forked from omega8cc/boa
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGELOG.txt
4318 lines (3487 loc) · 203 KB
/
CHANGELOG.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
### Stable BOA-2.2.6 Release - Full Edition
### Date: Sat Jun 21 06:14:18 PDT 2014
### Includes Aegir 2.x-boa-custom version.
### Latest hotfix added on: Mon Jun 30 02:28:19 PDT 2014
# Release Notes:
This release includes great new features, improvements, important changes,
many bug fixes, plus 3 new and 7 updated Octopus platforms.
IMPORTANT! This is the last Edition in the 2.2.x series, which marks the end
of Drupal 5, PHP 5.2 and Drush 4 support. Next Edition will open 2.3.x series,
which will allow us to provide newer Aegir version with built-in Drush 6
support, sites in subdirectories, and many Aegir User Interface improvements.
If you still host any Drupal 5 sites or you are using PHP 5.2 for D6 sites,
you will not be able to upgrade to the next 2.3.x Edition and you will have to
stay on the 'legacy' BOA 2.2.x version, which will receive only system
security upgrades, but no further feature nor bugfix releases.
This also means that from now on the 'legacy' 2.2.x version will no longer
receive Drupal core upgrades, even if there will be security core releases.
It is time to upgrade away from Drupal 5 and away from PHP 5.2, if still used.
# New Octopus platforms:
aGov 1.0-rc8 ----------------- https://drupal.org/project/agov
ERPAL 2.0-b2 ----------------- https://drupal.org/project/erpal
Restaurant 1.0-a5 ------------ https://drupal.org/project/restaurant
# Updated Octopus platforms:
Commerce 2.15 ---------------- https://drupal.org/project/commerce_kickstart
Commons 2.18 ----------------- https://drupal.org/project/commons
Commons 3.14 ----------------- https://drupal.org/project/commons
Guardr 1.5 ------------------- https://drupal.org/project/guardr
Open Atrium 2.19 ------------- https://drupal.org/project/openatrium
Open Outreach 1.7 ------------ https://drupal.org/project/openoutreach
Panopoly 1.6 ----------------- https://drupal.org/project/panopoly
# New features and enhancements in this release:
* Drush aliases based workflows are now supported also remotely over SSH.
This is significant improvement since we have added automatically generated
and updated Drush aliases for the on-the-server use in BOA-2.2.0
* Add gems: compass_radix v2 and compass_twitter_bootstrap
* Add support for automatic Scout App upgrade on RVM/Ruby/Gems upgrade.
* Install headless JRE and only if Solr is expected to run.
* Issue #2268889 - Allow to whitelist IPs for chive, cgp and sqlbuddy access.
* Issues #2248907 #1299526 - Allow to use comments for admin notes.
* Nginx: Disable proxy_buffering to avoid useless extra layer in local proxy.
* SQL: Allow to change InnoDB log file size via _INNODB_LOG_FILE_SIZE variable
* Use better subdirectory tree for Drush extensions.
* Add support for disable_user_register_protection INI variable on the
platform level - on self-hosted BOA and Power Engines only.
* Issue #2240277 - Customize Octopus platforms list via control file.
~/static/control/platforms.info
This file, if exists and contains a single line with supported platforms
symbols, allows to control/override the value of _PLATFORMS_LIST variable
normally defined in the /root/.${_USER}.octopus.cnf file, which can't be
modified by the Aegir instance owner with no system root access.
IMPORTANT: If used, it will replace/override the value defined on initial
instance install and all previous upgrades. It takes effect on every
future Octopus instance upgrade, which means that you will miss all newly
added distributions, if they will not be listed also in this control file.
Supported values which can be written in this file - remember: all in a
single line, space separated, so not one per line, as listed below
only for readability:
# D7P D7S D7D --- Drupal 7 prod/stage/dev
# D6P D6S D6D --- Pressflow 6 p/s/d
# AGV ----------- aGov
# CME ----------- Commerce v.2
# CS7 ----------- Commons 7
# DCE ----------- Commerce v.1
# DCS ----------- Commons 6
# ERP ----------- ERPAL
# FSR ----------- Feature Server
# GDR ----------- Guardr
# MNS ----------- Managing News
# OA7 ----------- Open Atrium D7
# OAM ----------- Open Atrium D6
# OAY ----------- Open Academy
# OBG ----------- OpenBlog
# OCH ----------- OpenChurch
# ODS ----------- Open Deals
# OOH ----------- Open Outreach
# OSR ----------- OpenScholar
# PPY ----------- Panopoly
# RER ----------- Recruiter
# RST ----------- Restaurant
# SRK ----------- Spark
# TTM ----------- Totem
# UC7 ----------- Ubercart D7
# UCT ----------- Ubercart D6
You can also use special keyword 'ALL' to have all available platforms
installed, including newly added in the future BOA system releases.
Examples:
ALL
D7P D6P OAM MNS OOH RST
* Issue #314 - Make _BACKEND_ITEMS configurable via _BACKEND_ITEMS_LIST
You can whitelist extra binaries to make them available for web server
requests, in addition to already whitelisted, known as safe binaries.
NOTE: This feature is available only on self-hosted BOA systems.
Please be aware that you could easily open security holes by whitelisting
commands which may provide access to otherwise not available parts of
the system, because the exec() in PHP doesn't respect other limitations
like open_basedir directive.
You should list only filenames, not full paths, for example:
_BACKEND_ITEMS_LIST="git foo bar"
# Changes in this release:
* Add memcache, memcache_admin to the list of automatically disabled modules.
* Add varnish to the list of automatically disabled modules.
* Add watchdog_live to the list of automatically disabled modules.
