As a lot of people are coming to my blog to read the installing instructions for Debian on the GuruPlug Server Plus, I shall not hide my opinion about the Guruplug Server Plus: It is a major design and QA fail. Don't waste your money on it.

The power supply Although I've ordered the Guruplug pretty early with the promise, that I'd have it in April, it arrived at the end of March due to QA issues with the power supply. While I appreciate that they didn't deliver broken power supplies, I would have preferred not to receive one which was "fixed" by somebody who uses the soldering iron like an axe. Here are some macro photos to show the gory details:

Software issues The version of UBoot which shipped with the device was only able to boot from NAND and network. Booting from USB failed and ext2 support was missing, too. Didn't have a look if the community came up with a fixed UBoot version yet, but in my opinion a piece of hardware for >100 EUR should not have such flaws.

Thermal issues Using the Guruplug with more than one 100 MBit/s connection is just not possible, as it would toast itself to death. For the details have a look at this discussion in the NewIT forum, it links to a lot of interesting photos and postings. This issue is a major design and QA failure. Even without knowing what the datasheets say, it is easy to imagine that a thin piece of alloy is not the proper way to cool a CPU and network chip. Especially not when it is mounted with cheapish pads instead of a proper paste. As it seems the plan was to send the heat to the shielding of the network/USB/eSata ports (the area is marked red as my first plan was to remove that part of the alloy and reuse the heat-spreader), a strong indication for that is that this is the only area with holes for air circulation. I could imagine that it was not possible to have these holes next to the PSU, which was mounted above the heat-spreader, to avoid electrical shocks. As there was no other opening for the heat to leave the case, even the microSD card became pretty hot - I've measured temperatures around 60 deg. C next to the card - while CPU and 100MB/s network were idling. The official information from GlobalScale Technologies is that only 10/100MBit/s should be used as workaround to avoid overheating until a "Professional Upgrade Kit" is released. As mentioned here the upgrade kit announcement was removed silently from GST's website. To be honest, this doesn't make me wonder. There is no way to fix the Guruplug with an external fan or any other external magic as the only way to fix it is to cool the CPU and networking chip properly. There are various workarounds for the cooling issues posted to the forums. I've decided to rip out the power supply and heat spreader out of the case and get a nice external PSU. The new connector is mounted, ready to supply the GuruPlug's board with power. Currently I'm waiting for the new heat sinks and glue to arrive. Then I'll give it a try to mount eveything in the small case again, probably with some additional air holes. As soon as I have a workign solution, I'll blog about it again.

Back in August 2007 I looked at the state of embedded md5sums in Debian packages and found that approximately 3% of the files in the archive didn't have checksums. Three years later, things have improved: only 0.76% of the archive is now missing checksums (sid, main/contrib/non-free). (See this lintian report for the list of affected packages.) Since then there's also been various discussions on this subject and there is now a policy bug open to make md5sums a requirement (at the "should" level). There is also a wishlist bug against debhelper to turn dh_md5sums into dh_checksums with a stronger hash algorithm, but MD5 still being good enough for simple integrity checking, it seems rather pointless to upgrade the algorithm without a trust path in the form of in-package signatures ala RPM... Anyway, what's perhaps more surprising is the growth of the distribution in only three years: sid has gone from 20774 to 30314 packages, a 45% increase. Similarly, the number of regular files has gone from approximately 2 million to just above 2.9 million. Indeed, looking at our last five releases, the distribution's growth is impressive:

• woody (2002): 8273 packages
• sarge (2005): 15195 packages (+83.7%)
• etch (2007): 18043 packages (+18.7%)
• lenny (2009): 22277 packages (+23.5%)
• squeeze (2010?): 28870 packages (+29.6%)

Whether or not that is a good thing is, of course, yet to be determined. As a data point, I used the UDD to know how many of these thousands of packages are actually used, and to my surprise, 22321 binary packages have a popcon installation count that is less than 500! (By comparison, dpkg's installation count is 89393.) So while each new release adds lots of packages, the majority of them have very few users. (If you want to check yourself, the query I used is select p.package, version, insts from packages p, popcon where (p.architecture = 'i386' or p.architecture = 'all') and p.release = 'squeeze' and p.package = popcon.package and popcon.insts < 500 order by insts;.)

