Install ddtrace via datadog-setup.php on PHP 7.0+

README.md

@@ -490,6 +490,8 @@ Here's the list of all the supported environment variables:
 | newrelic | `IPE_NEWRELIC_DAEMON=1` | Install the NewRelic daemon  |
 | newrelic | `IPE_NEWRELIC_KEEPLOG=1` | Keep the log files of NewRelic setup (`/tmp/nrinstall-….tar`)  |
 | newrelic | `NR_INSTALL_KEY` | Your New Relic license key |
+| ddtrace | `IPE_DD_APPSEC=1` | Also enable the Datadog [Application Security Monitoring](https://docs.datadoghq.com/security/application_security/) module (`ddappsec`). Requires PHP 7.0+ and the 1.x tracer line |
+| ddtrace | `IPE_DD_PROFILING=1` | Also enable the Datadog [Continuous Profiler](https://docs.datadoghq.com/profiler/) module (`datadog-profiling`). Requires PHP 7.1+, Alpine 3.13+ (or any Debian) and the 1.x tracer line |
 | swoole | `IPE_SWOOLE_WITHOUT_IOURING=1` | The io_uring kernel functionality is considered unsafe by security experts (see [here](https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html) and [here](https://i.blackhat.com/BH-US-23/Presentations/US-23-Lin-bad_io_uring.pdf)). By default Swoole 6 and later is configured with io_uring support, use this environment variable to skip configuring io_uring |
 | saxon | `IPE_SAXON_EDITION=EE` | The Saxon edition to be used: `EE` for Enterprise Edition (default), `PE` for Professional Edition, `HE` for Home Edition |
 

install-php-extensions

@@ -825,11 +825,15 @@ buildRequiredPackageLists() {
 				;;
 			ddtrace@alpine)
 				buildRequiredPackageLists_persistent="$buildRequiredPackageLists_persistent libgcc"
-				buildRequiredPackageLists_volatile="$buildRequiredPackageLists_volatile curl-dev automake libtool"
+				if test $PHP_MAJMIN_VERSION -lt 700; then
+					buildRequiredPackageLists_volatile="$buildRequiredPackageLists_volatile curl-dev automake libtool"
+				fi
 				;;
 			ddtrace@debian)
-				buildRequiredPackageLists_persistent="$buildRequiredPackageLists_persistent $buildRequiredPackageLists_libssl"
-				buildRequiredPackageLists_volatile="$buildRequiredPackageLists_volatile libcurl4-openssl-dev automake libtool"
+				if test $PHP_MAJMIN_VERSION -lt 700; then
+					buildRequiredPackageLists_persistent="$buildRequiredPackageLists_persistent $buildRequiredPackageLists_libssl"
+					buildRequiredPackageLists_volatile="$buildRequiredPackageLists_volatile libcurl4-openssl-dev automake libtool"
+				fi
 				;;
 			dba@alpine)
 				buildRequiredPackageLists_persistent="$buildRequiredPackageLists_persistent db"
@@ -2979,6 +2983,39 @@ You may need to:
 EOT
 }
 
