Search Results: "xam"

31 August 2009

David Pashley: Setting up gitosis on Jaunty

While git is a completely distributed revision control system, sometimes the lack of a central canonical repository can be annoying. For example, you might want to make your repository published publically, so other people can fork your code, or you might want all your developers to push into (or have code pulled into) a central "golden" tree, that you then use for automated building and continuous integration. This entry should explain how to get this all working on Ubuntu 9.04 (Jaunty). Gitosis is a very useful git repository manager, which adds support like ACLs in pre-commits and gitweb and git-daemon management. While it's possible to set all these things up by hand, gitosis does everything for you. It is nicely configured via git; to make configuration changes, you push the config file changes into gitosis repository on the server. Gitosis is available in Jaunty, but unfortunately there is a bug in the version in Jaunty, which means it doesn't work out of the box. Fortunately there is a fixed version in jaunty-proposed that fixes the main problem. This does mean that you need to add the following to your sources.list:
deb http://gb.archive.ubuntu.com/ubuntu/ jaunty-proposed universe
Run apt-get update && apt-get install gitosis. You should install 0.2+20080825-2ubuntu0.1 or later. There is another small bug in the current version too, as a result of git removing the git-$command scripts out of /usr/bin. Edit /usr/share/python-support/gitosis/gitosis/templates/admin/hooks/post-update and replace
git-update-server-info
with
git update-server-info
With these changes in place, we can now set up our gitosis repository. On the server you are going to use to host your central repositories, run:
sudo -H -u gitosis gitosis-init < id_rsa.pub
The id_rsa.pub file is a public ssh key. As I mentioned, gitosis is managed over git, so you need an initial user to clone and then push changes back into the gitosis repo, so make sure this key belongs to a keypair you have available to the remote user you're going to configure gitosis. Now, on your local computer, you can clone the gitosis-admin repo using:
git clone gitosis@gitserver.example.com:gitosis-admin.git
If you look inside the gitosis-admin directory, you should find a file called gitosis.conf and a directory called keydir. The directory is where you can add ssh public keys for your users. The file is the configuration file for gitosis.
[gitosis]
loglevel = INFO
[group gitosis-admin]
writable = gitosis-admin
members = david@david
[group developers]
members = david@david
writable = publicproject privateproject
[group contributors]
members = george@wilber
writable = publicproject
[repo publicproject]
daemon = yes
gitweb = yes
[repo privateproject]
daemon = no
gitweb = no
This sets up two repositories, called publicproject and privateproject. It enables the public project to be available via the git protocol and in gitweb if you have that installed. We also create two groups, developers and contributors. David has access to both projects, but George only has access to change the publicproject. David can also modify the gitosis configuration. The users are the names of ssh keys (the last part of the line in id_dsa.pub or id_rsa.pub). Once you've changed this file, you can run git add gitosis.conf to add it to the commit, git commit -m "update gitosis configuration to commit it to your local repository, and finally git push to push your commits back up into the central repository. Gitosis should now update the configuration on the server to match the config file. One last thing to do is to enable git-daemon, so people can anonymously clone your projects. Create /etc/event.d/git-daemon with the following contents:
start on startup
stop on shutdown
exec /usr/bin/git daemon \
   --user=gitosis --group=gitosis \
   --user-path=public-git \
   --verbose \
   --syslog \
   --reuseaddr \
   --base-path=/srv/gitosis/repositories/ 
respawn
You can now start this using start git-daemon So now, you need to start using your repository. You can either start with an existing project or an empty directory. Start by running git init and then git add $file to add each of the files you want in your project, and finally git commit to commit them to your local repository. The final task is to add a remote repository and push your code into it.
git remote add origin gitosis@gitserver.example.com:privateproject.git
git push origin master:refs/heads/master
In future, you should be able to do git push to push your changes back into the central repository. You can also clone a project using git or ssh, providing you have access, using the following commands. The first is for read-write access over ssh and the second uses the git protocol for read-only access. The git protocol uses TCP port 9418, so make sure that's available externally, if you want the world to be able to clone your repos.
git clone gitosis@gitserver.example.com:publicproject.git
git clone git://gitserver.example.com/publicproject.git
Setting up GitWeb is left as an exercise for the reader (and myself because I am yet to attempt to set that up).
Read Comments (0)