mksh was merged into Android (both AOSP and Google s internal master tree) in the night 24/25th August, and is expected to be the one shell to rule them all, for Gingerbread. mksh(1) now also has a cat builtin, for here documents mostly. It calls the cat(1) command if it receives any options. The shell is nevertheless smaller than yesterday because of improved string pooling. There s another reason to use the MirOS OPTU-16 encoding instead of PEP 383, on which I already wrote: try passing a wide-char filename to a function such as MessageBoxW, or create a filename on a system using wide chars, such as FAT s LFN or ISO 9660 s Joliet, or one that only allows Unicode (canonically decomposed u out of all things) like HFS+. OPTU-8 at least maps to somewhat reserved codepoints (would, of course, be better to get an official 128 codepoint block, but the chance s small of getting that in the BMP). Still. Oh well, the torrents. I ve remade them all, using one DHT seed node and OpenBitTorrent as tracker and put them on a very rudimentary BT page that will be completely redone soonish. Please re-download them. I currently do not believe f.scarywater.net will return. Finally, I fell victim to a selling-out and may have just bought a Windows Mobile 6 based phone (Glofiish X650) and an SDHC card and an extra battery with double capacity. Well, at least it s said to run CacheWolf well. I still would like to have something like Interix, Cygwin, UWIN, coLinux, or maybe some qemu-for-WinCE variant that runs Android, Maemo, Debian/armhf (or armel or arm) at near-native speed (and is usable the device sadly doesn t have a hardware keyboard, but it comes with SiRFstar GPSr). It only has 64 MiB RAM, like the Zaurus SL-C3200 and the jesusPhone, though. Any chance to get MirWorldDomination onto that device as well?

This release fixes an important ipconfig regression from Lenny due to a badly tested monster patch 4efbcf90f60. ipconfig should now perform better then ever, thanks to the inflow of fixes since Lenny release. This RC fixes are scheduled for Squeeze and it already landed in Sid. 1.5.19 had no release announcement, but fixed compilation on x86_32, the syscall handling on sh4 (initramfs-tools is said to boot fine with it), valgrind ipconfig warnings and added getrusage() for the mksh port. Thanks to hpa for giving me the official co-maintenance of klibc. Thanks to all contributors. P.S.: See klibc git repo.

I ve been wondering if the following kind of testing management software exists (preferably free software, of course). It would allow one to specify a number of test cases. For each, one should be able to describe preconditions, testing instructions and expected outcome. Also, file attachments should be supported in case a test case needs a particular data set. It would publish a web site describing each test case. A tester (who in the free software world could be anyone) would take a test case, follow the instructions given and observe whatever outcome occurs. The tester would then file a test report with this software, either a terse success report or a more verbose failure report. The software should maintain testing statistics so that testers could easily choose test cases that have a dearth of reports. As a bonus, it would be nice if the software could submit a failure report as a bug report . (Note that this would be useful for handling the sort of tests that cannot be automated. There are many good ways already to run automated test suites.)

Something was bound to go wrong when changing the policy for boot loaders. Let me try that again.

It looks a lot as if Facebook is closing up on third party developers. Seems like they've cherry picked the features they want to copy, and now are no longer interested in third parties anymore:

• They removed the "publisher" feature, which allowed applications to offer custom story forms. They said it wasn't used a lot - the reason was simple, they placed third party publishers in a tiny dropdown in the "attach" section, second class to their link sharing and even crappy 'gift' application. Of course: otherwise nobody would buy their birthday "gifts".
• They're removing the extra info boxes you could put into your profile. This is a key feature for two of my applications, which allowed people to publish a calendar feed in their profile.
• Places is aiming at killing FourSquare and similar on the long run.

