Search Results: "will"

14 September 2015

Lunar: Reproducible builds: week 20 in Stretch cycle

What happened in the reproducible builds effort this week: Media coverage Motherboard published an article on the project inspired by the talk at the Chaos Communication 15. Journalists sadly rarely pick their headlines. The sensationalist How Debian Is Trying to Shut Down the CIA got started a few rants here and there. One from OpenBSD developper Ted Unangst lead to a good email contact and some thorough comments. Toolchain fixes The modified version of gettext has been removed from the experimental toolchain. Fixing individual package seems a better approach for now. Chris Lamb sent two patches for abi-compliance-checker: one to drop the timestamp from generated HTML reports and another to make umask and timestamps deterministic in the abi tarball. Bugs submitted by Dhole lead to a discussion on the best way to adapt pod2man now that we have SOURCE_DATE_EPOCH specified. There is really a whole class of issues that are currently undiscovered waiting for tests running on a different date. This is likely to should happen soon. Chris Lamb uploaded a new version of debhelper in the reproducible repository, cherry-picking a fix for interactions between ddebs and udebs. Packages fixed The following packages became reproducible due to changes in their build dependencies: aspic, django-guardian, erlang-sqlite3, etcd, libnative-platform-java, mingw-ocaml, nose2, oar, obexftp, py3cairo, python-dugong, python-secretstorage, python-setuptools, qct, qdox, recutils, s3ql, wine. The following packages became reproducible after getting fixed: Some uploads fixed some reproducibility issues but not all of them: Patches submitted which have not made their way to the archive yet: reproducible.debian.net The configuration of all remote armhf and amd64 nodes in now finished. The remaining reproducibility tests running on the Jenkins host has been removed. armhf results and graphs are now visible in dashboard. We can now test the whole archive in 2-3 weeks using the current 12 amd64 jobs and 3 months using the current 6 armhf builders. We will be looking at improving the armhf sitation, maybe using more native systems or via arm64. (h01ger) The Jenkins UI is now more responsive since all jobs building packages have been moved to remote hosts. (h01ger) A new job has been added to collect information about build nodes to be included in the variation table. (h01ger) The currently scheduled page has been split for amd64 and armhf. They now give an overview (refreshed every minute, thanks to Chris Lamb) of the packages currently being tested. (h01ger) Several cleanup and bugfixes have been made, especially in the remote building and maintenance scripts. They should now be more robust against network problems. The automatic scheduler is now also run closer to when schroots and pbuilders are updated. (h01ger, mapreri) Package reviews 16 reviews have been removed, 54 added and 55 updated this week. Santiago Vila renamed lc_messages_randomness with the more descriptive different_pot_creation_date_in_gettext_mo_files. New issues added this week: timestamps_in_reports_generated_by_abi_compliance_checker, umask_and_timestamp_variation_in_tgz_generated_by_abi_compliance_checker, and timestamps_added_by_blast2. 23 new FTBFS bugs have been filled by Chris Lamb, and Niko Tyni. Misc. Red Hat developper Mike McLean had a talk at Flock 2015 about reproducible builds in Koji. Slides and video recording are available. Koji is the build infrastructure used by Fedora, Red Hat and other distributions. It already keeps track of the environment used for a given build, so the required changes for handling the environment are smaller than the ones in Debian. Fedora is still missing a team effort to fix non-determinism in the package builds, but it is great to see Fedora moving forward.

13 September 2015

Russ Allbery: Review: My Real Children

Review: My Real Children, by Jo Walton
Publisher: Tor
Copyright: May 2014
ISBN: 0-7653-3265-5
Format: Hardcover
Pages: 317
Patricia, the one form of her name that she's never used, is what the staff in the nursing home call her. "VC" is the frequent annotation on her daily chart: very confused. She's old, and forgetful, and trying very hard not to be her mother, and she remembers two lives. Not only remembers but lives: the nursing home isn't the same from day to day. They keep misplacing the lift, and the staff keep changing. But the memories are the strongest. She has two lives, two sets of children, all of whom she recognizes. When someone from one life visits, the other feels like a dream, but both of them persist. Two lives that divided at the most significant decision of her life. My Real Children is one of those books that fits in the broader speculative fiction genre as alternate history, but also has many of the virtues of mimetic fiction. It's the story of one woman's life, told, except for the opening frame, chronologically from start to finish. At the start, it's simple biography, telling Patty's story from childhood, through World War II, until the moment of her fateful decision in 1949. From there the narrative splits, and she lives two lives. And the world splits as well: in one, Kennedy was assassinated by a bomb; in another, the Cuban Missile Crisis escalated into something much worse. Much is still unchanged, including the general lives of people Patty knew well in one life and not in another, but the worlds keep diverging from each other and from ours. The exact nature of the divergence is not, however, a significant part of the book. This is not the type of alternate history that is obsessed with the point of change, or even the implications for the world. Rather, this novel is about one woman, one decision, and two very different paths through life. Different friends, different challenges, different careers... different hopes and dreams, and different children. But always the same person, the same sense of practicality, the same ethics. It's beautifully told, striking just the right balance of showing important moments in detail and passing quickly, but smoothly, over some years. And, as with Among Others, Walton strikes the perfect emotional balance, leaving some reactions understated, letting the reader bring their own reactions to the book, and filling it with small bits of telling, factual detail rather than internal monologues. This is also one of the most heart-wrenching books I've ever read. My Real Children is a whole life, and not an easy one, complete with the heartaches and betrayals, the good and bad decisions, care for elderly relatives, dementia, tragedy, and even abuse. And moments of shining joy or profound satisfaction, but made all the more poignant because they're fleeting. The reader knows, in a sense, how the story ends, which casts a shadow over the rest of the book. But, even without that shadow, life can be hard, or cruel, alongside the wonder and joy. And it ends, and the ending is not neat and clean and uplifting, although one can choose how one meets it. This is the story of a life, all of it, and how choices can divide that life, and how they can cast a long shadow over how one later defines oneself. This book hurts. A lot. Enough that I want to warn you in advance I was in tears through the last third of the book. But it hurts because it's so very real and deep, not via a blow-by-blow description of daily actions, but by striding unafraid into the deep complications of choice and consequence. It's also a profoundly feminist book, in a quiet and descriptive way. It shared the Tiptree award for 2015 and fully deserved it. Both of the protagonist's lives are struggles against expectations, around gender, sexuality, and the role of women in society. Those struggles take very different forms, but they share some deep similarities. Walton shows the impact from the bottom up: the effects on specific lives, specific people, specific situations. It's brilliantly done. One can't help but think of The Female Man given the telling of parallel lives, but this is a case study, whereas Russ's novel was a battle cry. It gets under your skin instead of in your face. (Use of subtlety on this topic is easier now, forty years of occasional progress past when Russ wrote her classic.) This is a much harder book to read than Among Others. It's less forgiving, less reassuring, less willing to provide a happy ending. Lives rarely have clean, happy endings; one has to construct them, by choosing the material to build the ending on. But it's a brilliant, profound book, in that way that stories about people in all their complexity can be. Be cautious about your mood when you read this, particularly if you've had the experience of caring for a dying relative, but it's a book I will remember for a very long time. Rating: 9 out of 10

