Search Results: "ed"

5 July 2014

Maximilian Attems: xserver-xorg-video-intel 2.99.912+20140705 in experimental

Since the release of xf86-video-intel 2.99.912 a month ago several enhancements and fixes in xf86-video-intel git piled up. Again testing is very much appreciated: xserver-xorg-video-intel packages.

Mario Lang: I love my MacBookAir with Debian

In short: I love my MacBook Air. It is the best (laptop) hardware I ever owned. I have seen hardware which was much more flaky in the past. I can set the display backlight to zero via software, which saves me a lot of battery life and also offers a bit of anti-spy-acroos-my-shoulder support. WLAN and bluetooth work nicely. And I just love the form-factor and the touch-feeling of the hardware. I even had the bag I use to carry my braille display modified so that the Air just fits in. I can't say how it behaves with X11. Given how flaky accessibility with graphical desktops on Linux is, I have still not made the switch. My MacBookAir is my perfect mobile terminal, I LOVE it. I am sort of surprised about the recent rant of Paul about MacBook Hardware. It is rather funny that we perceive the same technology so radically different. And after reading the second part of his rant I am wondering if I am no longer allowed to consider myself part of the "hardcore F/OSS world", because I don't consider Apple as evil as apparently most others. Why? Well, first of all, I actually like the hardware. Secondly, you have to show me a vendor first that builds usable accessibility into their products, and I mean all their products, without any extra price-tag attached. Once the others start to consider people with disabilities, we can talk about apple-bashing again. But until then, sorry, you don't see the picture as I do. Apple was the first big company on the market to take accessibility seriously. And they are still unbeaten, at least when it comes to bells and whistles included. I can unbox and configure any Apple product sold currently completely without assisstance. With some products, you just need to know a signle keypress (tripple-press the home button for touch devices and Cmd+F5 for Mac OS/X), and with others, during initial bootup, a speech synthesizer even tells you how to enable accessibility in case you need it. And after that is enabled, I can perform the setup of the device completely on my own. I don't need help from anyone else. And after the setup is complete, I can use 95% of the functionality provided by the operating system. And I am blind, part of a very small margin group so to speak. In Debian circles, I have even heard the sentiment that we supposedly have to accept that small margin groups are ignored sometimes. Well, as long as we think that way, as long as we strictly think economically, we will never be able to go there, fully. And we will never be the universal operating system, actually. Sorry to say that, but I think there is some truth to it. So, who is evil? Scratch your own itch doesn't always work to cover everything. How do we motivate contributors to work on things they don't personally need (yet)? How can we ensure that complicated but seldomly used features stay stable and do not fall to dust just because some upstream decides to rewrite an essential subcomponent of the dependency tree? I don't know. All I know is that these issues need to be solved in an universal operating system.

John Goerzen: The Heights of Coronado

Near the beautiful Swedish town of Lindsborg, Kansas, there stands a hill known as Coronado Heights. It lies in the midst of the Smoky Hills, named for the smoke-like mist that sometimes hangs in them. We Kansans smile our usual smile when we tell the story of how Francisco V squez de Coronado famously gave up his search for gold after reaching this point in Kansas. Anyhow, it was just over a year ago that Laura, Jacob, Oliver, and I went to Coronado Heights at the start of summer, 2013 our first full day together as a family. Atop Coronado Heights sits a castle , an old WPA project from the 1930s: IMG_9803 IMG_9824 The view from up there is pretty nice: IMG_9806 And, of course, Jacob and Oliver wanted to explore the grounds. IMG_9813 As exciting as the castle was, simple rocks and sand seemed to be just as entertaining. IMG_9835 After Coronado Heights, we went to a nearby lake for a picnic. After that, Jacob and Oliver wanted to play at the edge of the water. They loved to throw rocks in and observe the splash. Of course, it pretty soon descended (or, if you are a boy, ascended ) into a game of splash your brother. And then to splash Dad and Laura . 2013-05-27 15 Fun was had by all. What a wonderful day! Writing the story reminds me of a little while before that the first time all four of us enjoyed dinner and smores at a fire by our creek. IMG_9756 Jacob and Oliver insisted on sitting or, well, flopping on Laura s lap to eat. It made me smile. (And yes, she is wearing a Debian hat.)

