Search Results: "ron"

14 July 2007

Peter Van Eynde: enter the permuted index

Wouter did you ever see the two indexes of the Common Lisp Hyperspec? There is a normal index and a "permuted" one, which almost always does exactly what you want.

13 July 2007

Michael Prokop: Find out what users request

One of the coolest features of grml IMO is grml-tips. grml-tips is a collection of tips you can request via a keyword. For example if you want to know how to use grml-x just run ‘grml-tips grml-x’:
mika@meilenschwein ~ % grml-tips grml-x
Start X window system (XFree86 / Xorg / X.org):
% grml-x $WINDOWMANAGER
Usage examples:
% grml-x fluxbox
% grml-x -mode '1024x768' wmii
% grml-x -nosync wm-ng
--
mika@meilenschwein ~ %
So as soon as you invoke ‘grml-x $keyword’ and if the grml-tips collection includes something with $keyword inside you’ll get it. I use that on daily base because all the hard-to-remember command sequences or dangerous commands like mdadm, sfdisk,… are easy to use this way. :-) But how about keywords not being availble in grml-tips collection yet? What about keywords other users request but don’t get a match? Thanks to formorer we have a submit feature within grml-tips since version 0.4.1:
% grml-tips nfs
Sorry, could not find a tip for 'nfs'. :-( 
Do you want to submit the keyword 'nfs' to grml's keyword database?
The grml team will write tips for the most requested and useful keywords.
To use and contribute to this feature you'll need a working networking connection.
No personal data will be transmitted to the database.
Send "nfs" to grml's keyword database? [y N]
Keyword 'nfs' has been submitted to grml's keyword database.
Thanks.
%
Now being the maintainer of grml-tips I can check what users want to get through querying the sqlite database which stores the submitted keywords. Dear paranoid users: by default the keyword is not transfered to the database of course, you have to manually press ‘y’ to submit it. It’s not the default behaviour but an option. And there’s really no personal information stored inside the database, all I can query looks like the following:
$ID nfs grml 1.0-1 Release Codename Sonnenbrand [2007-07-13] 1184261151
Oh and thanks to Nico we also have our 24/7 support slave within the #grml channel:
19:37 <     mika > grml-tips: grml-x
19:37 < grml-tips> matches: http://www.grml.org/tips/index.html#23
And if our support guy does not work as expected:
19:38 <     mika > grml-tips: does-not-match
19:38 < grml-tips> Sorry, could not find a tip for 'does-not-match'.
If you want to submit a tip please mail it to tips (at) grml.org - thank you!
… and once a week I get a cronjob-triggered mail sending me all the keywords without a match. Cool, ey? ;-) All what’s missing now is a bot that writes all the missing tips on its own. 8-) Conclusion: make it easy for your users to submit information you might be interested in - to help your users.

11 July 2007

Ross Burton: Pimlico and Maemo Synergy Overdrive!

We've had Dates on Maemo for a long time now, but now and again people asked for Contacts. We never really bothered to build Contacts because it isn't ported to Maemo, so doesn't fit in to the environment. Well, yesterday I found myself with a clean Maemo 3.2 Scratchbox (quite unusual I assure you) so thought I'd build a package anyway. It's not integrated into Maemo, but it's in our repository now. Hopefully this will cause a fanbase of programmers to spontaneously appear who will help us develop the next generation of Contacts, which is modular and thus far easier to port to various platforms. Along with my recent Tasks on Maemo announcement, all of Pimlico is now available for Maemo. I'll have a N800 with the full suite on at GUADEC if anyone wants to see it. NP: This Too Shall Pass, Breakage

