Search Results: "ed"

19 July 2012

Andreas Metzler: Correcting Exif image orientation tags

Panasonic's G1, G2 and G3 micro four-thirds cameras are missing a dedicated orientation sensor. With a lens featuring image stabilisation the camera makes use of its sensor. Otherwise (e.g. with the Panasonic Lumix 20mm/1.7) the Exif image orientation tags are not correct for portrait format images. Here is how to write correct tags (compatible with the camera's preview function) with exiv2: Camera rotated anti-clockwise (shutter button on top):
exiv2 -k -M"set Exif.Image.Orientation 8" -M"set Exif.Panasonic.Rotation 8" -M"set Exif.Thumbnail.Orientation 8" P1020800.JPG Camera rotated clockwise (shutter button at bottom):
exiv2 -k -M"set Exif.Image.Orientation 6" -M"set Exif.Panasonic.Rotation 6" -M"set Exif.Thumbnail.Orientation 6" P1020800.JPG

Michal Čihař: Sponsoring phpMyAdmin

We've decided to accept sponsorships of phpMyAdmin in more official way. So if you or your company want to financially support this software, you now have great chance to do that. Time to time we've received offers for sponsoring, but we never got to point where we could easily handle these. In the past we were limited by sf.net requirements for no advertisement on website, but it got leveraged over the time and we did not change our policy much. For now the only benefit we are providing to our sponsors (besides good feeling that they are supporting good project) is logo and link on our website. In the future we might add some more, but at first we want to see how it works in this scale. Anyway if you are interested in sponsoring phpMyAdmin, you can do that on our website.

Filed under: English Phpmyadmin 0 comments Flattr this!

Christoph Berg: Machine Check Exception

Today's wtf:
Wed Jul 18 20:25:01 CEST 2012 MCA: Generic CACHE Generic Generic Error

Matthew Palmer: Melt your cores with Rake's multitask

Reading documentation does pay off. Browsing through the Rakefile format documentation for Rake, just now, I found mention of the multitask method which declares that all of that task s prerequisites can be executed in parallel. A comparison run:
$ rake clean; time rake build
real    0m7.116s
user    0m6.788s
sys     0m0.260s
$rake clean; time rake multibuild
real    0m3.820s
user    0m8.809s
sys     0m0.288s
This is a trivially small build I m doing, I must admit, but halving the build time (in this case at least) pays huge dividends in my perceived productivity. It really blows the dust out of my CPU cores, too, which tend to be woefully underutilised (being this is a quad-core laptop and all). So I say unto you all: go forth and multitask!

18 July 2012

C.J. Adams-Collier: NIST::NVD::Store::SQLite3 1.00.00

It s been released. Use this with NIST::NVD 1.00.00 and you will be able to perform immediate look-ups of CVE and CWE data given a CPE URN. For instance:
cjac@foxtrot:/usr/src/git/f5/NIST-NVD-Store-SQLite3$ perl Makefile.PL ; make ; make test ; cjac@foxtrot:/usr/src/git/f5/NIST-NVD-Store-SQLite3$ perl -MNIST::NVD::Query -MData::Dumper -e '
$q = NIST::NVD::Query->new(store    => q SQLite3 ,database => q t/data/nvdcve-2.0.db );
$cve_list = $q->cve_for_cpe( cpe => q cpe:/a:microsoft:ie:7.0.5730.11  );
print Data::Dumper::Dumper   cve_list => $cve_list, first_cvss => $q->cve( cve_id => $cve_list->[0] )-> q vuln:cvss   
'
$VAR1 =  
          'cve_list' => [
                          'CVE-2002-2435',
                          'CVE-2010-5071'
                        ],
          'first_cvss' =>  
                            'cvss:base_metrics' =>  
                                                   'cvss:confidentiality-impact' => 'PARTIAL',
                                                   'cvss:score' => '4.3',
                                                   'cvss:authentication' => 'NONE',
                                                   'cvss:access-vector' => 'NETWORK',
                                                   'cvss:source' => 'http://nvd.nist.gov',
                                                   'cvss:generated-on-datetime' => '2011-12-08T06:47:00.000-05:00',
                                                   'cvss:availability-impact' => 'NONE',
                                                   'cvss:integrity-impact' => 'NONE',
                                                   'cvss:access-complexity' => 'MEDIUM'
                                                  
