Merge pull request #845 from humanmade/backport-843-to-v23-branch

[Backport v23-branch] Always install the local CA in the system trust store

Author: mikelittle

docs/README.md

@@ -55,9 +55,9 @@ The subdomain / domain *optional* config options can be configured as follows:
 }
 ```
 
-* `name` - Project name, used as the subdomain of the primary site, e.g. `my-project`
-* `tld` - TLD of the project, e.g. `my-company.local`
-* `domains` - Custom domains used by the project, either for main or sub sites.
+- `name` - Project name, used as the subdomain of the primary site, e.g. `my-project`
+- `tld` - TLD of the project, e.g. `my-company.local`
+- `domains` - Custom domains used by the project, either for main or sub sites.
 
 Note: Altis does not manage the host entries for subdomains or custom domains, you'll need to manage those manually, via
 editing `/etc/hosts` in Linux / macOS, or `C:\Windows\System32\Drivers\etc\hosts` in Windows. Altis however tries to detect if those
@@ -88,46 +88,45 @@ started!
 ### Multisite Subdomains / Custom domains support
 
 Altis v12 introduced experimental support for multisite subdomains and custom domains. In order to support custom (sub)domains,
-Altis is using [`mkcert`](https://github.com/FiloSottile/mkcert) to generate SSL certificates based on a custom generated Root
-Certificate Authority that is uniquely-generated and trusted on the host machine upon installation. This allows Altis local-server
-to generate local SSL certificates that is automatically trusted, which provides a convenient and seamless local development
-experience.
+Altis uses [`mkcert`](https://github.com/FiloSottile/mkcert) to generate SSL certificates based on a generated Root
+Certificate Authority (CA) that is uniquely-generated and trusted on the host machine upon installation. This allows Altis
+local-server to generate local SSL certificates that is automatically trusted, which provides a convenient and seamless local
+development experience.
 
 Note: Altis local-server automatically collects domains names to issue the SSL certificate for, based on Altis configuration
 in `composer.json`, namely the `altis.modules.local-server` tree, specifically the `name`, `tld`, and `domains` config parameters.
 
 ## Available Commands
 
-* `composer server start [--xdebug=<mode>] [--mutagen]` - Starts the containers.
-  * `--xdebug=<mode>` will enable Xdebug. The `mode` is optional and defaults to `debug`. Available values
+- `composer server start [--xdebug=<mode>] [--mutagen]` - Starts the containers.
+  - `--xdebug=<mode>` will enable Xdebug. The `mode` is optional and defaults to `debug`. Available values
       are `off`, `develop`, `debug`, `profile`, `coverage`, `gcstats` and `trace`.
-  * `--mutagen` will enable Mutagen for container file sharing.
-* `composer server stop [<service>] [--clean]` - Stops the containers or specified service.
-  * `--clean` will also stop the proxy container if no service is specified, only use this if you have no other instances of Local
+  - `--mutagen` will enable Mutagen for container file sharing.
+- `composer server stop [<service>] [--clean]` - Stops the containers or specified service.
+  - `--clean` will also stop the proxy container if no service is specified, only use this if you have no other instances of Local
       Server
-  * `--tmp` will mount the PHP container's `/tmp` directory to `.tmp` in your project root. This is useful for debugging
+  - `--tmp` will mount the PHP container's `/tmp` directory to `.tmp` in your project root. This is useful for debugging
       with `--xdebug=profile` as the Cachegrind files are easily available
-* `composer server restart [<service>]` - Restart a given container, or all containers if none is provided. Available values
+- `composer server restart [<service>]` - Restart a given container, or all containers if none is provided. Available values
   are `nginx`, `php`, `db`, `redis`, `cavalcade`, `tachyon`, `s3` and `elasticsearch`.
-* `composer server destroy [--clean]` - Stops and destroys all containers.
-  * `--clean` will also destroy the proxy container, only use this if you have no other instances of Local Server
-* `composer server status` - Displays the status of all containers.
-* `composer server ssl` - Shows the status of local-server SSL certificate.