4 July 2014

Matthew Garrett: Self-signing custom Android ROMs

The security model on the Google Nexus devices is pretty straightforward. The OS is (nominally) secure and prevents anything from accessing the raw MTD devices. The bootloader will only allow the user to write to partitions if it's unlocked. The recovery image will only permit you to install images that are signed with a trusted key. In combination, these facts mean that it's impossible for an attacker to modify the OS image without unlocking the bootloader[1], and unlocking the bootloader wipes all your data. You'll probably notice that.

The problem comes when you want to run something other than the stock Google images. Step number one for basically all of these is "Unlock your bootloader", which is fair enough. Step number two is "Install a new recovery image", which is also reasonable in that the key database is stored in the recovery image and so there's no way to update it without doing so. Except, unfortunately, basically every third party Android image is either unsigned or is signed with the (publicly available) Android test keys, so this new recovery image will flash anything. Feel free to relock your bootloader - the recovery image will still happily overwrite your OS.

This is unfortunate. Even if you've encrypted your phone, anyone with physical access can simply reboot into recovery and reflash /system with something that'll stash your encryption key and mail your data to the NSA. Surely there's a better way of doing this?

Thankfully, there is. Kind of. It's annoying and involves a bunch of manual processes and you'll need to re-sign every update yourself. But it is possible to configure Nexus devices in such a way that you retain the same level of security you had when you were using the Google keys without losing the freedom to run whatever you want. Here's how.

Note: This is not straightforward. If you're not an experienced developer, you shouldn't attempt this. I'm documenting this so people can create more user-friendly approaches.

First: Unlock your bootloader. /data will be wiped.
Second: Get a copy of the stock recovery.img for your device. You can get it from the factory images available here
Third: Grab mkbootimg from here and build it. Run unpackbootimg against recovery.img.
Fourth: Generate some keys. Get this script and run it.
Fifth: zcat recovery.img-ramdisk.gz cpio -id to extract your recovery image ramdisk. Do this in an otherwise empty directory.
Sixth: Get DumpPublicKey.java from here and run it against the .x509.pem file generated in step 4. Replace /res/keys from the recover image ramdisk with the output. Include the "v2" bit at the beginning.
Seventh: Repack the ramdisk image (find . cpio -o -H newc gzip > ../recovery.img-ramdisk.gz) and rebuild recovery.img with mkbootimg.
Eighth: Write the new recovery image to your device
Ninth: Get signapk from here and build it. Run it against the ROM you want to sign, using the keys you generated earlier. Make sure you use the -w option to sign the whole zip rather than signing individual files.
Tenth: Relock your bootloader
Eleventh: Boot into recovery mode and sideload your newly signed image.

At this point you'll want to set a reasonable security policy on the image (eg, if it grants root access, ensure that it requires a PIN or something), but otherwise you're set - the recovery image can't be overwritten without unlocking the bootloader and wiping all your data, and the recovery image will only write images that are signed with your key. For obvious reasons, keep the key safe.

This, well. It's obviously an excessively convoluted workflow. A *lot* of it could be avoided by providing a standardised mechanism for key management. One approach would be to add a new fastboot command for modifying the key database, and only permit this to be run when the bootloader is unlocked. The workflow would then be something like which seems more straightforward. Long term, individual projects could do the signing themselves and distribute their public keys, resulting in the install process becoming as easy as which is actually easier than the current requirement to install an entirely new recovery image.

I'd actually previously criticised Google on the grounds that using custom keys wasn't possible on Android devices. I was wrong. It is, it's just that (as far as I can tell) nobody's actually documented it before. It's important that users not be forced into treating security and freedom as mutually exclusive, and it's great that Google have made that possible.

[1] This model fails if it's possible to gain root on the device. Thankfully this would never hold on what's that over there is that a distraction?

comment count unavailable comments

Paul Tagliamonte: Apple Hardware: Part II

A few interesting things happened after I got a macbook air.

Firstly, I got a lot of shit from my peers and friends about it. This was funny to me, nothing really bothered me about it, but I can see this becoming really tiresome at events like hackathons or conferences.

As a byproduct, there s a strong feeling in the hardcore F/OSS world that Apple hardware is the incarnation of evil.