                           
         ;
https://metacpan.org/release/CJCOLLIER/NIST-NVD-Store-SQLite3-1.00.00

Peter Eisentraut: Tracing shell scripts with time stamps

A random tip for shell script hackers. You know that with set -x you can turn on tracing, so that every command is printed before being executed. In bash, you can also customize the output prefix by setting the PS4 variable. The default is PS4='+ '. Here is an example. I wanted to "profile" a deployment script, to see why it took so long. Ordinarily, I might have sprinkled it with date calls. Instead, I merely added
set -x
PS4='+\t '
near the top. \t stands for time stamp. (The script was already using bash explicitly, as opposed to /bin/sh.) That way, every line is prefixed by a time stamp, and the logs could easily be analyzed to find a possible performance bottleneck.

Niels Thykier: Lintian-NG Accessing Lintian s collection data with 90 lines

 $ LINTIAN_ROOT=. perl lintian-ng ../lintian_2.5.10.dsc
 Successfully unpacked 1 packages
 Did you know that source:lintian/2.5.10 contains 3745 files or/and directories (excl. root dir)
 This useless information was brought to you by Lintian-NG
 $ git describe
 2.5.10-61-g7670427
 $ wc -l lintian-ng
 90 lintian-ng
This includes everything from creating a temporary lab, adding the packages to it and running all of Lintian s collections on it (parallelised, of cource). Writing this script yesterday would probably have required 250-300 lines of code to achieve the same. That said, 90 lines are still a bit much to copy/waste into this blog, so I won t do a $ cat lintian-ng . :) If you are interested in how it looks you can (for now) fetch it from http://people.debian.org/~nthykier/lintian-ng/lintian-ng Oh yeah, files or/and directories is actually any (extractable) entry in the tarball

Jon Dowland: Debian Day #3

Once again Debian day was somewhat compromised: this time by more DIY. I still managed a few bits and pieces, amortized over the rest of the week. I benefited from some train time this weekend. A new version of flactag and catching up the flactag packaging vcs repository. A maintainer endorsement for one of the flactag maintainers and a request to NM for another maintainer to be granted access to the collab-maint repository. More work on the musicbrainz 'transition': First, usertag tracking of packages to update, with upstream bugs where necessary. Tested and confirmed Michael Biebl's sushi patch; found and fixed a sushi bug along the way; wrote patches for sound-juicer ( merged upstream) and goobox.

Jon Dowland: Debian Days 4, 5 and 6 (round-up)

And we've frozen! How have we done on the musicbrainz stuff? I was really pleased to see Michael Biebl upload new sound-juicer (four bugs closed!), rhythmbox and gnome-sushi packages which move them up to musicbrainz5. I NMUed goobox (with the maintainer's permission) but sadly there was a build issue and the NMU was reversed with a second upload, so it's back to using libmusicbrainz3 in the freeze. that leaves two more packages. I haven't discussed or considered putting forward this 'transition' for freeze exceptions, but Pino Toscano raised a good point: upstream might not support the version 1 WS API (which libmusicbrainz3 depends on) throughout the wheezy lifetime. Some more research here is needed. What else? NMU of acpidump to resolve a trivial manpage error that I filed a patch for two years ago; the latest flactag upstream version; a new version of game-data-packager, incorporating stuff Joey Schmit patched last year, which fixes Heretic support and adds Hexen support; a new version of chocolate-doom. The last two are particularly interesting because I'm in Uploaders: despite having left the Games team last year: there have been no subsequent uploads before my latest ones. I removed myself from Uploaders: with these uploads, which technically means they are NMUs. What next? Typically I find the freeze time a hard one to work on Debian. I've never been very effective at chasing and resolving RC bugs. On the other hand, long, protracted freezes are demotivational for everyone. I'm going to try and focus on goals which hasten the release of wheezy and resist the urge to work on things that would not show up until wheezy+1.