Expect once-famous Facebook applications such as SuperPoke to disappear on the long run - their integration hooks have been pulled. The API gets more and more limited for the cash cow use case: games. And of course marketing. Oh, I forgot one type of "applications". The one that basically embeds you regular web page within a Facebook tab. Wow. That's technology!If it was really about the users, Facebook would seriously fight Facebook spam, worms and fraud. They still don't have that under control (and none of them used either of the removed features!). They do even less to prevent users from clicking on such bad links such as the Free iPad scam, which has been around for at least a week now. Or the famous "dislike button" scam. They could not spell much more clearly that they do not care about their users - they just want your data to sell more directed advertising to you. Forget about privacy, too!Now that all my three Facebook applications are pretty much dead, this comes with a good side for me: I've been considering to disable/suspend/kill my Facebook account for quite some time. But I wasn't sure if that would also kill my applications for their users. Now that they're dead anyway, there is not much keeping me anymore.

Recently I ve been using ebook readers rather a lot mostly the Kindle DX, though I have given iBooks a spin as well. Obviously, as with MP3 players, the main win they offer is the ability to easily carry about an entire library without the inconvenience of the physical media. I ve been reading an awful lot more than before since I started using them, mostly by virtue of it being very easy to keep several books on the go at once. What I ve found especially good with the Kindle is the ease with which I can flip between devices, taking advantage of the tradeoffs between the different form factors. Phones are obviously portable and these days have clear, easy to read screens (in most lights anyway) and are very light and easy to hold. They re great if you re stuck in a queue or on a bus but the small screen size and the fact that keeping the screen on for an extended period of time runs down the battery which isn t always desirable. Computers are similar, trading off portability and convenience in the form factor for the larger form factor. The iPad deals with the screen size issue without much impact on either the form factor or the battery life but the LCD display is hard to read in sunlight and can be hard on the eyes for extended use. E-Ink displays deal with those issues by swapping them for others that mean they can only work for eBooks so the devices aren t at all general purpose. The first generation of displays had problems with frustratingly long refresh times and less than ideal contrast ratios but these have been largely addressed in current generations of device current generation displays are beautiful. Thus far I ve pretty much just been reading copies of books I already have physical copies of so I ve not really had a think about how I feel about any of the models for eBook publishing that are floating about out there, or about the DRM issues.

If you find that running Windows makes a GRUB 2-based system unbootable (Debian bug, Ubuntu bug), then I'd like to hear from you. This is a bug in which some proprietary Windows-based software overwrites particular sectors in the gap between the master boot record and the first partition, sometimes called the "embedding area". GRUB Legacy and GRUB 2 both normally use this part of the disk to store one of their key components: GRUB Legacy calls this component Stage 1.5, while GRUB 2 calls it the core image (comparison). However, Stage 1.5 is less useful than the core image (for example, the latter provides a rescue shell which can be used to recover from some problems), and is therefore rather smaller: somewhere around 10KB vs. 24KB for the common case of ext[234] on plain block devices. It seems that the Windows-based software writes to a sector which is after the end of Stage 1.5, but before the end of the core image. This is why the problem appears to be new with GRUB 2. At least some occurrences of this are with software which writes a signature to the embedding area which hangs around even after uninstallation (even with one of those tools that tracks everything the installation process did and reverses it, I gather), so that you cannot uninstall and reinstall the application to defeat a trial period. This seems like a fine example of an antifeature, especially given its destructive consequences for free software, and is in general a poor piece of engineering; what happens if multiple such programs want to use the same sector, I wonder? They clearly aren't doing much checking that the sector is unused, not that that's really possible anyway. While I do not normally think that GRUB should go to any great lengths to accommodate proprietary software, this is a case where we need to defend ourselves against the predatory practices of some companies making us look bad: a relatively small number of people do enough detective work to realise that it's the fault of a particular Windows application, but many more simply blame our operating system because it won't start any more. I believe that it may be possible to assemble a collection of signatures of such software, and arrange to avoid the disk sectors they have stolen. Indeed, I have a first draft of the necessary code. This is not a particularly pleasant solution, but it seems to be the most practical way around the problem; I'm hoping that several of the programs at fault are using common "licence manager" code or something like that, so that we can address most of the problems with a relatively small number of signatures. In order to do this, I need to hear from as many people as possible who are affected by this problem. If you suffer from this problem, then please do the following:

