Search Results: "will"

16 December 2007

Mike Hommey: Moving a system off to a usb disk

There are cases where you don’t want to bring a laptop with you, but still want to have your data or, even better, your system and configuration. It is actually not so difficult to do if you are using LVM. With my setup, it was quite straightforward. So, if you happen to have a similar setup (2 partitions : one for /boot, and the other one for the LVM physical volume), here are the steps to do the same (assuming the usb disk is /dev/sda, the laptop disk /dev/hda, the LVM volume group vg, and you’re using grub as a bootloader). At this point (well, you obviously still need to wait for the pvmove to end), you can reboot right now. Your boot loader setup will use your old /boot partition and the kernel will use the root filesystem on the usb disk.
Be aware of a few things, though. You still need to do two things to finish your setup, now: Now you can have any computer run your system, booting off the usb disk. It had the nice side effect that my laptop is much faster now, as the internal disk is an old 4200 rpm disk, vs. 7200 rpm for the usb disk…
You may also want to try to remove the Xorg configuration file (/etc/X11/xorg.conf) so that the video driver and resolution are not hardcoded ; recent enough Xorg do runtime detection, and that worked pretty well on the two laptops I booted with the usb disk.

Michal Čihař: Nice to see PyICQ-t back alive

I just noticed, that Python Jabber transports have been migrated this weekend to Google Code and first people started to contribute. I especially like the fact, that first contributors are Czech guys and they're fixing encoding problems :-). Let's hope that this activity will also help to improve Debian package which is not really in good state, but I promised not to hijack it till the end of year ;-) (so for now I temporarily hack it in my repository). PS: I know ICQ is evil, but I don't have enough power to force all my contacts to start using Jabber.

Kartik Mistry: [VAC] 17 Dec - 27 Dec

* [VAC] I will not able to do any Debian work except answering mails/bug reports during 17th Dec to 27th Dec. Please do NMU if anything is critical in packages. But consult, co-maintainers :) I am heading to Ahmedabad today night around 8 O’ Clock [/VAC]. Well, its for Office work, so no VAC indeed :P * This means, I will miss Kavin. He has 1/2 year birthday today!!

Biella Coleman: From serenity to offense in 5 miles or less

When you live in NYC and have a demanding job, you tend to ignore the city (at least I do), that is until guests descend upon your place. And since a Large Family Clan has recently landed in my apt, I have spent the last few days trekking north, south, east, and west, across bridges, in parks, and memorials, eating, drinking, and passing out at night after the constant flurry of activity. Yesterday we headed pretty much as far north as you can go to pay a visit to the lovely Cloisters sitting high on a cliff. The Cloisters provides stellar views of the Hudson at the same time as it transports you back in time when a lot of energy was put into scribbling religious material on paper in really stunning and ornate ways. I have not paid a visit to the Cloisters since my undergraduate days and after yesterday’s stroll, I am sorry I waited until the frigid winter to do so. It is an *incredibly* serene place, especially the inner courtyard gardens, and if you need serenity (and I think anyone who lives in NYC, needs to counter the low-grade and high-grade exposure to constant noise with some noiseless environments), this is the place to go. We then made our way to the Columbia area to check out the campus, St. John the Divine (currently under renovation), and so I could pick up a book being held for me at the Book Culture bookstore (which I wish was a lot closer to me than it is)… It was nice to escape the blustering winter conditions and browse the rows of books in a warm and well lit environment. But after purchasing Information Please: Culture and Politics in the Digital Age, parts of which I am hoping to teach next semester, and flipping through the book, my new found serenity was replaced by some serious offense when the only index I could find was an author index. There was no subject index in sight, which at the time left me totally surprised!! Anyone who is in the business of using books as research tools knows the index is —-> indispensable. And a well indexed book is much appreciated (never mind what a non-existent index does). In fact, I felt like I stumbled on some rare object because I don’t think I have ever seen an academic book published in the last 30 years not sporting this useful tool and I wonder if 1) I have a bunk copy 2) The editors/authors forgot to include it and just pushed out the book anyway 3) This was a willful choice made for reasons hidden to the reader. I think I may have to contact Duke University Press and let me know they momentarily robbed me of my serenity :-)

Matthew Palmer: Camping: CGIs on steroids

There's no way around it: I'm a bit of a Rails fanboy. While it's got it's glitches, it's certainly made the part of my life that involves writing web applications a hell of a lot easier, and introduced me to the wonder that is the Ruby programming language. However, there are plenty of times when Rails just isn't a good fit. It's not particularly simple to deploy, it's quite heavy, and it does have a definite learning curve. So, when I need to write something simple, I've just used Ruby's built-in CGI support. But I will do so no longer. For I have found Camping. The name doesn't make a whole lot of sense, and until you come to grips with Why The Lucky Stiff's weird sense of humour, the docs will probably make you think that acid trip you took several years ago has just kicked in again. However, the purpose of Camping is pretty easy to understand: it allows you to make simple (CGI level) web "applications" using Rails-like (or more properly, MVC) concepts, which are fairly easy to write and deploy. If you're familiar with Rails (or probably most of the other Rails-clones that have sprung up in other languages) then Camping will probably smell at least faintly familiar. You have routes, which map URLs to controller actions, which retrieve models and feed them to a view which sends results back as HTML. From that perspective, Camping is easy to learn -- it's core concepts can piggyback on existing knowledge, and you can get started very quickly. Using your Rails-fu, however, will only get you so far. For one thing, the API is similar-but-different enough that while your first couple of simple experiments will probably Just Work, getting more complex things done will either fall under the "different" or "difficult" headings. That isn't meant to be a slight on Camping, though -- if you want to do horribly complex things, then you're heading into territory best served by Rails anyway. But there is a bit of a middle ground where the utter simplicity of Camping is stretched a little, but it's still more appropriate to write a Camping app than a Rails app, and it's important to remember that you're not using full-blown framework when you thump up against something that's beyond-trivial in Rails, but is not quite so simple in Camping. Camping is a microframework -- it says so right there on the front page. Why's intention is that Camping will always be provided in less than 4kB of code. So you're never going to get, for instance, the broad range of HTML helpers that Rails' ActionView provides to make writing HTML templates so easy, or the Prototype JavaScript framework shipped with the main code. If you don't want to blow a steam pipe, then, when starting out with Camping, you need to think "this is a lot easier than hand-writing CGIs" instead of "this is a lot harder than writing a Rails app". There are a few things that are undeniably a pest in Camping, though. The docs are a little incomplete and hard to follow (even when you account for Why's "unique" style of writing), and some of the coding tricks that are employed in making the framework can make debugging a bit tricky. They're not showstoppers, but it's worth knowing about them in advance so you don't go nuts when you're first using the framework. If you're not the sort of person who needs small, self-contained web scripts, then I'd say you'll probably never get much benefit out of Camping. On the other hand, if you're still writing your CGIs against the "bare(ish) metal", then I would strongly encourage you to take a look at Camping, to make your life just that little bit more delightful.

