# Technical documentation — unity Evidence date: 2026-09-30. Source: `git@bitbucket.org:overdrive/unity.git`, `master` at `7ac64a5` (2019-04-09, jacobrits, "wiki testing"). Second branch: `origin/develop` at `7a19009` (2019-04-08). `origin/HEAD` points at `master`. The scan-host path `~/projects/sonar_scan/repos/unity` was not on the machine that produced this document. Facts below come from those git revisions. Secret values are omitted. `SOawsCodeDeploy.pem` is described only as a file type and a risk. ## Architecture Two trees are deployed as one CodeDeploy revision. They do not call each other. ```text index.html static login views/dashboard/index.html shell (same file on both branches; welcome: "Silicon Overdrive +2.") views/dashboard/dashboard_*.html labelled copies of theme dashboards views/template/*.html INSPINIA 2.8 demo catalogue (122 HTML files) assets/ theme CSS, JS, images, fonts (~1,455 files) wiki/ master only; TiddlyHome 0.1.3 index.html TiddlyWiki 2.4.1 single file download.php, news.php require _th/lib/* _th/admin/init.php first-run Admin htpasswd _th/lib/*.php users, sites, store; sites require config.php _th/templates/ empty, NewsWiki, NewsWikiFR, htaccess templates appspec.yml + scripts/ CodeDeploy on the host (httpd via yum) codedeploy_deploy.py master pipeline codedeploy_deploy_develop.py develop pipeline bitbucket-pipelines.yml python:3.5.7 image ``` Page flow that works without a server-side session: 1. `/index.html` 2. `/views/dashboard/index.html` (form action) 3. Theme or dashboard HTML files by ordinary links `/wiki/index.html` is a separate static wiki file. PHP endpoints under `/wiki/` run only if the host has PHP. The CodeDeploy install script does not install PHP. There is no database, no application server in the current tips, and no queue. ## Repository shape About 1,638 files at `7ac64a5` (count reported by git while checking out that commit). | Path | Files (approx.) | Role | |---|---|---| | `assets/` | 1,455 | Theme static files. Largest type overall is `.png` (855 in the whole tree). | | `views/template/` | 122 HTML | INSPINIA demos. | | `views/dashboard/` | 6 HTML | Shell plus five dashboard variants. | | `wiki/` | 45 | TiddlyHome. 26 of the tree's `.php` files live here. | | `scripts/` | 3 | CodeDeploy hooks. No extension. | | Root | see below | Deploy, login, README, private key. | Root files: `appspec.yml`, `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `codedeploy_deploy_develop.py`, `index.html`, `README.md`, `SOawsCodeDeploy.pem`. No `.gitignore`. No `package.json`, `composer.json`, `Gemfile`, Dockerfile, or test directory. `README.md` is the Bitbucket starter tutorial. It is not a description of the system. ## Branches and history 20 commits, 2019-04-05 through 2019-04-09. No tags were inspected as release markers; `git branch -r` shows only `origin/master` and `origin/develop`. `develop` split at `00fe94c`. After that: - `master` has `591b740`, `efd1d18` (shell header and login title) and `7ac64a5` (entire `wiki/` addition, 46 files in the develop-to-master diff, about 78,050 insertions). - `develop` has `7a19009`, which only changes the login title and adds " - DEVELOPMENT" to the footer. Historical, not on the tips: - `app.rb` Sinatra app, bind `0.0.0.0`, `GET /` returns `Hello world!`. Removed in `8af29ca`. - Pipeline branch `test` and `codedeploy_deploy_test.py`. Removed in `98f1832`. - Pipeline image was `python:3.5.1` before `c760980`. ## Front end ### Login `index.html` loads: - `assets/css/bootstrap.min.css` - `assets/font-awesome/css/font-awesome.css` - `assets/css/animate.css` - `assets/css/style.css` - `assets/js/jquery-3.1.1.min.js` - `assets/js/popper.min.js` - `assets/js/bootstrap.js` `assets/js/jquery-2.1.1.js` is also in the tree and is not the file the login page loads. ### Shell `views/dashboard/index.html` loads the theme from `../../assets/`, including Toastr and Gritter CSS, and initialises a toast. Asset paths are two levels up, which matches `views/dashboard/`. Menu links that stay inside `views/template/` resolve. Links written as `profile.html`, `search_results.html`, `landing.html`, `404.html`, `500.html`, `vote_list.html`, `diff.html`, `datamaps.html`, and `validation.html` resolve under `views/dashboard/`, where those files are not present. The theme copies are in `views/template/`. The timeline element class on the shell is `Silicon Overdrive-timeline`. `views/template/index.html` uses `inspinia-timeline`. A search of `assets` for `inspinia-timeline` in `.css`, `.scss`, and `.less` found no rule for either class. Other classes on the same element (`ibox-content`) still come from the theme. ### Theme identity `assets/css/style.css` begins with `@import` of Google Fonts (Open Sans and Roboto) and a comment: "INSPINIA - Responsive Admin Theme, version 2.8". The shell file comment says "Silicon Overdrive - Responsive Admin, version 2.8". ## Wiki package Third-party layout, not written against the Silicon Overdrive shell. | Piece | Technology | |---|---| | `wiki/index.html` | TiddlyWiki 2.4.1 (version object in the page: major 2, minor 4, revision 1, date Aug 4, 2008). | | PHP library | PHP 5-era style: `var` properties, class constructors named after the class (`function Htpasswd`, `function Site`), short echo tags ``. `Options +Indexes`. | | Private site auth | `htaccessPrivate`: `Require group` for the site. `Options +Indexes`. | `Site::init()` copies the flavour template (default `empty.html`) to the new site's `index.html` and creates PHP links for download, logout, news, proxy, store, and storeTiddler. `init.php` opens `config.php` with `fopen(..., w)` — the mode `w` is an unquoted constant in the source. No Silicon Overdrive string appears under `wiki/`. ## Deployment ### Pipeline ```yaml image: python:3.5.7 # master -> zip * ; python codedeploy_deploy.py # develop -> zip * ; python codedeploy_deploy_develop.py ``` Steps install `zip` with apt and `boto3==1.3.0`. There is no test step and no Sonar step. `sonar-project.properties` and `sonarqube_scan.bat` are not in git. The task-creation scan listed both names at the root. **Unknown** whether they were untracked files on the scan host. ### CodeDeploy `appspec.yml` version 0.0, `os: linux`. | Hook | Script | Timeout | User | |---|---|---|---| | ApplicationStop | `scripts/stop_server` | 300 | root | | BeforeInstall | `scripts/install_dependencies` | 300 | root | | BeforeInstall | `scripts/start_server` | 300 | root | `install_dependencies` runs `yum install -y httpd`. `start_server` runs `service httpd start`. `stop_server` tries to stop `httpd` if `pgrep` finds it, but the script writes `isExistApp = \`pgrep httpd\`` with spaces around `=`, which Bash does not parse as an assignment. File mapping: source `/` to `/var/www/html/`. ### Deploy scripts Both are the Amazon Bitbucket Builds sample (header: Copyright 2016 Amazon.com, `narshiva@amazon.com`, v1.0.0) with the environment variable names changed. S3 key: `{APPLICATION_NAME}/{YYYYmmddHHMMSS}-bitbucket_builds.zip` (develop script uses `APPLICATION_NAME_DEV`). `create_deployment` uses an S3 revision, `bundleType` zip, description "New deployment from BitBucket", and `ignoreApplicationStopFailures=True`. The wait loop polls `get_deployment` until Succeeded, Failed, or Stopped, without sleeping. Credentials are whatever boto3 finds in the pipeline environment. They are not in git. The PEM file is not passed to boto3. ### Private key `SOawsCodeDeploy.pem` (1,692 bytes) was added in `00fe94c`. Its first line is `-----BEGIN RSA PRIVATE KEY-----`. The body is not recorded here. Nothing in the YAML or Python reads it. Because the artifact is `zip *` and the destination is the web root, a successful deploy places this file under `/var/www/html/`. ## Security observations (from the tree, not a penetration test) - Shell login does not authenticate. - Several shell links are broken relative paths (see Front end). - An RSA private key is committed and packaged into the public web root by the deploy spec. - TiddlyHome can store passwords in plaintext when `php_uname()` looks like Windows. - User-creation checks for length and character set run in the browser only. - Site directory names are taken from the request and passed to `mkdir` without a whitelist in `Site::inSite()`. - Public sites set `Options +Indexes`. - Admin init's `.htaccess` is the gate for the admin directory after the first POST. Before that, `init.php` is unprotected by that file because the file does not exist yet. - `eregi` and the old constructor style will fatal or warn on current PHP. The repo does not pin a PHP version. ## Configuration | Name | Where set | In git? | |---|---|---| | `APPLICATION_NAME` | Pipeline env, read by `codedeploy_deploy.py` | No | | `APPLICATION_NAME_DEV` | Pipeline env, read by `codedeploy_deploy_develop.py` | No | | `DEPLOYMENT_GROUP_NAME` | Production script | No | | `DEPLOYMENT_GROUP_NAME_DEV` | Develop script | No | | `DEPLOYMENT_CONFIG` | Both scripts | No | | `S3_BUCKET` | Both scripts | No | | AWS credentials | boto3 default chain | No | | `wiki/_th/lib/config.php` | Written by `init.php` | No | `develop`'s only committed configuration difference from the branch point is the login title and the DEVELOPMENT footer. ## Development and testing No unit tests, no lint config, no CI test stage, and no local server config (no Docker Compose, no PHP built-in server script). A developer can open `index.html` in a browser for the shell. Wiki PHP needs a PHP-capable Apache and a completed admin init. That combination is not described in the README. The early Sinatra process is gone. Nothing in the current tree listens on a port by itself; `httpd` is expected to serve the files. ## Related Silicon Ark directories Silicon Ark contains other folders whose names start with `unity` (`unity-api`, `unityFrontend`, `unityCLI`, `unity-framework`, and others). Each of those documents a different repository. This repository's files do not mention those projects, and those relationships are **Unknown / Requires Confirmation**.