As a result of both of the above, hardcore F/OSS (and Distro hackers) don t buy apple hardware.

Therefore, GNU/Linux is complete garbage on Apple hardware. Apple s firmware bugs don t help, but we re BAD.

Some might ask why this is a big deal. The fact is, this is one of the most used platforms for Open Source development (note I used that term exactly).

Are we to damn these users to a nonfree OS because we want to maintain our purity?

I had to give back my Air, but I still have a Mac Mini that i ve been using for testing bugs on OSX in code I have. Very soon, my Mac Mini will be used to help fix the common bugs in the install process.

Some things you can do:

Raphaël Hertzog: My Free Software Activity in June 2014

This is my monthly summary of my free software related activities. If you re among the people who made a donation to support my work (168.17 , thanks everybody!), then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. Debian LTS After having put in place the infrastructure to allow companies to contribute financially to Debian LTS, I spent quite some time to draft the announce of the launch of Debian LTS (on a suggestion of Moritz M hlenhoff who pointed out to me that there was no such announce yet). I m pretty happy about the result because we managed to mention a commercial offer without generating any pushback from the community. The offer is (in my necessarily biased opinion) clearly in the interest of Debian but still the money doesn t go to Debian so we took extra precautions. When I got in touch with the press officers, I included the Debian leader in the discussion and his feedback has been very helpful to improve the announce. He also officially acked the press release to give some confidence to the press officers that they were doing the right thing. Lucas also pushed me to seek public review of the draft press release, which I did. The discussion was constructive and the draft got further improved. The news got widely relayed, but on the flip side, the part with the call for help got almost no attention from the press. Even Linux Weekly News skipped it! On the Freexian side, we just crossed 10% of a full-time position (funded by 6 companies) and we are in contact with a few other companies in discussion. But we re far from our goal yet so we will have to actively reach out to more companies. Do you know companies who are still running Debian 6 servers ? If yes, please send me the details (name + url + contact info if possible) to deblts@freexian.com so that I can get in touch and invite them to contribute to the project. Distro Tracker In the continuation of the Debian France game, I continued to work together with Joseph Herlant and Christophe Siraut on multiple improvements to distro tracker in order to prepare for its deployment on tracker.debian.org (which I just announced \o/). Debian France Since the Debian France game was over, I shipped the rewards. 5 books have been shipped to: Misc Debian work I orphaned sql-ledger and made a last upload to change the maintainer to Debian QA (with a new upstream version). After having been annoyed a few times by dch breaking my name in the changelog, I filed #750855 which got quickly fixed. I disabled a broken patch in quilt to fix RC bug #751109. I filed #751771 when I discovered an incorrect dependency on ruby-uglifier (while doing packaging work for Kali Linux). I tested newer versions of ruby-libv8 on armel/armhf on request of the upstream author. I had reported him those build failures (github ticket here). Thanks See you next month for a new summary of my activities.

One comment Liked this article? Click here. My blog is Flattr-enabled.

Raphaël Hertzog: Tracker.debian.org is live

Maybe do you remember, last year I mentored a Google Summer of code whose aim was to replace our well known Package Tracking System with something more modern, usable by derivatives and more easily hackable. The result of this project is a new Django-based software called Distro Tracker. Warning, some internals aheadWith the help of the Debian System Administrators, it s now setup on tracker.debian.org! This service is also managed by the Debian QA team, it s deployed in /srv/tracker.debian.org/ (on ticharich.debian.org, a VM) if you want to verify something on the live installation. It runs under the qa user (so members of the qa-core group can administer it). That said you can reproduce the setup on your workstation quite easily, just by checking out the git repository and applying this change:
--- a/distro_tracker/project/settings/local.py
+++ b/distro_tracker/project/settings/local.py
@@ -10,6 +10,7 @@ overrides on top of those type-of-installation-specific settings.
 
 from .defaults import INSTALLED_APPS
 from .selected import *
+from .debian import *
 
 ## Add your custom settings here
Speaking of contributing, the documentation includes a Contributing section to get you up and running, ready to do your first contribution! Now go use this new service and report any issue against the new tracker.debian.org pseudo-package (BTW tracker.debian.org knows about pseudo-packages, example here). There are many small things that need to be fixed/improved, if you know Python/Django and would like to start contributing to Debian, here s your chance! :-)

10 comments Liked this article? Click here. My blog is Flattr-enabled.

