Update dependencies

Addresses a Guzzle vulnerability, though it does not affect The Arsse

.gitignore

@@ -1,15 +1,25 @@
-# Temporary files and dependencies
+# Temporary files
 
-/vendor/
-/vendor-bin/*/vendor
-/node_modules
+/release/
 /documentation/
 /manual/
 /tests/coverage/
+/dist/arch/arsse/
+/dist/arch/src/
+/dist/arch/pkg/
+/dist/man/
 /arsse.db*
 /config.php
 /.php_cs.cache
-yarn-error.log
+/tests/.phpunit.result.cache
+
+# Dependencies
+
+/vendor/
+/vendor-bin/*/vendor
+/node_modules
+/yarn.lock
+/yarn-error.log
 
 
 # Windows files
@@ -25,7 +35,6 @@ $RECYCLE.BIN/
 .DS_Store
 .AppleDouble
 .LSOverride
-Icon
 ._*
 .Spotlight-V100
 .Trashes
@@ -36,6 +45,7 @@ Icon
 *.zip
 *.7z
 *.tar.gz
+*.tar.xz
 *.tgz
 *.deb
 *.rpm

.php_cs.dist

@@ -3,6 +3,7 @@
  * Copyright 2017 J. King, Dustin Wilson et al.
  * See LICENSE and AUTHORS files for details */
 
+declare(strict_types=1);
 namespace JKingWeb\Arsse;
 
 const BASE = __DIR__.DIRECTORY_SEPARATOR;
@@ -15,10 +16,63 @@ $paths = [
     BASE."tests",
 ];
 $rules = [
+    // house rules where PSR series is silent
+    'align_multiline_comment'                   => ['comment_type' => "phpdocs_only"],
+    'array_syntax'                              => ['syntax' => "short"],
+    'binary_operator_spaces'                    => [
+        'default'   => "single_space",
+        'operators' => ['=>' => "align_single_space"],
+    ],
+    'cast_spaces'                               => ['space' => "single"],
+    'concat_space'                              => ['spacing' => "none"],
+    'list_syntax'                               => ['syntax' => "short"],
+    'magic_constant_casing'                     => true,
+    'magic_method_casing'                       => true,
+    'modernize_types_casting'                   => true,
+    'native_function_casing'                    => true,
+    'native_function_type_declaration_casing'   => true,
+    'no_binary_string'                          => true,
+    'no_blank_lines_after_phpdoc'               => true,
+    'no_empty_comment'                          => true,
+    'no_empty_phpdoc'                           => true,
+    'no_extra_blank_lines'                      => true, // this could probably use more configuration
+    'no_mixed_echo_print'                       => ['use' => "echo"],
+    'no_short_bool_cast'                        => true,
+    'no_trailing_comma_in_singleline_array'     => true,
+    'no_unneeded_control_parentheses'           => true,
+    'no_unneeded_curly_braces'                  => true,
+    'no_unused_imports'                         => true,
+    'no_whitespace_before_comma_in_array'       => true,
+    'normalize_index_brace'                     => true,
+    'object_operator_without_whitespace'        => true,
+    'pow_to_exponentiation'                     => true,
+    'set_type_to_cast'                          => true,
+    'standardize_not_equals'                    => true,
+    'trailing_comma_in_multiline_array'         => true,
+    'unary_operator_spaces'                     => true,
+    'yoda_style'                                => false,
+    // PSR standard to apply
     '@PSR2' => true,
-    'braces' => ['position_after_functions_and_oop_constructs' => "same"],
-    'function_declaration' => ['closure_function_spacing' => "none"],
-];
+    // PSR-12 rules; php-cs-fixer does not yet support PSR-12 natively
+    'compact_nullable_typehint'                 => true,
+    'declare_equal_normalize'                   => ['space' => "none"],
+    'function_typehint_space'                   => true,
+    'lowercase_cast'                            => true,
+    'lowercase_static_reference'                => true,
+    'no_alternative_syntax'                     => true,
+    'no_empty_statement'                        => true,
+    'no_leading_import_slash'                   => true,
+    'no_leading_namespace_whitespace'           => true,
+    'no_whitespace_in_blank_line'               => true,
+    'return_type_declaration'                   => ['space_before' => "none"],
+    'single_trait_insert_per_statement'         => true,
+    'short_scalar_cast'                         => true,
+    'visibility_required'                       => ['elements' => ["const", "property", "method"]],
+    // house exceptions to PSR rules
+    'braces'                                    => ['position_after_functions_and_oop_constructs' => "same"],
+    'function_declaration'                      => ['closure_function_spacing' => "none"],
+    'new_with_braces'                           => false, // no option to specify absence of braces
+    ];
 