Russ Allbery: Review: The Sea Thy Mistress

Review: The Sea Thy Mistress, by Elizabeth Bear
Series: Edda of Burdens #3
Publisher: Tor
Copyright: February 2011
ISBN: 0-7653-1884-9
Format: Hardcover
Pages: 334
The Sea Thy Mistress is the third book in the Edda of Burdens series, but the second book (By the Mountain Bound) was a prequel to the first, telling the story of an earlier world and the betrayal that ended it. This one is a direct sequel to All the Windwracked Stars, a complex and idea-rich book that I read more than six years ago. A challenging property of Bear's fiction is that it's short on explanation and doesn't hold your hand. This makes it lean, sharp, and effective if you're fully invested in it and can keep the context in your head. It becomes very hard to understand if you've mostly forgotten the plot of an earlier book. (Once again, I bemoan the death of the previous book synopsis in series fiction.) The Sea Thy Mistress is all about aftermath, loss, despair, unhealed wounds, old grudges, and complicated personal histories, and it relies very heavily on the reader being invested enough in the characters to care about all of those things. I wish I'd read this entire series closer together so that I could retain more of the state. The start of this story was therefore somewhat frustrating, as I scrambled to rebuild my memory of the first book and piece together the large cast. Thankfully, most of the characters are easy to care about. Aethelred reliably brought a smile to my face, and the opening scene of him finding a baby on the sea shore is a great piece of writing. Selene is back; she was one of my favorite characters in the first book. And Bear pulls off something I didn't think she could: the Grey Wolf is also back, for the third book, and he actually won me over. I think he grew up a bit; there's at least less whining and angst, and more effective action. It probably also helped that less of the story was told from his perspective. The Sea Thy Mistress is primarily the story of Cathoair and his son, Cathmar, and their encounter with a truly nasty threat: a goddess who has way more knowledge of how their world works than they do, and is out to destroy it. This review will necessarily be sketchy on details; most of them would partly spoil All the Windwracked Stars. (I suppose I'm spoiling it a bit anyway just by listing characters who are still around.) Cathmar is... not too irritating. He's young and stupid, and the first half of the book is a bit painful as he plays into the hands of the plot with much less information than the reader has available. But I was okay with him by the end of the book. Cathoair is a more complicated matter. I suspect whether you like this book will depend mostly on whether you can find some sympathy for his personal angst and self-destructive behavior, or at least tolerate him long enough to get to the ending. Quite a lot of this book consists of people behaving stupidly and horribly while those who love them stand by helplessly, unable to figure out how to break the cycle. If that sounds frustrating, you have the right impression. I really struggled with the first two-thirds of the book and started regretting reading it. But there is a payoff: one that's uncomfortable, raw, perilous, and sad, but also beautiful and honest and effective. Muire's role in this book may be minor, but it's very memorable. Despite the difficulties of the early book, I was very glad to have read it for the payoff. I'm not sure whether to recommend this or not, but I think it's worth reading if you enjoyed All the Windwracked Stars. If you do read it, though, try to read the whole series in close proximity. You'll want to remember the details between books. I'm now somewhat tempted to go back and re-read the whole series to experience it in context. Rating: 6 out of 10

12 September 2015

Michal Čihař: Weblate for translating everything

Weblate is not only useful for translating software, it can help in translating any content. Let's look where our users are using it. Software translation is the most usual use case. This is actually where Weblate was used for first time and still provides great support for that. As an example (and oldest project hosted in Weblate) you can look at phpMyAdmin, where Weblate also helps to keep in sync translation for different maintenance branches. It can also help you in using same terminology in command line utility and graphical one like it is done in Gammu and Wammu translations. Weblate also supports localization of mobile application. Android support was originally implemented for OsmAnd project, but now they also translate iOS application using Weblate. Another use case is for translating documentation. You need to have some infrastructure to do, but there are several free software project to help here as well. For phpMyAdmin documentation or documentation for python module Odorik the Sphinx documentation generator is used, which has support for translation of the documentation. I've recently published quick howto for this setup. Another great tool for translating documentation is Publican, it is Docbook based tool and is used for translating The Debian Administrator's Handbook. Last but not least, you can use Weblate to translate your website. For example website for Weblate itself is translated this way. Did you miss your use case for Weblate? Please let me know. PS: I've heard that one Linux distribution will start using Weblate soon.

