diff --git a/Makefile b/Makefile index 1ff1aee..846524c 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,4 @@ -COMMON_OVERLAYS = apache -COMMON_CONF += apache-credit apache-vhost +COMMON_CONF += apache-credit -include $(FAB_PATH)/common/mk/turnkey/mysql.mk +include $(FAB_PATH)/common/mk/turnkey/lamp.mk include $(FAB_PATH)/common/mk/turnkey.mk diff --git a/README.rst b/README.rst index 0074eb7..65ae95c 100644 --- a/README.rst +++ b/README.rst @@ -12,8 +12,10 @@ and on top of that: - Bugzilla configurations: - - Installed from upstream source code (HEAD of '5.0' branch) via git to - /var/www/bugzilla. + - Installed from the maintained upstream ``5.2`` branch via git to + ``/var/www/bugzilla``. The initial appliance build pins the upstream + commit while retaining the branch and official remote for supervised + updates. **Security note**: Updates to Bugzilla may require supervision so they **ARE NOT** configured to install automatically. See `Bugzilla @@ -25,6 +27,7 @@ and on top of that: - SSL support out of the box. - Postfix MTA (bound to localhost) to allow sending of email (e.g., password recovery). +- Adminer database management at https://*appliance\_ip*:12322. - Webmin modules for configuring Apache2, MySQL and Postfix. Initial configuration: http://*appliance\_ip*/editparams.cgi @@ -42,7 +45,8 @@ Initial configuration: http://*appliance\_ip*/editparams.cgi Credentials *(passwords set at first boot)* ------------------------------------------- -- Webmin, Webshell, SSH, MySQL: username **root** +- Webmin, SSH, MySQL: username **root** +- Adminer: username **adminer** - Bugzilla: - username is email set at first boot diff --git a/changelog b/changelog index 57d7b39..4e27f5d 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,12 @@ +turnkey-bugzilla-19.0 (1) turnkey; urgency=low + + * Install Bugzilla 5.2 from a pinned commit on the maintained upstream + branch and use its MariaDB driver. + + * Port the appliance to Debian 13/Trixie. + + -- TurnKey Linux release engineering Mon, 24 Aug 2026 00:00:00 +0000 + turnkey-bugzilla-18.0 (1) turnkey; urgency=low * Downgrade Bugzilla to 5.0.4 branch via git. See diff --git a/conf.d/downloads b/conf.d/downloads index 1334682..5a71fe4 100755 --- a/conf.d/downloads +++ b/conf.d/downloads @@ -3,4 +3,18 @@ [[ -z "$FAB_HTTP_PROXY" ]] || export http_proxy=$FAB_HTTP_PROXY [[ -z "$FAB_HTTPS_PROXY" ]] || export https_proxy=$FAB_HTTPS_PROXY -git clone --depth 1 --branch 5.0.4 https://github.com/bugzilla/bugzilla.git /var/www/bugzilla +BUGZILLA_COMMIT=5756ec67b506c20ff4b2c32d80e6fcf35e536b76 +BUGZILLA_URL=https://github.com/bugzilla/bugzilla.git +TEMPLATE_URL=https://cpan.metacpan.org/authors/id/T/TO/TODDR/Template-Toolkit-3.106.tar.gz +TEMPLATE_SHA256=c7474050be80201f1fb55f0a569b9c0ab6c1c3f0cebbd7e601bda9b4046eec85 + +git init /var/www/bugzilla +git -C /var/www/bugzilla remote add origin "$BUGZILLA_URL" +git -C /var/www/bugzilla fetch --depth 1 origin "$BUGZILLA_COMMIT" +git -C /var/www/bugzilla checkout -b 5.2 FETCH_HEAD +test "$(git -C /var/www/bugzilla rev-parse HEAD)" = "$BUGZILLA_COMMIT" + +curl --fail --location --output /usr/local/src/Template-Toolkit-3.106.tar.gz \ + "$TEMPLATE_URL" +echo "$TEMPLATE_SHA256 /usr/local/src/Template-Toolkit-3.106.tar.gz" \ + | sha256sum --check diff --git a/conf.d/main b/conf.d/main index 458dc99..b0e316e 100755 --- a/conf.d/main +++ b/conf.d/main @@ -10,6 +10,15 @@ ADMIN_PASS=turnkey SRC=/usr/local/src WEBROOT=/var/www/bugzilla +# Bugzilla 5.2 requires Template Toolkit 3.009 or newer. Trixie's package is +# older, so