"Again, we see there is nothing you can possess which I cannot take away."
The imagery of the ark appears to be borrowed from James Tissot's The Ark Passes Over the Jordan, part of the fin de siecle fascination with the occult and (ironically enough given the background of Raiders' director), a French Catholic revival.
The Lord said to Moses: Tell your brother Aaron that he is not to come whenever he chooses into the Most Holy Place behind the curtain in front of the atonement cover on the ark, or else he will die, for I will appear in the cloud above the mercy seat.But would it be too much of a stretch to also see the myth of Orpheus and Eurydices too? Orpheus's wife would only be saved from the underworld if he did not turn around until he came to his own house. But he turned round to look at his wife, and she instantly slipped back into the depths:
For he who overcome should turn back his gazePerhaps not, given that Marion and the ark are not lost in quite the same way. But whilst touching on gender, it was interesting to update my view of archaeologist Ren Belloq. To countermand his slight queer coding (a trope of Disney villains such as Scar, Jafar, Cruella, etc.), there is a rather clumsy subplot involving Belloq repeatedly (and half-heartedly) failing to seduce Marion. This disavows any idea that Belloq isn't firmly heterosexual, essential for the film's mainstream audience, but it is especially important in Raiders because, if we recall the relationship between Belloq and Jones: 'it would take only a nudge to make you like me'. (This would definitely put a new slant on 'Top men'.)
Towards the Tartarean cave,
Whatever excellence he takes with him
He loses when he looks on those below.
"Again, we see there is nothing you can possess which I cannot take away."The imagery of the ark appears to be borrowed from James Tissot's The Ark Passes Over the Jordan, part of the fin de siecle fascination with the occult and (ironically enough given the background of Raiders' director), a French Catholic revival.The Lord said to Moses: Tell your brother Aaron that he is not to come whenever he chooses into the Most Holy Place behind the curtain in front of the atonement cover on the ark, or else he will die, for I will appear in the cloud above the mercy seat.But would it be too much of a stretch to also see the myth of Orpheus and Eurydices too? Orpheus's wife would only be saved from the underworld if he did not turn around until he came to his own house. But he turned round to look at his wife, and she instantly slipped back into the depths:
For he who overcome should turn back his gazePerhaps not, given that Marion and the ark are not lost in quite the same way. But whilst touching on gender, it was interesting to update my view of archaeologist Ren Belloq. To countermand his slight queer coding (a trope of Disney villains such as Scar, Jafar, Cruella, etc.), there is a rather clumsy subplot involving Belloq repeatedly (and half-heartedly) failing to seduce Marion. This disavows any idea that Belloq isn't firmly heterosexual, essential for the film's mainstream audience, but it is especially important in Raiders because, if we recall the relationship between Belloq and Jones: 'it would take only a nudge to make you like me'. (This would definitely put a new slant on 'Top men'.)
Towards the Tartarean cave,
Whatever excellence he takes with him
He loses when he looks on those below.
Last Thursday was my last working day at DFINITY. There are various reasons why I felt that after almost three years the DFINITY Foundation isn t quite the right place for me anymore, and this plan has been in the making for a while. Primarily, there are personal pull factors that strongly suggest that I ll take a break from full time employment, so I decided to see the launch of the Internet Computer through and then leave.
DFINITY has hired some amazing people, and it was a great pleasure to work with them. I learned a lot (some Rust, a lot of Nix, and just how merciless Conway s law is), and I dare say I had the opportunity to do some good work, contributing my part to make the Internet Computer a reality.
I am especially proud of the Interface Specification and the specification-driven design principles behind it. It even comes with a model reference implementation and acceptance test suite, and although we didn t quite get to do formalization, those familiar with the DeepSpec project will recognize some influence of their concept of deep specifications .
Besides that, there is of course my work on the Motoko programming language, where I build the backend,a the Candid interoperability layer, where I helped with the formalism, formulated the a generic soundness criterion for Interface Description Languages in a higher order settings and formally verified that in Coq. Fortunately, all of this work is now Free Software or at least Open Source.
With so much work poured into this project, I continue to care about it, and you ll see me post on the the developer forum and hack on Motoko. As the Internet Computer becomes gradually more open, I hope I can be gradually more involved again. But even without me contributing full-time I am sure that DFINITY and the Internet Computer will do well; when I left there were still plenty of smart, capable and enthusiastic people forging ahead.