Filed under: English phpMyAdmin SUSE Weblate 0 comments

11 September 2015

Matthias Klumpp: Deploying Limba packages: Ideas & current status

LimbaHubThe Limba project does not only have the goal to allow developers to deploy their applications directly on multiple Linux distributions while reducing duplication of shared resources, it should also make it easy for developers to build software for Limba. Limba is worth nothing without good tooling to make it fun to use. That s why I am working on that too, and I want to share some ideas of how things could work in future and which services I would like to have running. I will also show what is working today already (and that s quite something!). This time I look at things from a developer s perspective (since the last posts on Limba were more end-user centric). If you read on, you will also find a nice video of the developer workflow 1. Creating metadata and building the software To make building Limba packages as simple as possible, Limba reuses already existing metadata, like AppStream metadata to find information about the software you want to create your package for. To ensure upstreams can build their software in a clean environment, Limba makes using one as simple as possible: The limba-build CLI tool creates a clean chroot environment quickly by using an environment created by debootstrap (or a comparable tool suitable for the Linux distribution), and then using OverlayFS to have all changes to the environment done during the build process land in a separate directory. To define build instructions, limba-build uses the same YAML format TravisCI uses as well for continuous integration. So there is a chance this data is already present as well (if not, it s trivial to write). In case upstream projects don t want to use these tools, e.g. because they have well-working CI already, then all commands needed to build a Limba package can be called individually as well (ideally, building a Limba package is just one call to lipkgen). I am currently planning DeveloperIPK packages containing resources needed to develop against another Limba package. With that in place and integrated with the automatic build-environment creation, upstream developers can be sure the application they just built is built against the right libraries as present in the package they depend on. The build tool could even fetch the build-dependencies automatically from a central repository. 2. Uploading the software to a repository While everyone can set up their own Limba repository, and the limba-build repo command will help with that, there are lots of benefits in having a central place where upstream developers can upload their software to. I am currently developing a service like that, called LimbaHub . LimbaHub will contain different repositories distributors can make available to their users by default, e.g. there will be one with only free software, and one for proprietary software. It will also later allow upstreams to create private repositories, e.g. for beta-releases. 3. Security in LimbaHub Every Limba package is signed with they key of its creator anyway, so in order to get a package into LimbaHub, one needs to get their OpenPGP key accepted by the service first. Additionally, the Hub service works with a per-package permission system. This means I can e.g. allow the Mozilla release team members to upload a package with the component-ID org.mozilla.firefox.desktop or even allow those user(s) to own the whole org.mozilla.* namespace. This should prevent people hijacking other people s uploads accidentally or on purpose. 4. QA with LimbaHub LimbaHub should also act as guardian over ABI stability and general quality of the software. We could for example warn upstreams that they broke ABI without declaring that in the package information, or even reject the package then. We could validate .desktop files and AppStream metadata, or even check if a package was built using hardening flags. This should help both developers to improve their software as well as users who benefit from that effort. In case something really bad gets submitted to LimbaHub, we always have the ability to remove the package from the repositories as a last resort (which might trigger Limba to issue a warning for the user that he won t receive updates anymore). What works Limba, LimbaHub and the tools around it are developing nicely, so far no big issues have been encountered yet. That s why I made a video showing how Limba and LimbaHub work together at time: Still, there is a lot of room for improvement Limba has not yet received enough testing, and LimbaHub is merely a proof-of-concept at time. Also, lots of high-priority features are not yet implemented. LimbaHub and Limba need help! At time I am developing LimbaHub and Limba alone with only occasional contributions from others (which are amazing and highly welcomed!). So, if you like Python and Flask, and want to help developing LimbaHub, please contact me the LimbaHub software could benefit from a more experienced Python web developer than I am (and maybe having a designer look over the frontend later makes sense as well). If you are not afraid of C and GLib, and like to chase bugs or play with building Limba packages, consider helping Limba development :-)

Russell Coker: Running a Shell in a Daemon Domain

allow unconfined_t logrotate_t:process transition;
allow logrotate_t shell_exec_t bin_t :file entrypoint;
allow logrotate_t unconfined_t:fd use;
allow logrotate_t unconfined_t:process sigchld; I recently had a problem with SE Linux policy related to logrotate. To test it out I decided to run a shell in the domain logrotate_t to interactively perform some of the operations that logrotate performs when run from cron. I used the above policy to allow unconfined_t (the default domain for a sysadmin shell) to enter the daemon domain. Then I used the command runcon -r system_r -t logrotate_t bash to run a shell in the domain logrotate_t. The utility runcon will attempt to run a program in any SE Linux context you specify, but to succeed the system has to be in permissive mode or you need policy to permit it. I could have written policy to allow the logrotate_t domain to be in the role unconfined_r but it was easier to just use runcon to change roles. Then I had a shell in the logrotate_t command to test out the post-rotate scripts. It turned out that I didn t really need to do this (I had misread the output of an earlier sesearch command). But this technique can be used for debugging other SE Linux related problems so it seemed worth blogging about.
Related posts:
  1. Xen CPU use per Domain The command xm list displays the number of seconds of...
  2. SE Linux Lenny Status Update I previously described four levels of SE Linux support on...
  3. UBAC and SE Linux in Debian A recent development in SE Linux policy is the concept...