-  * `composer server ssl install` - Install `mkcert` locally and set it up to prepare for SSL generation.
-  * `composer server ssl generate custom-domain.com` - (re)generates the local-server SSL certificate
+- `composer server destroy [--clean]` - Stops and destroys all containers.
+  - `--clean` will also destroy the proxy container, only use this if you have no other instances of Local Server
+- `composer server status` - Displays the status of all containers.
+- `composer server ssl` - Shows the status of local-server SSL certificate.
+  - `composer server ssl install` - Install `mkcert` locally and set it up to prepare for SSL generation.
+  - `composer server ssl generate custom-domain.com` - (re)generates the local-server SSL certificate
       including `custom-domain.com`
-  * `composer server ssl exec -- [<command>]` - Execute custom `mkcert` commands, e.g. `-uninstall` to revoke the root CA
-* `composer server logs <service>` - Tail the logs from a given service, defaults to `php`, available options
+  - `composer server ssl exec -- [<command>]` - Execute custom `mkcert` commands, e.g. `-uninstall` to revoke the root CA
+- `composer server logs <service>` - Tail the logs from a given service, defaults to `php`, available options
   are `nginx`, `php`, `db|mysql|sql`, `redis`, `cavalcade`, `tachyon`, `s3` and `elasticsearch`.
-* `composer server shell` - Logs in to the PHP container.
-* `composer server cli|wp -- <command>` - Runs a WP CLI command. Use either `cli` or `wp`. For example,
+- `composer server shell` - Logs in to the PHP container.
+- `composer server cli|wp -- <command>` - Runs a WP CLI command. Use either `cli` or `wp`. For example,
   `composer server cli -- info` or `composer server wp -- info`. Do not include `wp` in `<command>`.
-  * `composer server cli -- db import database.sql` - Imports a database file located in the project root.
-* `composer server create-alias` - Create a WP CLI alias. Useful if you have WP CLI installed locally.
-* `composer server exec -- <command>` - Runs any command on the PHP container.
-* `composer server db` - Logs into MySQL on the DB container.
-  * `composer server db info` - Print MySQL connection details.
-  * `composer server db (sequel|spf)` - Opens a connection to the database in [Sequel Pro](https://sequelpro.com)
-      or [Sequel Ace](https://sequel-ace.com/).
-  * `composer server db (tableplus|tbp)` - Opens a connection to the database in [Table Plus](https://tableplus.com/).
-* `composer server import-uploads` - Syncs files from `content/uploads` to the S3 container.
+  - `composer server cli -- db import database.sql` - Imports a database file located in the project root.
+- `composer server create-alias` - Create a WP CLI alias. Useful if you have WP CLI installed locally.
+- `composer server exec -- <command>` - Runs any command on the PHP container.
+- `composer server db` - Logs into MySQL on the DB container.
+  - `composer server db info` - Print MySQL connection details.
+  - `composer server db (sequel|spf)` - Opens a connection to the database in [Sequel Ace](https://sequel-ace.com/).
+  - `composer server db (tableplus|tbp)` - Opens a connection to the database in [Table Plus](https://tableplus.com/).
+- `composer server import-uploads` - Syncs files from `content/uploads` to the S3 container.

inc/composer/class-command.php

@@ -853,50 +853,57 @@ protected function ssl( InputInterface $input, OutputInterface $output ) {
 						break;
 				}
 
-				// If couldn't detect a support architecture, ask the user to install mkcert manually.
+				// If we couldn't detect a support architecture, ask the user to install mkcert manually.
 				if ( ! $binary_arch ) {
 					$output->writeln( '<error>`composer server ssl install` is only supported on macOS, Linux, and Windows x64, install `mkcert` manually for other systems.</error>' );
 					$output->writeln( '<error>Download and setup `mkcert` from https://github.com/FiloSottile/mkcert </error>' );
+
 					return 1;
 				}
 
 				$binary = "mkcert-$mkcert_version-$binary_arch";
-				$mkcert = 'vendor/mkcert';
+				$mkcert = 'mkcert';
 
-				// Check if mkcert is installed globally already, bail if so.
