Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Taming the Deployment Beast
1. Taming the
Deployment
Beast DallasPHP - Dallas, TX
08.11.2009
Monday, August 17, 2009
2. What is Deployment?
HERE THERE
The fun part is what happens in between...
- technology
- configuration
- coordination
- an increase in sanity
20090716-01
Monday, August 17, 2009
3. What’s included in Deployment?
- code testing
- building documentation
- checking permissions
- check coding standards
- updates/uninstall of components
- notifications
20090716-02
Monday, August 17, 2009
4. Thinking Environmentally
Development
Environment for application development (includes version control, unit testing, lint checks)
Quality Assurance/Testing
Environment for testing applications and ensuring all is functioning well
Staging
Environment immediately prior to deployment to production, checkout of current files
marked for "production"
Production
Environment for public consumption
20090716-02
Monday, August 17, 2009
5. Don’t Forget the Testing
Integration
Unit/other tests designed to identify potential errors with the communication
between pieces of functionality
Acceptance/System
Run "in browser" to validate functionality of the applications
Compatibility
Ensuring that the software will work with all platforms involved
Performance
Checking performance of the application on all sides
Security
Verifying that no security issues exist in the code for any stage in the process
20090716-04
Monday, August 17, 2009
6. Version Control Makes it Simple
CVS
Version control system, each file has its own version number, uses tags and
pseudo branches for code separation
Subversion
Version control system, repository has overall version number, uses tags/
branches for code separation
Git
Version control system, each checkout is a full repository in its own right,
allows for offline commits, updates/merges once connected
20090716-03
Monday, August 17, 2009
7. Build it Out
Phing
PHP-based build tool, automates the build process for a site to be deployed.
XML-based build file for simple management (PHP)
Ant
Apache's build tool, designed for flexibility for multiple deployment types.
XML-based configuration files (Java)
Capistrano
Tool for automation of tasks on multiple servers (as opposed to just a local build).
Allows for rollbacks. (Ruby)
20090716-05
Monday, August 17, 2009
8. Document Your Code
phpDocumentor
Uses code comments to build documentation
Examples:
/**
* This library (MyLib) provides this bit of functionality
* @author Chris Cornutt <ccornutt@phpdeveloper.org>
* @package mylibs
*/
class MyLib { }
//------------------
/**
* This method takes in things and outputs others
* @param array $arr_in Input Array
* @param string $str_in Input String
* @return object $obj_out Output object
*/
public function myMethod($arr_in,$str_in,$obj_out){
return $obj_out;
}
Wiki software (like MediaWiki)
Used by Wikipedia
Document the “why”, not really the “how”
Easy to get out of control
20090716-04
Monday, August 17, 2009
9. Frontend Testing
Selenium
Firefox extension
Session recording for typing, clicks, etc
Three flavors: Selenium IDE, Selenium Remote Control, Seleium Grid
Multiple browser support (IE, Firefox, Safari, Chrome)
WebTests
Based on an Ant build process
Build XML-based repeatable tests
Worries more about the page than how its rendered
Output reports on test results
20090716-04
Monday, August 17, 2009
10. Continuous Integration
phpUnderControl (CruiseControl)
CruiseControl is Java-based, but build tools for Ant, Phing, Rake, etc
Plugins for git, svn, cvs
Output methods include emails, ftp, http, jabber, etc
pUc adds integration for things like PHPUnit, phpDocumentor, PHP_CodeSniffer
Chart output for unit test coverage, coding violations, timeline
Xinc (Native PHP)
Written in PHP5 with built-in SVN support
Stats output for build status, testing summary, duration
Installable via PEAR
20090716-04
Monday, August 17, 2009
11. Syntax Tools
Tidy
Extension for PHP (http://php.net/tidy)
Parsing XML and HTML
Can specify a custom configuration file
CleanRepair is your best friend
PHP_CodeSniffer
Reduces the code to “tokens” & checks location, surroundings to ensure compliance
Comes with default “sniffs” - PEAR, PHPCS, Zend, Squiz
Command line tool: phpcs
FILE: /path/to/code/myfile.php
--------------------------------------------------------------------------------
FOUND 5 ERROR(S) AND 1 WARNING(S) AFFECTING 5 LINE(S)
--------------------------------------------------------------------------------
2 | ERROR | Missing file doc comment
20 | ERROR | PHP keywords must be lowercase; expected "false" but found
| | "FALSE"
88 | ERROR | Line not indented correctly; expected 9 spaces but found 6
--------------------------------------------------------------------------------
20090716-04
Monday, August 17, 2009
12. Deployment Options
SVN (svn up) PEAR installer
ssh/scp phar packages
rsync
ftp/sftp Other manual/automatic process
20090716-05
Monday, August 17, 2009
13. Enough Talk
It’s Time for Some Action
20090716-05
Monday, August 17, 2009
14. Overview
Phing / Ant
Unit Build
svn co Test Docs rsync
DEV PROD
Lint Code
Check Standard
Subversion
PHPUnit
phpDocumentor
PHP’s lint
PHP_CodeSniffer
rsync
Zip DB
Deploy PEAR Report Tar
20090716-05
Monday, August 17, 2009
15. Step 1 - Planning
What do we have right now?
What business processes/workflows need to be
considered?
Which technologies would we need to invest in?
What’s our release schedule?
Who’s going to run this thing?
20090716-05
Monday, August 17, 2009
16. Step 2 - Development
Single place to pull from
(You do use version control, right?)
Example:
Subversion environment with developer branches as well as QA and
PROD branches. PROD branch is “the point”.
QA
PROD
DEV
20090716-05
Monday, August 17, 2009
17. Step 3 - The Build
Determine the steps you’ll need
Think Easy
Server builds are good + Local build is even better
Example:
Phing configuration that includes an anonymous checkout of the latest from the repository,
a run of all unit tests for the project, generate the docs via phpDocumentor, check the syntax of
all files and run an rsync script to push it out live.
20090716-05
Monday, August 17, 2009
20. Step 4 - The Push
Where’s “here” and where’s “there”?
And what’s in between that could cause issues...
Pick the right tools & process for you
Things to consider: network config, what’s already in use (piggyback on a protocol?)
Ready...Set...Wait
Do you have everything you need? Is the staging environment ready?
20090716-05
Monday, August 17, 2009
22. Step 5 - The Aftermath
Clean up your mess, young man
This is where post-push belongs, wrap it all up
Make sure dev is ready to do it all again
Deployment should be simple and automatic
Giving the “All Clear”
Be sure to run your tests to ensure that all is happy in production.
20090716-05
Monday, August 17, 2009
23. The Point of it All
Like flipping a switch, a good build should make
deploying your website a simple task, no matter
the complexity.
It should remove the burden of repetitive tasks
from developers and make lives easier.
20090716-05
Monday, August 17, 2009
