Privatebin: PHP 8 support

[elrido]

TL;DR: It seems that our code base still works unchanged in PHP 8, if our phpunit tests are to be trusted. They provide 97.6% code coverage (1266 of 1297 lines).

PHP 8 is announced to be released end of November 2020, so I was curious if it's breaking changes have any impact on our code base or if we can still support older PHP releases.

As you may have seen I created a php8 branch for my experiments. The result is that the existing unit tests pass with no errors or warnings on a php 8.0 beta release and do so without any changes to our PHP code base (the lib and vendor folders). There are a few "BUT"s further explained below.

In order to test this, I had to enable PHP 8.0 (beta) in the github action workflow. In that environment phpunit is installed using composer - each phpunit release on packagist except the latest version 9 is capped at 7.x (^7 in terms of their composer.json definition). So to test PHP 8 support we can only use phpunit 9 at this time (or we need to install it in a different way, but that would get messy). Unfortunately version 9 also introduced several breaking changes that make it incompatible with even it's predecessor version 8. The branch contains changes in the tests and the phpunit.xml to make them work with phpunit version 9 - the logic of the tests remains unchanged.

The downside of these changes is that phpunit 9 is the only version working with those updated tests. I wouldn't mind that so much, but version phpunit 9 requires PHP 7.3 or later to work. This means on that branch we loose the test coverage for PHP 5.6, 7.0, 7.1 and 7.2. We know that the code still works on those branches, because we haven't changed it and in master it still passes the tests in all of these versions.

The benefit of using a phpunit version that supports PHP 5.6 is that we would notice if a change in our PHP code breaks compatibility to that version. Unfortunately phpunit 5.7 is the last version with PHP 5.6 support, which is why we are still stuck on that release with the unit tests. It was still fully working with PHP 7.4 and so does let us test the full range of PHP versions, that we support, with the same tests.

Due to the above issues, we can't have a single version of our phpunit tests that will work in all PHP versions supported by us, anymore. I propose to keep the php8 branch around, so we can use it to test changes in our PHP code against PHP 8, if they occur, but otherwise keep the existing tests in the master branch unchanged, so we do detect backwards incompatible changes going forward. Once we do drop support for PHP < 7.3 in our code, for whatever reason, we can merge the changes of the php8 branch into master and switch to the newer phpunit version.

[rugk]

Well… PHP v7.2 will be at the end of life in Jan 2021, anyway. So hmm… dunno.

[elrido]

Well, thats all nice, but the reality is this:

• RHEL 7 will still be maintained until August 2021 and ships PHP 5.4 (which we don't support anymore as of 1.3)
• Ubuntu 14.04 LTS server will still be maintained until 2022 and ships PHP 5.5 (1.3 will work, but not the latest 1.3.4)
• SLES 11 will still be maintained until 2022 and ships PHP 5.6
• Debian 9 will still be maintained until 2022 and ships PHP 7.0

Of course all of these distros have later releases with more up to date packages and often (community) repos with backports of later PHP releases. It's just a reality that in the wild you will encounter these old releases and so I would rather have these folks be able to update to a later PrivateBin release then sticking to an old release of ours, because their server runs on a legacy distro - which often won't be under the control of the PrivateBin admin, but whatever their hoster provides them with. Hence I am for server applications very much in favour of curating docker images, where we can use a well supported stack of software (our alpine 3.12 image ships with PHP 7.3).

[elrido]

Update on this: With alpine 3.13 we get PHP 8.0 packages (they also ship PHP 7.4, so you can choose and even install both, if needed) and so far I didn't encounter any issues with it. I am working on updating the image to use it and will switch the demo instance to it, once it's published. So it really looks like our tests in the php8 branch didn't lie and it just works.