15 December 2007

Jos Parrella: glibc 2.7 in Virtuozzo VPSs

If you’re using a Virtuozzo-based VPS running Debian Testing or Unstable (and probably other modern Linux distributions), you will probably run into problems regarding the patches used in the default kernel and glibc 2.7, which were properly described in the debian-glibc mailing list. Tektonic, my current provider, will upgrade the kernel this weekend but if you’re really in a hurry, you can set your VPS on repair mode, download a 2.6 version of libc6, install it from the repair VPS using dpkg –root=/repair –force-all –install … and restart your VPS. It will boot up, but lots of things that depend on versioned packages of libc6 won’t work correctly, most notably OpenSSH and PAM. The problem is due to non-standard TUX optimization patches implemented over Red Hat’s standard kernels, which seem to be quite popular in Virtuozzo-based VPSs (at least it seems that Strato, Tektonic and Unixshell use them?)

Sune Vuorela: Extremamamamamamamadura day 3

Day three in Extremadura
Yesterday after dinner, we phoned “Telepizza” and got a pizza with cheese and cheese a cheese - and a pizza with barbecue sauce and bacon and bacon.
After a long night of hacking we finally got to sleep. And I almost got my debian working again.
Sleeping until 10 was kind of needed after that - and I got my debian finally working again. No more ubuntu live cd.
We skipped breakfast and found a supermarket. Yay! Best food this trip so far.
A sneak peek on the lunch - and we kind of ate it, but … I feel sorry for the students dining here 3 meals every day. So far we have gotten some discussions about kde3 packaging and kde4 packaging. Lenny will probably ship with a kde3 desktop and with kde4 development platform. - and everytime someone is thirsty, the question arises: “why do they get drinking water from swimming pools?” And tomorrow it is “back home”. Kind of sad, but I miss my bed. And my hardware.

David Welton: Free Software Beer Network

I've actually had this idea floating around in my head for a while. Recently, I mentioned it on a Debian list, where it was well received. Since I don't think I'll be able to implement it any time soon, let me just throw it out there: One of the cool things about belonging to a group like Debian or the Apache Software Foundation, or other similar groups is that there are people all over the world that are often willing to meet if you're in their area. Wouldn't it be cool to have a centralized resource where you could post something like "hey, I'm going to be in Paris/Perth/Padova/Philadelphia/Porto Alegre/Pretoria, anyone want to get together for a beer or whatever people drink there?". You'd have to balance it some - make it too generic and it loses some of the appeal - part of the appeal about meeting someone from a group you belong to is that you instantly have something to talk about. Extend that too far and it would just be like meeting random people on Facebook. I don't have the time or inclination to pursue the creation of such a site, but it would be quite simple, I believe. And of course, if anyone is headed to Innsbruck, I'm always happy to go out for a beer!

