Here is a proposal to the issue #32. The objective, is to avoid the execution of untrusted scripts

• [x] Add tests
• [x] Document it
• [x] Remember trusted signatures
• [x] Trust users

$ ./bin/melody run ~/test.php  -vvv
Hello Melody!

$ ./bin/melody run 23bb3980daf65154c3d4 
You are running an untrusted resource
  URL: https://gist.github.com/23bb3980daf65154c3d4
  Owner: lyrixx
  Created at: Fri, 17 Oct 2014 14:44:13 +0000
  Last update: Fri, 17 Oct 2014 23:45:48 +0000
  Revision: #2

Do you want to continue [y/N]?y
----------------------------------
Hello greg
----------------------------------

$ ./bin/melody run 23bb3980daf65154c3d4 --trust
----------------------------------
Hello greg
----------------------------------

Hi !

Given this very simple witness script:

<?php

<<<CONFIG
packages:
    - "php"
CONFIG;

echo 'Hello World'.PHP_EOL;

I'm unable to redirect the output to a file using standard or error output redirection:

$ melody run hello_world.php > hello.txt
# hello.txt remains empty

Here is the strace output captured by @lyrixx that might help, showing it seems to be properly output on FD1:

16787 write(1, "/tmp/melody/aefded2aec05bb759178"..., 131) = 131
16787 write(1, "\n", 1)                 = 1
16787 lstat("/tmp/melody/aefded2aec05bb75917826c8787c3c6c24a4ff56cc67f6b6522fe8105cf4bc2c5/vendor/symfony/finder/Comparator/DateComparator.php", {st_mode=S_IFREG|0644, st_size=1465, ...}) = 0
16787 stat("/tmp/melody/aefded2aec05bb75917826c8787c3c6c24a4ff56cc67f6b6522fe8105cf4bc2c5/vendor/symfony/finder/Comparator/DateComparator.php", {st_mode=S_IFREG|0644, st_size=1465, ...}) = 0
16787 write(1, "/tmp/melody/aefded2aec05bb759178"..., 129) = 129
16787 write(1, "\n", 1)                 = 1

Any hint ?

ping @smaftoul, if by chance you have any idea.

before only directories were cleaned up, which contained a Runner::BOOTSTRAP_FILENAME. with this change, also files within the toplevel of storagePath are deleted, when older then GarbageCollector::TTL

I would like to store some temporary files which are required run melody-scripts from within another app (php-console).

If I could add somehow files to the melody's working-dir those were automatically cleaned up by the melody garbage collector, which would be highly usefull in my case. otherwise i need to create another garbage collector for my "own" temp files.

Would you consider this something in scope of melody?

We should integrate with FriendsOfPHP/security-advisories and warn the user when one of the required packages contains known vulnerabilities.

https://github.com/FriendsOfPHP/security-advisories

Let melody extensions/plugins also use the same working dir, which is also garbage collected by melody.

This change should be covered by already existing integration tests.

fixes https://github.com/sensiolabs/melody/issues/39

A melody script requires a proper initialized environment, including all its dependencies. When a composer command errors, let the cliExecutor do the output and stop further processing.

Otherwise we will trigger most likely only subsequent errors. This also makes sure that the working directory will be re-initialised on next run instead of leaving it in a inconsistent state.

It is a PR for #36.

With this PR, it is possible to use fork, private or local repositories (local maybe not useful).

<<<CONFIG
repositories:
    - type: vcs
      url: https://github.com/fabpot/Pimple
packages:
    - "pimple/pimple: 1.0.2"

In the implementation, I would have preferred to use the CLI composer to add a repository but without composer.json, composer throws an exception.

composer config repositories.pimple vcs https://github.com/fabpot/Pimple
[RuntimeException]                               
No composer.json found in the current directory 

Hi, I think melody should ask before running code loaded from the outside and wild world, the Internet.

The main reason for this is that melody allows you to pass in an url, a username/gistID, or just the gistID. It's not hard to type in "http://gist.github.com/gistID", but it would be even better if melody could show up useful informations before running it, like owner name, creation date, revisions count, last revision date ... And a direct link to the gist.

Still, some might wan't to run it without interaction, so it might be useful to add a --no-interaction flag

Thanks in advance (I'll try to do it, but can't promise anything ... and don't know how to test it)

When downloading a gist, we may have a failure

[InvalidArgumentException]                                                                                                                                                                                  
  There is an issue with your gist URL: API rate limit exceeded for W.X.Y.Z. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)  

We could take the composer's one ~/.composer/auth.json or asking the user to create ours auth.json.