaravelZero\Framework\Application->build($concrete = class Closure { public $static = ['abstract' => 'Illuminate\\Contracts\\Console\\Kernel', 'concrete' => 'LaravelZero\\Framework\\Kernel']; public $this = class LaravelZero\Framework\Application { protected $basePath = '/home/circleci/project'; protected $hasBeenBootstrapped = FALSE; protected $booted = FALSE; protected $bootingCallbacks = [...]; protected $bootedCallbacks = [...]; protected $terminatingCallbacks = [...]; protected $serviceProviders = [...]; protected $loadedProviders = [...]; protected $deferredServices = [...]; protected $appPath = NULL; protected $databasePath = NULL; protected $storagePath = NULL; protected $environmentPath = NULL; protected $environmentFile = '.env'; protected $namespace = NULL; protected $resolved = [...]; protected $bindings = [...]; protected $methodBindings = [...]; protected $instances = [...]; protected $aliases = [...]; protected $abstractAliases = [...]; protected $extenders = [...]; protected $tags = [...]; protected $buildStack = [...]; protected $with = [...]; public $contextual = [...]; protected $reboundCallbacks = [...]; protected $globalResolvingCallbacks = [...]; protected $globalAfterResolvingCallbacks = [...]; protected $resolvingCallbacks = [...]; protected $afterResolvingCallbacks = [...] }; public $parameter = ['$container' => '<required>', '$parameters' => '<optional>'] }) /home/circleci/project/vendor/illuminate/container/Container.php:667
    0.0095    2447936   6. LaravelZero\Framework\Application->Illuminate\Container\{closure:/home/circleci/project/vendor/illuminate/container/Container.php:259-267}($container = class LaravelZero\Framework\Application { protected $basePath = '/home/circleci/project'; protected $hasBeenBootstrapped = FALSE; protected $booted = FALSE; protected $bootingCallbacks = []; protected $bootedCallbacks = []; protected $terminatingCallbacks = []; protected $serviceProviders = [0 => class Illuminate\Events\EventServiceProvider { ... }]; protected $loadedProviders = ['Illuminate\Events\EventServiceProvider' => TRUE]; protected $deferredServices = []; protected $appPath = NULL; protected $databasePath = NULL; protected $storagePath = NULL; protected $environmentPath = NULL; protected $environmentFile = '.env'; protected $namespace = NULL; protected $resolved = []; protected $bindings = ['Illuminate\Foundation\Mix' => [...], 'events' => [...], 'Illuminate\Contracts\Console\Kernel' => [...], 'Illuminate\Contracts\Debug\ExceptionHandler' => [...]]; protected $methodBindings = []; protected $instances = ['path' => '/home/circleci/project/app', 'path.base' => '/home/circleci/project', 'path.lang' => '/home/circleci/project/resources/lang', 'path.config' => '/home/circleci/project/config', 'path.public' => '/home/circleci/project/public', 'path.storage' => '/home/circleci/project/storage', 'path.database' => '/home/circleci/project/database', 'path.resources' => '/home/circleci/project/resources', 'path.bootstrap' => '/home/circleci/project/bootstrap', 'app' => ..., 'Illuminate\Container\Container' => ..., 'Illuminate\Foundation\PackageManifest' => class Illuminate\Foundation\PackageManifest { ... }]; protected $aliases = ['Illuminate\Foundation\Application' => 'app', 'Illuminate\Contracts\Container\Container' => 'app', 'Illuminate\Contracts\Foundation\Application' => 'app', 'Psr\Container\ContainerInterface' => 'app', 'Illuminate\Auth\AuthManager' => 'auth', 'Illuminate\Contracts\Auth\Factory' => 'auth', 'Illuminate\Contracts\Auth\Guard' => 'auth.driver', 'Illuminate\View\Compilers\BladeCompiler' => 'blade.compiler', 'Illuminate\Cache\CacheManager' => 'cache', 'Illuminate\Contracts\Cache\Factory' => 'cache', 'Illuminate\Cache\Repository' => 'cache.store', 'Illuminate\Contracts\Cache\Repository' => 'cache.store', 'Illuminate\Config\Repository' => 'config', 'Illuminate\Contracts\Config\Repository' => 'config', 'Illuminate\Cookie\CookieJar' => 'cookie', 'Illuminate\Contracts\Cookie\Factory' => 'cookie', 'Illuminate\Contracts\Cookie\QueueingFactory' => 'cookie', 'Illuminate\Encryption\Encrypter' => 'encrypter', 'Illuminate\Contracts\Encryption\Encrypter' => 'encrypter', 'Illuminate\Database\DatabaseManager' => 'db', 'Illuminate\Database\Connection' => 