Maximilian Attems: Keep dpkg in c

Some projects tend to like to abstract everything - KDE, I am looking at your developer base, see phonon for a very misguided effort. While abstracting config files like elektra tries to do looks like a laudable goal, it can't cover all of them plus is a maintenance nightmare.
Adding a crappy^Wbloated c++ layer in order not to prompt user is definitely using the wrong tool at hands. It seems this year again Debian choose super boring Google summer subjects, while Linaro let the students do cool stuff. BTW git implemented all kind of merge strategies, that would be the first place to look at and merge into dpkg.

3 July 2014

Hideki Yamane: Open Source Conference 2014 Hokkaido

Oh, time flies... (= I'm lazy)

14th June, I've participated to OSC (Open Source Conference) 2014 Hokkaido in Sapporo, Hokkaido (sorry openSUSE folks, OSC does not mean openSUSE Conference ;) OSC has 10 years history in Japan, so don't blame me...)

Hokkaido is northan island of Japan (it has 4 major islands - Hokkaido, Honshu, Shikoku and Kyushu), takes 1.5 hours from Tokyo (HND-CTS) and debian-mirror.sakura.ne.jp is also there.

As always, we show the Debian booth with Debian lovers, Squeeze, Woody and Jessie.


And I gave talk about Debian a little,
mostly how it is developed and distribute, and shapes in Jessie at that time (PDF/odf is my page on Debian Wiki as usual).

Does Cowgirl Dream of Red Swirl? from Hideki Yamane


After that, Enjoyed food, beer (sure! :) and chatting in party.


Folks, see you in #osc15do again!

Wouter Verhelst: Docking and Undocking with LVM

I have a number of USB hard disks. Like, I suppose, mostly everyone who reads this blog. Unlike many people who do, however, for whatever reason I decided to create LVM volumes on most of my USB hard disks. The unfortunate result is that these now contain a lot of data with a somewhat less than efficient partitioning system. I don't really care much, but it's somewhat annoying, not in the least because disconnecting an LVM device isn't as easy as it used to be; originally you could just run the lvm2 init script with the stop argument, but that isn't the case anymore today. That is, you can run that, but it won't help you because all that does, effectively, is exit 0. So what do you do instead? This: Voila, your LVM volume group is no longer available, and you've not suffered data loss. Kewl. Note: I don't know what the lvm2 init script used to do. I suspect there's another way which doesn't require the --refresh step. I don't think it matters all that much, though. This works, and is safe. That being said, comments are welcome...

Steve Kemp: And so it begins ...

1. This weekend I will apply to rejoin the Debian project, as a developer. 2. In the meantime I've been begun releasing some some code which powers the git-based DNS hosting site/service. 3. This is the end of my list. 4. I lied. This is the end of my list. Powers of two, baby.

DebConf team: Second set of talks accepted; 3 days left to submit yours (Posted by Ana Guerrero Lopez)

There are only left 3 days to submit your talk. Submit yours before it s too late. From the submissions from the last week, we have accepted a second batch of talks: If your talk is not on the list, it doesn t mean that it is not accepted. The talks team will go through the list of talks again, and will publish the final list of talks towards the end of the month. We ll keep the submission of talks open after the deadline. Talks submitted after the deadline still have the possibility of being scheduled as ad-hoc talks. We ll publish more information about this closer to the conference.

Ian Donnelly: Hello Planet Debian!