Mart&iacute;n Ferrari: Introducing Pancut n / GSoC status update

Hi, as everybody else, I'm blogging about the status of my GSoC project, which now has a name: Pancut n. Pancut n is a lintian-like tool to check ISO images generated by debian-cd and friends. It aims to support CDDs, and even Debian-Live CDs. In case you're wondering, the name is a stupid pun about avoiding (skin) burns and unusable debian CDs (Pancut n is a vintage lotion for burns in Argentina, and I think most joungsters won't even recognise the name). In any case, it sounds good :-). Since it has a name, also it has a alioth project page, SVN repository and mailing list. If you want to try it out, just checkout the repository and run:
$ ./pancutan <list of iso files> If you set the environment variable DEBUG to a number greater than zero, you get debugging info. Its dependencies are currently libyaml-perl (or libyaml-syck-perl for faster operation), fuseiso9660 and an user which fuse permissions. Of course, as I've been working in the architecture, there aren't many tests. But you can try the powerpc business card ISO for which pancutan currently detects that it's too big for a business card cd:
$ ./pancutan /media/IOMega/mirror/isos/debian-40r0-powerpc-businesscard.iso
E: image-too-big
 - The ISO file is too big for the target media
 + 73207808
About the architecture. The general idea is that a directory is scanned for modules, "requires" them, and extracts metadata embedded into them (I'm still thinking that this can be separated to delay compiling of modules when they're needed, but I haven't decided it yet). From that metadata, tasks and tags (errors and warnings) definitions are loaded. Also a lot of internal sanity checking is performed. There isn't any fixed order of execution, it's constructed based on the dependencies the tasks define. And it has been thought from the start with parallelisation in mind, although that functionality hasn't been written yet (I'll do it during this week). I have written a draft spec for the plug-ins in the wiki. I have to properly document that, but you can get an idea from it. At this point, I'd like to other, more experienced people take a look at it. So feedback is very welcomed, specially from the people that will use the tool!

MJ Ray: North Somerset Rubbish Targets

One of my examples to explain "the tragedy of targets" used to be councils meeting recycling collection targets by collecting the recyclable waste, then putting it in landfill because that was cheaper than actually recycling it. That's bad because it makes a lot of extra work for everyone, but only meets the collection target in fact, not in spirit. I stopped using that example because I thought it was too incredible and I didn't have a good reference to support it. So imagine my surprise to see a report in the Weston Mercury saying:
"If Veolia does not have enough manpower it will send out a green waste lorry, or a domestic refuse lorry which usually picks up black bag rubbish, to pick up both at the same time. [...] The staff will just take it for granted that green waste is in the green lorries and domestic waste is in the blue lorries."
This is bad on many levels, even worse than my old example where recycling-ready waste was knowingly tipped into landfill. There's green waste contamination and false collection statistics, for starters. The article continues to report that Cllr Carl Francis-Pester, North Somerset Council's executive member for environment, said:
"We are carrying out an immediate investigation into these allegations which we take very seriously indeed. This investigation will include urgent discussions with the contractor to ensure they are fulfilling the contract we have with them in the correct manner."
There doesn't seem to be any information about this investigation on North Somerset Council's web site. And if Veolia have spotted a loop-hole in the contract, then what? Even if they haven't, the council has to watch solely-profit-led contractors like hawks because if you give them a chance to cut costs (and therefore increase profits), they will try it. That is the hidden cost of outsourcing, not covered by the Best Value Indicators and other privatised council jargon. Incredibly, the councillor continues with:
"Thanks to the residents of North Somerset we have increased our recycling rate from 20.5 per cent to 30.8 per cent in the last 12 months."
If the allegations are true, then no, we haven't, because the statistics would be as full of toxic rubbish as the green waste lorries. Have private rubbish collectors been doing this elsewhere?

Miriam Ruiz: SnowballZ - a fun RTS strategy game featuring snowball fights with penguins

What about a reat time strategy game, kinda Command and Conquer, with penguins as the main characters, surrounded by the polar freeze, and throwing mercilessly snowballs against each other? That’s what SnowballZ is about: march through snow laden forests to conquer new frontiers and grow your small army. Ambush enemy lines with blasts of freezing snowballs. Of course, don’t forget to feed your troops with fresh fish, or warm them up in a nice igloo, if you expect them to grant you a good victory. And don’t neglect your home, invaders are just over the next snow drift! The packages are already in Debian SID, so there’s no excuse for not trying it, just get ready for the next snowfall!