 $finder = \PhpCsFixer\Finder::create();
 foreach ($paths as $path) {
@@ -28,4 +82,4 @@ foreach ($paths as $path) {
         $finder = $finder->in($path);
     }
 }
-return \PhpCsFixer\Config::create()->setRules($rules)->setFinder($finder);
+return \PhpCsFixer\Config::create()->setRiskyAllowed(true)->setRules($rules)->setFinder($finder);

CHANGELOG

@@ -1,3 +1,108 @@
+Version 0.1?.? (2022-??-??)
+===========================
+
+Bug fixes:
+- Return all removed articles when multiple statuses are requested in Miniflux
+- Allow multiple date ranges in search strings in Tiny Tiny RSS
+- Honour user time zone when interpreting search strings in Tiny Tiny RSS
+- Perform MySQL table maintenance more reliably
+
+Version 0.10.2 (2022-04-04)
+===========================
+
+Changes:
+- Update Guzzle PSR-7 due to CVE-2022-24775
+
+Version 0.10.1 (2022-01-17)
+===========================
+
+Changes:
+- Support PHP 8.1
+
+Version 0.10.0 (2021-07-11)
+===========================
+
+New features:
+- Complete Unix manual page
+- Support for running service as a forking daemon
+- Respond to TERM and HUP signals when possible
+
+Changes:
+- Packages for Debian and related are now available (see manual for details)
+
+Version 0.9.2 (2021-05-25)
+==========================
+
+Bug fixes:
+- Do not fail adding users to an empty database (regression since 0.9.0)
+- Cleanly ignore unknown configuration properties
+- Set access mode to rw-r---- when creating SQLite databases
+
+Changes:
+- Packages for Arch Linux are now available (see manual for details)
+- Numerous improvements to the manual
+
+Version 0.9.1 (2021-03-18)
+==========================
+
+Bug fixes:
+- Respond to PUT requests with 201 rather than 200 in Miniflux
+
+Changes:
+- Correct Web server configuration in manual
+
+Version 0.9.0 (2021-03-06)
+==========================
+
+New features:
+- Support for the Miniflux protocol (see manual for details)
+- Support for API level 15 of Tiny Tiny RSS
+- Support for feed icons in Fever
+- Command-line functionality for managing user metadata
+- Command-line functionality for managing Miniflux login tokens
+
+Bug fixes:
+- Further relax Fever HTTP correctness, to fix more clients
+- Use icons specified in Atom feeds when available
+- Do not return null as subscription unread count
+- Explicitly forbid U+003A COLON and control characters in usernames, for 
+  compatibility with RFC 7617
+- Never return 401 in response to an OPTIONS request
+- Accept "t" and "f" as booleans in Tiny Tiny RSS
+
+Changes:
+- Administrator account requirements for Nextcloud News functionality are
+  now enforced
+- E_DEPRECATED is now suppressed for compatibility with PHP 8 until affected
+  dependencies can be replaced
+
+Version 0.8.5 (2020-10-27)
+==========================
+
+Bug fixes:
+- Relax Fever HTTP correctness, to fix some clients
+- Add the QUERY_STRING FastCGI parameter to the sample Nginx configuration
+
+Version 0.8.4 (2020-09-09)
+==========================
+
+Bug fixes:
+- Don't crash updating feeds cached without ETag (regression since 0.8.3)
+
+Version 0.8.3 (2020-02-16)
+==========================
+
+Changes:
+- Officially require PHP 7.1 (accidentally required since version 0.8.0)
+- Various internal changes pursuant to use of PHP 7.1
+
+Version 0.8.2 (2019-12-07)
+==========================
+
+Bug fixes:
+- Enforce foreign key constraints in MySQL
+- Widen most text fields for MySQL
+
 Version 0.8.1 (2019-10-28)
 ==========================
 
