-
Notifications
You must be signed in to change notification settings - Fork 6
Added install script & documentation for installing this repository. #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
0aaab17
Initial version of an install script. Currently supports Mac & Linux,…
frenck 2640e93
Improved installer script based on feedback & shellcheck.
frenck 124dad5
Improved install.sh to handle install vs update of the dealerdirect/q…
frenck ac7a81e
Updated documentation with installation instructions
frenck 3c8fbd8
Merge branch 'master' into feature/install-script
frenck 5d549c6
Improved installer script and documentation based on feedback in pr #3
frenck 31291ef
Updated .editorconfig
frenck 69ca2ab
Removed root check from install script. While installing as root is n…
frenck 809ce4c
Added GPG signed installer & documentation.
frenck 3089600
Documentation update, removed version constrain from installation ins…
frenck File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -83,6 +83,89 @@ The following packages are suggested: | |
[phpDox]: http://phpdox.de | ||
[Sami]: https://github.com/FriendsOfPHP/sami | ||
|
||
## Usage | ||
|
||
This is a simple metapackage which can be used in two different ways; globally installed or on a per project basis. | ||
|
||
Both methods have their pros (+) and cons (-). | ||
|
||
**Global installation**: | ||
* \+ All tools are present anywhere on your system | ||
* \+ Can be used on any codebase, even the ones that don't use Composer. | ||
* \- You'll have to update manually, since it's not a project, versioning is not managed. | ||
|
||
*Per project installation*: | ||
* \+ Versioning (update/installation) is provided in the project | ||
* \- Tools not available system wide. You'll need to execute them from a specific path. | ||
|
||
These methods are not mutual exclusive. You can have your global installed version, which can be used anywhere, but | ||
still use the one provided in a project. | ||
|
||
## Installation | ||
|
||
### Global installation | ||
|
||
The following script will install a system wide Composer for you, including the QA tools. | ||
|
||
```bash | ||
bash <(curl -S https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh) | ||
``` | ||
|
||
That's it. This can be put in any instructions, such as a README or someone's blog, since the logic is in the shell | ||
script. Provided you download the script using https, the file has standard levels of authentication and encryption | ||
protecting it from manipulation. We also sign the install with a GPG key, this way you can check if the downloaded | ||
releases signature matches the public key of Dealerdirect. | ||
|
||
```bash | ||
gpg --keyserver hkp://keys.gnupg.net --recv-keys C4133165DF5EB4BAEABDADCACF1E7823C5339B59 | ||
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh | ||
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh.sig | ||
gpg --verify install.sh.sig | ||
bash install.sh | ||
``` | ||
|
||
This is obviously a shell script, if you're really concerned about the argument that it may contain nefarious | ||
activities within, you can easily review it before you run it. | ||
|
||
```bash | ||
curl -O https://raw.githubusercontent.com/DealerDirect/php-qa-tools/master/bin/install.sh | ||
less install.sh | ||
bash instal.sh | ||
``` | ||
|
||
|
||
|
||
If you already have a global Composer setup, you could include the tools manually, without the need for running | ||
the shell script above. | ||
|
||
```bash | ||
composer global require "dealerdirect/qa-tools:*" | ||
``` | ||
|
||
#### Per project installation | ||
|
||
The other option is to install this on a per project basis. | ||
|
||
Using Composer (preferred method): | ||
|
||
```bash | ||
composer require --dev "dealerdirect/qa-tools" | ||
``` | ||
|
||
Or modify your `composer.json` to include `dealerdirect/qa-tools` in the `require-dev` sections: | ||
|
||
```json | ||
{ | ||
"name": "acme/my-project", | ||
"require": { | ||
"…": "*" | ||
}, | ||
"require-dev": { | ||
"dealerdirect/qa-tools": "*" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We might want to add a version number rather than "no constraint" |
||
} | ||
} | ||
``` | ||
|
||
## Contributing | ||
|
||
This is an active open-source project. We are always open to people who want to use the code or contribute to it. | ||
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't like telling people to pipe/redirect atbitrary code to bash. I also don't have any real alternative.. Other than
maybe
(which is not stable) or more work than it might be worth.Maybe @brammittendorff might have a suggestion?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I totally know where you are going here... this discussion is probably older than Netscape v.s. Mosaic...
This was based on how other larger tools do this (e.g. Composer, Homebrew). In my point of view, it's all about trust. We have a review process and the code is opensource. Take a look and decide. I would suggest adding a notice or warning above this instruction.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The alternative would be to tell people to install composer themselves which would kind of defeat the purpose of the script 😞
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I guess that warning people and telling them how to do it "safely" should be sufficient (like expressed here.
It would also help to sign commits and have 2FA required for direct contributors. (As a means for more trust).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice find! Will do a similar thing 👍
I totally agree on the last bit... little out of scope for this pull request. Sound like a 'guide'. Let's discuss this post daily and consider enforcing it.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why not use:
Yes you will split it up but you will let the user decide if he or she wants to see the file. You will give the power to the user to check that file for security reasons.
Maby you can add md5sum to check if the md5sum is correct. Yes I know you can fake this but it is a nice way of saying hey this file has the correct file integrity.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Potherca This is also a way of doing it.
https://rvm.io/rvm/security
They offer it as en extra installation method.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that is about as safe as we can make it without making it too difficult for common users.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@frenck even better
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Potherca @brammittendorff added GPG.