'db.connection', 'Illuminate\Database\ConnectionInterface' => 'db.connection', 'Illuminate\Events\Dispatcher' => 'events', 'Illuminate\Contracts\Events\Dispatcher' => 'events', 'Illuminate\Filesystem\Filesystem' => 'files', 'Illuminate\Filesystem\FilesystemManager' => 'filesystem', 'Illuminate\Contracts\Filesystem\Factory' => 'filesystem', 'Illuminate\Contracts\Filesystem\Filesystem' => 'filesystem.disk', 'Illuminate\Contracts\Filesystem\Cloud' => 'filesystem.cloud', 'Illuminate\Hashing\HashManager' => 'hash', 'Illuminate\Contracts\Hashing\Hasher' => 'hash.driver', 'Illuminate\Translation\Translator' => 'translator', 'Illuminate\Contracts\Translation\Translator' => 'translator', 'Illuminate\Log\LogManager' => 'log', 'Psr\Log\LoggerInterface' => 'log', 'Illuminate\Mail\Mailer' => 'mailer', 'Illuminate\Contracts\Mail\Mailer' => 'mailer', 'Illuminate\Contracts\Mail\MailQueue' => 'mailer', 'Illuminate\Auth\Passwords\PasswordBrokerManager' => 'auth.password', 'Illuminate\Contracts\Auth\PasswordBrokerFactory' => 'auth.password', 'Illuminate\Auth\Passwords\PasswordBroker' => 'auth.password.broker', 'Illuminate\Contracts\Auth\PasswordBroker' => 'auth.password.broker', 'Illuminate\Queue\QueueManager' => 'queue', 'Illuminate\Contracts\Queue\Factory' => 'queue', 'Illuminate\Contracts\Queue\Monitor' => 'queue', 'Illuminate\Contracts\Queue\Queue' => 'queue.connection', 'Illuminate\Queue\Failed\FailedJobProviderInterface' => 'queue.failer', 'Illuminate\Routing\Redirector' => 'redirect', 'Illuminate\Redis\RedisManager' => 'redis', 'Illuminate\Contracts\Redis\Factory' => 'redis', 'Illuminate\Http\Request' => 'request', 'Symfony\Component\HttpFoundation\Request' => 'request', 'Illuminate\Routing\Router' => 'router', 'Illuminate\Contracts\Routing\Registrar' => 'router', 'Illuminate\Contracts\Routing\BindingRegistrar' => 'router', 'Illuminate\Session\SessionManager' => 'session', 'Illuminate\Session\Store' => 'session.store', 'Illuminate\Contracts\Session\Session' => 'session.store', 'Illuminate\Routing\UrlGenerator' => 'url', 'Illuminate\Contracts\Routing\UrlGenerator' => 'url', 'Illuminate\Validation\Factory' => 'validator', 'Illuminate\Contracts\Validation\Factory' => 'validator', 'Illuminate\View\Factory' => 'view', 'Illuminate\Contracts\View\Factory' => 'view']; protected $abstractAliases = ['app' => [...], 'auth' => [...], 'auth.driver' => [...], 'blade.compiler' => [...], 'cache' => [...], 'cache.store' => [...], 'config' => [...], 'cookie' => [...], 'encrypter' => [...], 'db' => [...], 'db.connection' => [...], 'events' => [...], 'files' => [...], 'filesystem' => [...], 'filesystem.disk' => [...], 'filesystem.cloud' => [...], 'hash' => [...], 'hash.driver' => [...], 'translator' => [...], 'log' => [...], 'mailer' => [...], 'auth.password' => [...], 'auth.password.broker' => [...], 'queue' => [...], 'queue.connection' => [...], 'queue.failer' => [...], 'redirect' => [...], 'redis' => [...], 'request' => [...], 'router' => [...], 'session' => [...], 'session.store' => [...], 'url' => [...], 'validator' => [...], 'view' => [...]]; protected $extenders = []; protected $tags = []; protected $buildStack = [0 => 'LaravelZero\\Framework\\Kernel']; protected $with = [0 => [...], 1 => [...]]; public $contextual = []; protected $reboundCallbacks = []; protected $globalResolvingCallbacks = []; protected $globalAfterResolvingCallbacks = []; protected $resolvingCallbacks = []; protected $afterResolvingCallbacks = [] }, $parameters = []) /home/circleci/project/vendor/illuminate/container/Container.php:785
    0.0095    2447936   7. LaravelZero\Framework\Application->resolve($abstract = 'LaravelZero\\Framework\\Kernel', $parameters = [], $raiseEvents = FALSE) /home/circleci/project/vendor/illuminate/container/Container.php:265
    0.0096    2447936   8. LaravelZero\Framework\Application->build($concrete = 'LaravelZero\\Framework\\Kernel') /home/circleci/project/vendor/illuminate/container/Container.php:667
    0.0100    2576720   9. LaravelZero\Framework\Application->resolveDependencies($dependencies = [0 => class ReflectionParameter { public $name = 'app' }, 1 => class ReflectionParameter { public $name = 'events' }]) /home/circleci/project/vendor/illuminate/container/Container.php:816

