Add Site Audit to BOA

[mrconnerton]

Would be a nice feature the other platforms have: https://www.drupal.org/project/site_audit

It is just a drush command so needs a task button on a site to go with it.

[omega8cc]

We have tested it before and it reported too many false positives and caused too many false alarms and support requests, so it is now disabled by default, if present:

https://github.com/omega8cc/boa/blob/master/docs/MODULES.txt#L121

We are using https://www.drupal.org/project/security_review instead, and it is integrated within our custom health check Aegir task.

We could test site_audit again, though.

[omega8cc]

We would need to "add vendor specific support", perhaps, because there are still errors and warnings which are false alarms in the BOA stack/env context: https://gist.github.com/omega8cc/b68587b852f5739f99b6

[fluxsauce]

Hi, I'm the maintainer of site_audit. You know, I'm really open to adding vendor specific support, we even talked about that at DrupalCon Austin, then things got quiet.

Rather than just disabling it, let's improve the system to make it compatible :-)

Looking at https://gist.github.com/omega8cc/b68587b852f5739f99b6 ...

Questions:

• Fast 404 Pages - that can have a vendor specific support, as I understand it, that's being handled by the stack / nginx?
• Google PageSpeed Insights - that requires a publicly accessible URL or you should be skipping that report
• Both syslog and db_log are disabled; is there another logging mechanism that we should be checking for?
• Is there an environmental variable that I can use to determine if the site is in the BOA stack?
• Is there an environmental variable that I can use to determine if the site is in a development environment?

I've opened https://www.drupal.org/node/2443451 - I'll record the actionable items there once I know what to be checking for.

[omega8cc]

Hi, thanks for the follow up! We will share all details both here and on d.o, soon.

[fluxsauce]

Something that will be helpful - https://packagist.org/packages/drupal/site_audit

[fluxsauce]

Howdy, this is still out there, what can I do to help?

[omega8cc]

We will get back to this after BOA-3.1.0 release, when we plan to re-start the work on feature requests waiting in the 3.x.0 milestone / placeholder.

[kopeboy]

Any updates?

[omega8cc]

@kopeboy Working on this, stay tuned!

[omega8cc]

See also: https://www.drupal.org/project/hosting_site_audit

We may want to contribute either Aegir vendor, or Aegir and BOA vendor, if needed.

We will report the progress also at: https://www.drupal.org/node/2443451

[fluxsauce]

@omega8cc re: https://www.drupal.org/project/hosting_site_audit is that a forked version of site_audit? If so, why?

[omega8cc]

@fluxsauce No! It is an integration module/feature, and first step to propose Aegir vendor. It is a part of this set of modules:

https://www.drupal.org/project/hosting_monitor
https://www.drupal.org/project/hosting_report

As explained in the project description:

This module integrates the Site Audit extension with the Aegir Monitoring and Reporting systems. It allows all Site Audit checks to be run regularly against all sites hosted on a deployment of the Aegir Hosting System.

[fluxsauce]

@omega8cc it literally contains a copy of site_audit in it? http://cgit.drupalcode.org/hosting_site_audit/tree/lib/site_audit_7?id=8ed6e7c

[omega8cc]

@fluxsauce We are discussing it in today's Aegir scrum on the IRC: https://hefring.mig5.net/bot/log/aegir/2016-09-22

[omega8cc]

@fluxsauce Really? I was not aware of this.. it shouldn't, like we don't bundle rr

[omega8cc]

@fluxsauce - I have pinged @ergonlogic

[fluxsauce]

Yeah, that's why I was asking if it was a fork. Thanks!

[omega8cc]

I can only guess that it is temporary to work on modifications we should propose to make it work with Aegir with custom vendor. There is no point in bundling projects like this. But @ergonlogic should be able to talk more about it, I guess.

[ergonlogic]

Yeah, it was a temporary shortcut, mostly due to drupal.org not supporting git sub-modules. I also want to have both the 7.x and 8.x branches available, since Aegir hosts both.

I needed to make a minor alteration, and make AbstractCheck::$registry public, since there's otherwise no way to set it externally. So expect a PR to add a AbstractCheck::setRegistry() method.

[fluxsauce]

The long-term goal is to support both in the 8.3.x branch, but that should be cool, I'll keep an eye out for it.