+# Install the Datadog PHP tracer
+#
+# Arguments:
+#   $1: the version to be installed (optional)
+installDDTrace() {
+	printf '# Installing ddtrace\n'
+	installDDTrace_version="${1:-}"
+	if test -z "$installDDTrace_version"; then
+		installDDTrace_url='https://github.com/DataDog/dd-trace-php/releases/latest/download/datadog-setup.php'
+	else
+		installDDTrace_url="https://github.com/DataDog/dd-trace-php/releases/download/$installDDTrace_version/datadog-setup.php"
+	fi
+	installDDTrace_setup="$(mktemp -p /tmp/src)"
+	printf 'Downloading datadog-setup.php from %s\n' "$installDDTrace_url"
+	if ! curl $IPE_CURL_FLAGS -sSLf -o "$installDDTrace_setup" "$installDDTrace_url"; then
+		printf 'Failed to download %s\n' "$installDDTrace_url" >&2
+		exit 1
+	fi
+	installDDTrace_args='--php-bin=php'
+	case "${IPE_DD_APPSEC:-}" in
+		1 | y* | Y*)
+			installDDTrace_args="$installDDTrace_args --enable-appsec"
+			;;
+	esac
+	case "${IPE_DD_PROFILING:-}" in
+		1 | y* | Y*)
+			installDDTrace_args="$installDDTrace_args --enable-profiling"
+			;;
+	esac
+	php "$installDDTrace_setup" $installDDTrace_args
+	rm -f "$installDDTrace_setup"
+}
+
 # Compile the libraries specified in the COMPILE_LIBS variable
 compileLibs() {
 	if stringInList libaom "$COMPILE_LIBS"; then
@@ -3452,25 +3489,24 @@ installRemoteModule() {
 			fi
 			;;
 		ddtrace)
-			if test -z "$installRemoteModule_version"; then
-				if test $PHP_MAJMIN_VERSION -lt 700; then
-					installRemoteModule_version=0.75.0
+			if test -n "$installRemoteModule_version"; then
+				installRemoteModule_version="$(resolvePeclStabilityVersion "$installRemoteModule_module" "$installRemoteModule_version")"
+			fi
+			if test $PHP_MAJMIN_VERSION -lt 700; then
+				if test -n "$installRemoteModule_version" && test $(compareVersions "$installRemoteModule_version" 1.0.0) -ge 0; then
+					printf '### ERROR ### ddtrace %s requires PHP 7.0 or later (PHP %s is in use).\n' "$installRemoteModule_version" "$PHP_MAJDOTMIN_VERSION" >&2
+					exit 1
 				fi
 				if test -z "$installRemoteModule_version"; then
-					case "$DISTRO" in
-						alpine)
-							if test $DISTRO_MAJMIN_VERSION -le 312; then
-								# cc is not supported due to a memcmp related bug
-								installRemoteModule_version=1.1.0
-							fi
-							;;
-					esac
+					# newer 0.x releases reject PHP 5 in their configure script
+					installRemoteModule_version=0.75.0
 				fi
-			else
-				installRemoteModule_version="$(resolvePeclStabilityVersion "$installRemoteModule_module" "$installRemoteModule_version")"
-			fi
-			if test -z "$installRemoteModule_version" || test $(compareVersions "$installRemoteModule_version" 0.75.0) -ge 0; then
 				installCargo
+			elif test -n "$installRemoteModule_version" && test $(compareVersions "$installRemoteModule_version" 1.0.0) -lt 0; then
+				installCargo
+			else
+				installDDTrace "$installRemoteModule_version"
+				installRemoteModule_manuallyInstalled=2
 			fi
 			;;
 		decimal)

scripts/tests/ddtrace

@@ -0,0 +1,33 @@
+#!/usr/bin/env php
+<?php
+
+require_once __DIR__ . '/_bootstrap.php';
+
+$rc = 0;
+
+echo 'Checking if ddtrace_version() exists... ';
+if (!function_exists('ddtrace_version')) {
+    $rc = 1;
+    echo "NO!\n";
+} else {
+    echo 'yes (version: ' . ddtrace_version() . ").\n";
+}
+
+// When IPE_DD_PROFILING=1 was set during installation, the
+// datadog-profiling extension must also be loaded.
+$expectProfiling = (bool) getenv('IPE_DD_PROFILING');
+$hasProfiling = extension_loaded('datadog-profiling');
+if ($expectProfiling && !$hasProfiling) {
+    fwrite(STDERR, "Expected the datadog-profiling extension to be loaded but it is not.\n");
+    $rc = 1;
+}
+
+// Same for the AppSec module when IPE_DD_APPSEC=1 was set.
+$expectAppsec = (bool) getenv('IPE_DD_APPSEC');
+$hasAppsec = extension_loaded('ddappsec');
+if ($expectAppsec && !$hasAppsec) {
+    fwrite(STDERR, "Expected the ddappsec extension to be loaded but it is not.\n");
+    $rc = 1;
+}
+
+exit($rc);