Zak B. Elep: To Australia and Back: OSDC Brisbane 2007

Its been a couple of weeks since the Open Source Developers’ Conference in Brisbane, but it was only now that I’ve got the time to blog about it. :) This is due to some work that got piled in my backlog (I haven’t been lazy enough to have this work all automated yet :(). First off, my trip to Brisbane was a long one, due to the UNDP travel agency giving me a route taking me to Bangkok first, because of my exchange grant’s papers made in short notice. No matter: this being my first ever international trip, this meant that I would be visiting two different countries in just one shot. Bangkok was just an overnight stay though, so I didn’t see much, but their new airport was nevertheless impressive. Arriving there at almost midnight, the only bright places I saw were the big Suvarnabhumi airport and the Novotel where I had my layover. After some sleep, I had a pleasant morning, but only a short one at Bangkok, as my flight to Brisbane followed after: DSC06879.JPG The Brisbane flight was long, and I arrived just an hour before midnight. Now, my next problem was getting a place to stay. I took an airport shuttle to the Royal on the Park, where the conference will be held, first to see if there are any free rooms, or barring that, some recommendation on nearby places to stay, even if only for the night. I was quite anxious because I wasn’t able to arrange for accommodation prior to this trip (short notice, remember?), so I decided to go directly to the venue to be the best way of trying my luck. And try my luck it was! First, I was greeted by a front desk manager who turned out to be a fellow Filipino, and he helped me get a room in the hotel. At the time though, he could not guarantee that I can stay there for the duration of the trip (only for the night) but he would help me to find alternate accommodation instead on the next day. I thought that was good enough, since it was already midnight by the time I reached the hotel, and just a bed to sleep on for the night would do great for me to worry about moving elsewhere later. And the next day: Day 1 of OSDC: DSC06880.JPG I was up rather too early that day; the worrying about moving elsewhere settled in too early as well, and had made me check out very early so I can hopefully look for that alternate accommodation by lunchtime. One by one, the attendees came, and soon enough more than a couple of hundred people were filling the main conference room, waiting for OSDC to begin. And we began with a keynote from Rusty Russell on C, the humbling language and Ian Clatworthy’s talk on distributed version control systems. After the keynote, I was notified by the hotel management that instead of moving elsewhere, I can just remain there for the duration of the conference. I was quite relieved! For the remainder of the day, I listened in on the Perl stream of talks from Kirrily Robert, Josh Heumann, and Jacinta Richardson, on packaging Perl modules, Perl 6, and Perl code optimizations, respectively. Kirrily’s talk was timely since I am writing a couple of Perl modules to be released on the CPAN (one, Tie::Amazon::S3, is now up ;) On the morning Day 2, I listened in on Mark Rees’ talk on testing web applications using twill and a scripting language, like Python. I then followed Adam Kennedy’s talk on the CPAN 1.5, learning about CPAN::Mini, the CPANPLUS (which IIRC will be standard in Perl 5.10) and the Tiny modules in the process. More on the Perl stream continued with another talk from Josh Heumann on intermediate Perl testing, providing a humorous yet informative strategies not really just for testing Perl scripts or modules but for software testing in general: DSC06888.JPG Later in the afternoon was Paul King’s talk on agile developer practices for dynamic languages, covering Groovy and Ruby. That was later followed by Leslie Hawthorn’s talk about the Google Summer of Code and the announcement of the Highly Open Participation contest for the young geeks who are not yet in college or university but would like to work on open source projects just like the SoC-ers. After the day’s schedule of talks, there was a break before the conference dinner, allowing also for a short keysigning session and CACert identity check. Then, we had the conference dinner, sponsored by Google. There was also a game held: every table makes up a team who, given some Play-dohs and imagination, are to make up a bug’; the best bug’ wins a free book. Unfortunately, my table/team didn’t win any books, but that was beside the point anyway, as the bugs that were made up were quite something: DSC06898.JPG DSC06895.JPG On the last day, the morning talks I attended were all about Ruby and Rails. Nic Williams gave an introductory talk on Rails, then Paul King gave another talk, this time on Grails (the Java version of Rails,) and closing the morning session was Keith Pitty’s talk on Ruby for Java shops. For the afternoon, I followed Adam Kennedy’s talk on optimizing projects for wetware. DSC06936.JPG For the closing keynote, Nat Torkington talked about the future of software: DSC06945.JPG And with a day left before returning home, I went to sightseeing mode, bought a couple of books, and the mandatory pasalubong for the relatives. At midnight, my flight took me back to Bangkok, another long trip that touched down at the crack of dawn: DSC07034.JPG After a few hours’ wait, I took the plane back to Manila, returning home just after lunchtime. This being my first international trip, making it alone seemed to be quite an adventure. But I wasn’t really alone in this endeavor: kudos goes to the UNDP International Open Source Network for their exchange grant program, to my relatives for their support, to Free and Open Source Software for really making things rock (and free ;), and to $DEITY for being there. Until the next trip!

Joerg Jaspert: Using a SSH jumphost

As Tolimar was asking about it and I am using the setup at some places to get past idiotic^Wbroken firewalls, where you always want to kill the clueless people that did set them up - lets write a bit how to ease ssh usage at such locations. Imagine a place where you can’t ssh elsewhere directly, you have to go through at least one, in some cases two or three hosts, to get anywhere sane.[1] So the topic is SSH jumphost. Thats basically what you do manually if you 
  ssh some.host
  ssh next.host
where some.host is your jumphost. Add as many some.host as you want into this chain. We are all lazy and don’t want to type that by hand, one ssh is enough for everybody. Hurray, ssh already provides what we need, namely the ProxyCommand directive, it’s just not known as much as it should be. For this example imagine I have to ssh via the following host chain to get out: kosh -> vir -> babylon5 -> sheridan and also want to have my local port 2525 forwarded to sheridans port 25. The following config snippet (.ssh/config) is doing that[2] 
 Host yay
 ProxyCommand ssh -q -A -X vir ssh -q -A -X babylon5 'nc -w1 sheridan 22'
 LocalForward 2525 localhost:25
   
 Host vir
 ProxyCommand ssh -q -A -X kosh 'nc -w1 %h %p'
The effect of this is: and I end up having a shell on host sheridan. The LocalForward line also tells ssh to tunnel my port forwarding over that multi-hop session, voila, done. Of course there is a little caveat with this - all hosts do have to know the next one (ie. .ssh/known_hosts should have the right data). You should also think about using ssh keys (maybe including Agent forwarding). You really dont want to see 5 Password: prompts right behind each other for a 5-hop setup - with no clue if its for the next host or for a typo… Update: If you are a Debian Developer and do not have a host “outside” that listens to something else than Port 22 but are behind a firewall that only allows Port 80 and 443 - you are lucky. As long as you aren’t hit by [1] you put the following into your .ssh/config file and have fun: 
Host foo.gl bar.gl
ProxyCommand ssh -q -a -p 443 -x gluck.debian.org 'nc -w1 $(basename %h .gl) 22'
Add as many other config options as you want. The effect is: and as such you can get out via gluck. We are using the .gl as an extension here to remember that we go via gluck. Idea stolen from someone on IRC, just can’t remember who atm. [1] For added fun, which I have at one place, add things like a proxy with user authentication done in a way that tools like tor or openvpn can’t get through it and you always wish those admins use Windows, just so they suffer. Anyway, I talk about the first part only, using jumphost, other ways getting around crap admins needs, in my case, an own script to do it, not part of this topic… [2] Yes, one can do it in lots of ways and those here might not be the most optimized/nice/whatever ones. But they work and are just examples here, select your own parameters if you dont like mine!

