passenger 4.0.59 → 4.0.60

data/packaging/debian/internal/scripts/pin_certificates

@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby
+require 'net/https'
+
+def get_fingerprint(host, port = 443)
+  fingerprint = nil
+  http = Net::HTTP.new(host, port)
+  http.use_ssl = true
+  http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+  http.verify_callback = lambda do |preverify_ok, store_context|
+    if preverify_ok and store_context.error == 0
+      certificate = OpenSSL::X509::Certificate.new(store_context.chain[0])
+      fingerprint = Digest::SHA256.hexdigest(certificate.to_der).upcase.scan(/../).join(":")
+      true
+    else
+      false
+    end
+  end
+  request = Net::HTTP::Get.new("/")
+  http.request(request)
+  fingerprint
+end
+
+def update_pin_file(path, hostname, port = 443)
+  puts "+ Updating #{path}"
+  fingerprint = get_fingerprint(hostname, port)
+  puts fingerprint
+  File.open(path, "w") do |f|
+    f.write(fingerprint)
+  end
+end
+
+update_pin_file "internal/publish/packagecloud_fingerprint.txt", "packagecloud.io"
+update_pin_file "internal/publish/oss-binaries.phusionpassenger.com-fingerprint.txt", "oss-binaries.phusionpassenger.com"
+update_pin_file "internal/publish/passenger_website_fingerprint.txt", "www.phusionpassenger.com"

data/packaging/debian/internal/scripts/regen_distro_info_script.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -ex
+exec erb internal/lib/distro_info.sh.erb > internal/lib/distro_info.sh

data/packaging/debian/internal/scripts/setup-vagrant.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+set -o pipefail
+set -x
+
+if [[ ! -e /usr/bin/docker ]]; then
+	curl -sSL https://get.docker.com/ | bash
+fi
+usermod -aG docker vagrant
+if ! grep -q 'cd /vagrant' ~vagrant/.profile; then
+	echo 'if tty -s; then cd /vagrant; fi' >> ~vagrant/.profile
+fi

data/packaging/debian/internal/scripts/setuser

@@ -0,0 +1,31 @@
+#!/bin/my_init_python
+import sys, os, pwd
+if "initgroups" not in dir(os):
+	import initgroups
+
+if len(sys.argv) < 3:
+	sys.stderr.write("Usage: /sbin/setuser USERNAME COMMAND [args..]\n")
+	sys.exit(1)
+
+def abort(message):
+	sys.stderr.write("setuser: %s\n" % message)
+	sys.exit(1)
+
+username = sys.argv[1]
+try:
+	user = pwd.getpwnam(username)
+except KeyError:
+	abort("user %s not found" % username)
+if "initgroups" in dir(os):
+	os.initgroups(username, user.pw_gid)
+else:
+	initgroups.initgroups(username, user.pw_gid)
+os.setgid(user.pw_gid)
+os.setuid(user.pw_uid)
+os.environ['USER'] = username
+os.environ['HOME'] = user.pw_dir
+os.environ['UID']  = str(user.pw_uid)
+try:
+	os.execvp(sys.argv[2], sys.argv[2:])
+except OSError as e:
+	abort("cannot execute %s: %s" % (sys.argv[2], str(e)))

data/packaging/debian/internal/shell/initpbuilder.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -e
+exec /system/internal/build/setup-environment.sh "$@"

data/packaging/debian/internal/shell/preinit.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -e
+ROOTDIR=`dirname "$0"`
+ROOTDIR=`cd "$ROOTDIR/../.." && pwd`
+source "$ROOTDIR/internal/lib/library.sh"
+
+if [[ -e /work ]]; then
+	rm -rf /work/*
+else
+	run mkdir /work
+	run chown app: /work
+fi
+run setuser app "$ROOTDIR/internal/build/setup-environment-essentials.sh"
+run cp "$ROOTDIR/internal/shell/sudoers.conf" /etc/sudoers.d/app
+run chown root: /etc/sudoers.d/app
+run chmod 400 /etc/sudoers.d/app
+run ln -s "$ROOTDIR/internal/shell/initpbuilder.sh" /bin/initpbuilder
+
+echo ---------------------------------------------------------------
+echo
+echo Welcome to the buildbox shell. To login to a pbuilder chroot,
+echo run this:
+echo
+echo "  initpbuilder <CODENAME> <ARCH>"
+echo "  pbuilder-dist <CODENAME> <ARCH> login"
+echo
+
+exec "$@"

