geocouch: fix multiple audit warnings (mostly concerning using system…

[Abashinos]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same formula update/change?
• Does your submission pass brew audit --strict --online <formula> (where <formula> is the name of the formula you're submitting)?
• Have you built your formula locally prior to submission with brew install <formula>?

Fixed several warnings in audit for this formula. Replaced system calls to cd and ln commands with Ruby methods. Updated sha256 to match current one fetched from url.

[DomT4]

This probably isn't worth putting much effort into. Thinking about killing it off.

[Abashinos]

Oh ok. Didn't take too much effort though :)

[MikeMcQuaid]

Can this test be modified to do something more substantial than e.g. --version or --help? See cmake.rb for an example of an application formula with a good test and tinyxml2.rb for an example of a library formula with a good test. Thanks!

[Abashinos]

Thank you for the response. So, what's the preferred action plan for now? Should I enhance this now or wait until it's merged into couchdb formula?

[apjanke]

You can just wait until it's merged in to couchdb. We'll take care of most of the audit problems as part of that merge, and the code will change enough that you'll need to restart from the new formula, if there's any more work to be done.

What would be very helpful is if you could help us devise a test for the geocouch component of couchdb. Is there something simple we can run against couchdb to verify that the geocouch extension has been installed and is working? Something "Hello world" level. If you have ideas, drop them in comments on #475.

[Abashinos]

Actually, I'm not a user of couchdb or geocouch, but I can research it and think of some simple test cases, sure. I'll keep in touch

[MikeMcQuaid]

The main issue can be seen by doing brew install geocouch --sandbox

[xu-cheng]

Briefly scanning this formula, it's troubling. Not only it violates sandbox by almost rewriting other formula's installation, but also it tries to call Formula.brew, which is a private API.

I suggest to either kill this formula, or put it as an option of couchdb.

[MikeMcQuaid]

put it as an option of couchdb.

This seems like the best idea to me 👍

[xu-cheng]

Or there is a third option. Treating it as a modified version of couchdb. i.e. to install its own copy of couchdb and mark it conflicting with the original version of couchdb.

[apjanke]

The conflicting modified version of couchdb would probably be a bummer: there's no "provides couchdb", so anything that depends_on "couchdb" wouldn't be installable. Almost nothing does now, but seems like we shouldn't do that unless we have to.

[apjanke]

Here's a PR to fold geocouch in to an option on couchdb: #475.

I don't have a test for it though. Anyone here enough of a GeoCouch user that they could describe how to do a "Hello World" for it?

[xu-cheng]

The conflicting modified version of couchdb would probably be a bummer: there's no "provides couchdb", so anything that depends_on "couchdb" wouldn't be installable. Almost nothing does now, but seems like we shouldn't do that unless we have to.

Just want to add an caveat, we could introduce a :couchdb requirement for this. (Yes, requirement has its own disadvantage).

Generally speaking, either combining two formulae as one or treating them as conflicted versions have each their own pros and cons. And I have no strong opinion on which approach is better.

[MikeMcQuaid]

Passing on this for now in favour of #475. Thanks for the PR, @Abashinos!