Deprecated: Method ReflectionParameter::getClass() is deprecated in /home/circleci/project/vendor/illuminate/container/Container.php on line 927

Call Stack:

...

The php7 test succeeds locally (build_and_test-2):

$ circleci config process .circleci/config.yml > .circleci/local-config.yml && circleci local execute -c .circleci/local-config.yml --job 'build_and_test-2'

...

====>> Uploading artifacts
{"Runner":true,"level":"error","msg":"Can't add file //home/circleci/project/tests/_output to tar: io: read/write on closed pipe","task-id":"localbuild-1619189754","time":"2021-04-23T14:57:49Z"}
{"Runner":true,"level":"error","msg":"Can't close tar writer: io: read/write on closed pipe","task-id":"localbuild-1619189754","time":"2021-04-23T14:57:49Z"}
Uploading /home/circleci/project/tests/_output to home/circleci/project/tests/_output
Uploading /home/circleci/project/tests/_output/test_results.xml (2.6 kB): Error: FAILED with error not supported

Success!
jkowalleck commented 3 years ago

re https://github.com/sonatype-nexus-community/bach/pull/29#issuecomment-825702207

For what it's worth, I ran the php8 test (build_and_test-1) locally using this branch, and it fails - I'm guessing due to incompatible changes between php 7 and 8 [...]

yes, thats what it looks like to me. see my discussion thread here: #30

Meanwhile, would you like to share the problem you hit setting up the CircleCI CLI on ubuntu? Maybe we could get that working (and add the fixes to our CI docs for others).

since i found no ubuntu/debian sources for APT(ubuntu package manager), i used a snap-based setup as described here https://snapcraft.io/install/circleci/ubuntu and tried several other attempts. non was successfull. non was an official doc by the CirleCI team. I wonder if there is a documentation how to setup CircleCI locally, maintained by the CircleCI team themself?

bhamail commented 3 years ago

Meanwhile, would you like to share the problem you hit setting up the CircleCI CLI on ubuntu? Maybe we could get that working (and add the fixes to our CI docs for others).

since i found no ubuntu/debian sources for APT(ubuntu package manager), i used a snap-based setup as described here https://snapcraft.io/install/circleci/ubuntu and tried several other attempts. non was successfull. non was an official doc by the CirleCI team. I wonder if there is a documentation how to setup CircleCI locally, maintained by the CircleCI team themself?

Here's some "official" CircleCI CLI install docs: https://circleci.com/docs/2.0/local-cli/?section=configuration#installation

May not be anything new there, but may also be worth trying the "Manual Download" mentioned above.

What exactly happened with your install attempts? Could you post error messages, etc? (If nothing else, having the specifics of the install failures could lead searches to help others in the future).

jkowalleck commented 3 years ago

@bhamail thanks for the link.

  1. tried the snap install so far exactly as shown in the docs.
  2. ran circleci config process .circleci/config.yml > .circleci/local-config.yml
  3. validated the config: circleci config validate .circleci/local-config.yml
    output: Config file at .circleci/local-config.yml is valid.
  4. ran circleci local execute -c .circleci/local-config.yml
    got this output: 
    Docker image digest: sha256:4925752c0e3179ce8082ccdb9a52e5127f81430dd35d2a3fc8cae07be64e89c1
Error: failed to start event processor: failed to compute task config: failed to read config file: read /tmp/local_build_config.yml: is a directory

googled a bit for that error, found no fix so far. will continue research... maybe manual download/install/setup will help.

bhamail commented 3 years ago

@jkowalleck Just wanted to update you that I'm still working with CircleCI support to figure out why the CI build didn't fire for this PR. I did find a related webhook failure, but "re-delivering" it didn't work either, so still digging.

bhamail commented 3 years ago

@jkowalleck I heard back from CircleCI, and they saw some oauth errors occuring with your account. "That can sometimes happen when users have an account change to their GitHub account, such as an org they are part of enforcing SAML, or an expired GitHub token." They requested you go through the steps in this article for your account: How to perform a full re-authentication.

jkowalleck commented 3 years ago

@bhamail thanks for the update. i revoked CurcleCI integration to MY github account a while ago, since i am not planning to use it. So CircleCI should not have anything from me, nor should it have permissions to any of MY github stuff.

Should be fine, i guess. CircleCI runs in the PR on this repo, not on mine.

jkowalleck commented 3 years ago

got a mail from CirlcleCI today, that addressed the same thing you mentioned, @bhamail .

I re-enabled CircleCI for github access for a brief moment, refreshed CircleCIs permissions in my CircleCI profile. Then dropped CircleCI token from github again and wrote an email to CircleCI requesting a permanent deletion of my account, in hope this will solve the issue.

jkowalleck commented 3 years ago

closed this PR by accident. reopened it

bhamail commented 3 years ago

I just pressed the redeliver button on the most recent webhook event that showed an error, and (fingers crossed) it looks like it has triggered the CI build.

jkowalleck commented 3 years ago

I just pressed the redeliver button on the most recent webhook event that showed an error, and (fingers crossed) it looks like it has triggered the CI build.

It did :) Thanks for the effort. will look into the CI/CT results/issues later.

bhamail commented 3 years ago

@jkowalleck Does the recent fixes in #33 and #34 resolve the PHP version build issue you were working on here? If so, maybe we can close these PR's out?

jkowalleck commented 3 years ago

@bhamail seams like #33 and #34 don't address the the ideas of this very PR.