10 September 2015

Gunnar Wolf: So you want to get our book?

OK, I already bragged that our book on Operating Systems is finally printed and has, thus, been formally published. What I had not yet mentioned is how we planned its physical distribution. Yes, it is available for sale at some UNAM libraries... But coming to UNAM is sadly an option only for people who are in Mexico City. I have been quite busy, and was unable to come up with anything earlier, but I have finally finished setting up a decent although minimal web page for the book. In it, I mention the possible ways you can get your own printed copy of Fundamentos de sistemas operativos: Of course, the book is and will always be free for downloading, and its sources are online so you can easily derive from it as well. Enjoy! (and please report me any bugs you see!)

Gunnar Wolf: UNAM, more open than ever before.

Today I was refered to the publication of an "agreement" signed by my university's Rector: The Agreement that establishes the General Guidelines for the Open Access Policy of Universidad Nacional Aut noma de M xico. This is a document we have been waiting and pushing for throughout several years; I got involved in the Network of Digital Collections (Red de Acervos Digitales), RAD-UNAM back in 2011, and am honored to be its current coordinator, but this group has roots back in 2005. And, of course, by then several other people had been working on the topic without formal coordination. Not only we are happy because the agreement explicitly mentions our group as one of The Venues for Open Access publishing and dissemination in UNAM. In its seventh point, it mentions:
In the matters of Open Access, academic entities and university dependencies have the following obligations:
(...)
VII. Promote and support the creation and maintenance of institutional repositories, as well as the deposit of the digital resources produced by its academic community, which should be incorporated into Red de Acervos Digitales de la UNAM
(...)
So... We have done a good job. And there will be surely more to follow! I'm including here a copy of the agreement by itself (without the whole number of the Gaceta UNAM) because I will surely have to refer to it in the future.
AttachmentSize
Lineamientos generales para la pol tica de acceso abierto de la Universidad Nacional Aut noma de M xico89.83 KB

Dirk Eddelbuettel: Rcpp 0.12.1: First boat load of fixes!

The first updated in the 0.12.* series of Rcpp is now on the CRAN network for GNU R this morning, and I will push a Debian package. This follows the 0.12.0 release from late July which started to some serious new features. Rcpp has become the most popular way of enhancing GNU R with C++ code. As of today, 461 packages on CRAN depend on Rcpp for making analyses go faster and further. This release once again features contributions from a number of new contributors, with Florian Plaza O ate and Dan Dillon joining the fray with several pull requests each. Kurt Hornik also helped with a fix for a bad interaction between very recent R (3.2.2) changes and Rcpp; another related one was also addressed. A big Thanks! to everybody helping with code, bug reports or documentation, See below for a detailed list of changes extracted from the NEWS file.
Changes in Rcpp version 0.12.1 (2015-09-10)
  • Changes in Rcpp API:
    • Correct use of WIN32 instead of _WIN32 to please Windows 10
    • Add an assignment operator to DimNameProxy (PR #339 by Florian)
    • Add vector and matrix accessors .at() with bounds checking (PR #342 by Florian)
    • Correct character vector conversion from single char (PR #344 by Florian fixing issue #343)
    • Correct on use of R_xlen_t back to size_t (PR #348 by Romain)
    • Correct subsetting code to allow for single assignment (PR #349 by Florian)
    • Enable subset assignment on left and righ-hand side (PR #353 by Qiang, fixing issue #345)
    • Refreshed to included tinyformat template library (PR #357 by Dirk, issue #356)
    • Add operator<<() for vectors and matrices (PR #361 by Dan fixing issue #239)
    • Make String and String_Proxy objects comparable (PR #366 and PR #372 by Dan, fixing issue #191)
    • Add a new class Nullable for objects which may be NULL (PR #368 by Dirk and Dan, fixing issue #363)
    • Correct creation and access of large matrices (PR #370 by Florian, fixing issue #369)
  • Changes in Rcpp Attributes:
    • Correctly reset directory in case of no-rebuilding but Windows code (PR #335 by Dirk)
  • Changes in Rcpp Modules:
    • We no longer define multiple Modules objects named World in the unit tests with was seen to have a bad effect with R 3.2.2 or later (PR #351 by Dirk fixing issue #350).
    • Applied patch by Kurt Hornik which improves how Rcpp loads Modules (PR #353 by Dirk)
  • Changes in Rcpp Documentation:
    • The Rcpp.bib file with bibliographic references was updated.
Thanks to CRANberries, you can also look at a diff to the previous release As always, even fuller details are on the Rcpp Changelog page and the Rcpp page which also leads to the downloads page, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Norbert Preining: Getting CafeOBJ via MacPorts

I have finally finished the Portfile for CafeOBJ, which allows users to install CafeOBJ via the usual port command of MacPorts. For one needs to add our local source (which only ships CafeOBJ port), but I hope to get the port into the standard distribution soon. cafeobj-logo Necessary steps: This should give you a working installation of CafeOBJ 1.5.3. The port will be updated as soon as 1.5.4 is released (which should be rather soon). Enjoy, and please leave comments and suggestions how to improve the port file here, per email, or at our bug tracker.

