Port Drupal 10 appliance to TurnKey 19 - #11
Open
lirazsiri wants to merge 8 commits into
Open
Conversation
Move the appliance to PHP 8.4 and an exact maintained Drupal, Drush, and contributed-module set. Pin Guzzle 7.15.2 because the upstream Drupal lock selected a release affected by two current advisories, and replace schema-dependent welcome-page inserts and the retired Drush security command with supported APIs. Add functional acceptance coverage for firstboot login, authenticated web page creation, database persistence, service restarts, bundled modules, management endpoints, and non-mutating update paths. A disposable Trixie Composer preflight verified the selected dependency set and a clean advisory audit.
Composer 2.8 writes its successful advisory summary outside the stdout stream consumed by the old wording assertion. The exact appliance had already built, booted, completed firstboot, and reached this audit check. Rely on the command exit status, which is the supported machine-readable pass or fail contract, and keep the migration lane focused on appliance behavior.
Drupal 10.6.15 supersedes the previously tested patch and is the current supported production release in the 10.6 line. Build and acceptance expectations now target that release. Let core-recommended retain its tested Guzzle 7.15.3 lock instead of downgrading it with a direct requirement. Clarify the official Composer source channels and record the prior exact run separately from the current candidate preflight. Verified on Debian Trixie with PHP 8.4.24 using Composer platform checks, lock validation, audit, and a dry-run update. Shell and Python syntax, required test inputs, and Trixie package-plan availability also pass.
Record the passing exact run for the Drupal 10.6.15 release candidate so the documented README crosswalk is backed by reproducible appliance evidence. The run covered build, boot, firstboot, administrator authentication, content persistence, management endpoints, audit and updater behavior without requiring another product fix loop. Verified with exact run 20260829t160411z-5113-11051, shell syntax checks, Python AST parsing, and git diff validation.
The scheduled helper called turnkey-drush as www-data, but turnkey-drush itself must start as root so it can switch to the web account. Run the cron entry as root and exercise the helper through that configured identity during acceptance. This is product fix loop 2/6. Verified with shell syntax checks, a disposable Trixie fixture using the real helper and wrapper, and git diff validation.
Extend exact acceptance to prove that the real turnkey-drush wrapper reaches Drupal as www-data after the scheduled helper starts through its root cron identity. This is an evidence correction and consumes no product fix loop. Verified with shell syntax and git diff validation.
Drush 13 removed pm:security, causing the scheduled alert helper to fail even after its cron privilege was corrected. Audit the locked dependency set with Composer, ignore abandoned-package status for alert decisions, and mail root when Trixie's Composer reports a security finding. This is product fix loop 3/6. Verified with shell syntax, diff validation, and disposable Trixie fixtures covering clean and advisory exit paths through the real turnkey-composer wrapper.
Record the passing exact run after replacing the removed Drush security command with the supported Composer audit path. The evidence now covers the real root cron entry, application-user wrapper, all prior Drupal main flows, supported updater channels, and the accurate product fix count of three out of six. Verified with exact run 20260829t164241z-6730-30442, shell syntax checks, Python AST parsing, evidence hash matching, and git diff validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
docs/v19.0-testing.mdSHIPgit diff --check origin/master...ea71a1ed5d4aedbee2be695f809d612529fbfdbe