* Disable and remove not used init scripts on known VM systems.
* Drush: Upgrade command line version 6 to mini-6-21-06-2014
* Fast DNS Cache Server (pdnsd) install is no longer optional.
* Install only vanilla core platforms by default (can be overridden)
* Nginx: Update default limit_conn settings.
* Nginx: Use only newer control file to force DoS monitor aggressive mode.
* Sync permissions with new defaults in the hardened setup.
* Update files ownership to match defaults in the hardened setup.
* The BOA project has moved to Github!
We no longer use repositories and issue queues on drupal.org, in an effort
to avoid fragmentation and duplication. We have moved all downloads used
by Barracuda and Octopus to our mirrors a few months ago, and it helped to
make BOA faster and more reliable during both system install and upgrades.
The next step is to use http://boa.readthedocs.org as a new home for all
future documentation efforts - it will build the docs, including printable
versions, on the fly, using dedicated Github repository as a backend, where
you can help migrate existing docs and improve them, both via boa-docs
project issue queue and pull requests:
https://github.com/omega8cc/boa-docs
We also encourage you to use drupal.stackexchange.com for BOA support:
http://drupal.stackexchange.com/questions/tagged/aegir
Please use our Github project for contributing code, reporting bugs,
and also suggesting new features and ideas:
https://github.com/omega8cc/boa
# System upgrades in this release:
* cURL 7.37.0 (if installed from sources)
* MariaDB 10.0.12
* MariaDB 5.5.38
* MySecureShell 1.33
* Nginx 1.7.2
* OpenSSL 1.0.1h (if installed from sources)
* PHP 5.4.29
* PHP 5.5.13
* PHP: Zend OPcache master-28-05-2014
* Redis 2.8.11
* Ruby 2.1.2
# Fixes in this release:
* Add caveats to docs/REMOTE.txt
* Add explicit whitelisting in websh wrapper to avoid any edge case problems.
* Add info about Two-Factor Auth for Chive in the welcome e-mail template.
* Add missing exceptions in global.inc and simplify docs/REMOTE.txt
* Add missing wrapper exceptions required by daily.sh script.
* Clean up packages cache on finale()
* Create symlink for boa wrapper on the initial install only.
* Delete daily both files and directories in the ~/static/trash/
* Do not remove bundler in CI instances if /root/.keep.bundler.cnf exists.
* Explain that _ALLOW_UNSUPPORTED works only with head.
* Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template.
* Fix for already installed Open Atrium 2.18 7.28.1
* Fix for Postfix configuration.
* Fix incorrect version in the permissions fix.
* Fix permissions after every upgrade.
* Fix permissions and owner/group required for feeds (upload) support.
* Force apticron re-install if apticron.conf is outdated.
* Generate /data/all/cpuinfo daily to be used in Provision.
* GPL Ghostscript should be available for the web (PHP-FPM) access.
* Issue #2248037 - Add Platform and Site INI files Templates on Verify task.
* Issue #2262935 - Modules dir must be group writable in custom platforms.
* Issue #315 - Upgrading from older versions of BOA fails
* Issue #316 - Upgrade fails because of missing cd $_ROOT/.drush/sys line.
* Issue #319 - XTRAS_LIST settings are being overwritten (Ubuntu)
* PHP: Add protection from switching to not installed CLI or FPM version.
* PHP: Do not block getenv function.
* Provision: Use /data/all/cpuinfo generated by BOA daily, if exists.
* Remove redundant downloads silencer.
* Remove remote_import if found in the wrong directory.
* SQL: Do not run update_innodb_log_file_size() if the size is the same.
* Sync BOND with BARRACUDA.
* Update for switch_to_bash procedure.
* Use already downloaded patches.
* Use full path to sqlmagic in daily.sh to avoid 'command not found' error.
* Fix for authorized IPs detection in the protected vhosts logic - it should
ignore serial/remote console logins.
* Provision: Use higher hardcoded threshold to avoid breaking tasks due to
high load on multi-CPU systems when provision can't determine the real load.
### Stable BOA-2.2.5 Release - Full Edition
### Date: Thu May 8 11:59:23 PDT 2014
### Includes Aegir 2.x-boa-custom version.
### Latest hotfix added on: Sat May 10 09:05:19 PDT 2014
# Release Notes:
This release includes no new features, but does include bug fixes plus latest
Drupal 7.28.1 and Pressflow 6.31.2 core in all built-in Octopus platforms.
There are also three updated distributions included, as listed below.
We also list here all hot-fixes applied to previous stable after its release.
# Important - Read This First! (for self-hosted BOA only)
If you haven't run full barracuda+octopus upgrade to latest BOA Stable
Edition yet, don't use any partial upgrade modes explained in docs/UPGRADE.txt
Once new BOA Stable is released, you must run *full* upgrades with commands:
$ barracuda up-stable
$ octopus up-stable all both
For silent, logged mode with e-mail message sent once the upgrade is
complete, but no progress is displayed in the terminal window, you can run
alternatively, starting with screen session to avoid incomplete upgrade
if your SSH session will be closed for any reason before the upgrade
will complete:
$ screen
$ barracuda up-stable log
$ octopus up-stable all both log
Note that the silent, non-interactive mode will automatically say Y/Yes
to all prompts and is thus useful to run auto-upgrades scheduled in cron.