Jon Dowland: Debian Day #7

Very little done last night. Advocated a maintainer. My desktop computer is completely hosed as part of a wheezy update: many issues at once but one is GDM going into an infinite loop, spawning millions of X servers; another is something in the boot processes seemingly prodding /dev/sdc and failing. I'm not sure if I have time to get to the bottom of it, I might just reinstall from a d-i daily. Priority going forward should be to finish off the musicbrainz stuff. Pleased to see my gnome sushi patch merged upstream.

Michal Čihař: Triggering Jenkins from GitHub

For some time I thought it is not effective to use polling to get latest changes from GitHub into Jenkins, which we use for continuous integration, but II was always too lazy to investigate. Today I finally took a look at it and it turns out to be quite easy:
  1. Enable Github plugin in Jenkins.
  2. Enable "Build when a change is pushed to GitHub" in project configuration in Jenkins
  3. Disable "Prevent Cross Site Request Forgery exploits" in Jenkins configuration (to prevent bug JENKINS-10263).
  4. Configure Jenkins service hook in GitHub to trigger your server (the URL is http://<jenkins>/github-webhook/.
Try testing the hook and check "GitHub Hook Log" in Jenkins if it really works and you're done. So now, phpMyAdmin's tests should start as soon as somebody pushes changes to GitHub.

Filed under: English Phpmyadmin 0 comments Flattr this!

Jonathan McDowell: SPI 2012 Board Election

The SPI 2012 board election voting opened up on Sunday and is open until the end of Saturday 28th July. My 3 year term has come to an end, so I'm standing for re-election. Michael Schultheiss (our current treasurer) is also standing again. There are also 2 new candidates in the shape of Gregers Petersen and Selena Deckelmann. My nomination statement doesn't have anything earth shattering in it. I'm largely of the opinion that SPI itself should be a boring organization, dealing with the common admin tasks of its associated projects and letting them get on with the job of changing the world. There are some challenges about how we scale larger that I'd like to see solved, but on the whole I see my role as a board member as being one of ensuring that SPI continues to function in a sensible fashion, rather than one of engaging in altering it in any serious fashion. If you're an SPI contributing member please vote - obviously I'd like you to vote for me if you think I've done a decent job over the past 3 years, but even if you don't I'd still like you to take the time to be involved and vote.

17 July 2012

Sylvain Le Gall: Coding by example, migrating ocsoap to OASIS and ocamlbuild

In my effort to automate most of the stuff needed to release, I am working on a SOAP to OCaml converter. Richard W.M. Jones has kindly allowed me to take-over its project "ocsoap". The project is now located here and I am working on making it compatible with FusionForge SOAP. My first step was to make it compatible with OASIS and ocamlbuild. The project is Makefile based and needs some extra care to make it ocamlbuild based. The oasis-fication itself was a piece of cake. Just describe the dependencies of the project and make some extra choice like compiling the camlp5 extension to a .cma rather than a .cmo. You can see the _oasis and myocamlbuild.ml results, compared to the initial Makefile. The _oasis is simple:
OASISFormat:  0.3
Name:         ocsoap
Version:      0.7.1
Synopsis:     SOAP converter to OCaml code
Authors:      Richard W.M. Jones, Sylvain Le Gall
License:      LGPL-2.1 with OCaml linking exception
Plugins:      DevFiles (0.3), META (0.3), 
              StdFiles (0.3)
BuildTools:   ocamlbuild,
              cduce
BuildDepends: dynlink,
              pxp-lex-utf8,
              pxp-engine,
              netclient,
              cduce,
              extlib,
              calendar,
              pcre
Library ocsoap
  Path:       src
  Modules:    OCSoap
Library pa_ocsoapclientstubs
  Path:          src
  Modules:       Pa_ocsoapclientstubs
  BuildTools:    camlp5o
  BuildDepends:  camlp5
  FindlibParent: ocsoap
  FindlibName:   syntax
  CompiledObject: byte
  