Russell Coker: AISA

When I worked for Red Hat I joined AISA [1] (the Australian Information Security Association - formerly known as ISIG). Red Hat marketting paid for my membership so it was a good deal, I went to meetings (which often had free drinks), said good things about Red Hat security, and it cost me nothing. I was recently asked why I chose not to renew my membership, I didn’t have time to give a full answer so I’ll blog it now. AISA offers discounts on some conferences, books, and training related to computer security, if you plan to purchase such things then they do offer good deals. However I have little time to attend conferences at the moment, not enough time to read all the free Internet resources related to computer security, and feel no need to pay for such training. If at any time I plan to attend a conference where the discount for AISA members is equal or greater than the AISA membership fee then I can easily re-join. AISA membership seems largely to consist of managers and consultants not technical people or people doing R&D type work. This isn’t a bad thing if you are a manager or consultant, but when attending AISA meetings I don’t meet the type of people I meet at events such as SecureCon [2], Linux Conf Au [3], RuxCon [4], and the SE Linux Symposium [5] (which I think is not going to be held again for a while). Meetings of my local LUG [6] typically have more people doing serious technical work related to computer security than the AISA meetings I’ve attended. The AISA code of Ethics has as it’s second criteria “I will comply with all relevant laws“. Some laws can not be obeyed by decent people (study some German or Russian history or what is happening in China right now for examples). Many other laws should not be obeyed. Many countries (including Australia) have enacted many laws which should not be obeyed in the name of the “war on terror“. A final thing that irked me about AISA is their professional membership system (click on this link and download the AISA_Professional_Membership_Requirements_Nov_2006 document for details). It seems that I don’t qualify because I don’t have one of the listed certifications, and a public credit on the NSA web site [7] doesn’t count (yes, I asked about this). I’m not overly worried about this, I figure that any clique that won’t accept me also won’t accept a significant portion of the people that I want to associate with - so we can hang out elsewhere. I don’t recall there being any great benefit to professional membership apart from the possibility of adding it to your business card if you are so inclined (I don’t recall ever putting B.Sc [8] on a business card and don’t plan on adding anything less). There are some real benefits to AISA membership, but not for me.

Share This

Jose Luis Rivas Contreras: Waiting my new notebook

I decided that my christmas gift will be a new notebook and as I'm always complaining of the weight of my HP dv6000 then my new notebook will be a ThinkPad x61 with a 8cell battery and extended battery life! :-) That gives up to 12 hours of use!! BTW, this version includes a weird antenna in the right side of the screen, I don't know if it's really useful but seems like if were from some movie and is outside of the borders but anyway, still little and light. Now only rests to wait until it gets to my hand since all the custom houses of Venezuela decided to not admit more packages from outside of the country because they're full, so I will have to wait until january probably because of the inefficiency of my country custom officials. But at least I'm gonna have it :-)!

Benjamin Mako Hill: Annual Free Software Foundation Fundraiser

It's an end of year tradition for non-profit organizations to do big fund-raising and membership pushes. As I mentioned several days ago, I am personally giving to two organizations this year: the Wikimedia Foundation and the Free Software Foundation. The FSF has a goal of 500 associate members by year-end and it's an important goal that will sustain the foundation's activities. While membership dues keep the lights on, the fact that the foundation has a robust and growing membership is equally, if not more, important. FSF executive director Peter Brown put an appeal online in both video and text versions. In it, he lays out some of the most important issues for the next year. You should watch the video version in OGG Theora or this YouTube version (requires Gnash or non-free Flash). The appeal briefly lays out the FSF's plans for next year. My partner Mika Matsuzaki and my friend Oliver Day shot and edited the video. Please pass the link around to those you feel might be interested. Here's my appeal:
Now is the time to join and give to Free Software Foundation. 2008 is going to be extraordinarily important year for free software. Eben Moglen likes to quote Gandhi's "first they ignore you, then they laugh at you, then they fight you, then you win" progression when describing the free software movement. As I pointed out when I joined the FSF board, we're beginning to see powerful interests fighting free software. It's going to increase in the next few years. Things will probably get a lot uglier for free software before they get better. We can win but things are far from settled. The FSF is the front-line organization in this fight and we need a robust and proactive foundation, and an active and involved membership, if we're going to win. Here are the issues that I'm going to pushing the FSF to pursue in the next year. Expanding activism outside our traditional technologist communities: In part through the work of projects like Defective By Design, we've seen the tide turn for DRM on music in what what may be the FSF's greatest success last year. I'm going to push the FSF to continue the campaign to attack DRM for video, eBooks, and the other places it is cropping up. The most remarkable thing to me about Defective By Design is that its participants and supporters are not, for the most part, people who develop or use GNU/Linux or even know what GNU is! If advocacy for software freedom involves a conversation we can only have with people who understand what POSIX is and how one uses it, we've already lost. Through DbD, BadVista, and other projects, the FSF has made major strides in the last year. It need to do much more and needs your support to do so. Get proactive about software patents: As a community, we've had our head in the sand about software patents for far too long. There are companies and patent trolls sitting on massive, growing piles of software patents. They are not our friends and they do not mean us well. One cannot write non-trivial software today without running a serious risk of infringing patents. The software patents minefield we've found ourselves in is a very fundamental threat to the success of free software and we've already begun to see the first casualties and costs. We must eliminate software patents. Now. The US is very important in this fight (much patent law is "exported" from the US) and almost no organization is working on software patent elimination there. Not enough people are thinking and acting strategically on this issue. The FSF is planning to make major steps in this fight in the coming year and we need your support to do so. Web services and the changing face of software: This last year, I worked to help launch the new version the AGPLv3. The license addresses the role of copyleft for software like web-services which, due to the legal particulars of the GPL, did not extend to the purveyors of web services. Of course, access to source code does not make the users of all web-services free (e.g., the GMails and the Facebooks). Nobody seems to know what freedom for webserver entails. There might not even be good answers. In the next year, I'm going to push the FSF to help start several conversation and to begin to follow up on what I think was an important first step with the AGPLv3. While this is not a major organizational priority yet, it's a major action item that I will be pursuing through the FSF. If you feel strongly about this issue, whatever your position, become a member, stay involved as these projects develop, and have your voice be heard. We don't know the answers yet and we need your input as much as we need your action.
Please, support the FSF in the efforts listed above, and in others, by giving generously. If you're not a member, please join the FSF as an associate member. If you are already a member, please consider making a tax-deductible donation. The FSF is a very lean, very humble organization of passionate and dedicated individuals working tirelessly for software freedom. Every little bit helps. Members pays USD $120 ($10/month) and student members pay half that. FSF has members across the world -- where a weak dollar often makes it even cheaper. Member support and participation builds capacity and credibility for the foundation and keep the organization responsible, responsive, and in tune with our community.