If you have skipped some recent BOA releases, and you have new default config
option: _PERMISSIONS_FIX=NO in your /root/.barracuda.cnf configuration file,
plus, you are not sure if you follow best practices for managing permissions
as recommended in our docs: https://omega8.cc/node/116 then we recommend
that you change it to _PERMISSIONS_FIX=YES temporarily, or even permanently
if your VPS is fast enough, and then run this powerful script as root:
$ bash /var/xdrago/daily.sh
Note that BOA 'legacy' mode is still at version 2.1.3
# Updated Octopus platforms:
Commons 3.12 ----------------- https://drupal.org/project/commons
Open Atrium 2.18 ------------- https://drupal.org/project/openatrium
Open Outreach 1.6 ------------ https://drupal.org/project/openoutreach
# Changes in this release:
* Add rsyslog/sysklogd to auto-healing procedures.
* Make the aggressive scan_nginx mode optional and use old mode by default.
* Nginx: Add HiScan to blocked crawlers list.
* Nginx: Add Riddler to blocked crawlers list.
* PHP: Use pm.process_idle_timeout = 10s for speed and RAM optimization.
# System upgrades in this release:
* MySecureShell 1.33
* PHP 5.4.28
* PHP 5.5.12
# Fixes in this release:
* Always define _PHP_CN variable properly.
* Firewall: Sync CONNLIMIT for web ports with updated limit_conn in Nginx.
* Fix for _NGINX_DOS_LIMIT logical error in the scan_nginx template.
* Force Pure-FTPd server re-install if key files are missing for any reason.
* Issue #2237167 - Improve authorized IPs detection in all protected vhosts.
* Issue #2262935 - Modules dir must be group writable in custom platforms.
* Nginx: Do not overwrite custom symlinks to the Under Construction template.
* Nginx: Update limit_conn in all instances and vhosts on Barracuda upgrade.
* PHP: Delete pear in legacy paths, if still exists.
* PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA)
* Postfix: Force re-install if broken permissions detected on upgrade.
* Pressflow 6: Fix #GH 84 by using drupal_page_is_cacheable().
* Pressflow 6: Merge pull request #GH 85 from pressflow/SA-CORE-2014-002-fix.
* Pressflow 6: Remove duplicate openid_update_6001().
* Revert "Force MariaDB 5.5 re-install".
* Set the TERM env variable if missing to avoid errors.
* Skip packages set on hold when running apticron.
* The ~/static/control must be writeable by lshell user to manage ctrl files.
* Add extra cron semaphore to prevent concurrent cron invocations via
multiple running runner.sh instances.
### Stable BOA-2.2.4 Release - Full Edition
### Date: Wed Apr 30 17:03:36 PDT 2014
### Includes Aegir 2.x-boa-custom version.
### Latest hotfix added on: Fri May 2 04:54:25 PDT 2014
# Release Notes:
This release includes several bug fixes along with five updated platforms,
plus some hot-fixes applied to previous stable after its release. We have
also added a fix for known problem is recent Drupal 7.27 [#2245331] hence
the change from Drupal 7.27.1 to 7.27.2 in all D7 platforms.
# Updated Octopus platforms:
### Drupal 7.27.2
Commerce 1.25 ---------------- https://drupal.org/project/commerce_kickstart
Commerce 2.14 ---------------- https://drupal.org/project/commerce_kickstart
Commons 3.11 ----------------- https://drupal.org/project/commons
Panopoly 1.5 ----------------- https://drupal.org/project/panopoly
### Pressflow 6.31.1
Commons 2.17 ----------------- https://drupal.org/project/commons
Note: Always read and follow upgrade procedure if explained in the distro
release notes, like for Panopoly 1.5 at https://drupal.org/node/2255133
# New o_contrib modules:
* print-6.x-1.19 (includes patch to auto-detect /usr/bin/wkhtmltopdf)
* print-7.x-2.0 (includes patch to auto-detect /usr/bin/wkhtmltopdf)
# New features and enhancements in this release:
* Support for session.gc_maxlifetime configurable via INI files.
You can control session garbage collector (EOL) per site and per platform.
The value (in seconds) of the session_gc_eol variable is used as
session.gc_maxlifetime value and specifies the number of seconds after which
data will be seen as 'garbage' and potentially cleaned up, resulting with
$_SESSION variable discarded and affected authenticated users logged out.
BOA default defined in the system level global.inc file is 86400 == 24h.
# Changes in this release:
* Drush: Upgrade command line version 6 to mini-6-26-04-2014
* Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare)
* Nginx: Use more aggressive limits against spambots trying to rgstr accounts.
* Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-B
# System upgrades in this release:
* Nginx 1.7.0
* PHP 5.5.12
* Redis 2.8.9
# Fixes in this release:
* Add symlinks in the home directory if missing (every 5 minutes).
* Add warning that Compass Tools install and upgrade may take a LONG time.
* Always define _PHP_CN variable properly.
* Do not delete symlinks to wrappers to avoid false LFD alarms.
* Fix for 'Force backward compatible SERVER_SOFTWARE'.
* Fix in websh for _IN_PATH logic to not break backend Drush tasks.
* Fix the logic for wrappers update and symlinks.
* Improve status messages to display when silent mode is used on upgrade.
* Improve whitelisting in the websh wrapper.
* Issue #2238805 - Command filtering - no word containing *drush* is allowed.
* Issue #2241495 - wkhtmltopdf stopped working after upgrade.
* Issue #2247997 - Update docs/REMOTE.txt with workaround for websh issue.
* Issue #2250397 - Always follow (limited) redirects in cURL requests.
* Issue #GH-304 - [rvm] use $_RUBY_VERSION as default.
* Issue #GH-305 - Check disk usage before running install/upgrade.
* Issue #GH-306 - Allow ruby 1.8 to remain installed.
* Nginx: Allow to configure keywords for aggressive requests rate monitoring.
* Nginx: Do not overwrite custom symlinks to the Under Construction template.