Executable wsdl_validate
  Path:       src
  MainIs:     wsdl_validate.ml
  
Executable wsdltointf
  Path:       src
  MainIs:     wsdltointf.ml
Executable adwords_test1
  Path: examples/adwords
  BuildDepends: ocsoap
  MainIs: test1.ml
  Build$: flag(tests)
  Install: false
  BuildTools: camlp5o
  BuildDepends: ocsoap.syntax
Executable adwords_test2 
  Path: examples/adwords
  BuildDepends: ocsoap
  MainIs: test2.ml
  Build$: flag(tests)
  Install: false
  BuildTools: camlp5o
  BuildDepends: ocsoap.syntax
Executable adwords_examples 
  Path: examples/adwords
  BuildDepends: ocsoap
  MainIs: example.ml
  Build$: flag(tests)
  Install: false
  BuildTools: camlp5o
  BuildDepends: ocsoap.syntax
Document "api-ocsoap"
  Title: API reference of OCSoap
  Type: ocamlbuild (0.3)
  BuildTools+: ocamldoc
  XOCamlbuildLibraries: ocsoap
  XOCamlbuildPath:      src/
Most of it was generated using oasis quickstart, that helps you to write _oasis. This part was not tricky and mostly a translation of what the previous Makefile was explaining, in its language. Now comes the tricky part, translating Makefile rules into ocamlbuild rules. This part is more tricky because the general principle behind Makefile and ocamlbuild are not exactly the same. Let's start with a simple rule: compiling a CDuce .cd file into a .cdo. Here is the Makefile rule:
%.cdo: %.cd
        $(CDUCE) --compile $<
In the oasis-fication, we have added an extra complexity, because we move the source to src, which needs extra flags. Here is the ocamlbuild rule:
rule "cduce: %.cd -> %.cdo"
  ~prod:"%.cdo"
  ~dep:"%.cd"
  begin
    fun env build ->
      Cmd(S[cduce;
            T(tags_of_pathname (env "%.cd")++"cduce"++"compile");
            A"--compile";
            A"-I"; P(Filename.dirname (env "%.cd"));
            P (env "%.cd")])
  end
;;
It is a little bit more complex, lets explain it. The function rule create a rule with a name and a function that execute it. The labels ~prod and ~dep are the right and left parts of %.cdo: %.cd of the Makefile. When we call env "%cd", it replaces the % by the matching part of ~prod and ~dep. Next we return a Rule.action. The rule in this case is a command Cmd. This rules use a sequence S, which are the command line itself. The sequence is made of smaller pieces that can be a placeholder for tag content (T + what will trigger it), atom (A, typically command line option), and filename (P). For a file src/foo.ml, the command generated will
cduce $(TAG) --compile -I src src/foo.ml
where $(TAG) will be replaced by the content of flag ["file:src/foo.ml"; "cduce"; "compile"] content. But also by the content of flag ["cduce"; "compile"] content, the flag just need to be subset. For example if you want to add --verbose to the command line, just add flag ["cduce"; "compile"] (S[A"--verbose"]);; somewhere in myocamlbuild.ml. Next rules, we need to compile %.cdo to %.cmo. It is trickier because in this case, we want to have %.cmi eventually built before. It is not require to build it before, if there is no %.mli file. Here is the code to do that:
let cduce_mkstubs includes =
  Quote (S([cduce;
            S(List.map
                (fun fn -> S[A"-I"; P fn])
                includes);
            A"--mlstub"]));;