9 September 2015

Mike Gabriel: MATE 1.10 has fully arrived in Debian unstable

Yesterday, I uploaded the last missing piece for fully having MATE Desktop Environment 1.10 in Debian unstable and soon in Debian stretch and Ubuntu 15.10. Providing MATE in Debian is, in the first place, a team effort. People from four Linux distributions plus the developers from upstream work on providing the MATE experience to the users of Debian. There are many people to thank. This time I will only mention two of them. Two guys that have worked really hard on the MATE 1.10 release in Debian: Martin Wimpress (from the Ubuntu MATE team, aka flexiondotorg) and Vlad Orlov (from MATE upstream, aka monsta). May the MATE Desktop Environment be of use to all of you... light+love,
Mike (aka sunweaver)

8 September 2015

Daniel Silverstone: Orchestration, a cry for help

Over the past few years, a plethora of orchestration frameworks have been exploding onto the scene. Many have been around for quite a while but not all have the same sort of community behind them. For example there's a very interesting option in Joey Hess' Propellor but that is hurt by needing to be able to build Propellor on all the hosts you manage. On the other hand, Ansible is able to operate without installing extra software on your target hosts, but instead it ends up very latency-bound which can cause problems when your managed hosts are "far away". I have considered CFEngine, Chef, Puppet and Salt in addition to the above mentioned options, but none of them feel quite right to me. I am looking for a way to manage a small number of hosts, at least one of which is not always online (my laptop) and all of which are essentially snowflakes whose sparkleybits I want some reasonable control over. I have a few basic requirements which I worry would be hard to meet -- I want to be able to make changes to my hosts by editing a file and committing/pushing it to a git server. I want to be able to manage a host entirely over SSH from one or more systems, ideally without having to install the orchestration software on the target host, but where if the software is present it will get used to accelerate matters. I don't want to have to install Ruby or PHP on any system in order to have orchestration, and some of the systems I wish to manage simply can't compile Haskell stuff sanely. I'm not desperately interested in learning yet more DSLs, but I appreciate that it will be necessary, but I really don't want to have to learn more than one DSL simply to run one frameworks. I don't want to have to learn strange and confusing combinations of file formats. For example, Ansible quite sensibly uses YAML for its structured data except for its host/group lists. It uses Jinja2 for its templating and looping, except for some things which it generates its own looping constructs inside its YAML. I also personally find Ansible's sportsball oriented terminology to be confusing, but that might just be me. So what I'm hoping is that someone will be able to point me at a project which combines all the wonderful features of the above, with a need to learn only one DSL and which doesn't require to be installed on the managed host but which can benefit from being so installed, is driven from git, and won't hurt my already overly burdened brain. Dear Lazyweb, pls. kthxbye.

Dirk Eddelbuettel: It was twenty years ago today...

sgt pepper Hm, wasn't there a catchy tune that started that way? Just kidding. But about twenty years ago today I sent this email about a new Debian package upload -- and that makes it (as best as I can tell) the earliest trace of me doing Debian work. It so happened that I did upload two packages in July of 1995 as well, but it was so early in the project that we did not have a mailing list archive for such things yet (!!). And I have a vague recollection that the two in July were an adoption---whereas the post referenced above announced efax as my first new package added to the distribution. And there were more to come ... Anyway, thanks for all the fish! Twenty years with Debian has been a great, great ride. I learned a lot from a lot of fantastic people, and I hope I helped a few people along the way with a package or two I still maintain. Debian remains a truly fabulous project which I hope will go strongly for another 20 (or even 22).

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Russ Allbery: Review: Dark Currents

Review: Dark Currents, by Jacqueline Carey
Series: Agent of Hel #1
Publisher: Roc
Copyright: 2012
Printing: October 2013
ISBN: 0-451-41483-7
Format: Mass market
Pages: 399
This is another much-belated review. Hopefully I can remember the book well enough to do it justice. Daisy Johanssen has normal urban fantasy problems: her father was an incubus who (somewhat unsurprisingly) didn't stick around, she has to keep careful control of her own demonic side, her father occasionally tries to tempt her to invoke demonic power, and it's possible that she could breach the walls protecting the world from demons and bring about Armageddon. The typical sort of thing. Also, there's an unexplained murder in her home town, a mid-western US resort town whose image does not go well with eldritch murders. Daisy's only official role with the town police department is as a part-time file clerk, but this is urban fantasy, so you know the protagonist is going to be hip-deep in some sort of crime investigation. In this case, that's because the Norse goddess Hel (as distinct from the origin of Daisy's father entirely different thing) also lives here, in a manner of speaking, and Daisy is her liaison. In this case, Hel decides she's the one who should dispense justice. Carey previously has primarily been an epic fantasy writer, and this is her first foray into urban fantasy. (Well, arguably Santa Olivia and its sequel count, but those felt closer to superhero fiction to me.) The language and tone of her epic fantasy is far different than the conventions of either urban fantasy or superhero fiction, and I thought Santa Olivia was somewhat awkward in places. (None of the profanity quite worked, for instance.) Dark Currents felt smoother and more comfortable, aided by a charming mid-western feel. A few of Daisy's first-person narrative quirks wore poorly, such as every reference to "the Seven Deadlies," but Carey did a solid job with a typical out-of-her-depth urban fantasy protagonist. I'm pretty tired of the standard mythology of urban fantasy, and that is a bit of a drawback here: vampires and werewolves both feature, and I think I could happily go ten years before reading another story about vampires or hunky werewolves. Carey adds her own take on ghouls, but it's still pretty similar to lots (and lots) of other series. Thankfully, there's a bit of Norse mythology, a bit of fairy, and one extremely memorable lamia (of the serpent-tail-below-the-waist variety, at least some of the time). Lurine, a reclusive, retired starlet, a friend of Daisy's mother, and Daisy's childhood babysitter, is the lamia in question. She absolutely steals the show. The dynamic between her and Daisy is perfect: Carey resists the urge to ruin it with dark hints or falling-outs to increase tension. Instead, she lets it be a bit quirky, a bit complicated, but full of the reliability of a deep friendship. And Lurine is a wonderful character, the kind that only works as a supporting character because she's best seen through other people's eyes. Daisy's mother just makes the dynamic better. The reader can believe she's the sort of person who would have an ill-advised fling with an incubus, but also the sort of person who could raise a daughter like Daisy without many resources other than sheer grit. She never loses her optimistic outlook on the world, but has enough backbone behind it to make Lurine's friendship with her entirely believable. The plot here is nothing particularly special. Daisy unravels various clues, gets deeper into complicated relationships between various factions, occasionally finds herself in serious trouble, and relies on the help of friends and allies. I would have enjoyed the book more with a lot less Cody and more of the less typical mythology. But the relationships between the female characters, and the sheer persistence of mid-western normality and ordinary life challenges in the face of so much supernatural meddling, help this book stand out from the crowd. Dark Currents is different from most of what Carey has written, and you may be a bit disappointed if you were hoping for the epic sweep of the Kushiel series. But I found myself charmed by it, and will be reading the next book of the series. Followed by Autumn Bones. Rating: 7 out of 10