* Nginx: Sync FastCGI timeouts with other Nginx and PHP-FPM defaults.
* PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade.
* PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds)
* PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0
* PHP: Better defaults for realpath_cache_ttl and realpath_cache_size.
* PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA)
* PHP: pm.max_children was not properly updated on FPM version self-switch.
* PHP: Sync incorrect default_socket_timeout with max_execution_time (180s).
* PHP: Use 30s for pm.process_idle_timeout - it prevents too high RAM usage.
* PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level.
* Postfix: Force re-install if broken permissions detected on upgrade.
* Prevent duplicate cron invocations with more strict delays.
* Restart rsyslog once the install or upgrade is complete.
* Set the TERM env variable if missing to avoid errors.
* Shell: Proper fix for wildcard in the path (cd command only)
* Standardize install and upgrade for Chive, SQL Buddy and CGP.
* Sync Redis timeout with default FPM timeout (180s).
* Sync SQL connect_timeout with default mysql.connect_timeout in PHP (60s).
* The ~/static/control must be writeable by lshell user to manage ctrl files.
* Update the logic for multi-version PHP support in BOND.
* Update the logic for multi-version PHP support in docs/REMOTE.txt
### Stable BOA-2.2.3 Release - Full Edition
### Date: Fri Apr 18 12:57:40 PDT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
This release includes several bug fixes and security upgrades both for the
system services and Drupal core, along with three updated platforms and new
features, including support for MariaDB 10.0 and Ubuntu 14.04 LTS Trusty.
# Updated Octopus platforms:
### Drupal 7.27.1
Guardr 1.3 ------------------- https://drupal.org/project/guardr
Open Atrium 2.17 ------------- https://drupal.org/project/openatrium
Recruiter 1.2 ---------------- https://drupal.org/project/recruiter
# New features and enhancements in this release:
* Add docs/FAQ.txt
* Add support for MariaDB 10.0 or 5.5 install via _DB_SERIES variable.
* Add support for Ubuntu 14.04 LTS Trusty.
* Improve auto-healing for multi-version PHP-FPM setup.
* Improve docs/UPGRADE.txt
* Improve health check for protected vhosts during live SSH-auth update.
* Nginx: More aggressive limits against spambots trying to register accounts.
# Changes in this release:
* Issue #GH-299 - Force disable LESS developer mode on production sites.
* Move custom scripts to /opt/local/bin/
* Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare)
* Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1
* PHP: Do not use separate FPM pool for cron if _PHP_FPM_DENY is empty.
# System upgrades in this release:
* MariaDB 5.5.37
# Fixes in this release:
* Add 'exit 0' line if missing.
* Add /opt/local/bin to PATH by default.
* Add symlinks for wrappers only temporarily.
* Add warning that Compass Tools install and upgrade may take a LONG time.
* Better gem uninstall options.
* Compass: Multiple fixes for various expected gems versions install/upgrades.
* Do not override lshell env_path in websh wrapper.
* Do not use monitored bin path for custom scripts to avoid LFD false alarms.
* Extra db GRANT for 127.0.0.1 not added when migrating site.
* Improve auto-healing to create required directories in /var/run/ if missing.
* Issue #2230269 - New Jetty 9 version overrides JETTY_PORT=8099 with 8080.
* Issue #2235991 - Drush make needs better exceptions in websh wrapper.
* Issue #2236475 - Clarify what the Legacy mode really means.
* Issue #2238965 - Add missing path to switch_to_bash().
* Issue #2241013 - Git commands should be whitelisted in websh wrapper.
* Issue #2241495 - wkhtmltopdf stopped working after upgrade.
* Issue #GH-301 - Update the list of restricted keywords for Octopus username.
* Issue #GH-304 - [rvm] use $_RUBY_VERSION as default.
* Make sure that permissions on Chive Manager dir/files are correct.
* Note: _SSL_FROM_SOURCES=YES is ignored and not needed on Wheezy and Precise.
* PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade.
* PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds)
* PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0
* PHP: pm.max_children was not properly updated on FPM version self-switch.
* PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level.
* Remove the line with header TABLE_NAME (sqlmagic).
* Reset PATH to avoid RVM overrides after Compass Tools install/upgrade.
* Shell: Allow to run 'drush cache-clear drush' in any directory.
* The _PHP_MODERN_ONLY variable is no longer used.
* Ubuntu 14.04 LTS Trusty requires MariaDB 10.0
* Use hostname -b instead of deprecated hostname -v.
### Stable BOA-2.2.2 Release - Barracuda Edition
### Date: Tue Apr 8 07:24:18 PDT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
This is a bug-fix only release to address issues discovered after recent
major BOA-2.2.0 and subsequent BOA-2.2.1 Releases.
The most important problem fixed in this Release is related to known OpenSSL
security issue, which has been fixed in OpenSSL 1.0.1g
To learn more please visit: http://heartbleed.com
@=> Note for those on self-hosted BOA (skip this if you are on a hosted Aegir)
We recommend that you enable _SSL_FROM_SOURCES=YES option in your system
/root/.barracuda.cnf file, to always build latest OpenSSL from sources.
Note that it will also trigger OpenSSH and cURL install from sources, plus
subsequent PHP rebuild to include latest SSL libraries.
Note that _SSL_FROM_SOURCES=YES will not force the build from sources on
Debian Wheezy and Ubuntu Precise, to avoid confirmed conflicts and because
both OS versions already provide custom, patched OpenSSL packages.