@@ -17,7 +122,7 @@ Version 0.8.0 (2019-07-26)
 ==========================
 
 New features:
-- Support for the Fever protocol (see README.md for details)
+- Support for the Fever protocol (see manual for details)
 - Command line functionality for clearing a password, disabling the account
 - Command line options for dealing with Fever passwords
 - Command line functionality for importing and exporting OPML
@@ -57,7 +162,7 @@ Bug fixes:
 Version 0.6.1 (2019-01-23)
 ==========================
 
-Bug Fixes:
+Bug fixes:
 - Unify SQL timeout settings
 - Correctly escape shell command in subprocess service driver
 - Correctly allow null time intervals in configuration when appropriate
@@ -99,17 +204,17 @@ Bug fixes:
 - Print command-line error messages more sensibly
 - Allow exporting default configuration to standard output
 - Fail correctly on authentication failure
-- Prefer JSON data over GET parameters in NextCloud News
+- Prefer JSON data over GET parameters in Nextcloud News
 
 Changes:
 - Simplify user management backend to minimize opportunity for bugs
-- Document previously unknown NextCloud News behaviour
+- Document previously unknown Nextcloud News behaviour
 
 Version 0.4.0 (2018-10-26)
 ==========================
 
 New features:
-- Support for HTTP authentication in Tiny Tiny RSS (see README.md for details)
+- Support for HTTP authentication in Tiny Tiny RSS (see manual for details)
 - New userHTTPAuthRequired and userSessionEnforced settings
 
 Version 0.3.1 (2018-07-22)
@@ -120,7 +225,7 @@ Bug fixes:
 - Minor fixes to code and documentation
 
 Changes:
-- Disable memory and time limits to avoid deadlocks with NextCloud News
+- Disable memory and time limits to avoid deadlocks with Nextcloud News
 
 Version 0.3.0 (2018-01-12)
 ==========================
@@ -146,7 +251,7 @@ Bug fixes:
 - Rename feeds correctly via TTRSS protocol
 - Toggle marks correctly via TTRSS protocol
 - Sort everything case-insensitively
-- Be even stricter about output data types in NextCloud News
+- Be even stricter about output data types in Nextcloud News
 
 Changes:
 - Do not omit read feeds from TTRSS' getCounters, to fix some clients
@@ -155,13 +260,13 @@ Version 0.2.0 (2017-11-30)
 ==========================
 
 New features:
-- Support for the Tiny Tiny RSS protocol (see README.md for details)
+- Support for the Tiny Tiny RSS protocol (see manual for details)
 - Support for HTTP OPTIONS requests in all protocols
 
 Bug fixes:
 - Perform feed discovery *correctly*
-- Expose the incorrectDbCharset boolean in the NextCloud News server status
-- Give NextCloud News articles' guidHash attribute the correct type (string)
+- Expose the incorrectDbCharset boolean in the Nextcloud News server status
+- Give Nextcloud News articles' guidHash attribute the correct type (string)
 
 Changes:
 - Overhaul input type normalization to minimize bug opportunities
@@ -170,11 +275,12 @@ Version 0.1.1 (2017-09-30)
 ==========================
 
 Bug fixes:
-- Perform feed discovery like NextCloud News does
+- Perform feed discovery like Nextcloud News does
 - Respond correctly to HEAD requests
 - Various minor fixes
 
 Version 0.1.0 (2017-08-29)
 ==========================
 
-Initial release
+New features:
+- Initial release

README.md

@@ -6,9 +6,9 @@ Information on how to install and use the software can be found in [the manual](
 
 # Installing from source
 
-The main repository for The Arsse can be found at [code.mensbeam.com](https://code.mensbeam.com/MensBeam/arsse/), with a mirror also available [at GitHub](https://github.com/meansbeam/arsse/). The main repository is preferred, as the GitHub mirror can sometimes be out of date.
+The main repository for The Arsse can be found at [code.mensbeam.com](https://code.mensbeam.com/MensBeam/arsse/), with a mirror also available [at GitHub](https://github.com/mensbeam/arsse/). The GitHub mirror does not accept bug reports, but the two should otherwise be equivalent.
 