Andrew Pollock: [life] Sarah made the news

Last night NBC11 was running a story and an email poll about the impending new legislation requiring that all cats and dogs over 6 months of age be spayed or neutered. Anyway, the legislation seems (surprisingly, in my opinion) divisive within the community. Since Sarah has done a lot of volunteer work at the Palo Alto Animal Services animal shelter in the past, as well as doing a bit of feral cat trap/neuter/release work, she's strongly in favour of the legislation as it'll help reduce the number of unwanted kittens and puppies that get dumped at shelters (or just dumped) every year. Unfortunately, plenty of pet owners seem to feel some need to not have their pet spayed or neutered, even if they have no intention of using the animal to breed, and these people have been kicking up a fair bit of fuss. So, as I was saying, NBC11 ran an email opinion poll, and Sarah wrote in a fairly informed piece about why she felt the way she did, and got an email back this morning for a reporter wanting to interview her, and that happened today. It's funny, Sarah was saying on the way home from work, that in hindsight one of her answers was pretty lame, and sure enough, the one sound bite they decided to use was that one... Oh well, she's had her 30 seconds of fame.

Neil Williams: gpe-cash and GPL3

Made some progress with gpe-cash today - fixing compiler warnings, stripping out yet more source code and fixing the debian packaging. It does build from SVN but it needs libqof1 >= 0.7.3 which is an unreleased version from QOF CVS.

gpe-cash.

It's now down to < 1Mb installed binaries with less than 500kb of additional libraries (liqof1, libsqlite) compared to a basic Gtk installation. It may creep up to 2Mb all-in by the time the rest of the Gtk code is complete but an Emdebian build should be able to cut that back towards 1.5Mb or so, installed, by dropping the docs. The SQLite backend is fully functional and the default backend. An optional libxml2 backend adds libxml2 and bumps the size requirements substantially but is worth using on the desktop as it adds support for a command-line mode that combines SQL-type queries with XML results. (Eventual plan is to rsync the sqlite from the handheld and use XSL to generate reports etc.) Still a lot smaller than any other double-entry financial package I can find and with none of the dependency problems of the original GnuCash, despite using the same objects. Managed to remove the need for GConf too which is quite handy for an embedded application.

gpe-cash will be my first GPL3 upstream - all the code I'm forking from GnuCash is GPLv2 or later, as is QOF, and GPL3 code can be linked against the LGPL2 or later libgpewidget so I'm making the new Gtk frontend GPL3 or later and I will eventualy release the whole thing under the GPL3 "or later". Thanks to Joe Smith and Anthony W. Youngman for their help with all that. I had it nearly right, just tweaked debian/copyright a bit.

Actually spent a fair bit of time migrating my upstream projects to Anjuta2 and getting used to the new interface. It is a bit twiddly at times and one or two bits are annoying (bit too much eye candy for my liking - repetition of labels and buttons) but overall it's a lot better than when v2 was first uploaded. The integral DevHelp window is handy. I'm still waiting for the svn plugin though and I've no idea what is going wrong with the anjuta manual. It is being installed and yelp can load it when passed the URL directly but I can't get it to show in the normal Gnome Help browser lists - only the man pages show.

10 July 2007

Annabelle Tully: Silly chaos

Today must have been the most chaotic day of my life.
As we awakened at 0730AM, which was kindof late for the airport bus already, we hurried to the shower and got off to the busstop, where we found out we had missed the bus by two minutes and ended up having to take a taxi or we’d miss our flight.
As we arrived to the airport there seemed to be some issues with the tickets I had purchased the day before. They had for some reason not accepted the payment. The account had enough funds, and everything was filled in correctly.. We could not figure out what was wrong. The bitch behind the counter was most uncorporative, and refused to give me the number to the
airline in time for me to fix the problem. As a result we ended up buying twice as expensive tickets to Frankfurt so we could get to Amsterdam in time, as I was going to see some friends there tonight.
We slept for about six hours on the airport in a corner by a power socket with all our gear, and proceeded to the plane, where we were searched throughly, eventhough I was wearing a tanktop and sweatpants
with empty pockets + sandals. They also took disposal of our threat-to-the-nation sunblock. How dare we endanger nation with our threatening blonde hair and sunblock. The plane was also half an hour late because of some technical failure.
So ofcourse, we got to Frankfurt too late to get the last train to Amsterdam. Great.
We ended up taking the train to Dusseldorf to see Daves mother and step father, which was nice though. Though the all too tasty cake ruined my carefully prepared diet. Atleast it was a nice ending to the chaotic day.
So off to Amsterdam tomorrow morning..
ARGH.