This Release doesn't include any updates to the Octopus installer, so there is
no point in running full upgrade. It is enough to run the barracuda only,
system upgrade in the "silent mode" with:
$ screen
$ barracuda up-stable system
The system will send you an e-mail with results when the upgrade is complete,
but there will be no upgrade progress displayed in the console. You can watch
it, if you prefer, with command (DATE/TIME are placeholders for real values):
$ tail -f /var/backups/reports/up/barracuda/DATE/barracuda-up-DATE-TIME.log
# System upgrades in this release:
* Nginx 1.5.13
* OpenSSL 1.0.1g (if installed from sources)
* PHP 5.4.27
* PHP 5.5.11
# Fixes in this release:
* Chive Authentication via SSH session may break Nginx due to race conditions.
* Drush specific dt() wrapper is required in Provision for custom platforms.
* Fix Compass Tools support for Omega (gems dependencies via bundle install).
* Fix default shell for system level cron tasks.
* Fix for csf firewall compatibility test.
* Force better health check on protected vhosts on live SSH-auth update.
* Improved health check for protected vhosts during live SSH-auth update.
* Issue #2229555 - On fresh boa install link missing durring install.
* Issue #2229715 - Tasks queue doesn't work on the Master Instance.
* Issue #2231093 - Add new line before 'UseDNS no' in the sshd_config file.
* Issue #2235991 - Drush make needs better exceptions in websh wrapper.
* Issue #294 - New Relic ext not installed even if _NEWRELIC_KEY is not empty.
* Nginx: Backup and re-create default wildcard SSL cert/key with rsa:4096
* Nginx: Generate 4096 bit long DH parameters when _NGINX_FORWARD_SECRECY=YES
* Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1
* PHP: Better default workers limits for the ondemand mode.
* PHP: max_input_time should be set to 180 and not 60, by default.
* PHP: Zend OPcache directive opcache.enable=1 must be set in all ini files.
* Reset PATH to avoid RVM overrides after Compass Tools install/upgrade.
* The 'scp' command is broken in limited shell.
* Too broad whitelisting breaks commands in limited shell with 'tmp' keyword.
* Too restrictive open_basedir defaults break access to valid PEAR paths.
* Too restrictive open_basedir defaults break access to valid Tika paths.
* Use rsa:4096 by default in self-signed certs for Nginx and FTPS.
### Stable BOA-2.2.1 Release - Full Edition
### Date: Tue Apr 1 10:28:45 SGT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
This is a bug-fix only release to address issues discovered after recent
major BOA-2.2.0 Release.
# Fixes in this release:
* Chive Authentication via SSH session doesn't work on some older instances.
* Compass Tools don't use correct paths to Ruby 2.1.1
* Cron for sites doesn't work on old instances without Nginx wildcard vhost.
* FTPS (FTP over SSL) connections may experience TLS problems.
* PHP: Disabled 'assert' may cause warnings on features revert.
* PHP: Disabled 'create_function' may break some contrib modules or code.
* The 'git pull' command is broken in limited shell.
* The 'rsync' command is broken in limited shell.
* The 'drush dl foo' command can't be run outside of site directory.
# Known Issues on systems upgraded to BOA-2.2.1 (and 2.2.0) releases
==> Updated on Tue Apr 8 01:26:47 PDT 2014
@=> Issues fixed in BOA head (running the hotfix in stable is enough):
* Chive Authentication via SSH session may break Nginx due to race conditions.
* Drush specific dt() wrapper is required in Provision for custom platforms.
* Issue #2229715 - Tasks queue doesn't work on the Master Instance.
* PHP: max_input_time should be set to 180 and not 60, by default.
* The 'scp' command is broken in limited shell.
* Too broad whitelisting breaks commands in limited shell with 'tmp' keyword.
* Too restrictive open_basedir defaults break access to valid Tika paths.
* Zend OPcache directive opcache.enable=1 must be set in all php.ini files.
To fix all those problems you can run as root on self-hosted system:
$ wget -q -U iCab http://files.aegir.cc/update/boa221fix.txt
$ bash boa221fix.txt
We have fixed this on all hosted and remotely managed Aegir instances already.
@=> Other issues fixed in BOA head (run 'barracuda up-head system' to apply):
* PHP: New Relic extension not installed even if _NEWRELIC_KEY is not empty.
* Too restrictive open_basedir defaults break access to valid PEAR paths.
### Stable BOA-2.2.0 Release - Full Edition
### Date: Mon Mar 31 06:44:08 SGT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
There are many important changes and improvements in this release
you should be aware of *before* running your BOA system upgrade.
Even if you are on a hosted BOA system with upgrades managed for you,
it is very important to read at least this extensive release notes.
Here is a list of topics covered in detail further below:
* New 'legacy' mode available for installs and upgrades
* Important Note For Those Using Our Hosted Aegir Service!
* Custom php.ini protection has changed and will not honor old settings
* Barracuda no longer supports Percona since 2.2.0 release
* Support for PHP FPM/CLI version safe switch per Octopus instance
* All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode
* Drush aliases are now automatically copied to all relevant accounts
* Drush is now restricted to use only trusted modules installed by default
* The ~/.drush and other important directories and symlinks are protected
* Support for safely configurable cache bins exceptions in Redis
* Two-Factor-like Authentication to protect access to Chive DB Manager
* Support for session.cookie_lifetime configurable via INI files
* Support for files permissions-fix exceptions via platform level INI file
* High-performance JavaScript callback handler (js) in all platforms
And if you are more curious, read also the big changelog further below,
which covers only a small number of over 560 commits since BOA-2.1.3 release.
But what if you are not ready for this major upgrade and you would like
to have more time for testing, but still be able to run system upgrades,
thus effectively still using previous version 2.1.3 with standard command
'barracuda up-stable system', as explained in the docs/UPGRADE.txt?