Lars Wirzenius: Python list comprehension leaks variables

At the last Free Thursday someone told me that Python list comprehensions leak variables. I didn't believe it, but after testing it quickly, it turns out to be true: 
foo = [1, 2, 3]
bar = [x+1 for x in foo]
print x
The above prints out "3". I would have expected it to give a NameError exception. This turns out to be a known, and deprecated feature in Python 2.5 (see the reference manual), and it will probably be fixed in Python 3000, some time in the future.

14 December 2007

Joerg Jaspert: Using a SSH jumphost

As Tolimar was asking about it and I am using the setup at some places to get past idiotic^Wbroken firewalls, where you always want to kill the clueless people that did set them up - lets write a bit how to ease ssh usage at such locations. Imagine a place where you can’t ssh elsewhere directly, you have to go through at least one, in some cases two or three hosts, to get anywhere sane.[1] So the topic is SSH jumphost. Thats basically what you do manually if you 
  ssh some.host
  ssh next.host
where some.host is your jumphost. Add as many some.host as you want into this chain. We are all lazy and don’t want to type that by hand, one ssh is enough for everybody. Hurray, ssh already provides what we need, namely the ProxyCommand directive, it’s just not known as much as it should be. For this example imagine I have to ssh via the following host chain to get out: kosh -> vir -> babylon5 -> sheridan and also want to have my local port 2525 forwarded to sheridans port 25. The following config snippet (.ssh/config) is doing that[2] 
 Host yay
 ProxyCommand ssh -q -A -X vir ssh -q -A -X babylon5 'nc -w1 sheridan 22'
 LocalForward 2525 localhost:25
   
 Host vir
 ProxyCommand ssh -q -A -X kosh 'nc -w1 %h %p'
The effect of this is: and I end up having a shell on host sheridan. The LocalForward line also tells ssh to tunnel my port forwarding over that multi-hop session, voila, done. Of course there is a little caveat with this - all hosts do have to know the next one (ie. .ssh/known_hosts should have the right data). You should also think about using ssh keys (maybe including Agent forwarding). You really dont want to see 5 Password: prompts right behind each other for a 5-hop setup - with no clue if its for the next host or for a typo… [1] For added fun, which I have at one place, add things like a proxy with user authentication done in a way that tools like tor or openvpn can’t get through it and you always wish those admins use Windows, just so they suffer. Anyway, I talk about the first part only, using jumphost, other ways getting around crap admins needs, in my case, an own script to do it, not part of this topic… [2] Yes, one can do it in lots of ways and those here might not be the most optimized/nice/whatever ones. But they work and are just examples here, select your own parameters if you dont like mine!

Axel Beckert: No more NDA for events hosted at Google Zurich?

I first heard about the Open Source Jam Zurich somewhere at BlogCampSwitzerland 2.0 (which was more a TechCrunch7 than a BlogCamp — why did the organisators call it BlogCamp?) and subscribed to its Google Group. At Linuxday.at, hansmi (who seems to be assimilated bywork for Google) gave me a flyer about Open Source Jam Zurich. And while reading it, I noticed that it will be held at Google’s Zurich office. Remembering the need for early registration for one of the recent Webtuesdays because of signing an NDA being necessary to get into Google’s office, I asked him, if I need to sign an NDA if I want to take part at Open Source Jam Zurich. He acknowledge it and so I returned the flyer and forgot about the Open Source Jam Zurich. Today Gürkan told me, he was at Open Source Jam Zurich at Google and he didn’t need to sign any NDA. He also told me that he knows other people which didn’t take part either because of the expected the need to sign an NDA. I was puzzled. Did Google really started to realize that “Open Source” and “Free Software” doesn’t fit together with “Non-Disclosure Agreements”? I hope so, because this would make it possible to come to all future Webtuesdays — my favourite local geek event — and not only to those not taking place at Google.

Russell Coker: Blogroll - Bad Social Networking

A common feature in blog software is a Blogroll, this is a list of links to blogs which are associated in some way with the blog in question - most commonly it’s a list of blogs run by friends of the blogger in question. Now in the case of friends with very similar interests (IE same religious and political beliefs, sexual preferences, hobbies, etc) this wouldn’t cause a problem. In the case of commercial blogs it also will work well (EG Google runs a large number of blogs which contain links to all the rest - they may not interest all readers but should be expected not to offend any). In the case of personal blogs where people don’t always have the same interests there is scope for problems. A link to the main page of a blog is an unconditional recommendation for the blog. There are not many of my friends who I share that much in common with that I would be prepared to give such a recommendation for a frank personal blog, and for those few I am unwilling to do so as it generates social pressure to include others. Some of my friends who didn’t get listed in my blogroll would probably get offended, even though it’s only the occasional post that I strongly disagree with which would make me refrain from such a listing. I appreciate it when people add me to their blogroll, but don’t have any expectation that the listing will remain (I’m not going to get offended if someone changes their criteria for listing and removes my entry). But I consider it an equal compliment when someone cites one of my blog posts as a reference and recommends that other people read it. Citing an individual post has the advantage (for the person citing the post) they are specifically not recommending my entire blog. For example if you recommend one of my posts about Linux and one of your readers goes further into my site and is offended by my posts about politics then it’s not your issue. Tim Berners-Lee made an interesting point [1] “so readers, when they find something distasteful or unreliable, don’t just hit the back button once, they hit it twice“. I know that some people who would be interested in the technical Linux issues I write about don’t read my blog because they are offended by my political beliefs, I am not concerned about this - but I don’t expect that everyone who chooses to link to me will necessarily want to make the same trade-off. When citing individual posts it’s possible to strongly agree with one post and strongly disagree with another by the same author. Probably the best way of acknowledging your friends via blogging (if you choose to do so) would be to make an occasional links post which contains short positive recommendations to the best posts your friends wrote. If every month or two someone writes a links post (post which has little content, merely recommendations for other posts) which references your posts then you know that they like you (and you get a Technorati.com boost), so a blogroll entry hardly seems necessary. An additional benefit for giving such direct credit is that the person receiving the links will know what you consider to be their best work which will help them in their future writing. I believe that adding this feature to common blogging software was a mistake. The small number of people who actually need this (such as Google) can create it via a HTML widget (IE writing raw HTML for the page - it’s really easy to do) and the rest of the population would be better off without it.