So what s next?
So far, I have rushed every professional transition in my life: When starting my PhD, when starting my postdoc, when starting my job at DFINITY, and every time I regretted it. So this time, I will take a proper break and will explore the world a bit (as far as that is possible given the pandemic). I will stresslessly contribute to various open source projects. I also hope to do more public outreach and teaching, writing more blog posts again, recording screencasts and giving talks and lectures. If you want to invite me to your user group/seminar/company/workshop, please let me know! Also, I might be up for small interesting projects in a while.
Beyond these, I have no concrete plans and am looking forward to the inspiration I might get from hiking through the Scandinavian wilderness. If you happen to stumble across my tent, please stop for a tea.
Every couple of months, one of my users falls prey to phishing
attacks, and send their login/password data to an unknown somebody
who poses as Well, as me, their always-friendly and always-helpful
systems administrator.
What follows is, of course, me spending a week trying to get our
systems out of all of the RBLs/DNSBLs. But, no matter how fast I act,
there s always distruption and lost mails (bounced or classified as
spam) for my users.
Most of my users use the Webmail I have configured on our institute s
servers, Roundcube, for which I have the
highest appreciation. Only that Of course, when a user yields their
username and password to an attacker, it is very successful
at Sending huge amounts of unrequested mail, leading to my server
losing its reputation
This week, I set two bits of mitigation strategies. The first one,
most straightforward, was to ask Roundcube to disallow sending mails
with over ten recipients. In a Debian install, this is as easy as
setting up the following variable in /etc/roundcube/config.inc.php:
$config['max_recipients'] = 10
/index.php and there is quite a bit of
parsing to do to understand the actions done. When sending a mail, of
course, it is done using the POST HTTP verb, and the URI-specified
variables include _task=mail&_unlock=loading<message_id> (of course,
with changing message IDs).
After some poking here and there, I faced to SpiderLabs
ModSecurity Only
that I am not yet well versed in writing rules for it. But after quite
a bit of reading, poking, breaking I was able to come up with the
following rules:
# How often does the limit counter expire ratelimit_client=60,
# every 60 seconds
SecRule REQUEST_LINE "@rx POST.*_task=mail&_unlock" id:10,phase:2,nolog,pass,setuid:% tx.ua_hash ,setvar:user.ratelimit_client=+1,expirevar:user.ratelimit_client=60
# How many requests do we allow in the specified time period?
# @gt 3, 3 requests
SecRule user:ratelimit_client "@gt 2" chain,id:100009,phase:2,deny,status:429,setenv:RATELIMITED,log,msg:RATE-LIMITED
SecRule REQUEST_LINE "@rx POST.*_task=mail&_unlock"
_task=mail&_unlock fragment in the
URL. It increments tht ratelimit_client user variable, but expires
it after 60 seconds.
The first line verifies whether the above specified variable (do note
that it s user: instead of user.) is greater than 2. If so, it
sets the deny action, HTTP return status of 429 (Too Many
Requests), and logs the reason why this request was denied
(rate-limited).
And Given the way Roundcube works, this even works transparently!
If a user hits the limit, the mail sending component will just wait
and, after a while, time out. Then, the user can click Send
again. If legitimate users are too productive and try to send over
three mails in a minute, they won t lose any of it; spammers will
(hopefully!) find it unbearably slow and give up.
Logging is quite informative; I will probably later restrict it to
show fewer parts (even if just for privacy sake, as it logs the full
request!) For a complex permissions framework such as mod_security,
having information such as the following is most welcome in order to
find a possibly misbehaving rule:
--76659f4b-H--
Message: Access denied with code 429 (phase 2). Pattern match "POST.*_task=mail&_unlock" at REQUEST_LINE. [file "/etc/modsecurity/rate_limit_sender.conf"] [line "20"] [id "100009"] [msg "RATELIMITED BOT"]
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client 192.168.1.48] ModSecurity: Access denied with code 429 (phase 2). Pattern match "POST.*_task=mail&_unlock" at REQUEST_LINE. [file "/etc/modsecurity/rate_limit_sender.conf"] [line "20"] [id "100009"] [msg "RATELIMITED BOT"] [hostname "my.server.mx"] [uri "/roundcube/"] [unique_id "YMzJLR9jVDMGsG@18kB1qAAAAAY"]
Action: Intercepted (phase 2)
Stopwatch: 1624033581838813 1204 (- - -)
Stopwatch2: 1624033581838813 1204; combined=352, p1=29, p2=140, p3=0, p4=0, p5=94, sr=81, sw=89, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/).