#-### New 'legacy' mode available for installs and upgrades
We are introducing special 'legacy' mode both for BOA installs and upgrades.
This means that starting with BOA-2.2.0 you can use commands like:
$ boa in-legacy public server.mydomain.org my@email o1
$ barracuda up-legacy system
$ octopus up-legacy o1
etc.
These special 'legacy' commands allow you to install and/or upgrade the 'old
stable', once the 'new stable' is released. But only until another 'stable'
is released, of course. Thus you can use it only as an interim solution
if you are not yet ready for latest 'stable' BOA Edition, for any reason,
but you want to update at least the low level system packages, kernel etc.
Note also that if you will upgrade to current 'stable', it is not possible
to downgrade back to the 'old stable' with 'legacy' mode, so please proceed
with care!
This option will be particularly important once we release *next* major BOA
Edition. It will come with terminated support for Drush 4, Drupal 5 and, yes,
PHP 5.2 (finally). This step is required to use latest Drush 6+ with supported
Drupal cores versions and supported PHP versions, which in fact is required
to introduce the real Aegir 2.0 in BOA -- we are still using older, customized
for backward compatibility, Aegir 2 HEAD version, so it is time to move on and
stay up to date with everything, get new features like ability to manage
Drupal sites in subdirectories etc.
Once that *next* major BOA Edition is released, we will freeze the 'legacy'
mode at 2.2.x series level, which will receive only security upgrades and
no further feature nor bugfix releases. At that point you will have to stick
to the 'legacy' BOA version if you will need to run PHP 5.2 and Drupal 5
with Aegir based on Drush 4. It will be still possible, but not recommended
and not really supported, besides security related issues outside of Drupal.
This also means that at that point the 'legacy' version will no longer
receive Drupal core upgrades, even if there will be security core releases.
Note that we don't use the term "major release" in the known convention
for versions naming. It is because the first digit, for historical reasons,
refers to the Aegir version supported, the second digit refers to BOA stack
major release, and the last digit refers to both feature and bugfix BOA
stack upgrades.
#-### Important Note For Those Using Our Hosted Aegir Service!
NOW is the time (and last chance) to upgrade all your legacy Drupal 5 sites
and outdated Drupal 6 sites still not compatible with at least PHP 5.3,
because once we upgrade to the *next* major BOA Edition, it will be no longer
possible to still run Drupal sites not compatible with PHP 5.3 -- there
were literally years of this legacy support provided, and this finally
comes to the end, because we will not use the BOA 'legacy' mode on our own
servers. It will be still available for remotely managed 'Aegir on Your Own
Server' option, though, but only on request: https://omega8.cc/support
#-### Custom php.ini protection has changed and will not honor old settings
If you have custom settings in any of your php.ini files protected with
old variable in the /root/.barracuda.cnf, make a backup of your ini files
before running this upgrade. While these files will not get overwritten,
they will no longer be used, because we have introduced new, standardized
directory structure to properly support multi-PHP-versions systems.
Respective php.ini files are now located in /opt/phpXX/etc/phpXX.ini
for FPM and /opt/phpXX/lib/php.ini for CLI, where XX is 55, 54, 53 or 52,
depending on the versions listed via _PHP_MULTI_INSTALL variable in the
/root/.barracuda.cnf file. Also the variables used to protect ini files
from being overwritten have changed to _CUSTOM_CONFIG_PHPXX.
If you need any non-standard settings in any of active ini files, don't
overwrite them with the old files, but rather carefully review and apply
only the differences you need.
#-### Barracuda no longer supports Percona since 2.2.0 release
If you have used Percona before, Barracuda will force upgrade to MariaDB 5.5
and PHP rebuild automatically. We plan to add possibility to install
MariaDB 10.0 once released as stable and tested. MariaDB is the default
DB server in Barracuda for a long time already.
#-### Support for PHP FPM/CLI version safe switch per Octopus instance
This allows to easily switch PHP version by the instance owner w/o system
admin (root) help. All you need to do is to create ~/static/control/fpm.info
and ~/static/control/cli.info file with a single line telling the system
which available PHP version should be used (if installed): 5.5 or 5.4 or 5.3
Only one of them can be set, but you can use separate versions for web access
(fpm.info) and the Aegir backend (cli.info). The system will switch versions
defined via these control files in 5 minutes or less. We use external control
files and not any option in the Aegir interface to make sure you will never
lock yourself by switching to version which may cause unexpected problems.
Note that the same version will be used in all platforms and all sites hosted
on the same Octopus instance. Why not to try latest and greatest PHP 5.5 now?
#-### All PHP FPM workers in 5.5, 5.4 and 5.3 now use the 'ondemand' mode
This change will help to better manage memory use, especially on systems with
multiple PHP versions running in parallel. This will also free resources
and allocate them dynamically only when requests are coming and only to
the active FPM pools. Note that the 'ondemand' mode doesn't affect Zend
OPcache, because it is managed by the parent process(es) which stay(s) active.
The net result is that on a vanilla BOA install, without non-hostmaster sites
running, the complete stack consumes just ~200 MB of RAM (in total, so with
MariaDB, Redis and Nginx etc. included) with all three PHP-FPM versions
running in parallel: 5.5, 5.4 and 5.3:
CPU[#* 2.0%]
Mem[|||||||||||||###***********************************209/1002MB]
Swp[ 0/0MB]
magic:~# ps axf | grep fpm
8380 ? Ss 0:00 php-fpm: master process (/opt/php55/etc/php55-fpm.conf)
8391 ? Ss 0:00 php-fpm: master process (/opt/php54/etc/php54-fpm.conf)
8402 ? Ss 0:00 php-fpm: master process (/opt/php53/etc/php53-fpm.conf)
magic:~#
#-### Drush aliases are now automatically copied to all relevant accounts
While Aegir manages Drush aliases for its backend needs, they are normally
not available for the main nor the extra shell users on the instance.
