Skip to content

Added install script & documentation for installing this repository. #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Oct 27, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .editorconfig
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ trim_trailing_whitespace = true
ident_size = 2
trim_trailing_whitespace = false

[*.sh]
ident_size = 2

[*.json]
ident_size = 2

Expand Down
83 changes: 83 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,89 @@ The following packages are suggested:
[phpDox]: http://phpdox.de
[Sami]: https://github.com/FriendsOfPHP/sami

## Usage

This is a simple metapackage which can be used in two different ways; globally installed or on a per project basis.

Both methods have their pros (+) and cons (-).

**Global installation**:
* \+ All tools are present anywhere on your system
* \+ Can be used on any codebase, even the ones that don't use Composer.
* \- You'll have to update manually, since it's not a project, versioning is not managed.

*Per project installation*:
* \+ Versioning (update/installation) is provided in the project
* \- Tools not available system wide. You'll need to execute them from a specific path.

These methods are not mutual exclusive. You can have your global installed version, which can be used anywhere, but
still use the one provided in a project.

## Installation

### Global installation

The following script will install a system wide Composer for you, including the QA tools.

```bash
bash <(curl -S https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like telling people to pipe/redirect atbitrary code to bash. I also don't have any real alternative.. Other than maybe (which is not stable) or more work than it might be worth.

Maybe @brammittendorff might have a suggestion?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I totally know where you are going here... this discussion is probably older than Netscape v.s. Mosaic...

This was based on how other larger tools do this (e.g. Composer, Homebrew). In my point of view, it's all about trust. We have a review process and the code is opensource. Take a look and decide. I would suggest adding a notice or warning above this instruction.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The alternative would be to tell people to install composer themselves which would kind of defeat the purpose of the script 😞

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess that warning people and telling them how to do it "safely" should be sufficient (like expressed here.

It would also help to sign commits and have 2FA required for direct contributors. (As a means for more trust).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice find! Will do a similar thing 👍

I totally agree on the last bit... little out of scope for this pull request. Sound like a 'guide'. Let's discuss this post daily and consider enforcing it.

Copy link
Contributor

@brammittendorff brammittendorff Oct 26, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use:

curl -o install.sh https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh
bash install.sh

Yes you will split it up but you will let the user decide if he or she wants to see the file. You will give the power to the user to check that file for security reasons.

Maby you can add md5sum to check if the md5sum is correct. Yes I know you can fake this but it is a nice way of saying hey this file has the correct file integrity.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Potherca This is also a way of doing it.
https://rvm.io/rvm/security
They offer it as en extra installation method.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that is about as safe as we can make it without making it too difficult for common users.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@frenck even better

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

```

That's it. This can be put in any instructions, such as a README or someone's blog, since the logic is in the shell
script. Provided you download the script using https, the file has standard levels of authentication and encryption
protecting it from manipulation. We also sign the install with a GPG key, this way you can check if the downloaded
releases signature matches the public key of Dealerdirect.

```bash
gpg --keyserver hkp://keys.gnupg.net --recv-keys C4133165DF5EB4BAEABDADCACF1E7823C5339B59
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh.sig
gpg --verify install.sh.sig
bash install.sh
```

This is obviously a shell script, if you're really concerned about the argument that it may contain nefarious
activities within, you can easily review it before you run it.

```bash
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh
less install.sh
bash instal.sh
```



If you already have a global Composer setup, you could include the tools manually, without the need for running
the shell script above.

```bash
composer global require "dealerdirect/qa-tools:*"
```

#### Per project installation

The other option is to install this on a per project basis.

Using Composer (preferred method):

```bash
composer require --dev "dealerdirect/qa-tools"
```

Or modify your `composer.json` to include `dealerdirect/qa-tools` in the `require-dev` sections:

```json
{
"name": "acme/my-project",
"require": {
"…": "*"
},
"require-dev": {
"dealerdirect/qa-tools": "*"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might want to add a version number rather than "no constraint"

}
}
```

## Contributing

This is an active open-source project. We are always open to people who want to use the code or contribute to it.
Expand Down
Loading