-
Notifications
You must be signed in to change notification settings - Fork 208
PHPC-2356: Remove explicit env variables #1514
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
5bc1c4e
90e3476
273c4cf
8ad63d2
8b7d679
3c94e9a
0909e0c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -167,9 +167,19 @@ functions: | |
"bootstrap mongo-orchestration": | ||
- command: shell.exec | ||
params: | ||
include_expansions_in_env: | ||
- MONGODB_VERSION | ||
- TOPOLOGY | ||
- AUTH | ||
- SSL | ||
- STORAGE_ENGINE | ||
- LOAD_BALANCER | ||
- REQUIRE_API_VERSION | ||
- ORCHESTRATION_FILE | ||
script: | | ||
${PREPARE_SHELL} | ||
SKIP_LEGACY_SHELL=true MONGODB_VERSION=${MONGODB_VERSION} TOPOLOGY=${TOPOLOGY} AUTH=${AUTH} SSL=${SSL} STORAGE_ENGINE=${STORAGE_ENGINE} LOAD_BALANCER=${LOAD_BALANCER} REQUIRE_API_VERSION=${REQUIRE_API_VERSION} ORCHESTRATION_FILE=${ORCHESTRATION_FILE} sh ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh | ||
SKIP_LEGACY_SHELL=true \ | ||
sh ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh | ||
# run-orchestration generates expansion file with MONGODB_URI and CRYPT_SHARED_LIB_PATH | ||
- command: expansions.update | ||
params: | ||
|
@@ -185,28 +195,32 @@ functions: | |
"run OCSP responder": | ||
- command: shell.exec | ||
params: | ||
include_expansions_in_env: | ||
- TEST_COLUMN | ||
- CERT_TYPE | ||
- USE_DELEGATE | ||
shell: bash | ||
script: | | ||
${PREPARE_SHELL} | ||
TEST_COLUMN=${TEST_COLUMN} \ | ||
CERT_TYPE=${CERT_TYPE} \ | ||
USE_DELEGATE=${USE_DELEGATE} \ | ||
${PROJECT_DIRECTORY}/.evergreen/run-ocsp-responder.sh | ||
|
||
"run tests": | ||
- command: shell.exec | ||
type: test | ||
params: | ||
include_expansions_in_env: | ||
- API_VERSION | ||
- ATLAS_CONNECTIVITY_URIS | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should this always be specified? In the There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I could create a separate function to run just the connectivity tests that also passes the necessary expansion to the env, but this would entail duplicating all of the logic in this function. I don't think it's worth it, as any attacker who might modify tests to get access to this environment variable would be able to do so in the particular test that includes this variable. |
||
- CRYPT_SHARED_LIB_PATH | ||
- MONGODB_URI | ||
- APPEND_URI | ||
- SKIP_CRYPT_SHARED | ||
- SSL | ||
- SSL_DIR | ||
- TESTS | ||
working_dir: "src" | ||
script: | | ||
${PREPARE_SHELL} | ||
API_VERSION=${API_VERSION} \ | ||
CRYPT_SHARED_LIB_PATH=${CRYPT_SHARED_LIB_PATH} \ | ||
MONGODB_URI="${MONGODB_URI}${APPEND_URI}" \ | ||
SKIP_CRYPT_SHARED=${SKIP_CRYPT_SHARED} \ | ||
SSL=${SSL} \ | ||
SSL_DIR=${SSL_DIR} \ | ||
TESTS=${TESTS} \ | ||
sh ${PROJECT_DIRECTORY}/.evergreen/run-tests.sh | ||
|
||
"cleanup": | ||
|
@@ -242,12 +256,6 @@ functions: | |
# Don't use ${file} syntax here because evergreen treats it as an empty expansion. | ||
[ -f "$file" ] && sh $file || echo "$file not available, skipping" | ||
|
||
"decrypt atlas URI list": | ||
- command: shell.exec | ||
params: | ||
script: | | ||
openssl aes-256-cbc -S "${encrypted_uris_salt}" -K "${encrypted_uris_key}" -iv "${encrypted_uris_iv}" -in ${PROJECT_DIRECTORY}/.evergreen/atlas-uris.txt.enc -out ${PROJECT_DIRECTORY}/.evergreen/atlas-uris.txt -d | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Are other drivers doing this as well? I don't have an opinion on which is more secure, but storing the URIs directly in the Evergreen project config is certainly more convenient. Note: you can also remove |
||
|
||
"start load balancer": | ||
- command: shell.exec | ||
params: | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -19,7 +19,7 @@ buildvariants: | |
- ".sharded .local !.3.6 !.4.0 !.4.2 !.4.4 !.5.0" | ||
- ".loadbalanced .local !.3.6 !.4.0 !.4.2 !.4.4 !.5.0" | ||
- "test-atlas-connectivity" | ||
- ".ocsp !.4.4" | ||
- ".ocsp !.4.4 !.5.0" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. IIUC, this drops OCSP testing on 5.0. What the impetus for this change? The OCSP spec test README doesn't talk about server versions. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We only test 6.0 and newer on Debian 11 - 5.0 and older are tested on Debian 9.2. OCSP tests for 5.0 are included in the test-debian92-php82-local matrix below. |
||
display_tasks: | ||
- name: "test-ocsp-latest" | ||
execution_tasks: | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -52,7 +52,6 @@ php.ini | |
!.github/ | ||
!tests/utils/*.php | ||
!.evergreen | ||
.evergreen/atlas-uris.txt | ||
|
||
|
||
!scripts | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Noted that
vars
(when calling afunc
) actually define expansions (per Functions). That distinction wasn't clear to me before this PR.