Server: Apache
WebApp-Info: "default" "-" ""
Engine-Mode: "ENABLED"
@dataclass class Host: """ A host to be provisioned. """ name: str type: str = "Mitogen" args: Dict[str, Any] = field(default_factory=dict) def _make_system(self) -> System: cls = getattr(transilience.system, self.type) return cls(self.name, **self.args)
# Add host/group variables to role constructor args host_fields = f.name: f for f in fields(host) for field in fields(role_cls): if field.name in host_fields: role_kwargs.setdefault(field.name, getattr(host, field.name)) role = role_cls(**role_kwargs)
@dataclass class Webserver: server_name: str = "www.example.org" @dataclass class Srv1(Webserver): ...
isinstance or issubclass test.
Playbooks
So far Transilience is executing on one host at a time, and Ansible can execute
on a whole host inventory.
Since the most part of running a playbook is I/O bound, we can parallelize
hosts using threads, without worrying too much about the performance impact of
GIL.
Let's introduce a Playbook class as the main entry point for a playbook:
class Playbook: def setup_logging(self): ... def make_argparser(self): description = inspect.getdoc(self) if not description: description = "Provision systems" parser = argparse.ArgumentParser(description=description) parser.add_argument("-v", "--verbose", action="store_true", help="verbose output") parser.add_argument("--debug", action="store_true", help="verbose output") return parser def hosts(self) -> Sequence[Host]: """ Generate a sequence with all the systems on which the playbook needs to run """ return () def start(self, runner: Runner): """ Start the playbook on the given runner. This method is called once for each system returned by systems() """ raise NotImplementedError(f" self.__class__.__name__ .start is not implemented") def main(self): parser = self.make_argparser() self.args = parser.parse_args() self.setup_logging() # Start all the runners in separate threads threads = [] for host in self.hosts(): runner = Runner(host) self.start(runner) t = threading.Thread(target=runner.main) threads.append(t) t.start() # Wait for all threads to complete for t in threads: t.join()
from dataclasses import dataclass import sys from transilience import Playbook, Host @dataclass class MyServer(Host): srv_root: str = "/srv" site_admin: str = "enrico@enricozini.org" class VPS(Playbook): """ Provision my VPS """ def hosts(self): yield MyServer(name="server", args= "method": "ssh", "hostname": "host.example.org", "username": "root", ) def start(self, runner): runner.add_role("fail2ban") runner.add_role("prosody") runner.add_role( "mailserver", postmaster="enrico", myhostname="mail.example.org", aliases= ... ) if __name__ == "__main__": sys.exit(VPS().main())
./provision --help usage: provision [-h] [-v] [--debug] Provision my VPS optional arguments: -h, --help show this help message and exit -v, --verbose verbose output --debug verbose output
Role classes could become dataclasses, too, and declare the variables and
facts that they intend to use (typed, even!):
class Role(role.Role): """ Postfix mail server configuration """ # Postmaster username postmaster: str = None # Public name of the mail server myhostname: str = None # Email aliases defined on this mail server aliases: Dict[str, str] = field(default_factory=dict)
dataclasses.asdict()
I immediately gain context variables for rendering Jinja2 templates:
class Role: # [...] def render_file(self, path: str, **kwargs): """ Render a Jinja2 template from a file, using as context all Role fields, plus the given kwargs. """ ctx = asdict(self) ctx.update(kwargs) return self.template_engine.render_file(path, ctx) def render_string(self, template: str, **kwargs): """ Render a Jinja2 template from a string, using as context all Role fields, plus the given kwargs. """ ctx = asdict(self) ctx.update(kwargs) return self.template_engine.render_string(template, ctx)
# From ansible/module_utils/facts/system/platform.py @dataclass class Platform(Facts): """ Facts from the platform module """ ansible_system: Optional[str] = None ansible_kernel: Optional[str] = None ansible_kernel: Optional[str] = None ansible_kernel_version: Optional[str] = None ansible_machine: Optional[str] = None # [...] ansible_userspace_architecture: Optional[str] = None ansible_machine_id: Optional[str] = None def summary(self): return "gather platform facts" def run(self, system: transilience.system.System): super().run(system) # ... collect facts
Facts
action will collect, and what variables a Role needs.
