Add Site Audit to BOA

[mrconnerton]

Would be a nice feature the other platforms have: https://www.drupal.org/project/site_audit

It is just a drush command so needs a task button on a site to go with it.

[omega8cc]

We have tested it before and it reported too many false positives and caused too many false alarms and support requests, so it is now disabled by default, if present:

https://github.com/omega8cc/boa/blob/master/docs/MODULES.txt#L121

We are using https://www.drupal.org/project/security_review instead, and it is integrated within our custom health check Aegir task.

We could test site_audit again, though.

[omega8cc]

We would need to "add vendor specific support", perhaps, because there are still errors and warnings which are false alarms in the BOA stack/env context: https://gist.github.com/omega8cc/b68587b852f5739f99b6

[fluxsauce]

Hi, I'm the maintainer of site_audit. You know, I'm really open to adding vendor specific support, we even talked about that at DrupalCon Austin, then things got quiet.

Rather than just disabling it, let's improve the system to make it compatible :-)

Looking at https://gist.github.com/omega8cc/b68587b852f5739f99b6 ...

Questions:

• Fast 404 Pages - that can have a vendor specific support, as I understand it, that's being handled by the stack / nginx?
• Google PageSpeed Insights - that requires a publicly accessible URL or you should be skipping that report
• Both syslog and db_log are disabled; is there another logging mechanism that we should be checking for?
• Is there an environmental variable that I can use to determine if the site is in the BOA stack?
• Is there an environmental variable that I can use to determine if the site is in a development environment?

I've opened https://www.drupal.org/node/2443451 - I'll record the actionable items there once I know what to be checking for.

[omega8cc]

Hi, thanks for the follow up! We will share all details both here and on d.o, soon.