Eriberto Mota: Debian: how to use blhc to solve hardening issues when packaging

Implementing the hardening When packaging in Debian, is very common to see the lintian messages 'hardening-no-relro' and 'hardening-no-fortify-functions' in some softwares written in C or C++. To solve these issues, we can use the 'blhc' tool (apt-get install blhc). Please, get the revision 1.11-9 of the icmpinfo package. You can get this revision from http://snapshot.debian.org or from http://eriberto.pro.br/debian/icmpinfo. As a shortcut, you can use the following command: 
$ dget -u http://eriberto.pro.br/debian/icmpinfo/icmpinfo_1.11-9.dsc
The icmpinfo 1.11-9 is almost clean for lintian (in 2015-09-07, Standards-Version 3.9.6). The only problem is: 
W: icmpinfo: hardening-no-relro usr/sbin/icmpinfo
To track the problem I will use blhc over the .build file: 
$ blhc icmpinfo_1.11-9_amd64.build
LDFLAGS missing (-Wl,-z,relro): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -o icmpinfo recvping.o print.o err.o icmpinfo.o pid.o
Note that the problem is some missing options (-Wl,-z,relro) for LDFLAGS when building icmpinfo (for newbies, in GCC, -o is used to indicate the name to be used for the final binary after the compilation). If you are using the DebHelper compat 9 (debian/compat=9) and the DebHelper 9 (debhelper >= 9 in Build-Depends field in d/control), some variables as CFLAGS, LDFLAGS, CPPFLAGS and CXXFLAGS will be automatically passed during calls to dh_auto_* programs (yes, you should use the new and reduced d/rules format - see as example the debian/rules of the icmpinfo 1.11-9; if you still have doubts, $ man dh). Now, we need discover the reason why the LDFLAGS is being changed between its generation by the Debian build system and its utilization by the upstream's source code. So, we need to check the upstream Makefile. There is in Makefile (after a 'quilt push -a', to apply all current patches): 
LDFLAGS= $(CFLAGS)
OBJECTS= recvping.o print.o err.o icmpinfo.o pid.o
TARGET = icmpinfo
$(TARGET): $(OBJECTS)
 $(CC) $(LDFLAGS) -o $@ $(OBJECTS) $(LDLIBS)
Hummm... The LDFLAGS content generated by Debian is being dropped by Makefile because it is saying that "LDFLAGS = CFLAGS content". This line is a problem because the upstream Makefile needs to take and use the CFLAGS and LDFLAGS independently. To fix the issue, you can use this patch: 
--- icmpinfo-1.11.orig/Makefile
+++ icmpinfo-1.11/Makefile
@@ -20,13 +20,13 @@ VERS = 1.11
 
 RM = rm -f
 
-LDFLAGS= $(CFLAGS)
+#LDFLAGS= $(CFLAGS)
 
 OBJECTS= recvping.o print.o err.o icmpinfo.o pid.o
 TARGET = icmpinfo
 
 $(TARGET): $(OBJECTS)
- $(CC) $(LDFLAGS) -o $@ $(OBJECTS) $(LDLIBS)
+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $(OBJECTS) $(LDLIBS)
 