data/packaging/debian/internal/shell/sudoers.conf

@@ -0,0 +1 @@
+app ALL=(root)NOPASSWD:ALL

data/packaging/debian/internal/test/apache/apache-24.conf

@@ -0,0 +1,5 @@
+<Directory />
+	Allow from all
+	Options -MultiViews
+	Require all granted
+</Directory>

data/packaging/debian/internal/test/apache/apache-pre-24.conf

@@ -0,0 +1,4 @@
+<Directory />
+	Allow from all
+	Options -MultiViews
+</Directory>

data/packaging/debian/internal/test/apache/vhost.conf

@@ -0,0 +1,17 @@
+<VirtualHost *:80>
+	ServerName passenger.test
+	DocumentRoot /home/app/ruby_test_app/public
+	PassengerUser app
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName 1.passenger.test
+	DocumentRoot /home/app/python_test_app/public
+	PassengerUser app
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName 2.passenger.test
+	DocumentRoot /home/app/nodejs_test_app/public
+	PassengerUser app
+</VirtualHost>

data/packaging/debian/internal/test/misc/config.json

@@ -0,0 +1,15 @@
+{
+  "normal_user_1": "games",
+  "normal_user_2": "daemon",
+  "default_user": "man",
+  "normal_group_1": "daemon",
+  "normal_group_2": "man",
+  "default_group": "games",
+
+  "nonexistant_user": "xxxxxxxxxxxxxxxxxxx",
+  "nonexistant_group": "xxxxxxxxxxxxxxxxxxx",
+  "nonexistant_uid": 9999,
+  "nonexistant_gid": 9999,
+
+  "nginx": "/usr/sbin/nginx"
+}

data/packaging/debian/internal/test/misc/hosts.conf

@@ -0,0 +1,4 @@
+127.0.0.1 passenger.test
+127.0.0.1 1.passenger.test 2.passenger.test 3.passenger.test
+127.0.0.1 4.passenger.test 5.passenger.test 6.passenger.test
+127.0.0.1 7.passenger.test 8.passenger.test 9.passenger.test

data/packaging/debian/internal/test/misc/init.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -e
+
+echo "PS1='\\u@testbox:\\w\\\$ '" >> /root/.bashrc
+
+# Make setuser available in PATH
+cp /system/internal/scripts/setuser /sbin/
+
+if ! /system/internal/test/test.sh "$@"; then
+	echo
+	echo "---------------------------------------------"
+	if $DEBUG_CONSOLE_ON_FAIL; then
+		echo "*** Test failed. A debugging console will now be opened for you."
+		echo
+		if [[ -e /tmp/passenger ]]; then
+			cd /tmp/passenger
+		fi
+		bash -l
+	elif $JENKINS; then
+		echo "*** Test failed. To debug this problem, please read https://github.com/phusion/passenger_apt_automation#debugging-a-packaging-test-failure"
+	else
+		echo "*** Test failed. If you want a debugging console to be launched, re-run the test with -D."
+	fi
+	exit 1
+fi

data/packaging/debian/internal/test/misc/nodejs_test_app.js

@@ -0,0 +1,6 @@
+var http = require('http');
+var server = http.createServer(function(req, res) {
+	res.writeHead(200, { 'Content-Type': 'text/plain' });
+	res.end("Hello Node.js\n");
+});
+server.listen('127.0.0.1', 3000);

data/packaging/debian/internal/test/misc/python_test_app.py

@@ -0,0 +1,3 @@
+def application(environ, start_response):
+	start_response('200 OK', [('Content-Type', 'text/plain')])
+	return [str('Hello Python\n')]

data/packaging/debian/internal/test/misc/ruby_test_app.rb

@@ -0,0 +1,5 @@
+app = lambda do |env|
+  [200, { "Content-Type" => "text/plain" }, ["Hello Ruby\n"]]
+end
+
+run app