Romain Beauxis: Some quick notes on netboot install

Since I recently got a new laptop, I wanted to install Debian on it, of course :) However, I really didn't feel like buying a new CDR and burning yet another single-use boot CD and did not have a USB key available. Hence, I looked at installing through netboot using the previous one as the boot server and the available documentation. Well it turned out to be much more easy than what I was expecting initially ! The quick notes around this are:
- First you need to setup iptables for ip forwarding and masquerading, in order to be able to connect the new laptop to the internet:
  • ifconfig eth0 192.168.1.1
  • echo 1 > /proc/sys/net/ipv4/ip_forward
  • iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

- Then you need to enable dhcp and bootp. This means simply:
  • apt-get install dhcp3-server
  • Copy configuration example in Section 4.5.2.1 of the documentation
  • Edit with your own values, in particular check the nameserver used by the laptop sharing the connection. Also the tftp server will be your laptop, so set its address to 192.168.1.1 (in our case). Eventually, you need the MAC address of the new laptop (check ifconfig on it for instance)

- Eventually, you have to enable the tftp server, which only means:
  • apt-get install tftpd-hpa
  • The server serves files located in /srv/tftp (check ps -Af). You have to download the netboot tarball and untar its content in this directory.
The only strange thing here is that for some reason, the ethernet card would loose its address when the new laptop was using the DHCP to obtain an address. I didn't check it, but setting it at a regular intervals solved the problem: while true; do sleep 0.1; ifconfig eth0 192.168.1.1; echo "done"; done. Yeah, that's hacky, but I wanted a quick solution :) After all of that, you boot the new laptop, select the network boot and... voila ! In conclusion, since it is not that difficult to setup, it would probably be nice to have some sort of standard script to enable PXE boot on a computer. Then we could claim that the new Debian release is committed to sustainable development and allows to install without wasting a CD :-D

7 June 2009

Martin-&#201;ric Racine: When can we have a balanced and meaningful debate on immigration?

This question keeps on popping up in many recent newspaper articles, on discussion boards and in seminars debating immigration issues in Finland. At the core of the question is a general impression that, between the enthusiastic supporters of multiculturalism and the pessimistic nationalist rednecks, very little constructive discussion is possible in Finland. At one end, humanitarian help organizations, as well as politicians from the Green Party and the Swedish Folk Party, keep on taking excessively generous initiatives towards refugees and asylum seekers, all while labeling their detractors as racists. At the other end, nationalist candidates in the National Coalition Party and True Finns Party keep on painting every immigrant as a refugee who is abusing social security and label their detractors as turning Finland into the easiest country to abuse social security, at the Finnish taxpayer's expense. In between, candidates from the Christian Democrats and Center Party spread equally among these two camps. Meanwhile, while the Left is currently avoiding discussions on this topic, Social Democrats have previously shown that they tend to side with the nationalists in labeling all immigrants as social security abusing refugees. One interesting point is that, no matter at which end of the political spectrum one looks, the whole Finnish immigration debate keeps on focusing exclusively on refugees and asylum seekers, despite the fact that migrant workers and foreign spouses of Finnish nationals make up for a good 70% of the foreign population residing on Finnish soil. This recalcitrance to discuss immigration from any other perspective than refugees is rather painfully noticeable. Some recent examples: What's remarkable about all these examples is how public opinion is so persistently hardwired into thinking that all foreigners living in Finland came here as refugees from 3rd-world countries whose culture is radically different from Finland's and that they all became perpetually unemployed, forever living off social security, to the point that even politicians who ought to know better go along with it. When will we be able to have a balanced and meaningful debate on immigration, you ask? The day both multicultural hippies and nationalist rednecks will have been kicked off the podium. Of course, it would also help if the refugees themselves stopped monopolizing the podium, whenever the opinion of immigrants is solicited. Then again, perhaps these 3 groups benefit so much from the current status quo that they'd rather not see the day when others can participate in this debate on equal footing with them, so that a balanced and meaningful debate can finally take place?