At this point, I can add machinery to allow a Role to declare what Facts it
needs, and automatically have the fields from the Facts class added to the
Role class. Then, when facts are gathered, I can make sure that their fields
get copied over to the Role classes that use them.
In a way, variables become role-scoped, and Facts subclasses can be used like
some kind of Role mixin, that contributes only field members:
# Postfix mail server configuration @role.with_facts([actions.facts.Platform]) class Role(role.Role): # Postmaster username postmaster: str = None # Public name of the mail server myhostname: str = None # Email aliases defined on this mail server aliases: Dict[str, str] = field(default_factory=dict) # All fields from actions.facts.Platform are inherited here! def have_facts(self, facts): # self.ansible_domain comes from actions.facts.Platform self.add(builtin.command( argv=["certbot", "certonly", "-d", f"mail. self.ansible_domain ", "-n", "--apache"], creates=f"/etc/letsencrypt/live/mail. self.ansible_domain /fullchain.pem" ), name="obtain mail.* certificate") # the template context will have the Role variables, plus the variables # of all the Facts the Role uses with self.notify(ReloadPostfix): self.add(builtin.copy( dest="/etc/postfix/main.cf", content=self.render_file("roles/mailserver/templates/main.cf"), ), name="configure /etc/postfix/main.cf")
runner.add_role( "mailserver", postmaster="enrico", myhostname="mail.enricozini.org", aliases= "me": "enrico", , )
A while ago, I got a request from Kentaro Hayashi on the project I use to manage funding requests addressed to Freexian. He was keen to see some improvements on the way reimbursement requests are handled in Debian. In my opinion, the idea is certainly good but he s not part of the treasurer team and was not willing to implement the project either, so it was not really ready to be submitted to us.
To be able to fund a useful project, we need either someone that is willing to do the work and try to push it further in Debian, or we need a Debian team interested in the result of the project (and in that case, we can try to find someone willing to implement the project). In this case, it s a bit sad that the treasurer team didn t comment at all but in general, what should we do with those suggestions ?
It would still be interesting to have a list of such suggestions and have Debian developers be able to advocate (+1) those suggestions. It s in this spirit that Kentaro created the Grow your ideas project on salsa.debian.org. Browse the list of issues, submit your own and click on 
(+1) to bump the suggestions that you find interesting. And click on the Watch button on the homepage to receive notifications when others submit suggestions so that you can evaluate those suggestions and possibly improve them through your comments.
In the end, this can only help those that are looking for ways to contribute to Debian: maybe some of them will formalize a concrete action plan and request funding for it! We have a pile of money sitting unused that s clearly targeted to pay contributors to improve our infrastructure. And we have endless lists of (wishlist) bugs on all our infrastructure projects (dak, distro-tracker, ). What are you waiting ?
Powershell and nushell take unix piping beyond raw streams of text to
structured or typed data. Is it possible to keep a traditional shell
like bash and still get typed pipes?
I think it is possible, and I'm now surprised noone seems to have done it
yet. This is a fairly detailed design for how to do it. I've not
implemented it yet. RFC.
Let's start with a command called typed. You can use it in a pipeline
like this:
typed foo typed bar typed baz
typed does is discover the types of the commands to its left and its
right, while communicating the type of the command it runs back to them.
Then it checks if the types match, and runs the command, communicating the
type information to it. Pipes are unidirectional, so it may seem hard
to discover the type to the right, but I'll explain how it can be done
in a minute.
Now suppose that foo generates json, and bar filters structured data of a
variety of types, and baz consumes csv and pretty-prints a table. Then bar
will be informed that its input is supposed to be json, and that its output
should be csv. If bar didn't support json, typed foo and typed bar
would both fail with a type error.
Writing "typed" in front of everything is annoying. But it can be made a
shell alias like "t". It also possible to wrap programs using typed:
cat >~/bin/foo <<EOF
#/usr/bin/typed /usr/bin/foo
EOF
typed, so it
natively supports being used in typed pipelines. I'll explain one way to
make such a library later on, once some more details are clear.