(* cduce < 0.3.9:  cdo2ml -static *) 
let cduce_compile_args env =
  [
    A"-c"; A"-package"; A"cduce";
    A"-pp"; cduce_mkstubs [Filename.dirname (env "%.cmi")];
    A"-I"; P(Filename.dirname (env "%.cmi"));
    A"-impl"; P(env "%.cdo")
  ]
;;
let cduce_prepare_compile env build =
  List.iter
    (function
         Outcome.Bad _ ->
           (* Fail but it just means that the .cmi will be generated 
            * during compilation.
            *)
           ()
         Outcome.Good _ ->
           ())
    (build [[env "%.cmi"]])
;;
rule "cduce: %.cdo -> %.cmo"
  ~prod:"%.cmo"
  ~dep:"%.cdo"
  begin
    fun env build ->
      cduce_prepare_compile env build;
      Cmd(S(
        [ocamlfind; ocamlc;
         T(tags_of_pathname (env "%.cdo")
           ++"cduce"++"ocamlc"++"compile"++"byte")]
        @ (cduce_compile_args env)))
  end
;;
The difference with the former rules, is that we call cduce_prepare_compile which in turns call (build [[env "%.cmi"]]). The call to build will ask ocamlbuild to compile src/foo.cmi, but we don't care about the result, i.e. in case of Outcome.Bad exn we don't fail. This way we don't stop the build process that will continue and produce a .cmo and .cmi just out of the .cdo. The .cdo itself is compiled as a .ml file with ocamlfind ocamlc except that we apply cduce --mlstub as a preprocessor A"-pp"; Quote(S[cduce; ..; A"--mlstub"]). The last rule that I will comment is the one that transform a .intf into a .ml. This rule is particular because it is totally different than the pieces of code of the original Makefile. Here are the couple of rules that was needed to translate .intf:
examples/adwords/%Service.cmx: examples/adwords/%Service.intf                                                       
   ocamlfind ocamlopt $(OCAMLOPTFLAGS) -c \                                                                          
     -pp "camlp5o ./pa_ocsoapclientstubs.cmo -impl" -c -impl $<
.depend: $(wildcard *.mli) $(wildcard *.ml) \
  $(wildcard examples/adwords/*.mli) $(wildcard examples/adwords/*.ml)
  $(OCAMLDEP) $^ > .depend
  for f in examples/adwords/*.intf; do \
    $(OCAMLDEP) \
    -pp "camlp5o ./pa_ocsoapclientstubs.cmo pr_o.cmo -impl" $$f \
    >> .depend; \
  done
Here is the ocamlbuild rule:
rule "ocsoap: %.intf -> %.ml"
  ~prod:"%.ml"
  ~deps:(if !ocsoap_dev then
           ["%.intf"; !pa_ocsoapclientstubs]
         else
           ["%.intf"])
  begin
    fun env build ->
      Cmd(S[Px !camlp5o; P !pa_ocsoapclientstubs; P "pr_o.cmo"; A"-impl";
            P(env "%.intf"); A"-o"; P(env "%.ml")])
  end
;;
Here we decided to translate directly the .intf into a .ml file. The good thing about ocamlbuild is that it has a powerfull dynamicy dependencies scheme. So here you will generate the .ml file, which in turns will generate a .ml.depends and then will be compiled the standard way. In the makefile, you need to compute the .depends file using a different process that will do everything before the compilation even starts (in fact, before the inclusion of the .depends). We also use the trick to use an OCaml printer (pr_o.cmo) with camlp5o, that will directly output the standard .ml file. Don't hesitate to post comment if you have question about OASIS and ocamlbuild Enjoy.