data/packaging/debian/internal/test/misc/test_support.rb

@@ -0,0 +1,61 @@
+require 'socket'
+
+def sh(command)
+  output = IO.popen("#{command} 2>&1", "r") do |io|
+    io.read
+  end
+  if $?.exitstatus != 0
+    raise "Command failed: #{command}\n" +
+      "Output:\n#{output}"
+  end
+end
+
+def ping_socket(socket_domain, sockaddr)
+  begin
+    socket = Socket.new(socket_domain, Socket::Constants::SOCK_STREAM, 0)
+    begin
+      socket.connect_nonblock(sockaddr)
+    rescue Errno::ENOENT, Errno::EINPROGRESS, Errno::EAGAIN, Errno::EWOULDBLOCK
+      if select(nil, [socket], nil, 0.1)
+        begin
+          socket.connect_nonblock(sockaddr)
+        rescue Errno::EISCONN
+        rescue Errno::EINVAL
+          if RUBY_PLATFORM =~ /freebsd/i
+            raise Errno::ECONNREFUSED
+          else
+            raise
+          end
+        end
+      else
+        raise Errno::ECONNREFUSED
+      end
+    end
+    true
+  rescue Errno::ECONNREFUSED, Errno::ENOENT
+    false
+  ensure
+    socket.close if socket
+  end
+end
+
+def ping_tcp_socket(hostname, port)
+  sockaddr = Socket.pack_sockaddr_in(port, hostname)
+  begin
+    ping_socket(Socket::Constants::AF_INET, sockaddr)
+  rescue Errno::EAFNOSUPPORT
+    ping_socket(Socket::Constants::AF_INET6, sockaddr)
+  end
+end
+
+def eventually(deadline_duration = 10, check_interval = 0.05)
+  deadline = Time.now + deadline_duration
+  while Time.now < deadline
+    if yield
+      return
+    else
+      sleep(check_interval)
+    end
+  end
+  raise "Time limit exceeded"
+end

data/packaging/debian/internal/test/nginx/vhost.conf

@@ -0,0 +1,23 @@
+server {
+	listen 80;
+	server_name passenger.test;
+	root /home/app/ruby_test_app/public;
+	passenger_enabled on;
+	passenger_user app;
+}
+
+server {
+	listen 80;
+	server_name 1.passenger.test;
+	root /home/app/python_test_app/public;
+	passenger_enabled on;
+	passenger_user app;
+}
+
+server {
+	listen 80;
+	server_name 2.passenger.test;
+	root /home/app/nodejs_test_app/public;
+	passenger_enabled on;
+	passenger_user app;
+}

data/packaging/debian/internal/test/system_web_server_test.rb

@@ -0,0 +1,126 @@
+require 'fileutils'
+require 'open-uri'
+require File.expand_path(File.dirname(__FILE__) + '/misc/test_support')
+
+include FileUtils
+
+def create_app_dir(source, startup_file, dir_name)
+  app_root = "/home/app/#{dir_name}"
+  rm_rf(app_root)
+  mkdir(app_root)
+  cp("/system/internal/test/misc/#{source}", "#{app_root}/#{startup_file}")
+  mkdir("#{app_root}/public")
+  mkdir("#{app_root}/tmp")
+  chown_R("app", "app", app_root)
+  app_root
+end
+
+def create_app_dirs
+  app_dirs = []
+  app_dirs << create_app_dir("ruby_test_app.rb", "config.ru", "ruby_test_app")
+  app_dirs << create_app_dir("python_test_app.py", "passenger_wsgi.py", "python_test_app")
+  app_dirs << create_app_dir("nodejs_test_app.js", "app.js", "nodejs_test_app")
+  app_dirs
+end
+
+shared_examples_for "Hello world Ruby application" do
+  it "works" do
+    open("http://passenger.test/", "rb") do |io|
+      expect(io.read).to eql("Hello Ruby\n")
+    end
+  end
+end
+
+shared_examples_for "Hello world Python application" do
+  it "works" do
+    open("http://1.passenger.test/", "rb") do |io|
+      expect(io.read).to eql("Hello Python\n")
+    end
+  end
+end
+
+shared_examples_for "Hello world Node.js application" do
+  it "works" do
+    open("http://2.passenger.test/", "rb") do |io|
+      expect(io.read).to eql("Hello Node.js\n")
+    end
+  end
+end
+
+describe "The system's Apache with Passenger enabled" do
+  before :all do
+    @app_dirs = create_app_dirs
+    cp("/system/internal/test/apache/vhost.conf", "/etc/apache2/sites-enabled/001-testapp.conf")
+    chmod(0644, "/etc/apache2/sites-enabled/001-testapp.conf")
+    sh("service apache2 start")
+    eventually do
+      ping_tcp_socket("127.0.0.1", 80)
+    end
+  end
+
+  after :all do
+    sh("service apache2 stop")
+    eventually do
+      !ping_tcp_socket("127.0.0.1", 80)
+    end
+    @app_dirs.each do |path|
+      rm_rf(path)
+    end
+    rm("/etc/apache2/sites-enabled/001-testapp.conf")
+  end
+
+  before :each do
+    sh("passenger-config restart-app / --ignore-app-not-running")
+  end
+
+  describe "Ruby support" do
+    include_examples "Hello world Ruby application"
+  end
+
+  describe "Python support" do
+    include_examples "Hello world Python application"
+  end
+
+  describe "Node.js support" do
+    include_examples "Hello world Node.js application"
+  end
+end
+
+describe "The system's Nginx with Passenger enabled" do
+  before :all do
+    @app_dirs = create_app_dirs
+    cp("/system/internal/test/nginx/vhost.conf", "/etc/nginx/sites-enabled/001-testapp.conf")
+    chmod(0644, "/etc/nginx/sites-enabled/001-testapp.conf")
+    sh("sed -i 's/# passenger_root/passenger_root/' /etc/nginx/nginx.conf")
+    sh("sed -i 's/# passenger_ruby/passenger_ruby/' /etc/nginx/nginx.conf")
+    sh("service nginx start")
+    eventually do
+      ping_tcp_socket("127.0.0.1", 80)
+    end
+  end
+
+  after :all do
+    sh("service nginx stop")
+    eventually do
+      !ping_tcp_socket("127.0.0.1", 80)
+    end
+    @app_dirs.each do |path|
+      rm_rf(path)
+    end
+    rm("/etc/nginx/sites-enabled/001-testapp.conf")
+    sh("sed -i 's/\tpassenger_root/\t# passenger_root/' /etc/nginx/nginx.conf")
+    sh("sed -i 's/\tpassenger_ruby/\t# passenger_ruby/' /etc/nginx/nginx.conf")
+  end
+
+  describe "Ruby support" do
+    include_examples "Hello world Ruby application"
+  end
+
+  describe "Python support" do
+    include_examples "Hello world Python application"
+  end
+
+  describe "Node.js support" do
+    include_examples "Hello world Node.js application"
+  end
+end