Cameron Dale: DebTorrent Release 0.1.2

Today I have released the next version of DebTorrent. It's been over a month since the last release, which means there are lots of new features in this one. This is also the first release that I consider actually useable, as it now listens for HTTP requests from APT for packages to download, and feeds the downloaded packages back to APT. It also includes a backup HTTP downloader that will use a Debian mirror to download packages from, only when no peers can be found that have them. This means your download always works, even if you're an early adopter (which I hope you are) and there aren't that many peers available. Finally, the larger packages have now been split into multiple pieces, which makes downloading them much more efficient. Here's the changelog: I've already started work on the next release, which will include almost no new features, but will be much easier (I hope) to use. It will also be distributed in a .deb binary format for the first time, and (again I hope) be available in the Debian archive. Here are the plans I've come up with for the steps to complete for the next release:
  1. Make a debtorrent daemon script based on btlaunchmany
  2. Make a config file with lots of explanations
  3. Load configuration info from /etc
  4. Save downloads and state to /var/cache
  5. Log all messages to /var/log
  6. Clean up the debug logging, possibly add debug levels
  7. Use bittornado packaging files (debian/)
  8. Add init script
I've never created/packaged a daemon before, so hopefully I haven't made any blunders in those plans.

Annabelle Tully: Adventures

So the journey of David Noble and I began. (Actually a few days ago I just couldn’t be arsed to write anything before now).
After driving to Cambridge and staying in Norwich for a whole dreadful week, we went back to Cambrige for a couple of nights, where I ended up playing Zelda on the wii for a good 11 hours. On our way to the airport, at 4am, the bus was late due to someone leaving a bag at the busstop, so they ofcourse took this as a bombthreat and closed down the entire road leaving the bus 45 minutes late.
We then arrived at Stansted, which was surprisingly non-hell-like this time as opposed to last time where I was treated as a terrorist for bringing vaseline.
An interesting planeride with paper IRC in the google notebook (Which will never be spoken of again) later, we arrived Stockholm, or, atleast what Ryanair calls Stockholm. It was two hours away from the actual Stockholm so we had to take the bus. I saw the sun for the first time in three weeks and it was the happiest day of my life, until the event that followed..
Our boat tickets for Turku were the only things we hadn’t printed out, so we ofcourse went to the wrong side of the shore in the city. They said they couldn’t find us in the system and assumed it was because our boat wasn’t arriving for another six hours. We locked our bags in the lockers and ran off into the city and had wonderful wonderful sushi and sun.
A few hours later when we returned, about an hour before our boat was to leave, they still could not find us in the system. Upon where we thought ’shit’.
Struggling to get online, we found out our actual boat terminal was on the other side of the city.
We rushed down, and actually DID make it to the boat in time. The boats had sauna ohmygod.
However, Dave had booked us a nightboat with no room or beds, so we had to spend the night on a cold floor. After not sleeping for two days already that is not very pleasent.
We eventually arrived Turku, took the train to Helsinki, and went to Teemus place and passed out on the grass in the sun. This ended in sunburns for my sunintolerant useless norwegian-english skin. Totally worth it though.
The day after we left for the festival Konemetsa with Hanna/Tulitar. The weather was nice uptil the middle of it where a huge rainstorm covered the area. It was literally bucketing down with rain, which resulted in a wild crowd, tons of mud, and us jumping and dancing around in it being very much into the music (I’ve never been so happy to have a shower my entire life once we got home). I can’t believe none of us are sick after that actually, one would think it would result in a heavy cold doing this for three days.
Tomorrow we will head for Copenhagen by plane, followed by train to Amsterdam. New adventures await us!