Enrico Zini: Voice-controlled waypoints

Voice-controlled waypoints I have it in my TODO list to implement taking waypoints when pressing the headset button of the openmoko, but that is not done yet. In the meantime, I did some experiments with audio mapping, and since I did not manage to enter waypoints while recording them, I was looking for a way to make use of them anyway. Enter findvoice:
$ ./findvoice  --help
Usage: findvoice [options] wavfile
Find the times in the wav file when there is clear voice among the noise
Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -v, --verbose         verbose mode
  -p NUM, --percentile=NUM
            percentile to use to discriminate noise from voice
            (default: 90)
  -t, --timestamps      print timestamps instead of human readable information
You give it a wav file, and it will output a list of timestamps corresponding to where it things that you were talking clearly and near the FreeRunner / voice recorder instead of leaving the recorder dangling to pick up background noise. It does not use sound statistics because I have no background whatsoever in audio processing, but it basically finds those parts of the audio file where the variance of the samples is above a given percentile: the higher the percentile, the less timestamps you get; the lower the percentile, the more likely it is that it picks a period of louder noise. For example, you can automatically extract waypoints out of an audio file by using it together with gpxinterpolate:
./findvoice -t today.wav   ./gpxinterpolate today.gpx > today-waypoints.gpx
On the timestamps that it outputs, it will add the modification time of the .wav. This means that if you touch -d "@timestamp" the .wav file with the date you started recording, then you can get decently accurate waypoints provided your system clock is decently synchronized. For example:
START= date +%s 
arecord file.wav
^C
touch -d "@$START" file.wav
./findvoice -t file.wav   ./gpxinterpolate today.gpx > today-waypoints.gpx
In record-audio-on-freerunner I even set the .wav mtime using the GPS time at the start of the recording.

Enrico Zini: Geocoding Unix timestamps

Geocoding Unix timestamps Geocoding EXIF tags in JPEG images is fun, but there is more that can benefit from interpolating timestamps over a GPX track. Enter gpxinterpolate:
$ ./gpxinterpolate --help
Usage: gpxinterpolate [options] gpxfile [gpxfile...]
Read one or more GPX files and a list of timestamps on standard input. Output
a GPX file with waypoints at the location of the GPX track at the given
timestamps.
Options:
  --version      show program's version number and exit
  -h, --help     show this help message and exit
  -v, --verbose  verbose mode
For example, you can create waypoints interpolating file modification times:
find . -printf "%Ts %p\n"   ./gpxinterpolate ~/tracks/*.gpx > myfiles.gpx
In case you wonder where you were when you modified or accessed a file, now you can find out.

Francois Marier: Reinstalling grub on an unbootable Debian system

Fixing an unbootable computer after a failed grub installation can be a bit tricky. Here's what I ended up doing.

First of all, boot the machine up and get access to the root partition:
  1. Get a Debian installation CD for the same architecture (i.e. don't use an i386 CD if your root partition is amd64). The distro version doesn't matter too much: a lenny CD will boot squeeze/sid just fine.
  2. Boot the install CD and select Rescue mode under Advanced options.
  3. Answer the language, keyboard and network questions any way you want and provide the decryption passphrases for any of the encrypted partitions you need to mount.
  4. When prompted, request a shell on the root partition.
If you need to upgrade the version of the grub package (for example if this problem was caused by a bug which is now fixed):
  1. Make sure that the network interface is up (ifup eth0).
  2. Make sure that /etc/resolv.conf has at least one nameserver line, otherwise add one.
  3. Install the latest version using apt-get or dpkg.
Now that you have the right grub version, run the following (with the right device name for your machine):
grub-mkdevicemap
grub-install /dev/hda
update-grub
Finally, reboot and cross your fingers :)