Ben Hutchings: Wireless regulation in squeeze

Alternate title: 'for those who care about channels 12-13'. For background, see the earlier entry on wireless regulation. If your wifi interface no longer supports channel 12 or 13, this may be because the kernel does not know the regulations for the domain code detected by the driver. Prior to Linux 2.6.34, regulations for 'US', 'JP' (Japan) and 'EU' (ETSI members) were built-in, but now there is only '00' (world, conservative regulations) which allows only channels 1-11 in the 2.4 GHz band. For any driver that detects specific European country codes, the 'EU' regulatory information was useless even in 2.6.32 (squeeze) and the unknown code would be mapped to the '00' (world) domain. Since wireless regulations are subject to change from time to time, they are now provided by the wireless-regdb package and supposed to be loaded into the kernel by crda. These packages should have been included in squeeze, but for various reasons they missed it. But they are now available in squeeze-backports.

Luciano Bello: there is no cabal.. but, what s a cabal?

In my long trip to Nicaragua I made progress in my reading: Quicksilver, by Neal Stephenson. In the Spanish edition the title is Azogue. But I m assuming that you are not a Spanish speaker. Here is a small fragment (in English) I found there:
You must remember that the planters are short-sighted. They re all desperate to get out of Jamaica they wake up every day expecting to find themselves, or their children, in the grip of some tropical fever. To import female Neegers would cost nearly as much as to import males, but the females cannot produce as much sugar particularly when they are breeding. Daniel had finally recognized this voice as belonging to Sir Richard Apthorp the second A in the CABAL.
It s a bit embarrassing when I discovered myself realizing where the word cabal comes from. And I m posting this as a head-up for everyone who know there is no cabal in Debian; but they don t know which is the origin of the word cabal. Stephenson changed the name of the historic cabal, a group of high councillers of King Charles II of England, Scotland and Ireland, in 1668. In the novel, they are: John Comstock (Earl of Epsom), Louis Anglesey (Duke of Gunfleet), Knott Bolstrood (Count Penistone), Sir Richard Apthorp and Hugh Lewis (Duke of Tweed). In the real world they had been:
Thomas Clifford, 1st Baron Clifford of Chudleigh (1630-1673). Henry Bennet, 1st Earl of Arlington (1618-1685). George Villiers, 2nd Duke of Buckingham (1628-1687). Anthony Ashley Cooper, 1st Baron Ashley of Wimborne St Giles (1621-1683). John Maitland, 1st Duke of Lauderdale (1616-1682).
This group shared the effective power in a royal council rather than the King.

Ritesh Raj Sarraf: Reporting bugs with Apport - II

This is a follow up to the previous post regarding Reporting bugs with ApportApport, version 2.2.3-2, has been pushed to experimental. There were some nice feedback that led to some more changes that I will talk here.Opt out: As a developer, if you see the volume of reports to be annoying, you have the option to opt out of apport reports. To do this, you should specify the XBS-Apport: No field in your package's control file. When your application crashes, apport first checks for that field in your package's description and acts based on what you chose.Following image is that the user sees for packages where the developer has opted out.opt outRepetition: Repetition of the same crash could lead to multiple reports on the same buggy behavior. For this, apport, if senses that you have already filed a bug, it provides you with the option to further ignore all crashes for that particular type.Following image should explain it better.ignore report My initial thought regarding defaults was to make apport a default opt out tool for the entire archive and only file reports for packages where the developer has manually enabled to opt-in for apport reports. But that'd have been very slow in terms of adoption, hence, for now, instead, the version in experimental does it the other way around. It will file bug reports for all packages. If you need to opt out, you will have to add the above expalined control field. That's it for this post. Please provide feedback once you spend some time with apport.PS: Please take conscious steps when filing bug reports with apport. I think it is a great tool. It just needs great users. :-)
Categories:
Keywords:

16 July 2012

Petter Reinholdtsen: Call for help from docbook expert to tag Free Culture by Lawrence Lessig

I am currently working on a project to translate the book Free Culture by Lawrence Lessig to Norwegian. And the source we base our translation on is the docbook version, to allow us to use po4a and .po files to handle the translation, and for this to work well the docbook source document need to be properly tagged. The source files of this project is available from github. The problem is that the docbook source have flaws, and we have no-one involved in the project that is a docbook expert. Is there a docbook expert somewhere that is interested in helping us create a well tagged docbook version of the book, and adjust our build process for the PDF, EPUB and HTML version of the book? This will provide a well tagged English version (our source document), and make it a lot easier for us to create a good Norwegian version. If you can and want to help, please get in touch with me or fork the github project and send pull requests with fixes. :)

Tanguy Ortolo: MySQL save/restore: an example of what not to do

Database icon I had to play a bit with MySQL, saving and restoring databases with mysqldump and mysql. These two tools have one severe discrepancy, which I would like to comment here because I think it is an excellent example of what not to do when designing tools to be used together.Save mysqldump(1) is a database backup tool, that takes a MySQL database and prints the necessary SQL statements to restore it to a new server. It has one interesting option:
--default-character-set=charset_name Use charset_name as the default character set. See Section 10.5, Character Set Configuration . If no character set is specified, mysqldump uses utf8.
As you can see, it is quite modern in its default choice: if you do not specify which encoding you want to encode your database content into, it uses UTF-8. This way, it can save any database content, whatever characters it may contain. A more sensible choice may have been to use the LC_CTYPE environment variable. Restore mysql(1) is the command-line MySQL client, which can is used to restore such dumps. It has a similar option:
--default-character-set=charset_name Use charset_name as the default character set for the client and connection. A common issue that can occur when the operating system uses utf8 or another multi-byte character set is that output from the mysql client is formatted incorrectly, due to the fact that the MySQL client uses the latin1 character set by default. You can usually fix such issues by using this option to force the client to use the system character set instead.
As you can see, this utility is still has an antique design: if you do not specify a character set, it assumes you are giving it data encoded in latin-1. Discrepancy You can see the obvious discrepancy here: mysqldump encodes your database backups in UTF-8 by default, and mysql restores them as if they were encoded in latin-1. This way, when you have to restore your databases, if you thought you could do it without wondering, congratulations: voil , you have just fucked your databases up! And as an additional present, chances are high that this mistake is discreet enoughto be detected only after a while, when modifications have been done to the restored database and the original backups have been deleted. So, if you are dealing with MySQL databases, remember that you must take care of the encoding of your backups, because MySQL utilities will not by itself, or rather it will do just what should not be done. And if you are designing similar tools, please think, and if you want an example of what not to do, here is one!