9 July 2007

Biella Coleman: La Rogativa

Last night I came across an amazing photo of one of my favorite spots in Viejo San Juan, Puerto Rico, La Rogativa. It is one of the *best* spots to sit, at night, after a walk and few drinks, and watch the lights dazzle in front of you till the sun decides to rise. You will not be disappointed, especially during a winter’s night when there just may also be a slight touch of cool breeze to caress your skin. Here is the story of the statue:
A modern bronze statue of the Bishop of San Juan and three torch-bearing women stands in the Plazuela de la Rogativa. A good spot for scenic views, due to is fine location overlooking the bay. The beautiful bronze statue is the work of Lindsay Daen, created in 1971 to mark the old city’s 450th anniversary. Plazuela de la Rogativa (plaza of the procession) features a modern sculpture depicting a procession of religious women and a bishop. It commemorates an event that took place on the site in 1797. During the spring of that year, a fleet of British ships led by under Sir Ralph Ambercrombie sailed into San Juan Bay, meaning to launch an assault on the city and take control of the colony. When the attack was foiled, they undertook a naval blockade of San Juan, hoping to starve the residents into submission. As the town s people began to despair of any help from soldiers garrisoned in the inland towns, the governor ordered a rogativa, or plea, to ask the saints for assistance. The women of the town formed a procession through the streets, carrying torches and ringing bells. The British, hearing the commotion and seeing the moving lights, decided that reinforcements had arrived and quickly sailed off.

Matthew Palmer: Hell is other people('s code)

I've been working (part-time) on an existing Rails application for the last month or so, getting comfortable with it, modifying some sections to support needed functionality, and beginning an all-out, carpet-bombing "shock and awe" assault on it's test suite. However, a significant portion of the system is (or rather was, since I've already gutted a lot of it) a chunk of rather messy and unpleasant auto-generated code. I've always been a bit iffy about code generation tools, ever since my first encounters with them whilst working on some $DEITY-awful access application years ago. (First encounters with anything Microsoft usually have that effect on me, though). Since then, I've never found any reason to change my mind, and dealing with this particular chunk of auto-generated code has pushed me over the edge into "wild-eyed extremist" territory. Please note that when I say "code generator", I'm talking here about programs or wizards or whatever that create a block of code that you're then expected to tweak to suit your conditions. If it's just a mechanical transformation of an input format to an output format, where a human is never expected to maintain the output by hand, that's not code generation in my book -- that's just a compiler being used for it's intended purpose. I like compilers. I'm fairly sure you do too. Code generators, though? EVIL. Consider what you get out of your generator: A big blob of code in your application that you then have to understand and maintain. It's like you gave a commit bit to some random person who dropped a 5000 line change into your tree and then ran away into the night, cackling. If there's bugs in the generated code (and remember, there's always bugs in software), when they get fixed upstream you're up the creek unless you haven't modified the code at all (and thus can regenerate), or you're willing to apply the necessary patches to your modified version, often by hand. Hand-patching is error-prone, and if you've modified the code at the same place that has to be patched, things can get unpleasant. In the case of the generator I'm dealing with at the moment, I'm not even blessed with it being decent code. It's ugly code, in every possible sense of the word. There's inconsistent formatting, poor commenting, it uses some totally whack coding constructs[1], the hard-coded text strings are ungrammatical, it's got very few (and poorly covering) test cases, the methods are huge and unwieldy, and it's got security bugs (not so hot for something that's supposed to be guarding your application). In short, it looks like some quick-and-dirty internal hack that escaped one night and is now wreaking havoc on the world. There's probably some really good code generators out there. I've been poking around a bit, and there's some written for Rails by people who I know produce good code. However, no matter how good the author of the code generator is, the very best you can hope for is solid, clean code that is the equivalent of some portion of your application having been coded by some member of your team who you (and nobody else) has ever met, who didn't follow your team's coding conventions, and who has never looked at any other part of your application to make sure that everything hung together in a consistent manner. Which you now have to maintain. I've read a lot of books, articles, blog posts, and mailing list messages, and participated in no shortage of "why software sucks" discussions with other programmers, but I've never heard anyone advocate that the way to clean code, minimal bugs, and happy programmers was to drop a big chunk of unknown code right in the middle of things. Before you start charging up the e-mail-delivered tasers, ready to fry my delicate braincells for the twin crimes of Xenocodophobia and a vicious case of Not Invented Here syndrome, though, please understand that I'm not against code reuse in the right place. That right place is a library, component, or other abstract, documented, fairly static, and presumably-replaceable chunk of code. By using a library, you get a relatively simple interface to somebody else's complexity. This is a good thing, for all the reasons that everyone should already be able to recite. Items such as a comprehensible interface, minimal learning curve, and so on. Things you don't get with generated code because, pretty much by definition, the entire chunk of code is you "interface". There are some times, though, when what you want to do can't be done in a library. Either the thing has too many tentacles to be able to easily encapsulate behind an abstracted interface, or you need to modify it's behaviour in too many places to be able to get away with a few simple callbacks to get the job done. Hence, it might be tempting to fire up the code generator to get yourself out of a hole quickly. Don't do it though. Don't succumb to the temptation of saving yourself a little bit of time by firing up a code generator. What you're doing there is just making pain for yourself, by inheriting a big chunk of code that you don't fully understand, probably doesn't solve your problem particularly well, and which you (or whichever poor slob gets the job after you) will have to maintain into perpetuity -- most likely by gradually rewriting large pieces of it so that it fits your application better. The output of a code generator is likely to be the least maintainable code in your tree -- either by virtue of the fact that it's crap code, or at the very least because you just don't understand it. The general principle of good codebase hygiene is that you get rid of unmaintainable code quickly, so it doesn't infect everything else (a la the "broken window theory"). With that in mind, why would you ever consider deliberately introducing a huge chunk of unmaintainable code into your application? The closest I can come to a defence of code generators is something like Rails' scaffolding, where the controller and views for a set of simple CRUD operations on a table are auto-generated. The key word there, though, is scaffolding. It's very name suggests that it's temporary, to be replaced with something more robust and useful as soon as is reasonable. The default scaffolding is ugly as sin, besides, which encourages you to replace it, and -- as of Rails 1.1 (I think), there's a 'scaffold' method which creates the scaffolding output at runtime, so you never, ever need to generate scaffolding code any more. Anyone planning on producing any significant piece of their application through the use of code generators is, in my book, committing a crime against software decency.
1. My favourite whack code construct thus far has been this gem:
 case somevar
   when 17
     do_something_here()
 end
Because, you know, if statements are for people who know how to program, or something.