-[Composer](https://getcomposer.org/) is required to manage PHP dependencies. After cloning the repository or downloading a source code tarball, running `composer install` will download all the required dependencies, and will advise if any PHP extensions need to be installed. If not installing as a programming environment, running `composer install --no-dev` is recommended.
+[Composer](https://getcomposer.org/) is required to manage PHP dependencies. After cloning the repository or downloading a source code tarball, running `composer install` will download all the required dependencies, and will advise if any PHP extensions need to be installed. If not installing as a programming environment, running `composer install -o --no-dev --no-scripts` is recommended.
 
 # Repository structure
 
@@ -34,13 +34,15 @@ Also necessary to the functioning of the application is the `/vendor/` directory
 
 The `/locale/` and `/sql/` directories contain human-language files and database schemata, both of which are occasionally used by the application in the course of execution. The `/www/` directory serves as a document root for a few static files to be made available to users by a Web server.
 
-The `/dist/` directory, on the other hand, contains samples of configuration for Web servers and init systems. These are not used by The Arsse itself, but are merely distributed with it for reference.
+The `/dist/` directory, on the other hand, contains general and system-specific build files, and samples of configuration for Web servers and other system integration. These are not used by The Arsse itself, but are used during the process of preparing new releases for supported operating systems.
 
 ## Documentation
 
 The source text for The Arsse's manual can be found in `/docs/`, with pages written in [Markdown](https://spec.commonmark.org/current/) and converted to HTML [with Daux](#building-the-manual). If a static manual is generated its files will appear under `/manual/`.
 
-In addition to the manual the files `/README.md` (this file), `/CHANGELOG`, `/UPGRADING`, `/LICENSE`, and `/AUTHORS` also document various things about the software, rather than the software itself.
+The Arsse also has a UNIX manual page, also written in Markdown, which can be found under `/manpages/`. [Pandoc](https://pandoc.org/) is needed to convert it to the appropriate format, with the results stored under `/dist/man/`.
+
+In addition to the manuals the files `/README.md` (this file), `/CHANGELOG`, `/UPGRADING`, `/LICENSE`, and `/AUTHORS` also document various things about the software, rather than the software itself.
 
 ## Tests
 
@@ -50,7 +52,7 @@ The `/tests/` directory contains everything related to automated testing. It is
 |--------------------|------------------------------------------------------------------------------------|
 | `cases/`           | The test cases themselves, organized in roughly the same structure as the code     |
 | `coverage/`        | (optional) Generated code coverage reports                                         |
-| `docroot/`         | Sample documents used in some tests, to be returned by the PHP's basic HTTP server |
+| `docroot/`         | Sample documents used in some tests, to be returned by PHP's basic HTTP server |
 | `lib/`             | Supporting classes which do not contain test cases                                 |
 | `bootstrap.php`    | Bootstrap script, equivalent to `/arsse.php`, but for tests                        |
 | `phpunit.dist.xml` | PHPUnit configuration file                                                         |
@@ -74,7 +76,7 @@ The `/vendor-bin/` directory houses the files needed for the tools used in The A
 | `/robo`           | Simple wrapper for executing Robo on POSIX systems       |
 | `/robo.bat`       | Simple wrapper for executing Robo on Windows             |
 
-In addition the files `/package.json`, `/yarn.lock`, and `/postcss.config.js` as well as the `/node_modules/` directory are used by [Yarn](https://yarnpkg.com/) and [PostCSS](https://postcss.org/) when modifying the stylesheet for The Arsse's manual.
+In addition the files `/package.json` and `/postcss.config.js` as well as the `/node_modules/` directory are used by [Yarn](https://yarnpkg.com/) and [PostCSS](https://postcss.org/) when modifying the stylesheet for The Arsse's manual.
 