Which gets us back to a nice simple pipeline, now automatically typed.
foo bar baz
find bar baz
# type error, bar expected json or csv
foo bar less
# less displays csv
typed discover the types of the commands to the left and
right? That's the hard part. It has to start by finding the pids to its
left and right. There is no really good way to do that, but on Linux, it
can be done: Look at what /proc/self/fd/0 and /proc/self/fd/1 link to,
which contains the unique identifiers of the pipes. Then look at other
processes' fd/0 and fd/1 to find matching pipe identifiers. (It's also
possible to do this on OSX, I believe. I don't know about BSDs.)
Searching through all processes would be a bit expensive (around 15 ms with
an average number of processes), but there's a nice optimisation:
The shell will have started the processes close together in time, so the
pids are probably nearby. So look at the previous pid, and the next
pid, and fan outward. Also, check isatty to detect the beginning and end
of the pipeline and avoid scanning all the processes in those cases.
To indicate the type of the command it will run, typed simply opens
a file with an extension of ".typed". The file can be located
anywhere, and can be an already existing file, or can be created as needed
(eg in /run). Once it discovers the pid at the other end of a
pipe, typed first looks at /proc/$pid/cmdline to see if it's
also running typed. If it is, it looks at its open file handles
to find the first ".typed" file. It may need to wait for the file handle
to get opened, which is why it needs to verify the pid is running typed.
There also needs to be a way for typed to learn the type of the command
it will run. Reading /usr/share/typed/$command.typed is one way.
Or it can be specified at the command line, which is useful for wrapper scripts:
cat >~/bin/bar <<EOF
#/usr/bin/typed --type="JSON CSV" --output-type="JSON CSV" /usr/bin/bar
EOF
typed communicates the type information to the command that it runs.
This way a command like bar can know what format its input should be in,
and what format to use as output. This might be done with environment
variables, eg INPUT_TYPE=JSON and OUTPUT_TYPE=CSV
I think that's everything typed needs, except for the syntax of types and
how the type checking works. Which I should probably not try to think up
off the cuff. I used Haskell ADT syntax in the example above, but don't
think that's necessarily the right choice.
Finally, here's how to make a library that lets a program natively support
being used in a typed pipeline. It's a bit tricky, because it has to run
typed, because typed checks /proc/$pid/cmdline as detailed above. So,
check an environment variable. When not set yet, set it, and exec typed,
passing it the path to the program, which it will re-exec. This should
be done before program does anything else.
The Python programming language is one of the most popular and in huge demand. It is free, has a large community, is intended for the development of projects of varying complexity, is easy to learn, and opens up great opportunities for programmers. To work comfortably with it, you need special Python tools, which are able to simplify your work. We have selected the best Python tools that will be relevant in 2021.
In May I was assigned 13.5 hours of work by Freexian's Debian LTS
initiative and carried over 4.5 hours from earlier months. I worked
16 hours and will carry over the remainder.
I finished reviewing the futex code in the PREEMPT_RT patchset for
Linux 4.9, and identified several places where it had been
mis-merged with the recent futex security fixes. I sent a patch for
these upstream, which was accepted and applied in v4.9.268-rt180.
I have continued updating the Linux 4.9 package to later upstream
stable versions, and backported some missing security fixes. I have
still not made a new upload, but intend to do so this week.
It's been more than a year since I wrote about Opinionated IkiWiki, a
pre-configured, containerized deployment of Ikiwiki
with opinions. My intention was to make something that is easy to get up and
running if you are more experienced with containers than IkiWiki.
I haven't yet switched to Opinionated IkiWiki for this site, but that was my
goal, and I think it's mature enough now that I can migrate over at some point,
so it seems a good time to call it Version 1.0. I have been using it for my
own private PIM systems for a while now.