Share This

John Goerzen: A Clarification

You may remember my post Monday in which I told Mother Nature to "bring it on".

I would like to clarify that remark at this time. I would have preferred Mother Nature to interpret this in the President Bush sense of "please don't hurt us", rather than the "let's just knock out power to the entire plains region". A nice little romantic power outage Tuesday evening would have been nice.

We lost power at 3:10 on Tuesday according to my workstation's logs. It's still out, and our rural electric cooperative is estimating it will be another week until it's back, though that's better than the Dec. 22 date the state's much larger for-profit utility is giving people. We were lucky enough to be able to find a generator to rent on Wednesday morning. $35 a day isn't cheap. But on the other hand, we don't have a flooded basement due to not pumping out the sump pump, our food isn't spoiled, and our pipes aren't frozen.

At work, our Internet connection went down Tuesday morning. We use a fixed wireless connection, and this was the first time our ISP's radios have been tested in ice. Some antenna designs performed flawlessly. Then there were the antennas we had. 80% packet loss or worse. It wasn't safe to get up on the roof to deice them until Wednesday afternoon, and even then we couldn't get all the ice off. Finally today the connection was back to normal.

That two weeks after someone -- yes -- dug through Sprint/Embarq's apparent only fiber-optic link into town. Took down all long-distance calling into or out of the town, most cell towers, as well as all access to 911 (since dispatch is in another town) for about 8 hours. If we had still be using wired T1s, we would have been out of service with Internet as well.

All told, 200,000 households or business customers of the state's largest utility have been without power. Dozens of other utilities have also had significant outages. Ours alone lost 700 power poles and there are substations in need of repair all over the eastern part of the state. And we weren't even the hardest hit.

On the generator, we can generally pick any three of refrigerator, server, workstation, or furnace to run. So sometime warm, I'll upload the pictures I've taken so far. We have one nice CFL-powered electric lamp we're using, flashlights, and a kerosene lamp. It's amazing how after just a few days of this, we're starting to want to go to bed earlier. Or perhaps that was because I haven't had the chance to get a lot of sleep lately...

When we look out the house to the east, we see pitch black. Normally we can see some yard lights in the distance. Not this week. Nothing at all to the east. To the west, we can see yard lights tantalizingly close -- only 2 miles away, fed from a different location. Ah, the joys of being at the very end of a utility's network.

All this despite the fact that this storm wasn't really all that bad. The roads were never really terrible, and there weren't as many trees down as there were in the ice storm of 2005.

I heard a comment on the news today from an Iowa Republican who had followed the GOP debate yesterday. She mentioned that Romney made a comment like "Well, guess there's no global warming in Iowa with an ice storm like this, huh?" She pointed out that if Iowa was still as chilly as it used to, it would have been a snow storm instead of an ice storm. I agree.

13 December 2007

Raphael Geissert: HOWTO create and maintain a repository using reprepro and DeBaBaReTools

DeBaBaReTools seems to work good enough that writing an early-stage HOW TO seems to worth the time :)
The first thing to do is of course fetch the sources:
$ svn export https://neo.yahostme.com/svn/DeBaBaReTools/trunk/ DeBaBaReTools


Build and install the package:
$ cd DeBaBaReTools; dpkg-buildpackage -b; dpkg -i ../debabaretools_0.2_all.deb


$ dpkg -L debabaretools
/.
/etc
/etc/DeBaBaReTools
/etc/DeBaBaReTools/common.conf
/usr
/usr/bin
/usr/bin/wannaBuild
/usr/bin/needsBuild
/usr/bin/needsReBuild
/usr/bin/buildQueue
/usr/bin/checkSums
/usr/bin/wannaUpload
/usr/bin/processIncoming
/usr/share
/usr/share/doc
/usr/share/doc/debabaretools
/usr/share/doc/debabaretools/copyright
/usr/share/doc/debabaretools/ENV
/usr/share/doc/debabaretools/changelog.gz
/usr/share/doc/debabaretools/TODO
/usr/share/DeBaBaReTools
/usr/share/DeBaBaReTools/backends
/usr/share/DeBaBaReTools/backends/config
/usr/share/DeBaBaReTools/backends/config/reprepro.sh
/usr/share/DeBaBaReTools/backends/probe.sh
/usr/share/DeBaBaReTools/backends/fetch
/usr/share/DeBaBaReTools/backends/fetch/dget.sh
/usr/share/DeBaBaReTools/backends/verbosity.sh
/usr/share/DeBaBaReTools/backends/lock
/usr/share/DeBaBaReTools/backends/lock/default.sh
/usr/share/DeBaBaReTools/backends/setDefault.sh
/usr/share/DeBaBaReTools/backends/buildQueue
/usr/share/DeBaBaReTools/backends/buildQueue/plaintext.sh
/usr/share/DeBaBaReTools/backends/signature
/usr/share/DeBaBaReTools/backends/signature/gpgv.sh
/usr/share/DeBaBaReTools/backends/check
/usr/share/DeBaBaReTools/backends/check/default.sh
/usr/share/DeBaBaReTools/backends/build
/usr/share/DeBaBaReTools/backends/build/pbuilder.sh
/usr/share/DeBaBaReTools/backends/upload
/usr/share/DeBaBaReTools/backends/upload/dput.sh
/usr/share/DeBaBaReTools/backends/parsers
/usr/share/DeBaBaReTools/backends/parsers/default.sh
/usr/share/DeBaBaReTools/backends/repository
/usr/share/DeBaBaReTools/backends/repository/shared.sh
/usr/share/DeBaBaReTools/backends/repository/reprepro.sh
/usr/share/DeBaBaReTools/backends/misc.sh
/usr/share/DeBaBaReTools/backends/codenamesTable
/usr/share/DeBaBaReTools/backends/codenamesTable/release.sh
/usr/share/DeBaBaReTools/backends/codenamesTable/reprepro.sh
/usr/share/DeBaBaReTools/backends/config/default.sh
/usr/share/DeBaBaReTools/backends/fetch/default.sh
/usr/share/DeBaBaReTools/backends/buildQueue/default.sh
/usr/share/DeBaBaReTools/backends/signature/default.sh
/usr/share/DeBaBaReTools/backends/build/default.sh
/usr/share/DeBaBaReTools/backends/upload/default.sh
/usr/share/DeBaBaReTools/backends/repository/default.sh
/usr/share/DeBaBaReTools/backends/codenamesTable/default.sh