• Save the output of fdisk -lu to a file. In this output, take note of the start sector of the first partition (usually 63, but might also be 2048 on recent installations, or occasionally something else). If this is something other than 63, then replace 63 in the following items with your number.
• Save the contents of the embedding area to a file (replace /dev/sda with your disk device if it's something else): dd if=/dev/sda of=sda.1 count=63
• Do whatever you do to make GRUB unbootable (presumably starting Windows), then boot into a recovery environment. Before you reinstall GRUB, save the new contents of the embedding area to a different file: dd if=/dev/sda of=sda.2 count=63
• Follow up to either the Debian or the Ubuntu bug with these three files (the output of fdisk -lu, and the embedding area before and after making GRUB unbootable.

I hope that this will help me to assemble enough information to fix this bug at least for most people, and of course if you provide this information then I can make sure to fix your particular version of this problem. Thanks in advance!

It seems that Google is blocking wikileaks.org in its Public DNS servers (8.8.8.8 and 8.8.4.4):

; <<>> DiG 9.7.1-P2 <<>> @8.8.8.8 wikileaks.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 50227
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;wikileaks.org.			IN	A
;; Query time: 2457 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug 27 18:10:43 2010
;; MSG SIZE  rcvd: 31

Filed under: General

CVE-2010-2959 allows to exploit an integer overflow in the CAN protocol driver to escalate privileges to root. This requires the CAN BCM module (can_bcm) to be loaded, so its impact is either null or easily mitigated since it is never used on normal systems. If this command finds the alias needed to autoload the module then an unpatched system is vulnerable:

grep can-proto-2 /lib/modules/$(uname -r)/modules.alias -r /etc/modprobe.d/

In practice, the combination of the unpatched lenny kernel and module-init-tools packages are not (normally) vulnerable because the alias does not exist, while more recent kernels are: nowadays kernel modules carry their own built-in aliases, which are collected by depmod(8).

The unofficial rc bug tracker currently knows about the following bugs:

In Total:	390
Affecting Squeeze:	299
Squeeze only:	82
Remaining to be fixed in Squeeze:	217

Of these 217 bugs, the following tags are set:

Pending in Squeeze:	18
Patched in Squeeze:	35
Duplicates in Squeeze:	21
Contrib or non-free in Squeeze:	14
Claimed in Squeeze:	3
Delayed in Squeeze:	10
Can fixed in a security Update:	13
Otherwise fixed in Squeeze:	17

Ignoring all the above (multiple tags possible), 126 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 245 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