6 June 2009

Enrico Zini: Recording audio on the FreeRunner

Recording audio on the FreeRunner The FreeRunner can record audio. It is nice to record audio: for example I can run the recording in background while I keep tangogps in the screen, and take audio notes about where I am while I am doing mapping for OpenStreetMap. Here is the script that I put together to create geocoded audio notes:
#!/bin/sh
BASENAME=~/rec/rec-$(date +%Y-%m-%d-%H-%M-%S)
alsactl -f /usr/share/openmoko/scenarios/voip-handset.state restore
echo "Getting GPS info..."
getgps > $BASENAME.info
arecord -D hw -f cd -r 8000 -v -t wav $BASENAME.wav
echo "Setting wav timestamp to GPS start of recording"
TS=$(cat $BASENAME.info   grep time_tstamp   cut -f2 -d' ')
touch -d "@$TS" $BASENAME.wav
echo "Done"
It works like this:
  1. It loads mixer settings to record from the handset, but the same could in theory be done for the headset.
  2. It gets all sort of information from the GPS and stores them into a file.
  3. It records audio until it gets interrupted.
  4. It retrieves the GPS timestamp from the beginning of the audio recording, and uses it to set the file timestamp
And the following is the getgps script, adapted from a mailing list post: it can be generally useful to save information about a fix from the GPS.
#!/usr/bin/env python
import dbus
from time import gmtime, strftime
obj = dbus.SystemBus().get_object('org.freesmartphone.ogpsd', '/org/freedesktop/Gypsy')
constatus = obj.GetConnectionStatus(dbus_interface='org.freedesktop.Gypsy.Device')
print "connection_status:", constatus
print "connection_status_name:", (constatus and 'TRUE' or 'FALSE')
fixstatus = obj.GetFixStatus(dbus_interface='org.freedesktop.Gypsy.Device')
print "fix_status:", fixstatus
names = ["INVALID", "NONE", "2D", "3D"]
if fixstatus < 0 or fixstatus > len(names):
    print "fix_status_name:", names[0]
else:
    print "fix_status_name:", names[fixstatus]
def yesno(val):
    return val and "yes" or "no"
(fields, tstamp, lat, lon, alt) = obj.GetPosition(dbus_interface='org.freedesktop.Gypsy.Position')
print "pos_fields:", fields,
print "pos_tstamp:", tstamp
print "pos_time:", strftime('%F %T', gmtime(tstamp))
print "pos_lat: %f" % lat
print "pos_lat_valid:", yesno(fields & (1 << 0))
print "pos_lon: %f" % lon
print "pos_lon_valid:", yesno(fields & (1 << 1))
print "pos_alt: %f" % alt
print "pos_alt_valid:", yesno(fields & (1 << 2))
(fields, pdop, hdop, vdop) = obj.GetAccuracy(dbus_interface='org.freedesktop.Gypsy.Accuracy')
print "accuracy_fields: %d", fields
print "accuracy_pdop: %f" % pdop
print "accuracy_pdop_valid:", yesno(fields & (1 << 0))
print "accuracy_hdop: %f" % hdop
print "accuracy_hdop_valid:", yesno(fields & (1 << 1))
print "accuracy_vdop: %f" % vdop
print "accuracy_vdop_valid:", yesno(fields & (1 << 2))
(fields, tstamp, speed, heading, climb) = obj.GetCourse(dbus_interface='org.freedesktop.Gypsy.Course')
print "course_fields:", fields
print "course_tstamp:", tstamp
print "course_time:", strftime('%F %T', gmtime(tstamp))
print "course_speed: %f" % speed
print "course_speed_valid:", yesno(fields & (1 << 0))
print "course_heading: %f" % heading
print "course_heading_valid:", yesno(fields & (1 << 1))
print "course_climb: %f" % climb
print "course_climb_valid:", yesno(fields & (1 << 2))
time = obj.GetTime(dbus_interface='org.freedesktop.Gypsy.Time')
print "time_tstamp:", time
print "time_time:", strftime('%F %T', gmtime(time))
satellites = obj.GetSatellites(dbus_interface='org.freedesktop.Gypsy.Satellite')
for satIndex, sat in enumerate(satellites):
    print "sat%d_prn: %u" % (satIndex, sat[0])
    print "sat%d_used: %s" % (satIndex, yesno(sat[1]))
    print "sat%d_used_value: %u" % (satIndex, sat[1])
    print "sat%d_elevation: %u" % (satIndex, sat[2])
    print "sat%d_azimuth: %u" % (satIndex, sat[3])
    print "sat%d_snr: %u" % (satIndex, sat[4])