Now you have to create a base reprepro repository. I strongly recommend setting the REPREPRO_BASE_DIR ENV variable if possible.

A recommended repository structure is (in repoitory/):
.:
./build:
./build/cache:
./build/data:
./build/data/logs:
./build/tmp:
./conf:
distributions
incoming
options
tiffany.py
uploaders
./db:
./debian:
./debian/dists:
etch
oldstable
sarge
sid
stable
testing
unstable
./debian/dists/...
./debian/pool/...
./incoming:
./incoming/accepted:
./incoming/new:
./incoming/rejected:
./pub:
./pub/UploadQueue:

Note that the build/, incoming/ and pub/ directory structures are DeBaBaReTools' defaults, if you want to change them you will have to set some variables at the configuration file ($HOME/.DeBaBaReToolsrc).

The distributions file must at least contain the Codename, Suite and Architectures entries for DeBaBaReTools to work correctly. Note that the current code used to correlate the suites with the codenames greps for the given codename/suite including two lines before and two after the match, so the entry must be on that scope.
E.g.
$ cat conf/distributions
Codename: sid
Suite: unstable
Architectures: i386 amd64 source
Components: main contrib non-free
Uploaders: uploaders
DebIndices: Packages Release .bz2 .gz .
DscIndices: Sources Release . .gz .bz2
Contents: .bz2 .gz .
Tracking: minimal includechanges keepsources


conf/incoming must name at least one rule. This is because when installing, DeBaBaReTools will grep for all the rule names and execute them one by one.
The rest of reprepro's setup is trivial.

When building packages with pbuilder, DeBaBaReTools expects the basetgz's to be named like $PBUILDER_CACHE/$CODENAME.tgz where $PBUILDER_CACHE is an environment variable defaulting to /var/cache/pbuilder.

Tweaking DeBaBaReTools:
Because we are using reprepro and pbuilder we'll give some hints to DeBaBaReTools so it uses a reprepro-specific and/or pbuilder-specific backend where possible.

$ echo 'HINT_ALL="reprepro pbuilder"' > $HOME/.DeBaBaReToolsrc


The .DeBaBaReToolsrc file is sourced by all scripts, so you might even set variables like $REPREPRO_BASE_DIR there.

/usr/share/doc/debabaretools/ENV documents only some of the multiple environment variables that can be specified to customise DeBaBaReTools' behaviour. It is important to say that variables which are empty will be filled with a default value.

You may now want to modify .dput.cf by adding a 'local' target for your repository:
[local]
fqdn = localhost
method = local
incoming = /home/raphael/Deb/repository/pub/UploadQueue
allow_unsigned_uploads = 0
run_dinstall = 0


So let the fun begin! :)

To make sure everything is ok let's run processIncoming in verbose mode:
VERBOSE=1 processIncoming
processIncoming v0.1 started.
processIncoming v0.1 stopped.

Not getting that output means something is not ok.

All the scripts will try to source a file called $HOME/.$ APP_NAME rc, where $APP_NAME is the name of the script, e.g. processIncoming. This can be used to customise them even more.

Tweaking the scripts behaviour:

processIncoming offer some options such as:


wannaBuild:



When you should call which DeBaBaReTools script:
processIncoming takes care of accepting package uploads and installing them when told to do so.
needsBuild processes the .changes files accepted by processIncoming and tells the build queue manager that a given package needs to be built, or when the binary package is also uploaded, or is already built.
wannaBuild only takes care of building source packages (note that arch: all-onnly packages WON'T be built, they must be uploaded together with the source package).

So the workflow is:
processIncoming -> needsBuild -> INSTALL=1 processIncoming

A package won't be installed in the repository if it isn't handled before by needsBuild.

Here's a demonstration (note the usage of VERBOSE=1):
$ dput local kcometen3_1.1-1_source.changes
Checking Signature on .changes
...
Uploading to local (via local to localhost):
Successfully uploaded packages.
Not running dinstall.
sh: /usr/bin/mini-dinstall: No such file or directory
Error while executing command.
Continuing...

The package is now at pub/UploadQueue

$ VERBOSE=1 processIncoming
processIncoming v0.1 started.
Processing /home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1_source.changes...
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1.diff.gz" to "/home/raphael/Deb/repository/incoming/accepted/"
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1.dsc" to "/home/raphael/Deb/repository/incoming/accepted/"
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1_source.changes" to "/home/raphael/Deb/repository/incoming/accepted/"
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1.orig.tar.gz" to "/home/raphael/Deb/repository/incoming/accepted/"
processIncoming v0.1 stopped.