You can pull built images from quay.io, here:
https://quay.io/repository/jdowland/opinionated-ikiwiki
The source lives here:
https://github.com/jmtd/opinionated-ikiwiki
A description of some of the changes made to the IkiWiki version lives here:
https://github.com/jmtd/ikiwiki/blob/opinionated-doc/README.md
class Role(role.Role): def main(self): self.add(builtin.apt( name=["fail2ban"], state="present", )) self.add(builtin.copy( content=inline(""" [postfix] enabled = true [dovecot] enabled = true """), dest="/etc/fail2ban/jail.local", owner="root", group="root", mode=0o644, ), name="configure fail2ban")
#!/usr/bin/python3 import sys from transilience.system import Mitogen from transilience.runner import Runner @Runner.cli def main(): system = Mitogen("my server", "ssh", hostname="server.example.org", username="root") runner = Runner(system) # Send roles to the server runner.add_role("general") runner.add_role("fail2ban") runner.add_role("prosody") # Run until all roles are done runner.main() if __name__ == "__main__": sys.exit(main())
from transilience import actions, role from transilience.actions import builtin from .handlers import RestartProsody class Role(role.Role): """ Set up prosody XMPP server """ def main(self): self.add(actions.facts.Platform(), then=self.have_facts) self.add(builtin.apt( name=["certbot", "python-certbot-apache"], state="present", ), name="install support packages") self.add(builtin.apt( name=["prosody", "prosody-modules", "lua-sec", "lua-event", "lua-dbi-sqlite3"], state="present", ), name="install prosody packages") def have_facts(self, facts): facts = facts.facts # Malkovich Malkovich Malkovich! domain = facts["domain"] ctx = "ansible_domain": domain self.add(builtin.command( argv=["certbot", "certonly", "-d", f"chat. domain ", "-n", "--apache"], creates=f"/etc/letsencrypt/live/chat. domain /fullchain.pem" ), name="obtain chat certificate") with self.notify(RestartProsody): self.add(builtin.copy( content=self.template_engine.render_file("roles/prosody/templates/prosody.cfg.lua", ctx), dest="/etc/prosody/prosody.cfg.lua", ), name="write prosody configuration") self.add(builtin.copy( src="roles/prosody/templates/firewall-ruleset.pfw", dest="/etc/prosody/firewall-ruleset.pfw", ), name="write prosody firewall") # ...
self.have_facts().
At that point, the role can use the results to build certbot command lines,
render prosody's configuration from Jinja2 templates, and use the results to
file further action down the pipe.
Note that this way, while the server is potentially still busy installing
prosody, we're already streaming prosody's configuration to it.
If anything goes wrong with the installation of prosody's package, the role
will be marked as failed and all further actions of the same role, even those
filed by have_facts() will be skipped.
Notify and handlers
In the previous example self.notify() also appears: that's my attempt to
model the equivalent of Ansible's handlers. If any of the actions inside the
with produce changes, then the RestartProsody role will be executed,
potentially filing more actions ad the end of the playbook.
The runner will take care of collecting all the triggered role classes in a
set,
which discards duplicates, and then running
the main() method of all resulting roles, which will cause more actions to be
filed down the pipe.
Action conditions
Sometimes some actions are only meaningful as consequences of other actions.
Let's take, for example, enabling buster-backports as an extra apt source:
a = self.add(builtin.copy( owner="root", group="root", mode=0o644, dest="/etc/apt/sources.list.d/debian-buster-backports.list", content="deb [arch=amd64] https://mirrors.gandi.net/debian/ buster-backports main contrib", ), name="enable backports") self.add(builtin.apt( update_cache=True ), name="update after enabling backports", # Run only if the previous copy changed anything when= a: ResultState.CHANGED , )
/etc/apt/sources.list.d/debian-buster-backports.list. If the
file was already there from a previous run, we can skip downloading the new
package lists.
The when= attributes adds an annotation to the action that is sent town the
pipeline, that says that it should only be run if the state of a previous
action matches the given one.
In this case, when on the remote it's the turn of "update after enabling
backports", it gets skipped unless the state of the previous "enable backports"
action is CHANGED.
Effects of pipelining
I ported enough of Ansible's modules to be able to run the provisioning scripts
of my VPS entirely via ansible.
This is the playbook run as plain Ansible:
$ time ansible-playbook vps.yaml [...] servername : ok=55 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 real 2m10.072s user 0m33.149s sys 0m10.379s
$ export ANSIBLE_STRATEGY=mitogen_linear $ time ansible-playbook vps.yaml [...] servername : ok=55 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 real 0m24.428s user 0m8.479s sys 0m1.894s
$ time ./provision [...] real 0m2.585s user 0m0.659s sys 0m0.034s
setup.py, publishing to PIP, packaging
in DebianTransilience: n. A leap across or from one thing to another [1913 Webster]Transilience. I like everything about this name. Now that the hardest problem is solved, the rest is just a simple matter of implementation details.
Next.