Wouter Verhelst: NBD, TRIM, and sparse files

Ever since I read about the ATA TRIM command, I've been thinking that something like that would make a lot of sense for things like NBD. Currently, it's possible to serve a sparse file using NBD. I often do this, for example, testing things like the fix for Bug #513568 (nbd-server choking on a >3 TB RAID device) which would otherwise require me to spend significant amounts of money so that I get enough disks to test. Obviously that's not going to happen. If we're using sparse files, that means we claim to export more than we actually do. This is obviously useful for testing, but there are other cases where this kind of behaviour could be useful; for instance, when exporting swapdevices to several diskless clients, it would be a rare case indeed where all those clients need all of their available swapspace; it might be safe to slightly overcommit the disk space on your hard disk, on the assumption that none of your clients is going to use all that space at the same time. Similarly, when a file is removed on a filesystem on an NBD device, the kernel might use the generic TRIM layer described by Ted in the article above to relay that removal to the nbd-server process, which could then make sure the diskspace is deallocated. However, unfortunately, there currently is no way for an nbd-server to tell the kernel to create a new hole in a sparse file. Creating sparse files is done at file creation time; if you later want to add more holes than you did when creating the file, you need to recreate the whole file from scratch in order to do so. Additionally, when we're talking about a large amount of data that needs to be removed, it's usually much faster to say 'remove this block of data' rather than 'overwrite several megabytes with zeroes here' not just in API, also in kernel-side implementation, provided the filesystem supports extents. I think it might be nice if there were a public (userspace) API to tell the kernel that particular bits of a file or a block device are no longer required, and that they may thus be removed. But then, I'm not very experienced with kernel code, and it might be that I'm just plainly missing something here. Anyone?

5 June 2009

Cristian Mauricio Porras Duarte: Aptitude History Tracking progress report, Week 2


The first important task when one wants to carry out a historical study of the behavior of a system is to determine what information you want to store and how this is going to be saved, thinking of providing an easy way to access information when needed. In our case, we need to store the information of the packages status and the actions that have been made to them. For now I have confronted the aptitude state and the dpkg state. We use the state of dpkg to see the changes that other applications (Apt, Synaptic, Adept, etc..) can perform on the packets.
To see the changes we rely on the pkgstates file (which contains some information about the last state that was seen by aptitude) and the routine build_selection_list, comparing what is in the apt cache and what is stored in pkgstates. So the first task was to create routines to save in each member of the history the information that can be collected from pkgstates and the cache, which really is not much. This process is accompanied by the function to write in the text log and the binary database. I believe that work it s around 70-75%, missing optimization and definitions of some values.
I have been working this week on the aptitude state , creating a vector of entries which is storing the information collected from the state s changes through the functions cleanup_after_change, apply_solution and build_selection_list from aptitudeDepCache, calling on the last function to the routine that writes the whole vector of changes made so far in the text log and the database, I think this work is located at 50%. Plan for next weeks For the dpkg state, optimize the functions and add to the info of each package the date when it changed. Maybe based on /var/log/dpkg.log For the Aptitude state, finishing collecting the information about changes. For example the dep that trigger a change, groups of packets that share the same reason of change. Look at other relevant information that could be included for the trace of each package. Change the structure of the database to include information that is missing.
Open a separate branch in the repository of aptitude, looking for a more fluid feedback.
Pd. Hello Planet Debian!