 # Common tasks
 
@@ -88,7 +90,7 @@ There is also a `test:quick` Robo task which excludes slower tests, and a `test:
 
 ### Test coverage
 
-Computing the coverage of tests can be done by running `./robo coverage`. Either [phpdbg](https://php.net/manual/en/book.phpdbg.php) or [Xdebug](https://xdebug.org) is required for this. An HTML-format coverage report will be written to `/tests/coverage/`.
+Computing the coverage of tests can be done by running `./robo coverage`, after which an HTML-format coverage report will be written to `/tests/coverage/`. Either [PCOV](https://github.com/krakjoe/pcov), [Xdebug](https://xdebug.org), or [phpdbg](https://php.net/manual/en/book.phpdbg.php) is required for this. PCOV is generally recommended as it is faster than Xdebug; phpdbg is faster still, but less accurate. If using either PCOV or Xdebug, the extension need not be enabled globally; PHPUnit will enable it when needed.
 
 ## Enforcing coding style
 
@@ -105,17 +107,20 @@ The Arsse's user manual, made using [Daux](https://daux.io/), can be compiled by
 
 The manual employs a custom theme derived from the standard Daux theme. If the standard Daux theme receives improvements, the custom theme can be rebuilt by running `./robo manual:theme`. This requires that [NodeJS](https://nodejs.org) and [Yarn](https://yarnpkg.com/) be installed, but JavaScript tools are not required to modify The Arsse itself, nor the content of the manual.
 
-The Robo task `manual:css` will recompile the theme's stylesheet without rebuilding the entire theme.
+## Building the man page
+
+The Arsse's UNIX manual page is authored in Markdown, and must be converted to the native roff format using [Pandoc](https://pandoc.org/). This can be done by running `./robo manpage`, which will output appropriate files to `/dist/man/`. The conversion should not be done manually as there is post-processing required for optimal output.
 
 ## Packaging a release
 
-Producing a release package is done by running `./robo package`. This performs the following operations:
+Producing release packages is done by running `./robo package`. This performs the following operations:
 
-- Duplicates a working tree with the commit (usually a release tag) to package
-- Generates the manual
+- Duplicates a [Git](https://git-scm.com/) working tree with the commit (usually a release tag) to package
+- Generates UNIX manual pages with [Pandoc](https://pandoc.org/)
+- Generates the HTML manual
 - Installs runtime Composer dependencies with an optimized autoloader
 - Deletes numerous unneeded files
 - Exports the default configuration of The Arsse to a file
 - Compresses the remaining files into a tarball
-
-Due to the first step, [Git](https://git-scm.com/) is required to package a release.
+- Produces a binary package for Arch Linux, if possible
+- Produces source and binary packages for Debian using [pbuilder](https://pbuilder-team.pages.debian.net/pbuilder/), if possible

RoboFile.php

@@ -6,6 +6,8 @@ const BASE = __DIR__.\DIRECTORY_SEPARATOR;
 const BASE_TEST = BASE."tests".\DIRECTORY_SEPARATOR;
 define("IS_WIN", defined("PHP_WINDOWS_VERSION_MAJOR"));
 define("IS_MAC", php_uname("s") === "Darwin");
+define("IS_LINUX", !IS_WIN && !IS_MAC);
+error_reporting(0);
 
 function norm(string $path): string {
     $out = realpath($path);
@@ -24,7 +26,7 @@ class RoboFile extends \Robo\Tasks {
      * ./robo test --testsuite TTRSS --exclude-group slow --testdox
      *
      * Please see the PHPUnit documentation for available options.
-    */
+     */
     public function test(array $args): Result {
         return $this->runTests(escapeshellarg(\PHP_BINARY), "typical", $args);
     }
@@ -33,7 +35,7 @@ class RoboFile extends \Robo\Tasks {
      *
      * This includes pedantic tests which may help to identify problems.
      * See help for the "test" task for more details.
-    */
+     */
     public function testFull(array $args): Result {
         return $this->runTests(escapeshellarg(\PHP_BINARY), "full", $args);
     }
@@ -42,7 +44,7 @@ class RoboFile extends \Robo\Tasks {
      * Runs a quick subset of the test suite
      *
      * See help for the "test" task for more details.
-    */
+     */
     public function testQuick(array $args): Result {
         return $this->runTests(escapeshellarg(\PHP_BINARY), "quick", $args);
     }
@@ -53,10 +55,10 @@ class RoboFile extends \Robo\Tasks {
      * tests/coverage/. Additional reports may be produced by passing
      * arguments to this task as one would to PHPUnit.
      *
-     * Robo first tries to use phpdbg and will fall back to Xdebug if available.
-     * Because Xdebug slows down non-coverage tasks, however, phpdbg is highly
-     * recommended if debugging facilities are not otherwise needed.
-    */
+     * Robo first tries to use pcov and will fall back first to xdebug then
+     * phpdbg. Neither pcov nor xdebug need to be enabled to be used; they
+     * only need to be present in the extension load path to be used.
+     */
     public function coverage(array $args): Result {
         // run tests with code coverage reporting enabled
         $exec = $this->findCoverageEngine();
@@ -71,7 +73,7 @@ class RoboFile extends \Robo\Tasks {
      * run all tests which may cover code.
      *
      * See also help for the "coverage" task for more details.
-    */
+     */
     public function coverageFull(array $args): Result {
         // run tests with code coverage reporting enabled
         $exec = $this->findCoverageEngine();
@@ -89,17 +91,30 @@ class RoboFile extends \Robo\Tasks {
     }
 