 tgz: clean
 rm -f CHECKSUMS.asc
After a 'debuild' is a fact the problem is solved and the lintian is happy. See the blhc results: 
$ blhc ../icmpinfo_1.11-9_amd64.build
$
Now, we can improve the hardening. To see the current status, we can use the 'blhc --all' command. See here: 
blhc --all ../icmpinfo_1.11-9_amd64.build
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o recvping.o recvping.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o print.o print.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o err.o err.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o icmpinfo.o icmpinfo.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o pid.o pid.c
LDFLAGS missing (-fPIE -pie -Wl,-z,now): cc -Wl,-z,relro -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -o icmpinfo recvping.o print.o err.o icmpinfo.o pid.o
Well, we know that CFLAGS and LDFLAGS are present. Now, we can force the DebHelper to pass some extra options to make hardening better. Generally, is only needed to add the following line to debian/rules: 
export DEB_BUILD_MAINT_OPTIONS = hardening=+all
See the results (after a new debuild command): 
$ blhc --all ../icmpinfo_1.11-9_amd64.build
$
More examples Let me to show other example. I will use the mac-robber 1.02-3 (however, I disabled the Makefile.patch in debian/patches/series). After a debuild, the following lintian messages are presented: 
W: mac-robber: hardening-no-relro usr/bin/mac-robber
I: mac-robber: hardening-no-fortify-functions usr/bin/mac-robber
Using blhc: 
$ blhc ../mac-robber_1.02-3_amd64.build 
CFLAGS missing (-g -O2 -fstack-protector-strong -Wformat -Werror=format-security): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
LDFLAGS missing (-Wl,-z,relro): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
We need to verify what is the problem in Makefile with CFLAGS, CPPFLAGS and LDFLAGS when generating the binary 'mac-robber' (just recalling, -o mac-robber in GCC command). See: 
linux_notstatic: 
 $(CC) -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
There are no references to CFLAGS, CPPFLAGS and LDFLAGS. To solve the problem, we need patch the Makefile to make this: 
linux_notstatic: 
 $(CC) $(CFLAGS) $(LDFLAGS) $(CPPFLAGS) -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
As last example, is possible that the Makefile is overriding the content sent by DebHelper when building. See this line from a hypothetical Makefile: 
CFLAGS = -g -Wall
As you can see, the Makefile is redefining CFLAGS; consequently, it is discarding any previous content sent by DebHelper. To solve this issue, we can use the following patch: 
-CFLAGS = -g -Wall
+CFLAGS += -g -Wall
So, the content received from DebHelper will be added to '-g -Wall'. Default parameters As curiosity, to see the basic parameters created by DebHelper as hardening, use the command: 
$ dpkg-buildflags
To see the all parameters, use the command: 
$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags
More information More information about the hardening can be viewed at two places: https://wiki.debian.org/Hardening https://wiki.debian.org/HardeningWalkthrough I hope this help. Enjoy!

7 September 2015

Steve Kemp: The Jessie 8.2 point-release broke for me

I have about 18 personal hosts, all running the Jessie release of Debian GNU/Linux. To keep up with security updates I use unattended-upgrades. The intention is that every day, via cron, the system will look for updates and apply them. Although I mostly expect it to handle security updates I also have it configured such that point-releases will be applied by magic too. Unfortunately this weekend, with the 8.2 release, things broke in a significant way - The cron deamon was left in a broken state, such that all cronjobs failed to execute. I was amazed that nobody had reported a bug, as several people on twitter had the same experience as me, but today I read through a lot of bug-reports and discovered that #783683 is to blame: The solution: 
# dpkg --configure -a
# apt-get upgrade
I guess the good news is I spotted it promptly, with the benefit of hindsight the bug report does warn of this as being a concern, but I guess there wasn't a great solution. Anyway I hope others see this, or otherwise spot the problem themselves. In unrelated news the seaweedfs file-store I previously introduced is looking more and more attractive to me. I reported a documentation-related bug which was promptly handled, even though it turned out I was wrong, and I contributed CIDR support to whitelisting hosts which was merged in well. I've got a two-node "cluster" setup at the moment, and will be expanding that shortly. I've been doing a lot of little toy-projects in Go recently. This weekend I was mostly playing with the nats.io message-bus, and tying it together with sinatra.

Matthias Klumpp: Update notifications in Debian Jessie

Piwik told me that people are still sharing my post about the state of GNOME-Software and update notifications in Debian Jessie. So I thought it might be useful to publish a small update on that matter: I hope that clarifies things a little. Have fun using Debian 8!
UPDATE: It appears that many people have problems with getting update notifications in GNOME on Jessie. If you are affected by this, please try the following:
  1. Open dconf-editor and navigate to org.gnome.settings-daemon.plugins.updates. Check if the key active is set to true
  2. If that doesn t help, also check if at org.gnome.settings-daemon.plugins.updates the frequency-refresh-cache value is set to a sane value (e.g. 86400)
  3. Consider increasing the priority value (if it isn t at 300 already)
  4. If all of that doesn t help: I guess some internal logic in g-s-d is preventing a cache refresh then (e.g. because I thinks it is on a expensive network connection and therefore doesn t refresh the cache automatically, or thinks it is running on battery). This is a bug. If that still happens on Debian Stretch with GNOME-Software, please report a bug against the gnome-software package. As a workaround for Jessie you can enable unconditional cache refreshing via the APT cronjob by installing apt-config-auto-update.