David Moreno Garza: Back

Yeah, we are almost two weeks back now, but until now I can feel we are done with lots of pending issues.

To summarize, I left DebConf on Saturday morning, arrived NYC on the afternoon where Raquel was waiting for me. By Sunday, we had the very nice chance to meet with abrotman, rcox and stew. We stayed at stew and rcox’s place until Tuesday, when we got back. We also had the chance to meet with people that we have been working for remotely. We were walking around in NYC, and suddenly, the 5th avenue became multicolor. It was the gay pride parade. You can take a look at the pics on the gallery, lots of gay people. Our visit to NYC was pretty gayish actually, since we spent our first night in Chelsea, presenced an electronic music festival or similar for lesbians, and the next day, first row on the parade :-)

And that’s it, since we came back until like yesterday, life was a mess; lots of work pending to deliver and many other issues. Finally, we are right now settled up again, enjoying a cold rainy nice weather in Mexico City with very cheap beer (compared with UK pints!) and loved people :-) Thanks to all who made such a wonderful DebConf, even that, in my case, I arrived late and left early, it was just great (thanks also to MJ Ray, specially; and also to all people who was worried about my arrival, you know who you are, thanks). Thanks also to Mike and Rachel who hosted us, they are a very nice couple. And also, thanks to Alex who joined us in NYC, coming from Philadelphia, spent a nice day with us, took us to Chinatown and Little Italy and gave me a Phillies baseball cap (just as exchange of the worldwide famous umbrella hat).

8 July 2007

Bastian Venthur: Reportbug-NG finally in testing!

Waiting ten days for rng to slip into testing, I had enough time to stuff the next version with new features and small bugfixes. The most interesting ones are: In totally unrelated news, I finally managed to master Rubenstein’s Revenge.