data/packaging/debian/internal/test/test.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+set -e
+ROOTDIR=`dirname "$0"`
+ROOTDIR=`cd "$ROOTDIR/../.." && pwd`
+source "$ROOTDIR/internal/lib/library.sh"
+
+COMPILE_CONCURRENCY=${COMPILE_CONCURRENCY:-2}
+export DEBIAN_FRONTEND=noninteractive
+if [[ "$DISTRIBUTION" = debian6 ]]; then
+	export LC_ALL=POSIX
+	export LC_CTYPE=POSIX
+else
+	export LC_ALL=C.UTF-8
+	export LC_CTYPE=C.UTF-8
+fi
+if [[ "$DISTRIBUTION" = debian7 ]]; then
+	APACHE2_DEV_PACKAGES="apache2 apache2-threaded-dev"
+else
+	APACHE2_DEV_PACKAGES="apache2 apache2-dev"
+fi
+
+if ls /output/*enterprise* >/dev/null 2>/dev/null; then
+	if [[ ! -e /etc/passenger-enterprise-license ]]; then
+		echo "ERROR: please set a Passenger Enterprise license key with -e."
+		exit 1
+	fi
+fi
+
+echo
+header "Installing packages..."
+run apt-get update -q
+if ls /output/*enterprise* >/dev/null 2>/dev/null; then
+	run gdebi -n -q /output/passenger-enterprise_*_amd64.deb
+	run gdebi -n -q /output/passenger-enterprise-dbg_*_amd64.deb
+	run gdebi -n -q /output/passenger-enterprise-dev_*_amd64.deb
+	run gdebi -n -q /output/passenger-enterprise-doc_*_all.deb
+	run gdebi -n -q /output/libapache2-mod-passenger-enterprise_*_amd64.deb
+else
+	run gdebi -n -q /output/passenger_*_amd64.deb
+	run gdebi -n -q /output/passenger-dbg_*_amd64.deb
+	run gdebi -n -q /output/passenger-dev_*_amd64.deb
+	run gdebi -n -q /output/passenger-doc_*_all.deb
+	run gdebi -n -q /output/libapache2-mod-passenger_*_amd64.deb
+fi
+run gdebi -n -q /output/nginx-common_*_all.deb
+run gdebi -n -q /output/nginx-extras_*_amd64.deb
+run apt-get install -y -q $APACHE2_DEV_PACKAGES
+
+echo
+header "Preparing Passenger source code..."
+# /passenger is mounted read-only, but 'rake' may have to create files, e.g.
+# to generate documentation files. So we copy it to a temporary directory
+# which is writable.
+run rm -rf /tmp/passenger
+if [[ -e /passenger/.git ]]; then
+	run setuser app mkdir /tmp/passenger
+	echo "+ cd /passenger"
+	cd /passenger
+	echo "+ Git copying to /tmp/passenger"
+	(
+		set -o pipefail
+		git archive --format=tar HEAD | setuser app tar -C /tmp/passenger -x
+		submodules=`git submodule status | awk '{ print $2 }'`
+		for submodule in $submodules; do
+			echo "+ Git copying submodule $submodule"
+			pushd $submodule >/dev/null
+			mkdir -p /tmp/passenger/$submodule
+			git archive --format=tar HEAD | setuser app tar -C /tmp/passenger/$submodule -x
+			popd >/dev/null
+		done
+	)
+	if [[ $? != 0 ]]; then
+		exit 1
+	fi
+else
+	run setuser app cp -R /passenger /tmp/passenger
+fi
+echo "+ cd /tmp/passenger"
+cd /tmp/passenger
+
+echo
+header "Preparing system..."
+export PATH=/usr/lib64/ccache:$PATH