After checking sums and signature, the upload is accepted.

$ VERBOSE=1 needsBuild
needsBuild v0.2 started.
Architectures: i386 amd64 all
Now processing /home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1_source.changes
Adding kcometen3 to be built in i386 for the sid distribution
Adding kcometen3 to be built in amd64 for the sid distribution
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1.dsc" to "/home/raphael/Deb/repository/incoming"
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1.orig.tar.gz" to "/home/raphael/Deb/repository/incoming"
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1.diff.gz" to "/home/raphael/Deb/repository/incoming"
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1_source.changes" to "/home/raphael/Deb/repository/incoming"
needsBuild v0.2 stopped.

The package is now marked to be built on i386 and amd64 for sid (note that distro to codename conversion is performed) and moved to incoming/ so processIncoming is able to install it.

$ VERBOSE=1 processIncoming
processIncoming v0.1 started.
processIncoming v0.1 stopped.

There's nothing under pub/UploadQueue and nothing is installed (do you remember the INSTALL=0 option? :))

$ INSTALL=1 VERBOSE=1 processIncoming
processIncoming v0.1 started.
No distribution found for 'kcometen3_1.1-1_source.changes'!
There have been errors!
No distribution found for 'kcometen3_1.1-1_source.changes'!
There have been errors!
No distribution found for 'kcometen3_1.1-1_source.changes'!
There have been errors!
making diffs between /home/raphael/Deb/repository/debian/dists/sid/main/source/Sources and /home/raphael/Deb/repository/debian/dists/sid/main/source/Sources.new:
generating diff
Exporting indices...
processIncoming v0.1 stopped.

The errors can be safely ignored, it is just that reprepro couldn't install kcometen3_1.1-1_source.changes for the specified install rule (I've one for each distro, that's why).

$ VERBOSE=1 wannaBuild
wannaBuild v0.1 started.
Fetching list of packages to be built for unstable
Fetching source package kcometen3 v1.1-1
Use of uninitialized value in string eq at /usr/bin/dget line 377.
cat: /home/raphael/Deb/repository/build/data/needsBuild.unstable: No such file or directory
Starting build backend...
Executing sudo pbuilder --update --basetgz /var/cache/pbuilder/unstable.tgz
Starting build process
Verifying signature of /home/raphael/Deb/repository/build/kcometen3jb3362/kcometen3_1.1-1_i386.changes...
gpgv: no valid OpenPGP data found.
gpgv: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
Fetching list of packages to be built for testing
Fetching list of packages to be built for stable
Fetching list of packages to be built for oldstable
wannaBuild v0.1 stopped.

There are still some things that need to be fixed (e.g. the no such file or directory message).
Other than that, the output is just fine: the package wasn't automatically signed so when trying to check the signature it failed to find it thereby not uploading the package automatically.

Now we cd to build/kcometen3jb3362/, review the build log, the .changes file, and we finally sign it.
Afterwards, we upload the package and install it:

$ VERBOSE=1 processIncoming
processIncoming v0.1 started.
Processing /home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1_i386.changes...
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1_i386.changes" to "/home/raphael/Deb/repository/incoming/accepted/"
mv'ing "/home/raphael/Deb/repository/pub/UploadQueue/kcometen3_1.1-1_i386.deb" to "/home/raphael/Deb/repository/incoming/accepted/"
processIncoming v0.1 stopped.

$ VERBOSE=1 needsBuild
needsBuild v0.2 started.
Architectures: i386 amd64 all
Now processing /home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1_i386.changes
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1_i386.deb" to "/home/raphael/Deb/repository/incoming"
mv'ing "/home/raphael/Deb/repository/incoming/accepted/kcometen3_1.1-1_i386.changes" to "/home/raphael/Deb/repository/incoming"
needsBuild v0.2 stopped.


$ INSTALL=1 VERBOSE=1 processIncoming
processIncoming v0.1 started.
No distribution found for 'kcometen3_1.1-1_i386.changes'!
There have been errors!
No distribution found for 'kcometen3_1.1-1_i386.changes'!
There have been errors!
No distribution found for 'kcometen3_1.1-1_i386.changes'!
There have been errors!
making diffs between /home/raphael/Deb/repository/debian/dists/sid/main/binary-i386/Packages and /home/raphael/Deb/repository/debian/dists/sid/main/binary-i386/Packages.new:
generating diff
Exporting indices...
processIncoming v0.1 stopped.


done :)

We can now setup some cronjobs:
*/10 * * * * processIncoming
*/5 * * * * needsBuild
@daily INSTALL=1 processIncoming

needsReBuild and uploadQueue still need to be written, so don't expect them to do anything right now.

I hope people start using it so I receive more feedback :D

Steve Kemp: Children Of The Dammed

After a lot of hacking I've now got chronicle displaying comments upon entries. Since my blog is compiled on my home desktop machine and comment submission happens upon a remote machine the process involves a bit of a hack:
Publish Blog
The blog is compiled and uploaded to the live location using rsync.
Wait For Comments
Once the blog is live there are embedded forms which may be used to receive comments. The CGI script which is the target of the forms will then write each comment out to a text file, located outside the HTTP-root.
Sync Them
Prior to rebuilding the blog the next time I update I rsync the comments directory to my local machine - such that the comments posted are included in the output
This my local tree looks something like this: 
~/blog/
 -- comments/
 -- data/
 -- output/
 -- Makefile
 -- chroniclerc
Here I have a Makefile to automate the import of the comments from the live site to the local comments/ directory, rebuild, and finally upload. All this means that I can rebuild a blog created by a combination of plain text post files and plain text comment files. It also means that there is a fair lag between comment submission and publication - though I guess there is nothing stopping me from auto-rebuilding and syncing every hour or two via cron... I'll make a new release with this comment.cgi script and changes once the package hits Debian unstable...

Next.

Previous.