Matt Brown: POSIX/NFSv4 ACL Inheritance Problems

I (as root) have a directory hierarchy that I want a particular group to always have write access to. The files and folders inside the hierarchy are owned and manipulated by a wide variety of diffrent users. Essentially I want to delegate ‘root’ access for a portion of the filesystem to a particular group. My first attempt at implementing this was to use the standard POSIX ACLs that are available for almost every filesystem Linux supports. I recursively set an ACL on the top-level directory to give the group write access to all files and directories that currently exist and then I recursively set a default ACL to give the group write access on all the directories. This default ACL should be inherited by any new files that are created ensuring that the group keeps write access to everything. Problem solved? Unfortunately not. The intricacies of complying with POSIX means that ACLs are implemented as an ACL plus a mask. To gain access to a particular file or directory the user or group must match an appropriate ACL granting the access and the mask for that file or directory must also allow the requested permission to be granted. When you add an ACL to a file or directory, the ‘group’ bits of the standard Unix permissions magically switch from controlling group access to controlling the mask portion of the ACL, effectively providing an upper bound on the permissions that an ACL entry can grant. This prevents legacy POSIX applications that do not understand ACLs from unintentionally granting excessive permissions - arguably a good thing. Unfortunately this also makes it very hard to preserve the ACL granting write access to the ‘root’ group which I legitimately intended to have in place on this portion of the filesystem. Newly created files under the hierarchy generally inherit the ACL as intended, as most applications attempt to create files with as many permissions as possible, leaving it up to the umask to remove undesired permissions. However any file that is copied into the hierarchy without the ‘group’ write bit set, or any file that has the ‘group’ write bit removed via chmod will actually remove the write bit from the ACL mask invalidating the ACL and leaving me back at square one! After a bit of Googling I thought that NFSv4 ACLs might be the answer to this problem, as they are marketed as “very similar to Windows ACLs” and I’m sure that I vaugely recall Windows being able to properly inherit ACLs from parent directories. Unfortunately after downloading the NFSv4 ACL patches and trying all the various mount options I cannot find any combination that will offer the functionality I need. The implementation conforms to POSIX, so it still has a mask parameter and the same problems as the standard POSIX ACLs. The only benefit from using NFSv4 ACLs that I can see is that you have more permissions to grant. So once again, I’m back to square one. I’m hoping that there is some fundamental point that I’m missing as this seems like a very common use-case that I would have thought would be well supported. If a command-line example is clearer to you look at:
http://www.mattb.net.nz/blog/dump/acl-inheritance-problems.txt My current solution is to run a cronjob every X minutes to recursively ‘chmod -R g+w /dir’, however that’s far from optimal as it exposes all sorts of race conditions and just seems ugly! Any suggestions or solutions will be gratefully received.

7 July 2007

Sune Vuorela: paranoia++ ?

Hi! Earlier I blogged about being too (little) paranoid. One of the comments was my unencrypted /boot on my harddrive. So I did something to it. Daniel Baumann told me some stuff at debconf about how to make bootable cd’s with grub - so I had to try to move my /boot to a cdrom instead. It works. A quick and dirty howto:
mkdir -p builddir/foo
cp -r /boot builddir/foo
cd builddir
genisoimage -no-emul-boot -boot-load-size 4 -boot-info-table -r -b boot/grub/stage2_eltorito -o boot.iso foo
and now you are not yet up and running. It looks like it, but you have to adapt boot/grub/menu.lst to make it boot from cd. First issue: boot fails with a “Error 29: Disk Write Error” - I wondered a bit and asked for help around and wondered a bit more why grub wanted to write to my harddrives in order to boot … finally solved it with help from the Super Grub Disk Page - it was the savedefault point of all my kernels. Removing that made it boot. So time to remove /boot and trust my cd. Which was a wrong decision. All my kernels had root=(hd0,0) so it kind of didn’t work. Changing this to root=(cd) did it - and removing (hd0,0) from my splashimage was also a bit nessesary. So after this, rebuild the cd again with the genisoimage command mentioned above and now I am up and running completely. And I of course have secretly marked the cd so evil people can’t replace it without me noticing it. So what’s next step in my tinfoil covered world ? SELinux? something else? I guess you know how to make comments. Feel free. /Sune