Thorsten Glaser: Apache 2, https clients linked against GnuTLS, connection errors

I ve been debugging a weird problem at work after upgrading a complex system from lenny to wheezy, some https clients failed to connect: GNU wget and Debian s version of lynx(1) which is linked against libgnutls26 fail. NSS applications continue to work, as does cURL; wget and lynx on MirBSD (linked with OpenSSL of course) work. Even Debian s gnutls-cli tools from both gnutls26 and gnutls28 work. Huh. The error_log shows renegotiation problems, yet setting the new Apache 2 configuration option to use insecure renegotiation doesn t help either. (The option is a total #FAIL: its only other value is use secure TLSv1.x renegotiation , but I don t want/need SSL renegortiation at all, anyway.) Natureshadow told me this was a hot issue on Debianforum at the moment, yet, nobody had a clue or enough information to file a formal bugreport against (initially) apache2, as that s what changed. I tracked it down on a new VM with no configuration otherwise, and here are my findings so others don t run into it.

Tracking down the problem, this can be reduced to the following configuration (minimised, to show the problem) in /etc/apache2/sites-enabled/1one:

	<VirtualHost *:443>
		ServerName wiki-70.lan.tarent.de
		RedirectMatch permanent . https://evolvis-70.lan.tarent.de/
		SSLEngine on
		SSLCertificateFile /etc/ssl/W_lan_tarent_de.cer
		SSLCertificateKeyFile /etc/ssl/private/W_lan_tarent_de.key
		SSLCertificateChainFile /etc/ssl/godaddy.ca
	</VirtualHost>
 

Do not mind the actual content, this is a very stripped-down demo on a not-actually-set-up-yet box.

Same is valid for the companion configuration file /etc/apache2/sites-enabled/2two:

	NameVirtualHost *:443
	<VirtualHost *:443>
		ServerName evolvis-70.lan.tarent.de
		SSLEngine on
		# workaround for BEAST (CVE-2011-3389), short-term
		SSLCipherSuite RC4-SHA
		SSLCertificateFile /etc/ssl/W_lan_tarent_de.cer
		SSLCertificateKeyFile /etc/ssl/private/W_lan_tarent_de.key
		SSLCertificateChainFile /etc/ssl/godaddy.ca
		SSLProtocol TLSv1
	</VirtualHost>
 

Turns out the BEAST workaround was at fault here: the differing SSLCipherSuites between the vhosts (on the same Legacy IP / TCP Port tuple, as we use Wildcard SSL Certificates) made Apache 2 want to renegotiate, so either commenting it on 2two or, better, adding it to 1one helped. Interestingly enough, the SSLProtocol directive did not matter (in my tests). So, keep SSL settings synchronised between vhosts. In fact, those were already from include files, but 2two was from the Evolvis 5 generation, whereas we added to 1one an Include of the httpd.ssl1.inc file generated by the previous releases of EvolvisForge and had not switched those legacy vhosts to the new configuration, as everything worked on lenny. This wlog entry brought to you by the system administrators of tarent solutions GmbH and the Evolvis Project, based on FusionForge.

R&#233;mi Vanicat: Sofware as service

Someone recently give me a link to a web picasa photo album. I wanted to download all the photo in good resolution, but the only official way to download it is by using the picasa proprietary software. Not only I'm not thrilled to install yet another unfree software, but Google refuse me to download it because "Picasa is not currently available for your operating system". Another solution exist, but need some research: Some time, its great to be able to beat limitation of unfree software thanks to free software.

Next.

Previous.