Hi Planet Debian! My name is Ian Donnelly. I am going into my Senior Year at Florida State University this fall but for the summer I am working on a Google Summer of Code project with Debian. My mentor is Markus Raab and I am working with the Elektra team to implement a great new feature for Debian! I am spending this summer working on a system to allow automatic conffile merging by utilizing the Elektra Framework. Elektra is designed to provide a universal and secure framework to store configuration parameters in a global, hierarchical key database. For this project, conffiles will be mounted to the Elektra framework as KeySets. I have written code that performs a three-way merge on these KeySets which is much more robust than merging individual lines. A conffile can easily be mounted to the Key database using the kdb mount command, which I detailed in a previous blog post. Elektra has many included plugins which allow all types of conffiles to be mounted to the Key database. With our newest release, we even added an augeas plugin which will provide compatibility for most of the major conffiles. Once a conffile is mounted, any changes to the Elektra KeySet it is contained in will be updated in the actual conffile and visa-versa. So far this summer, I have written code for a three-way merge of Elektra KeySets and we have begun to look at the next step of implementing a automatic merge into dpkg. We are currently working on identifying exactly how the merge should take place and where we need to modify dpkg. The basic idea of what will change is that: Once dpkg has been patched, we will modify some packages and thoroughly test the new merge operation. It is designed to be non-destructive and to not infringe with any of the advantages of the current system. Package maintainers would need to opt in to using this feature to insure that all packages get tested before using it. However, we have designed this system to require minimal modification in order for maintainers to utilize it. This project will benefit Debian by removing a large pain-point with users. For experienced uses, merging changes in conffiles can be a tedious process. For newer users, the current system can be downright confusing. The goal of our project is to make Debian easier to use for everybody while not loosing the features that make it such a powerful platform. Please let us know what you think of the project or if you have any questions. Sincerely,
Ian S. Donnelly

Ian Donnelly: How-To: kdb mount

I would like to go over the kdb mount command. The mount command is used to mount configuration files to the Elektra Key Database. Once a file is mounted, any changes to the file will be reflected in the Elektra Keys and any changes to the keys will be reflected in the configuration file. So how do we use the mount command? kdb mount [filepath] [mountpoint] [plugin] For instance, to mount /etc/hosts to system/hosts (using the hosts plugin):
kdb mount /etc/hosts system/hosts hosts
At this point the hosts file has been mounted. On my system the following key now exist under system/hosts

system/hosts/ian-debian

Which makes sense as the only line in my hosts file is:

127.0.0.1 ian-debian

Now I can edit this configuration file through the Elektra API, the kdb tool, or by editing the file (like always). So if I make a change using kdb such as:

kdb set system/hosts/ian-debian 192.168.0.2

My hosts file will be updated accordingly:

192.168.0.2 ian-debian
So that s how kdb mount works! Update: For the sake of clarity, I just want to add a quick example of how to unmount a configuration file from Elektra. The command is:

kdb umount [backend]

For our above example:

kdb umount system_hosts

Russ Allbery: remctl 3.9

This release fixes an embarassing bug that caused the server to often abort sending information back to the client if the server-side program exited while the server was still sending data. It also fixes a more minor bug in which children of the server were spawned with SIGPIPE ignored instead of set to the default handling behavior. The major new feature in this release is a new ACL type, localgroup, contributed by Remi Ferrand. When this ACL type is used, the remote principal is converted to a local username using the normal Kerberos krb5_aname_to_localname call, and then the server checks whether that local username is a member of a local (nsswitch) group. This release also prefers calloc and reallocarray to malloc and realloc with calculated sizes across all code, and adds version and compatibility information to all manual pages. You can get the latest release from the remctl distribution page.

Russ Allbery: rra-c-util 5.5

The most significant change in this release is a somewhat embarassing bug fix: the network_read and network_write functions introduced in version 4.2 to support timeouts didn't correctly handle a timeout interrupted by a signal. This is now fixed by restarting the calls on EINTR. Also in this release is a general cleanup for integer overflows during memory allocation. rra-c-util now provides a replacement for reallocarray for systems that don't have it, and calloc and reallocarray are used internally where a size is calculated with multiplication. The util library also now provides a checked xreallocarray function. There are also a few minor fixes: portable/system.h guarantees the inclusion of inttypes.h and limits.h, portable/pam.h will now build with a C++ compiler, the Kerberos Autoconf probes provide a Makefile variable that can be used to suppress warnings from Kerberos headers by forcing them to be system headers, and the util/messages-krb5 test will be skipped when not built with Kerberos support. You can get the latest version from the rra-c-util distribution page.