+export CCACHE_DIR=/cache/test-$DISTRIBUTION/ccache
+export CCACHE_COMPRESS=1
+export CCACHE_COMPRESS_LEVEL=3
+run setuser app mkdir -p $CCACHE_DIR
+echo "+ Updating /etc/hosts"
+cat /system/internal/test/misc/hosts.conf >> /etc/hosts
+APACHE_INFO=`apache2ctl -V 2>/dev/null`
+APACHE_VERSION=`echo "$APACHE_INFO" | grep 'Server version' | sed 's/.*\///; s/ .*//'`
+if [[ -e /etc/apache2/conf-enabled ]]; then
+	APACHE_CONF_D_DIR=/etc/apache2/conf-enabled
+else
+	APACHE_CONF_D_DIR=/etc/apache2/conf.d
+fi
+if ruby -e 'exit(ARGV[0] >= ARGV[1])' "$APACHE_VERSION" 2.4; then
+	run cp /system/internal/test/apache/apache-24.conf $APACHE_CONF_D_DIR
+	run chmod 644 $APACHE_CONF_D_DIR/apache-24.conf
+else
+	run cp /system/internal/test/apache/apache-pre-24.conf $APACHE_CONF_D_DIR
+	run chmod 644 $APACHE_CONF_D_DIR/apache-pre-24.conf
+fi
+run a2enmod passenger
+run setuser app mkdir -p /cache/test-$DISTRIBUTION/bundle
+run setuser app mkdir -p /cache/test-$DISTRIBUTION/node_modules
+run setuser app ln -s /cache/test-$DISTRIBUTION/node_modules node_modules
+run setuser app rake test:install_deps DOCTOOLS=no DEPS_TARGET=/cache/test-$DISTRIBUTION/bundle BUNDLE_ARGS="-j 4"
+run setuser app cp /system/internal/test/misc/config.json test/config.json
+find /var/{log,lib}/nginx -type d | xargs --no-run-if-empty chmod o+rwx
+find /var/{log,lib}/nginx -type f | xargs --no-run-if-empty chmod o+rw
+
+if $DEBUG_CONSOLE; then
+	echo
+	echo "---------------------------------------------"
+	echo "A debugging console will now be opened for you."
+	echo
+	# Do not trigger the debugging console that will be called on failure.
+	bash -l || true
+	exit 0
+fi
+
+echo
+header "Running tests..."
+
+run env BUNDLE_GEMFILE=/paa/Gemfile bundle exec \
+	rspec -f d -c --tty /system/internal/test/system_web_server_test.rb
+# The Nginx instance launched by system_web_server_test.rb may have created subdirectories
+# in /var/lib/nginx. We relax their permissions here because subsequent tests run Nginx
+# as the 'app' user.
+echo "+ Relaxing permissions in /var/lib/nginx"
+find /var/lib/nginx -type d | xargs --no-run-if-empty chmod o+rwx
+find /var/lib/nginx -type f | xargs --no-run-if-empty chmod o+rw
+
+run passenger-config validate-install --auto --validate-apache2
+run setuser app bundle exec drake -j$COMPILE_CONCURRENCY \
+	test:integration:native_packaging PRINT_FAILED_COMMAND_OUTPUT=1
+run setuser app env PASSENGER_LOCATION_CONFIGURATION_FILE=`passenger-config --root` \
+	bundle exec drake -j$COMPILE_CONCURRENCY test:integration:apache2
+run setuser app env PASSENGER_LOCATION_CONFIGURATION_FILE=`passenger-config --root` \
+	bundle exec drake -j$COMPILE_CONCURRENCY test:integration:nginx