Russell Coker: Google is Good for the Environment

Google has just announced the Recharge project. They are converting some of their own fleet of Prius and other hybrid cars to be “plug-in hybrids”, this means that the car can be plugged in to mains power to charge it’s batteries and petrol will only be used as a fuel of last resort. If a car is mostly used for short trips then the petrol use is dramatically reduced - but the car still has the 1000Km range that a full tank of petrol provides! Google is also going to invest $10,000,000 in companies that develop technologies related to hybrid vehicles. If you have some ideas for new technological developments related to power saving then you might want to check out what Google is doing.

Ben Armstrong: Bumpy Typo blog upgrade: mod_fcgid 1.10 -> 2.1

For some time I have ignored my blog so I did not notice that when my co-admin upgraded our system from etch to lenny, it broke. When I found some time to look at it, it turned out to be because the blog was no longer running in production mode, so it pointed at the empty development database. This caused every URL to redirect to the login page, but since I didn’t have a valid user for that db, I couldn’t login. This, in turn, was due to the upgrade of mod_fcgid from the old 1.10 version in Etch to 2.1. Apparently, this used to work. Note the name of the module:
<IfModule mod_fastcgi.c>
   <Directory /var/www/vir/syn.theti.ca/typo>
    FastCgiIpcDir /tmp/fcgi_ipc/
    FastCgiServer /var/www/vir/syn.theti.ca/typo/public/dispatch.fcgi -initial-env RAILS_ENV=production -processes 15 -idle-timeo
ut 60
   </Directory>
</IfModule>
It’s strange that the section is called mod_fastcgi.c, not mod_fcgid.c. Either that was done to make it a “drop in” replacement for fastcgi, and later changed in the next release, or else this config was not actually used, but somehow my blog started in production mode before the upgrade anyway. In any case, the blog is back in production node with the new fcgid with the following module section (based on this one from the mod_fcgid home page).
<IfModule mod_fcgid.c>
   DefaultInitEnv RAILS_ENV production
   <Directory /var/www/vir/syn.theti.ca/typo>
     FCGIWrapper "/var/www/vir/syn.theti.ca/typo/public/dispatch.fcgi" .fcgi
   </Directory>
</IfModule>
Hope this is helpful to others making the upgrade.

6 July 2007

Eddy Petri&#537;or: RPMs, gaaaaaah!

Always when I have to deal with RPM systems I feel so handicapped and it feels so wrong from multiple PoV.

This is a rant and a dear lazyweb (not that lazy, actually) type of post.

I would like to be able to have a few things solved when dealing with RPMs:
  1. I would like a pbuilder like builder for specs
    • I know about mock, but
      • it accepts only src.rpm files (I know about rpmbuild -bs, but is broken, read further for the groovy details)
      • I have some specs that have %include directives for the maintainer scripts and when rpmbuild -bs is ran, guess what, the extra files are left outside the src.rpm;oh yes, the directives are processed correctly for the binary rpm
      • mock relies on bootstrapping a system using fedoralegacy.org, which was recently discontinued
      • I have a redhat-9 chroot tarball which I would like to use and tell mock to use that without caring about upgrades (since my packages are not at all that dependent on the build system)
      • mock fails to bootstrap even for fedora-devel-i386-core with the message "Cannot find a valid baseurl for repo: extras"
      • the older versions fail to bootstrap because, apparently, it "Could not find useradd in chroot, maybe the install failed?"
    • plague (how's that for irony?) relies on mock, which is broken
    • mach seems to be deprecated
  2. I would like a simple repo creation and maintainance tool, something in the line of mini-dinstall, which should have apt4rpm and yum support, but it seems that repos are still the "new shiny thing" which has no proper tools
  3. I would like to be able to know from which version I am upgrading from the current package, not only that I am upgrading (in case you didn't knew, the only way to know that you are upgrading in a post/pre install/remove script, is the wonderful $1 parameter which indicates the number of packages installed after the script finishes or something along that line..
So my question is, is there any way to fix any of the issues above in a sane way, without me reimplementing apt-like functionality in rpm land?

Next.

Previous.