6 September 2015

Lunar: Reproducible builds: week 19 in Stretch cycle

What happened in the reproducible builds effort this week: Toolchain fixes Dmitry Shachnev uploaded sphinx/1.3.1-6 with improved patches from Val Lorentz. Chris Lamb submitted a patch for ibus-table which makes the output of ibus-table-createdb deterministic. Niko Tyni wrote a patch to make libmodule-build-perl linking order deterministic. Santiago Vila has been leading discussions on the best way to fix timestamps coming from Gettext POT files. Packages fixed The following 35 packages became reproducible due to changes in their build dependencies: apache-log4j2, dctrl-tools, dms, gitit, gnubik, isrcsubmit, mailutils, normaliz, oaklisp, octave-fpl, octave-specfun, octave-vrml, opencolorio, openvdb, pescetti, php-guzzlehttp, proofgeneral, pyblosxom, pyopencl, pyqi, python-expyriment, python-flask-httpauth, python-mzml, python-simpy, python-tidylib, reactive-streams, scmxx, shared-mime-info, sikuli, siproxd, srtp, tachyon, tcltk-defaults, urjtag, velvet. The following packages became reproducible after getting fixed: The package is not in yet in unstable, but linux/4.2-1~exp1 is now reproducible! Kudos to Ben Hutchings, and most fixes are already merged upstream. Some uploads fixed some reproducibility issues but not all of them: Patches submitted which have not made their way to the archive yet: reproducible.debian.net Some bugs that prevented packages to build successfully in the remote builders have been fixed. (h01ger) Two more amd64 build jobs have been removed from the Jenkins host in favor of six more on the new remote nodes. (h01ger) The munin graphs currently looks fine, so more amd64 jobs will probably be added in the next week. diffoscope development Version 32 of diffoscope has been released on September 3rd with the following new features: It also fixes many bugs. Head over to the changelog for the full list. Version 33 was released the day after to fix a bug introduced in the packaging. Documentation update Chris Lamb blessed the SOURCE_DATE_EPOCH specification with the version number 1.0 . Lunar documented how the .file assembler directive can help with random filenames in debug symbols. Package reviews 235 reviews have been removed, 84 added and 277 updated this week. 29 new FTBFS bugs were filled by Chris Lamb, Chris West (Faux), Daniel Stender, and Niko Tyni. New issues identified this week: random_order_in_ibus_table_createdb_output, random_order_in_antlr_output, nondetermistic_link_order_in_module_build, and timestamps_in_tex_documents. Misc. Thanks to Dhole and Thomas Vincent, the talk held at DebConf15 now has subtitles! Void Linux started to merge changes to make packages produced by xbps reproducible.

5 September 2015

Lisandro Dami&aacute;n Nicanor P&eacute;rez Meyer: Important Akonadi fix in today's Debian Jessie's update (aka 8.2)

Todays Debian Jessie's update brings a fix in Akonadi that you certainly want in your system.

There was a bug in Akonadi that made it leak files. And if you use Kmail you will certainly want to keep reading: most of us who tested it before pushing it to testing (and now to stable) removed more than 4 GiB of useless data from our homes.

The bug that makes Akonadi leak files gets solved with the latest stable update (and has been in testing for a couple of months already). But you need to purge the leaked files. It's pretty easy: with your normal user account just run:

akonadictl fsck

That's all. After a while you will get back a lot of disk space. Note that you don't need the Akonadi fix in order to run this tool and recover your space. The fix just makes sure this won't happen again.

Christoph Berg: 10 Years Debian Developer

I knew it was about this time of the year 10 years ago when my Debian account was created, but I couldn't remember the exact date until I looked it up earlier this evening: today :). Rene Engelhard had been my advocate, and Marc Brockschmidt my AM. Thanks guys! A lot of time has passed since then, and I've worked in various parts of the project. I became an application manager almost immediately, and quickly got into the NM front desk as well, revamping parts of the NM process which had become pretty bureaucratic (I think we are now, 10 years later, back where we should be, thanks to almost all of the paperwork being automated, thanks Enrico!). I've processed 37 NMs, most of them between 2005 and 2008, later I was only active as front desk and eventually Debian account manager. I've recently picked up AMing again, which I still find quite refreshing as the AM will always also learn new things. Quality Assurance was and is the other big field. Starting by doing QA uploads of orphaned packages, I attended some QA meetings around Germany, and picked up maintenance of the DDPO pages, which I still maintain. The link between QA and NM is the MIA team where I was active for some years until they kindly kicked me out because I was MIA there myself. I'm glad they are still using some of the scripts I was writing to automate some things. My favorite MUA is mutt, of which I became co-maintainer in 2007, and later maintainer. I'm still listed in the uploaders field, but admittedly I haven't really done anything there lately. Also in 2007 I started working at credativ, after having been a research assistant at the university, which meant making my Debian work professional. Of course it also meant more real work and less time for the hobby part, but I was still very active around that time. Later in 2010 I was marrying, and we got two kids, at which point family was of course much more important, so my Debian involvement dropped to a minimum. (Mostly lurking on IRC ;) Being a PostgreSQL consultant at work, it was natural to start looking into the packaging, so I started submitting patches to postgresql-common in 2011, and became a co-maintainer in 2012. Since then, I've mostly been working on PostgreSQL-related packages, of which far too many have my (co-)maintainer stamp on them. To link the Debian and PostgreSQL worlds together, we started an external repository (apt.postgresql.org) that contains packages for the PostgreSQL major releases that Debian doesn't ship. Most of my open source time at the moment is spent on getting all PostgreSQL packages in shape for Debian and this repository. According to minechangelogs, currently 844 changelog entries in Debian mention my name, or were authored by me. Scrolling back yields memories of packages that are long gone again from unstable, or I passed on to other maintainers. There are way too many people in Debian that I enjoy(ed) working with to list them here, and many of them are my friends. Debian is really the extended family on the internet. My last DebConf before this year had been in Mar del Plata - I had met some people at other conferences like FOSDEM, but meeting (almost) everyone again in Heidelberg was very nice. I even remembered all basic Mao rules :D. So, thanks to everyone out there for making Debian such a wonderful place to be!

Next.

Previous.