2 July 2014

Russ Allbery: C TAP Harness 3.1

Most of the changes in this release are based on work by Peter P schl to make the behavior of the C TAP library more consistent with the Perl Test::More functions. ok, okv, and all the is_* functions now return true if the test succeeds and false if it fails, allowing them to be used in conditionals. diag and sysdiag now always return 1, making it easier to insert (possibly temporary) calls into compound statements while debugging test cases. The C TAP library now provides a new breallocarray API that does the same thing as brealloc but takes calloc-style arguments and checks internally for integer overflow. Tests for integer overflow during memory allocation have also been added to several other parts of C TAP Harness, including the runtests harness and other internals of the C TAP library. These probably don't matter a tremendous amount for test code, but best to be safe and consistent everywhere possible. All uses of sprintf have now been replaced with a simpler internal string concatenation function that checks for allocation overflow. The previous usage was probably safe, but this approach is much easier to audit. You can get the latest release from the C TAP Harness distribution page.

Tanguy Ortolo: PayPal cut a secure email project's funds

It should be no news that PayPal have made an habit of opposing to projects that fight for the respect of freedom and democracy by cutting their funds. Anyway, they have just provided us another example of such an abuse, against the ProtonMail project.ProtonMail is a secure email service project, similar to the defunct Lavabit service, with characteristics that should allow it a greater resistance to external pressure: it is based in Switzerland (which has specific privacy laws and with a strong democratic control) and developed by CERN and MIT researchers. Well, it seems that this project was not appreciated by some organization, for which PayPal is just a puppet. Long story short, PayPal cut ProtonMail's funds without prior warning nor real explanation. When pressed to explain themselves, they eventually asked them if their email encryption project was approved by the government (which one, by the way?)! As I said in introduction, this is not really a surprise, but it remind us that PayPal's major position is a threat to freedom and democracy as they still behave as enemies of these values (or as collaborator to known harmful organization, which is close enough) and that no project should rely on them. Fortunately, ProtonMail does not.,

Osamu Aoki: debmake -- checking source against DEP-5 copyright

It has been already more than a year after my initial uploading of the debmake package which offers semi-automatic generation of the DEP-5 copyright file.

One recent feature addition is the "debmake -k" command which audits debian/copyright contents against the latest source. If, for example, the upstream changed the license from GPL-2.0+ to 3,0+, this command will tell you this change. (In the debian/copyright, the more specific entry should be listed after the generic entry since parser uses the last definition as the valid one.)

I admit that this package had some regressions in some previous versions. It is now a stable tool to help making multiarch aware Debian packages of any types. If you had negative experiences, please try this again.

Let me quote from its documentation for the features. (Also available in the package.)
The debmake command is intended to replace functions offered historically by deb-make and dh_make commands. Its features include:
  • use of dh syntax under the new debhelper (> 9.0) package
    • extensive check of copyright for DEP-5 (debian/copyright)
    • substvar supports for binary packages (debian/control)
    • support of compiler hardening options (debian/rules)
  • keep pre-existing Debian package configuration files untouched
    • automatic generation of the missing template packaging files
    • easy verification of the debian/copyright file against the current source. (-k option)
  • easy packaging command line UI supporting
    • non-stop execution with clean results
    • direct operation on the tarball archive
    • direct operation on the source tree from VCS
    • the multiarch Debian package
    • the multi binary Debian package
    • the non-native Debian packages from the VCS snapshot
    • seamless work with debuild, pdebuild, etc.
Note
I wrote this debmake command because there was no easy command like "python setup.py bdist_deb" to create the Debian binary package. Now "debmake -d -s -b":python" -i debuild" does the job for me.
This documentation comes with detailed packaging examples, too.

Hideki Yamane: fancy screenshot with screenfetch

matoken (Ken'ichiro Matohara) found interesting tool and told it through G+, named "screenfetch". What's that? yes, look below screenshot.


You can get your running host information with fancy Ascii Art :)

Now it's waiting in NEW queue by me, you can also get it from alioth git repo and build it with git-buildpackage

$ sudo apt-get install packaging-dev
$ git clone git://anonscm.debian.org/collab-maint/screenfetch.git
$ cd screenfetch
$ git checkout pristine-tar; git checkout master
$ gbp buildpackage
...
$ sudo dpkg -i ../screenfetch*.deb
Have fun! :-)

(update: now it's in unstable, thanks to ftpmasters :-)

Next.

Previous.