But starting with 2.2.0, BOA automatically manages copies of all Drush
aliases, by adding them, updating or removing, every 5 minutes, once it
detects that there are changes applied, like: the site has been migrated
to another platform, or associated client/owner has been updated, etc.
You no longer need to `cd` to the respective site directory to perform
some available Drush tasks. Just check the available aliases list with
`drush aliases` and then enjoy the beauty of `drush @foo.com command` syntax.
#-### Drush is now restricted to use only trusted modules installed by default
Note: this change affects only Aegir backend/system user, typically o1,
while all other limited shell accounts are not affected, because they are
already individually jailed with protected custom php.ini and special
Drush wrappers and settings.
This means that you can skip this section if you are on a hosted Aegir.
Customized Drush now included in BOA by default, will be able to use only
extensions/commands bundled with contrib modules which are either a part
of modules added in every platform via shared o_contrib/o_contrib_seven
symlink located in the platform core modules directory, or are included
in the built-in platforms installation profiles space, or in the system
account, protected .drush sub-directory.
This means that any Drush extension/command bundled with contrib module
uploaded to the sites/all/modules space in all built-in platforms will be
ignored and not available on command line for the backend user. The same
applies to site level contrib space, if used.
Additionally, any Drush extension/command bundled with custom platforms
located in the ~/static directory tree will be completely ignored by Drush,
no matter where uploaded: core, profiles, sites/all or sites/foo.com space.
This is not a problem in hosted environments, where users normally never
should have an access to the Aegir backend user, anyway.
If you have any reason to use Drush on command line as an Aegir backend/system
user, for example to escape limited shell restrictions, we recommend to
install vanilla Drush 6, for example in /opt/tools/drush/vanilla/drush/ and
then symlink it into /usr/local/bin/ with custom name, so it will be available
automatically in your backend o1 user's PATH.
Further improvements to secure sites and instances in a completely locked
virtual jails are planned in next BOA releases, which will address all other
known and even potential security issues in Aegir.
#-### The ~/.drush and other important directories and symlinks are protected
There are directories, files and symlinks which should be protected from
any changes and managed exclusively by the BOA system. The reasons may vary
from security to avoidable support requests when the less experienced user
will delete his sites or platforms symlinks, while they can't be easily nor
automatically recreated. It also prevents the sub-accounts users from using
their account home directory as a private upload/archive disk space.
#-### Support for safely configurable cache bins exceptions in Redis
Sometimes you may want to exclude some problematic cache bins from Redis
so they will use default SQL engine, at least until related issue will be
fixed either in your contrib code or in the Redis integration module.
Normally you had to edit the local.settings.php file which is both tedious
and dangerous because of extra steps: https://omega8.cc/node/230 to add
a line, for example: $conf['cache_class_cache_foo'] = 'DrupalDatabaseCache';
Plus, it had to be done for every site separately.
Now you can simply list the cache bins to exclude, comma separated, either
in the site or platform level active INI file.
Example: redis_exclude_bins = "cache_views,cache_foo,cache_bar"
#-### Two-Factor-like Authentication to protect access to Chive DB Manager
We are introducing Two-Factor-like Authentication logic - now extended also
to protect Chive DB Manager, Collectd Graph Panel and SQL Buddy DB Manager.
You must be logged in via SSH and run any auto-continuos command, for example:
`ping -i 30 google.com` to keep the access open for your IP address.
Why is this important?
While BOA forces HTTPS connection for Chive, anyone who knows the URL can
access it and attempt to either run brute-force attack to get into your
site's database, or at least attempt to hammer the server and cause DoS-like
effects, at least until the system will block his IP on the firewall.
The other important reason is that your site's DB credentials change only
when you migrate or rename the site, and otherwise remain intact. Now, what
if you have an employee or a freelancer whom you no longer want to be able
to access your site? If you think that deleting his SFTP sub-account is
enough, think again. He still can access your site's database via Chive, if
he knows the site's DB credentials and the Chive URL.
But now it's no longer possible. Only the visitor who is able to successfully
authenticate himself via SSH, and keeps active SSH session, will be able
to access the Chive URL. The rest of the world will see just dummy Nginx 403
Access Denied error.
And in case you are using self-hosted BOA, the same protection is applied
also to Collectd Graph Panel and SQL Buddy DB Manager.
#-### Support for session.cookie_lifetime configurable via INI files
You can control session cookies expiration (TTL) per site and per platform.
The value (in seconds) of the session_cookie_ttl variable is used as
session.cookie_lifetime value.
BOA default defined in the system level global.inc file is 86400 == 24h.
We also recommend that you enable and configure built-in session_expire
module, which allows you to keep the sessions DB table tidy. Make sure that
TTL set via session_cookie_ttl variable is *lower* than TTL configured
in the session_expire module, because the module does not care about PHP
settings and simply deletes old entries from the sessions table on cron run.
#-### Support for files permissions-fix exceptions via platform level INI file
You can opt-out from globally enabled daily-permissions-fix procedure per
platform with new fix_files_permissions_daily variable.
This feature can be useful when you prefer to manage custom platform in
a monolithic codebase mode in Git, so forcing permissions could conflict
with your workflow or development tools. Otherwise you should never disable
this to avoid issues with Aegir tasks related to sites on this platform.