My last post discussed the year-to-year budgeting of DebConf. This post discusses what makes budgeting difficult within one particular DebConf. Since every DebConf is unique in its arrangements, the particular difficulties always vary year-to-year. For example, DebConf10 was easy in that Software in the Public Interest was in the same country so that we had easy access to bank accounts, but more difficult venue payment logistics. I'll use DebConf10 as an example below.
For DebConf10, we get our venue "for free" thanks to the support of the Columbia Computer Science department. However, we had to pay for guard costs after building hours, and custodial costs. For custodial costs at least, we had to go through many layers of bureaucracy, and people kept insisting it would be more than they quoted. (It ended up being about half, since DebConf attendees were so responsible!)DebConf sponsors many attendees. This means that all their food and accommodation costs are paid by us. We have sponsored registration and reconfirmation deadlines to set a maximum of the number of people we have to sponsor, but people are continually dropping out and it's hard to know just how many people to reserve for. Sponsored people won't always eat every meal with us, and usually won't decide until the day before - so figuring out food amounts is hard, too. Furthermore, we have unsponsored people who will want food and accommodations (paying themselves) which we must somehow plan for.Different venues operate on different payment rules. This year, CU Housing was fairly strict on asking for attendee counts and room assignments two weeks in advance. Then, as time gets closer, they got more flexible, and in the end told us that they will, in fact, only charge based on number of people actually attending - a huge win for us. Similarly with CU Dining, we had to go through great lengths to make sure that we would pay only for meals we ate. At CU, food had to be paid in advance, but accommodation and other costs are paid afterwards.We have to guess how much will be spent on miscellaneous supplies once DebConf starts. We have to then decide how much to spend on extras such as the day trip or conference dinner, and how to sponsor those, if possible.Debian (and thus DebConf) has money held in trust in many currencies in different accounts. Different sponsors will pay to different currencies, depending on what is convenient for them. This means that we need to consider fluctuating currency conversion rates, and decide if and when to transfer money. In general, DebConf hasn't transfer money just to make sure the DebConf-tagged money gets spent first. Some surpluses are best left in other countries to help pay future travel sponsorship since it is expensive to move money out of the country. Some conferences may result in a net movement of money from USA to Europe (more donors in one, more expenses in the other), some the other way around.Travel sponsorship is in the form of reimbursement. These can take many months to have the documentation received from attendees and the reimbursements all sent out, and thus finalizing the budget and surplus for next year.The overall principle we've tried to stick to is plan for a balanced budget in the worst case scenario, and then be happy when it ends up better than that.
At the DebConf&Debian BOF, someone mentioned how budgeting for any (free software) conference is hard. I think that's certainly true. Some of the registration fluctuations could be made easier by being less flexible, but DebConf wants to serve our attendees even if it is a bit of extra work for us. Each DebConf will have its own ways budgeting is difficult, but things have always work out, and usually with a bigger surplus than we were expecting.Tags: debconf

Urban Honking has an insightful article about the Arduino and suggests that it is one of the most important factors for the development of the computer industry in the near future [1]. It compares the Arduino to the Altair. Wired has an interesting article about a company that provides a satellite kit and a launch into low Earth orbit for $8000 [2]. Arduino in space? Linux Journal has an interesting article by David Rowe about the Mesh Potato which is a Wifi mesh router that also runs VOIP [3]. One particularly interesting aspect of this article is the explanation of the way they designed and tested it. Susan Shaw gave an informative TED talk about the toxic effects of the attempts to clean up the oil spill in the Gulf of Mexico [4]. It seems that trying to disperse the oil just makes it worse, and the chemical companies are refusing to disclose the chemicals that are being used. The New York Times has an interesting article by David Leonhardt about the value of pre-school teachers [5]. Some research on the difference that good teachers can make in economic terms suggests that the make an economic difference to the children to the value of $320,000 per annum (IE a class of 16 children who were taught for a year would on average each receive a benefit of $20,000 over their lifetime). Also there are social benefits which aren t counted by that study. While I can t imagine pre-school teachers getting paid $320,000 any time soon, it does seem obvious that good teachers deserve significantly better pay. Of course one problem is how to determine which teachers are good, better test results are not a reliable indication. Paul Krugman describes America as being on the unlit, unpaved road to nowhere due to the policies of saving money by cutting funding for schools, street-lights, and roads [6]. The Chive has an amusing post about how to quit a bad job [7]. It would be good if someone really did this, I m sure that there are enough creative people who don t like their job. Hell Pizza in New Zealand published a zombie themed choose your own adventure on Youtube [8]. Unfortunately the options to choose the next segment don t work on HTML5 with Chromium so if you don t have flash you miss out. AskThePilot.com has an informative essay about airline security written by a commercial pilot [9]. The anecdote about the pilot not being allowed to take the type of knife that is issued to first and business class passengers is rather amusing. FredOnEverything.net has an interesting analysis of Wikileaks and why the Pentagon and Fox News hate it [10]. Fred is a very skillful writer, while he s not the first person to say some of these things he may have said it best. The Wikipedia page on Borosilicate glass (which is best known under the trademark Pyrex) is really interesting [11]. Borsilicate glass was formerly known as Duran and it s main characteristic that makes it suitable for lab use is resistance to Thermal Shock, but it s also harder and has a higher melting point. Apparently you can get Pyrex drinking glasses, I want some! Eben Moglen gave an interesting talk Freedom in the Cloud about the development of free servers to manage personal data and replace Facebook etc (among many other things) [12]. The Debian Wiki has an articla about designing such a system [13]. The APNIC published an interesting paper on IPv4 background radiation [14]. Apparently some /24 s receive so much random traffic (from broken applications and viruses) that they can t be delegated. IPv6 will solve this problem by making it infeasible to scan all IP addresses. Also it s interesting to note the excessive amounts of traffic to 1.0.168.192 which is from applications too broken to correctly send data to 192.168.0.1 which have been installed by sysadmins who are too incompetent to watch what is being sent out of their network.