     protected function findCoverageEngine(): string {
-        if (IS_WIN) {
-            $dbg = dirname(\PHP_BINARY)."\\phpdbg.exe";
-            $dbg = file_exists($dbg) ? $dbg : "";
+        $dir = rtrim(ini_get("extension_dir"), "/").\DIRECTORY_SEPARATOR;
+        $ext = IS_WIN ? "dll" : (IS_MAC ? "dylib" : "so");
+        $php = escapeshellarg(\PHP_BINARY);
+        $code = escapeshellarg(BASE."lib");
+        if (extension_loaded("pcov")) {
+            return "$php -d pcov.enabled=1 -d pcov.directory=$code";
+        } elseif (extension_loaded("xdebug")) {
+            return "$php -d xdebug.mode=coverage";
+        } elseif (file_exists($dir."pcov.$ext")) {
+            return "$php -d extension=pcov.$ext -d pcov.enabled=1 -d pcov.directory=$code";
+        } elseif (file_exists($dir."xdebug.$ext")) {
+            return "$php -d zend_extension=xdebug.$ext -d xdebug.mode=coverage";
         } else {
-            $dbg = trim(`which phpdbg 2>/dev/null`);
-        }
-        if ($dbg) {
-            return escapeshellarg($dbg)." -qrr";
-        } else {
-            $ext = IS_WIN ? "dll" : (IS_MAC ? "dylib" : "so");
-            return escapeshellarg(\PHP_BINARY)." -d zend_extension=xdebug.$ext";
+            if (IS_WIN) {
+                $dbg = dirname(\PHP_BINARY)."\\phpdbg.exe";
+                $dbg = file_exists($dbg) ? $dbg : "";
+            } else {
+                $dbg = trim(`which phpdbg 2>/dev/null`);
+            }
+            if ($dbg) {
+                return escapeshellarg($dbg)." -qrr";
+            } else {
+                return $php;
+            }
         }
     }
 
@@ -108,7 +123,7 @@ class RoboFile extends \Robo\Tasks {
         return $all ? ">$hole 2>&1" : "2>$hole";
     }
 
-    protected function runTests(string $executor, string $set, array $args) : Result {
+    protected function runTests(string $executor, string $set, array $args): Result {
         switch ($set) {
             case "typical":
                 $set = ["--exclude-group", "optional"];
@@ -131,63 +146,258 @@ class RoboFile extends \Robo\Tasks {
         return $this->taskExec($executor)->option("-d", "zend.assertions=1")->arg($execpath)->option("-c", $confpath)->args(array_merge($set, $args))->run();
     }
 
+    protected function commitVersion(?string $commit): array {
+        $target = $commit ?? $this->askDefault("Reference commit:", "HEAD");
+        $base = escapeshellarg(BASE);
+        $blackhole = $this->blackhole();
+        // get useable version strings from Git
+        $version = trim(`git -C $base describe --tags $target $blackhole`);
+        if (!$version) {
+            throw new \Exception("Commit reference invalid");
+        }
+        return [$target, $version];
+    }
+
+    protected function toolExists(string ...$binary): bool {
+        $blackhole = $this->blackhole(IS_WIN);
+        foreach ($binary as $bin) {
+            if (
+                (IS_WIN && (!exec(escapeshellarg($bin)." --help $blackhole", $junk, $status) || $status))