-				$version = trim( shell_exec( 'mkcert -version' ) ?: '' );
+				// Check if mkcert is installed globally already.
+				$version = trim( shell_exec( "$mkcert -version" ) ?: '' );
 				if ( $version ) {
 					$output->writeln( "<info>mkcert $version is already installed globally</>" );
-					return 0;
-				}
 
-				// Check if mkcert is installed locally already, bail if so.
-				$version = trim( shell_exec( "$mkcert -version" ) ?: '' );
-				if ( $version ) {
-					$output->writeln( "<info>mkcert $version is already installed to vendor/mkcert</>" );
-					return 0;
-				}
+				} else {
 
-				$output->writeln( "Detected system architecture to be $os $arch" );
-				$output->writeln( "Downloading https://github.com/FiloSottile/mkcert/releases/download/$mkcert_version/$binary to $mkcert ..." );
-				exec( "curl -o $mkcert -L https://github.com/FiloSottile/mkcert/releases/download/$mkcert_version/$binary", $dummy, $result );
-				if ( $result ) {
-					$output->writeln( '<error>Could not download mkcert binary, try using sudo or manually installing mkcert.</error>' );
-					$output->writeln( '<error>Download and setup `mkcert` from https://github.com/FiloSottile/mkcert </error>' );
-					return 1;
-				}
+					// Check if mkcert is installed locally already.
+					$mkcert = 'vendor/mkcert';
+					$version = trim( shell_exec( "$mkcert -version" ) ?: '' );
+					if ( $version ) {
+						$output->writeln( "<info>mkcert $version is already installed to vendor/mkcert</>" );
 
-				$output->writeln( "<info>mkcert $mkcert_version was downloaded.</info>" );
+					} else {
 
-				chmod( $mkcert, 0755 );
+						// We need to install it locally.
+						$output->writeln( "Detected system architecture to be $os $arch" );
+						$output->writeln( "Downloading https://github.com/FiloSottile/mkcert/releases/download/$mkcert_version/$binary to $mkcert ..." );
+						exec( "curl -o $mkcert -L https://github.com/FiloSottile/mkcert/releases/download/$mkcert_version/$binary", $dummy, $result );
+						if ( $result ) {
+							$output->writeln( '<error>Could not download mkcert binary, try using sudo or manually installing mkcert.</error>' );
+							$output->writeln( '<error>Download and setup `mkcert` from https://github.com/FiloSottile/mkcert </error>' );
 
-				exec( "$mkcert -version", $dummy, $result );
-				if ( $result ) {
-					$output->writeln( '<error>Could not launch mkcert binary, try manually installing mkcert.</error>' );
-					$output->writeln( '<error>Download and setup `mkcert` from https://github.com/FiloSottile/mkcert </error>' );
-					return 1;
+							return 1;
+						}
+
+						$output->writeln( "<info>mkcert $mkcert_version was downloaded.</info>" );
+
+						chmod( $mkcert, 0755 );
+
+						exec( "$mkcert -version", $dummy, $result );
+						if ( $result ) {
+							$output->writeln( '<error>Could not launch mkcert binary, try manually installing mkcert.</error>' );
+							$output->writeln( '<error>Download and setup `mkcert` from https://github.com/FiloSottile/mkcert </error>' );
+
+							return 1;
+						}
+						$output->writeln( "<info>mkcert $mkcert_version was installed.</info>" );
+					}
 				}
-				$output->writeln( "<info>mkcert $mkcert_version was installed.</info>" );
 
 				// Setup and accept the root certificate.
 				exec( "$mkcert -install", $dummy, $result );
@@ -908,6 +915,7 @@ protected function ssl( InputInterface $input, OutputInterface $output ) {
 
 				$output->writeln( '<info>mkcert root CA was installed and accepted successfully.</info>' );
 				break;
+
 			case 'generate':
 				$config = $this->get_composer_config();