• [1] http://www.urbanhonking.com/ideasfordozens/2009/05/why_the_arduino_matters.html
• [2] http://www.wired.com/gadgetlab/2010/07/tubesat-personal-satellite/
• [3] http://www.linuxjournal.com/article/10604
• [4] http://www.ted.com/talks/susan_shaw_the_oil_spill_s_toxic_trade_off.html
• [5] http://www.nytimes.com/2010/07/28/business/economy/28leonhardt.html
• [6] http://www.nytimes.com/2010/08/09/opinion/09krugman.html
• [7] http://thechive.com/2010/08/10/girl-quits-her-job-on-dry-erase-board-emails-entire-office-33-photos/
• [8] http://www.youtube.com/watch?v=9p1yBlV7Ges
• [9] http://www.askthepilot.com/essays-and-stories/terrorism-tweezers-and-terminal-madness-an-essay-on-security/
• [10] http://www.fredoneverything.net/Wikileaks.shtml
• [11] http://en.wikipedia.org/wiki/Borosilicate_glass
• [12] http://www.isoc-ny.org/?p=1338
• [13] http://wiki.debian.org/FreedomBox
• [14] http://meetings.apnic.net/__data/assets/pdf_file/0007/23398/ipv4-background-radiation.pdf

OCaml compiles native executables in static mode. It allows to have a minimal set of dependencies when delivering an executable. It has also disadvantages like the size of the executable and problems arising when considering libraries update -- but this is another topic. There is still one strong dependency that you should not forget when you want to deliver a product for most of the Linux distributions: dependency on the glibc version. Trying to run OASIS compiled with Debian Lenny, on CentOS 5.5:

$ OASIS
.../OASIS: /lib64/libc.so.6: version  GLIBC_2.7' not found (required by .../OASIS)

So when compiling for delivery, one should choose the oldest distribution he targets. In my case, I choose CentOS 5 which comes with glibc v2.5. I usually choose Debian stable at the moment of writing Debian Lenny. But for now, the Debian Lenny's glibc is newer (v2.7) than the one coming from the CentOS 5.5 stable release. CentOS is a Red Hat like Linux distribution. I use a Debian Lenny amd64 host system and I decided to setup a chroot of CentOS 5 i386 and amd64. I also setup schroot to use my CentOS chroot. CentOS 5 amd64 setup First of all we use rinse, which can setup a RPM based distribution in a chroot. The version v1.3 shipped with Debian Lenny has some bugs: it doesn't install nss and other mandatory packages. So I downloaded v1.7 directly from Debian Sid. There is no dependencies problems and the package is arch:all, so it is straightforward to install:

$ wget http://ftp.de.debian.org/debian/pool/main/r/rinse/rinse_1.7-1_all.deb # Replace ftp.de.debian.org by your preferred Debian mirror
$ dpkg -i rinse_1.7-1_all.deb

Then I create the chroot directory and launch rinse:

$ mkdir /srv/chroot/centos5-amd64
$ rinse --arch amd64 --distribution centos-5 --directory /srv/chroot/centos5-amd64 # N.B. you must use --arch, the default is i386

Once installation is complete, you can add an entry for this distribution in /etc/schroot/schroot.conf:

[centos5-amd64]
description=Centos 5 (amd64)
location=/srv/chroot/centos5-amd64
priority=3
users=XXX
groups=
root-groups=root
type=directory
run-setup-scripts=true
run-exec-scripts=true

Replace XXX by your login. If you try to login directly, you will get warnings:

$ schroot -c centos5-i386
I : [chroot centos5-i386-a952de23-7f4b-4bae-a9b9-752ecee4a185] Ex cution de l'interpr teur de commandes initial :  /bin/bash 
-bash: /dev/null: Permission denied
-bash: /dev/null: Permission denied
-bash: /dev/null: Permission denied
-bash: /dev/null: Permission denied
-bash: /dev/null: Permission denied

This is a bit misleading because the real problem is that nothing is created in /dev/. CentOS delegates creating char/block devices to udev. You have two solutions to solve this issue:

• login and call MAKEDEV to create missing devices:

$ MAKEDEV random
$ MAKEDEV console
$ MAKEDEV zero
$ MAKEDEV null
$ MAKEDEV stdout
$ MAKEDEV stdin
$ MAKEDEV stderr

• use an already setup Debian chroot to copy the missing devices:

$ rsync -av /srv/chroot/lenny-amd64/dev/* /srv/chroot/centos5-amd64/dev/

That's it, you now have a functional chrooted CentOS 5 environment:

$ schroot -c centos5-amd64 cat /etc/redhat-release
I : [chroot centos5-amd64-b9bae264-285b-4d17-a046-13386736cecd] Ex cution de la commande :   cat /etc/redhat-release  
CentOS release 5.5 (Final)

CentOS 5 i386 setup To setup an i386 environment, we follow almost the same scheme, except we need to fix a bug in rinse v1.7: we need to call linux32 before executing chroot. The problem is that the first stage installation of rinse install an i386/686 environment but as soon as you call chroot yum install ..., it will guess that the system is amd64 and will install missing packages. See the Debian bug report and the example patch attached to correct this behavior. WARNING: this patch is just an example, you can apply it for creating CentOS i386 chroot on Lenny amd64 host but you should remove the patch as soon as the installation is complete.

$ mkdir /srv/chroot/centos5-i386/
$ rinse --arch i386 --distribution centos-5 --directory /srv/chroot/centos5-i386 # With /usr/lib/rinse/centos-5/post-install.sh patched 
$ rsync -av /srv/chroot/lenny-i386/dev/* /srv/chroot/centos5-i386/dev/

Add this distribution to /etc/schroot/schroot.conf:

[centos5-i386]
description=Centos 5 (i386)
location=/srv/chroot/centos5-i386
priority=3
users=XXX
groups=
root-groups=root
type=directory
run-setup-scripts=true
run-exec-scripts=true
personality=linux32

You now have a schroot of CentOS 5 i386:

$ schroot -c centos5-i386 cat /etc/redhat-release
I : [chroot centos5-i386-9acafa91-9862-4488-aaef-4ab2a482771e] Ex cution de la commande :  cat /etc/redhat-release 
CentOS release 5.5 (Final)

Happy schroot hacking!

Due to a variety of people and places we want to see, Mika and I have regrouped around a more ambitious travel schedule in Italy for the next week or so. Our new plan is:

• August 23-27: Florence
• August 27-29: Verona
• August 29-31: Bologna
• August 31-September 1: Siena
• September 1-3: Rome

I know we'll have an organized LUG meeting in Siena. The rest of the period is a little more open. As always, if other free software, wikimedian, or like-minded folks are around and would like to meet up in any of those places, don't hesitate to get in contact. In related news, inspired by Florence and by Mika's domo-kun purse, I made a duomo-kun today.

Apparently this statements also holds true for frozen yogurt. An Austrian A1 spokes person has confirmed that the HTC Magic will not receive a 2.1 or 2.2 Android update. One can only wonder about the sugar HTC puts on top of regular Android that hinders themself to update their products. The Austrian A1 carrier sells you the device for a 18 month contract, but actively only supported it for 6 month. I must revise my previous positive review of the HTC Magic. Some HTC speaker had promised earlier this year an upgrade to at least 2.1: HTC Magic 2.1 upgrade. A SFR speaker had promised an update to current Android: HTC Magic and Nexus One 2.2 upgrade. The Webkit Android Browser can be easily tricked into leaking your user and passwords: Android Luecke. Beside the obvious that as a user one shouldn't give out to much data to untrusted third party this opens lots of Google accounts for criminal activity. The inability of the carrier to provide a secure and uptodate device is massively deceiving and certainly not appropriate handling of their defects liability.