install the pinned official CPAN release downloaded above. +tar --extract --gzip --file $SRC/Template-Toolkit-3.106.tar.gz --directory $SRC +cd $SRC/Template-Toolkit-3.106 +perl Makefile.PL INSTALLDIRS=site +make +make test +make install + # set ownership chown -R www-data:www-data $WEBROOT @@ -20,11 +29,21 @@ a2enmod rewrite a2enmod headers a2enmod expires a2enmod cgid +a2enmod ssl # setup the database service mysql start mysqladmin create $DB_NAME --default-character-set=utf8; mysql --batch --execute "grant all privileges on $DB_NAME.* to $DB_USER@localhost identified by '$DB_PASS'; flush privileges;" +cat >/etc/mysql/mariadb.conf.d/60-bugzilla.cnf <<'EOF' +[mysqld] +max_allowed_packet = 1G +innodb_file_per_table = ON +ft_min_word_len = 2 + +[mysql] +max_allowed_packet = 1G +EOF # configure bugzilla cat > $WEBROOT/answers < $WEBROOT/answers <&2' ERR + +systemctl --quiet is-active apache2.service mariadb.service postfix.service \ + cron.service multi-user.target +systemctl --quiet is-enabled apache2.service mariadb.service postfix.service \ + cron.service +apache2ctl -t + +git_safe=(git -c safe.directory=/var/www/bugzilla -C /var/www/bugzilla) +bugzilla_commit=$("${git_safe[@]}" rev-parse HEAD) +test "$bugzilla_commit" = 5756ec67b506c20ff4b2c32d80e6fcf35e536b76 +test "$("${git_safe[@]}" branch --show-current)" = 5.2 +test "$("${git_safe[@]}" remote get-url origin)" = \ + https://github.com/bugzilla/bugzilla.git +test "$(perl -MTemplate -e 'print $Template::VERSION')" = 3.106 +test "$(perl -MDBD::MariaDB -e 'print $DBD::MariaDB::VERSION')" != "" +grep -Eq "^[$]db_driver[[:space:]]*=[[:space:]]*'mariadb';" \ + /var/www/bugzilla/localconfig + +curl --insecure --fail --silent --show-error "$base/" >"$response" +grep -qi '.*Bugzilla' "$response" + +curl --insecure --fail --silent --show-error \ + --get --data-urlencode "login=$admin_email" \ + --data-urlencode "password=$app_password" \ + "$base/rest/login" >"$response" +token=$(python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])' <"$response") +test -n "$token" + +cat >"$payload" <<EOF +{"product":"TestProduct","component":"TestComponent","version":"unspecified","summary":"TurnKey v19 acceptance bug","description":"Created through the Bugzilla REST API","op_sys":"All","platform":"All","priority":"Normal","severity":"normal","token":"$token"} +EOF +curl --insecure --fail --silent --show-error \ + -H 'Content-Type: application/json' --data-binary @"$payload" \ + "$base/rest/bug" >"$response" +bug_id=$(python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' <"$response") +test "$bug_id" -gt 0 + +curl --insecure --fail --silent --show-error \ + "$base/rest/bug/$bug_id?token=$token" >"$response" +python3 - "$bug_id" "$response" <<'PYTHON' +import json +import sys + +bug_id = int(sys.argv[1]) +with open(sys.argv[2], encoding='utf-8') as stream: + data = json.load(stream) +bug = data['bugs'][0] +assert bug['id'] == bug_id +assert bug['summary'] == 'TurnKey v19 acceptance bug' +PYTHON +mariadb --batch --skip-column-names bugzilla --execute \ + "SELECT short_desc FROM bugs WHERE bug_id=$bug_id" | \ + grep -Fxq 'TurnKey v19 acceptance bug' +systemctl restart mariadb.service +curl --insecure --fail --silent --show-error \ + "$base/rest/bug/$bug_id?token=$token" >"$response" +grep -q 'TurnKey v19 acceptance bug' "$response" + +test "$(postconf -h inet_interfaces)" = localhost +ss -ltn | awk '$4 ~ /^(127\.0\.0\.1|\[::1\]):25$/ { found=1 } END { exit !found }' +python3 - <<'PYTHON' +import json + +with open('/var/www/bugzilla/data/params.json', encoding='utf-8') as