Note that the system level option _PERMISSIONS_FIX (introduced in BOA-2.1.0
and set to NO by default) should be also enabled with YES in the system level
/root/.barracuda.cnf file, if you prefer to have permissions fixed in all
sites on all platforms, except those with fix_files_permissions_daily = FALSE
set in the platform level, active INI file.
#-### High-performance JavaScript callback handler (js) in all platforms
All platforms, both built-in and custom in the ~/static directory tree, enjoy
automatically added High-performance JavaScript callback handler (js) support,
which requires extra /js.php file in the platform root and also proper Nginx
rewrites. The module itself is also included in the built-in o_contrib bundle.
All you need is to enable the module, if recommended by any other module,
and enjoy much faster page generation, where possible. You can review the
full list of modules which will benefit from this great helper module on its
project page: https://drupal.org/project/js
Enjoy another super-fast and even more powerful BOA Edition!
# New Octopus platforms:
### Drupal 7.26.4
Guardr 1.1 ------------------- https://drupal.org/project/guardr
# Updated Octopus platforms:
### Drupal 7.26.4
Commerce 1.24 ---------------- https://drupal.org/project/commerce_kickstart
Commerce 2.13 ---------------- https://drupal.org/project/commerce_kickstart
Commons 3.9.1 ---------------- https://drupal.org/project/commons
Drupal 7.26.4 ---------------- https://drupal.org/drupal-7.26
Open Academy 1.0 ------------- https://drupal.org/project/openacademy
Open Atrium 2.15 ------------- https://drupal.org/project/openatrium
Open Deals 1.32 -------------- https://drupal.org/project/opendeals
Open Outreach 1.5 ------------ https://drupal.org/project/openoutreach
OpenBlog 1.0-a3 -------------- https://drupal.org/project/openblog
OpenChurch 1.12 -------------- https://drupal.org/project/openchurch
OpenScholar 3.12.1 ----------- http://theopenscholar.org
Panopoly 1.2 ----------------- https://drupal.org/project/panopoly
Recruiter 1.1.2 -------------- https://drupal.org/project/recruiter
Spark 1.0-b1 ----------------- https://drupal.org/project/spark
Totem 1.1.2 ------------------ https://drupal.org/project/totem
Ubercart 3.6 ----------------- https://drupal.org/project/ubercart
### Pressflow 6.30.1
Commons 2.16 ----------------- https://drupal.org/project/commons
Feature Server 1.2 ----------- http://bit.ly/fserver
Managing News 1.2.4 ---------- https://drupal.org/project/managingnews
Open Atrium 1.7.2 ------------ https://drupal.org/project/openatrium
Pressflow 6.30.1 ------------- http://pressflow.org
Ubercart 2.13 ---------------- https://drupal.org/project/ubercart
# New features and enhancements in this release:
* Add High-performance JavaScript callback handler (js) in all platforms.
* Add session_expire module to shared contrib space in all platforms.
* Add support for session.cookie_lifetime configurable via INI variable.
* Allow to control swap clear with control file /root/.no.swap.clear.cnf
* Auto-Update all BOA install and upgrade wrappers daily.
* Default system /bin/sh symlink target replaced with /bin/websh wrapper.
* Disable tcp_slow_start_after_idle for better SPDY performance.
* Improve the logic in the global.inc for faster processing.
* Issue #1217486 - Add o_contrib symlinks on platform Verify task.
* Issue #1310054 - Add support for drush aliases in all lshell accounts.
* Issue #2148335 - Add Default Localhost Vhost.
* Issue #2166641 - Make hard-coded load thresholds configurable.
* Issue #2170079 - Use _CUSTOM_CONFIG_LSHELL to protect lshell.conf template.
* Issue #2226919 - Custom Platforms in Version Control (skip permissions fix).
* Lshell: Update /etc/lshell.conf only when required instead of every 5 min.
* Manage extra db GRANT for 127.0.0.1 to allow SSH tunneling for SQL access.
* New option _REDIS_LISTEN_MODE to configure PORT or SOCKET mode globally.
* Nginx: Add support for protected PHP-FPM monitor.
* Nginx: Force aggressive no-cache headers for the under construction page.
* Nginx: Switch to buffered logging when /root/.high_traffic.cnf exists.
* PHP: Add support for FPM/CLI version safe switch per Octopus instance.
* PHP: Allow to install and run all supported versions: 5.5, 5.4, 5.3, 5.2
* PHP: Extra php.ini files automatically managed per system and shell user.
* PHP: FPM workers in 5.5, 5.4 and 5.3 will use 'ondemand' mode by default.
* PHP: Use separate FPM pools per Octopus instance.
* PHP: Use TCP Socket mode for all FPM pools and Port mode for legacy vhosts.
* Protect ~/.drush and other important directories and symlinks from changes.
* Redis: Allow to exclude cache bins on the fly, per site or per platform.
* Save 295 seconds on BOA Install and Upgrade.
* Set and auto-manage strict permissions on some important config files.
* Set PHP CLI version in the /bin/websh wrapper on the fly.
* Use Two-Factor-like Authentication logic for Chive DB Manager access.
* Improve `sqlmagic fix file.sql` to properly replace INSERT INTO with
INSERT IGNORE INTO (a workaround for duplicate keys in the DB dump)
* Use the same trick with modules/local-allow.info to temporarily make
civicrm.settings.php writable, if exists.
# Changes in this release:
* Add ~/static/trash/* to automatic daily cleanup.
* Add coder to auto-disabled modules -- see #2068771
* Allow 'drush uli' as root, but deny root access to Drush by default.
* Disable D8 install via _ALLOW_UNSUPPORTED until next release.