The Chicago Symphony hosted the world premiere of Louis last evening, and I had snatched the (literally) last available ticket. The film, which is written, directed and producted by Dan Pritzker, is based loosely on the early years of Louis Armstrong in New Orleans. The movie is shot beautifully by Vilmos Zsigmond in blend of colour and black-and-white which works very well for invoking the early days of film. A key part of the production is of course the score, and the live music with both a thirteen-piece orchestra featuring Wynton Marsalis as well as piano solo recitals by Cecile Licad with an emphasis on pieces by 19th-century composer Louis Moreau Gottschalk. The combination of a silent movie with a stong live band is something to behold -- if you can catch the movie and performance in a city nearby, go!

My file system sematics program presented a few days ago is very useful to verify that a file system can work as a unix home directory,and today I had to extend it a bit. I'm looking into alternatives for home directory access here at the University of Oslo, and one of the options is sshfs. My friend Finn-Arne mentioned a while back that they had used sshfs with Debian Edu, but stopped because of problems. I asked today what the problems where, and he mentioned that sshfs failed to handle umask properly. Trying to detect the problem I wrote this addition to my fs testing script:

mode_t touch_get_mode(const char *name, mode_t mode)  
  mode_t retval = 0;
  int fd = open(name, O_RDWR O_CREAT O_LARGEFILE, mode);
  if (-1 != fd)  
    unlink(name);
    struct stat statbuf;
    if (-1 != fstat(fd, &statbuf))  
      retval = statbuf.st_mode & 0x1ff;
     
    close(fd);
   
  return retval;
 
/* Try to detect problem discovered using sshfs */
int test_umask(void)  
  printf("info: testing umask effect on file creation\n");
  mode_t orig_umask = umask(000);
  mode_t newmode;
  if (0666 != (newmode = touch_get_mode("foobar", 0666)))  
    printf("  error: Wrong file mode %o when creating using mode 666 and umask 000\n",
           newmode);
   
  umask(007);
  if (0660 != (newmode = touch_get_mode("foobar", 0666)))  
    printf("  error: Wrong file mode %o when creating using mode 666 and umask 007\n",
           newmode);
   
  umask (orig_umask);
  return 0;
 
int main(int argc, char **argv)  
  [...]
  test_umask();
  return 0;
 

Sure enough. On NFS to a netapp, I get this result:

Testing POSIX/Unix sematics on file system
info: testing symlink creation
info: testing subdirectory creation
info: testing fcntl locking
  Read-locking 1 byte from 1073741824
  Read-locking 510 byte from 1073741826
  Unlocking 1 byte from 1073741824
  Write-locking 1 byte from 1073741824
  Write-locking 510 byte from 1073741826
  Unlocking 2 byte from 1073741824
info: testing umask effect on file creation

When mounting the same directory using sshfs, I get this result:

Testing POSIX/Unix sematics on file system
info: testing symlink creation
info: testing subdirectory creation
info: testing fcntl locking
  Read-locking 1 byte from 1073741824
  Read-locking 510 byte from 1073741826
  Unlocking 1 byte from 1073741824
  Write-locking 1 byte from 1073741824
  Write-locking 510 byte from 1073741826
  Unlocking 2 byte from 1073741824
info: testing umask effect on file creation
  error: Wrong file mode 644 when creating using mode 666 and umask 000
  error: Wrong file mode 640 when creating using mode 666 and umask 007

So, I can conclude that sshfs is better than smb to a Netapp or a Windows server, but not good enough to be used as a home directory. Update 2010-08-26: Reported the issue in BTS report #594498 Update 2010-08-27: Michael Gebetsroither report that he found the script so useful that he created a GIT repository and stored it in http://github.com/gebi/fs-test.

On the other hand I have managed to take a family holiday in sunny Brittany...