stream: + params = json.load(stream) +assert params['mailfrom'] == 'bugzilla-daemon@example.com' +assert params['mail_delivery_method'] == 'Sendmail' +PYTHON + +crontab -u root -l | grep -Fq './collectstats.pl' +crontab -u root -l | grep -Fq './whineatnews.pl' +crontab -u root -l | grep -Fq './whine.pl' +test -x /var/www/bugzilla/collectstats.pl +test -x /var/www/bugzilla/whine.pl + +dpkg-query -W adminer webmin-apache webmin-mysql webmin-postfix >/dev/null +curl --insecure --fail --silent --show-error \ + https://127.0.0.1:12322/ >"$response" +grep -qi 'Adminer' "$response" +curl --insecure --silent --show-error --location \ + --cookie-jar "$cookies" --cookie "$cookies" \ + --data-urlencode 'auth[driver]=server' \ + --data-urlencode 'auth[server]=localhost' \ + --data-urlencode 'auth[username]=adminer' \ + --data-urlencode "auth[password]=$db_password" \ + --data-urlencode 'auth[db]=bugzilla' \ + https://127.0.0.1:12322/ >"$response" +grep -qi 'bugzilla' "$response" +grep -qi 'Logout' "$response" +curl --insecure --fail --silent --show-error --head \ + https://127.0.0.1:12321/ >/dev/null + +"${git_safe[@]}" fetch --quiet origin 5.2 +candidate=$("${git_safe[@]}" rev-parse FETCH_HEAD) +"${git_safe[@]}" merge-base --is-ancestor \ + "$bugzilla_commit" "$candidate" +/var/www/bugzilla/checksetup.pl --check-modules \ + >"$response" +grep -q 'COMMANDS TO INSTALL' "$response" +test "$("${git_safe[@]}" rev-parse HEAD)" = \ + "$bugzilla_commit" + +apache_version=$(dpkg-query -W -f='${Version}' apache2) +mariadb_version=$(dpkg-query -W -f='${Version}' mariadb-server) +adminer_version=$(dpkg-query -W -f='${Version}' adminer) +before="$apache_version|$mariadb_version|$adminer_version" +apt-get update >/dev/null +for package in apache2 mariadb-server adminer libdbd-mariadb-perl; do + apt-cache policy "$package" >"$policy" + candidate_version=$(awk '/Candidate:/ {print $2}' "$policy") + test -n "$candidate_version" + test "$candidate_version" != '(none)' + grep -Eq 'trixie|deb13' "$policy" +done +after="$(dpkg-query -W -f='${Version}' apache2)|$(dpkg-query -W -f='${Version}' mariadb-server)|$(dpkg-query -W -f='${Version}' adminer)" +test "$after" = "$before" +grep -Rqs '^Suites: trixie' /etc/apt/sources.list.d +! grep -Rqi bookworm /etc/apt/sources.list.d + +cat >"$result" <<EOF +package_source=Debian 13 Trixie APT repositories for Apache, MariaDB, Postfix, Adminer and Perl dependencies; pinned official Bugzilla 5.2 Git commit and Template Toolkit CPAN release +installed_version=bugzilla 5.2 commit $bugzilla_commit; Template Toolkit 3.106; apache2 $apache_version; mariadb-server $mariadb_version; adminer $adminer_version +runtime_checks=normal init; Apache HTTPS; Bugzilla administrator REST login; bug create and read with MariaDB readback and service restart; Postfix loopback and mail settings; cron; Adminer authenticated database view; Webmin endpoint +updater_command=apt-get update and apt-cache policy for Debian packages; git fetch origin 5.2 and checksetup.pl --check-modules for Bugzilla +updater_result=signed Debian metadata refreshed with installed packages unchanged; upstream 5.2 candidate $candidate descends from installed commit; current checksetup module replay passed without changing source +updater_channel=Debian and TurnKey Trixie APT repositories; official Bugzilla 5.2 Git branch +integrity_evidence=APT accepted signed repository metadata; Bugzilla initial commit pinned to $bugzilla_commit; Template Toolkit 3.106 download pinned by SHA-256; no Bookworm source remained +EOF