Julian Andres Klode: python-apt 0.7.91 released


As I promised, I released python-apt 0.7.91 today. This version provides a new API, with real classes in apt_pkg, new names which conform to PEP 8 conventions, and it supports new language features such as the with statement. Old code should still continue to work, if it does not and it is using only public interfaces, report a bug against python-apt or send an email. I can not guarantee that all the names will be kept like they are at the moment (it s a pre-release), but there should not be many more changes needed. The series will hit Ubuntu Karmic later this month, and the final 0.8.0 release is going to be shipped in the final Karmic release. If you want to help with python-apt, consider to write some examples of what can be done with python-apt, and some tutorials for the documentation. You can also check for spelling mistakes and alike. If you want, you can also contribute code. See the documentation (in the package, or online) for guidelines on how to contribute. You can get the 0.7.91 release from Debian experimental, and you can view the documentation online at http://apt.alioth.debian.org/python-apt-doc-exp/. And of course, a short example:
with cache.actiongroup(): # apt.Cache 'cache'
    for package in my_selected_packages:
        package.mark_install() # New PEP 8 names, previously named markInstall()
Posted in Debian, Ubuntu

Andrew Pollock: [life] Oh noes, my first cavity!

I've always prided myself in the fact that I didn't have any fillings. That's about to change, sadly. One of the teeth at the back, top right of my mouth has a deep valley, which makes it hard to get at with a toothbrush, and there's a small cavity at the bottom of that. Dentist trips for me have always just involved the cleaning and scaling and an exam. Aside from having my wisdom teeth out (which I had done under general anaesthesia) I've never had a dental procedure before. Eeek.

Martin Michlmayr: Corporate participation in open source communities

Someone recently asked me a few question about corporate participation in open source communities and I thought I'd share my thoughts on this topic here. Are there differences between an open source project done for a corporation and one done for personal reasons? There are many different ways to run an open source project, led by a corporation or by someone else. Some projects that are run by corporations have few outside contributors. This is often the case with projects that require copyright assignment (i.e. contributors have to assign their copyright to the corporation). These projects may not gain all the benefits of a true open source community, such as outside contributions or high levels of peer review. However, they may still be very successful projects and may have high levels of quality. Projects done by a corporation may have better planning and may have more resources than other projects. When a corporation, especially a large one, starts or becomes involves in a project it can also give credibility to the project and attract a lot of interest to the project. This means that projects done by corporations may have a bigger impact and might also be more visible in terms of publicity. How do corporations successfully utilize an open source community? Corporations can benefit from an open source community in many ways. For example, they can often find people who will review their code or make code contributions. If people become excited about what the corporation does, they might also spread the word and create viral marketing for the corporation. Establishing a community around one's project is often also a good way to identify people to hire since you already have experience working with them and know their capabilities. How do open source communities successfully utilize their corporate relationships? Corporations can make several unique contributions. For example, large corporations can use their name to attract attention to a project and give it credibility. Furthermore, corporations have some capabilities that personal contributors often don't have access. They may have special testing equipment (such as servers with thousands of CPUs or hard drives) or access to a testing lab where a professional usability test can be done. Finally, corporations can sponsor developer conferences, which are typically very effective means for the community to come together and work on activities together. It is important for projects to remember that corporations are not charities and that they will invest in an open source project for a reason. Therefore, they have to ensure that the corporation will get tangible outcomes from their involvement or sponsorship, otherwise they may not stay involved in the long run. What are the risks for a corporation when working with an open source community? One risk is that the code (or other form of contribution) is not accepted. However, this is a risk any contributor to a project faces. Before making any sort of contribution, it is therefore important to become familiar with the project and its culture. Every project has their own "do's" and "don'ts" that have to be followed. Another risk is that a corporation will invest in a community project that later on is abandoned by the community. However, in this case, the corporation could take the lead and continue to maintain the project. What are the risks for an open source community when working with a corporation? One potential risk is that the corporation will assert too much control over the project. It's important for projects to ensure that the community as a whole has influence over the direction of a project rather than one particular player. Are certain certifications needed in order for someone to participate in open source projects for a corporation? Certifications are not needed to get involved in or start a project. However, it is important to become familiar with the open source community and the project one wants to contribute to. A good first step is to read the book Producing Open Source Software by Karl Fogel which is available online. As a next step, the community in which someone wants to get involved in should be studied, for example by reading the mailing list archives. This will help to become familiar with the culture of a project as well as the mechanisms to contribute to the project. How do open source communities communicate and collaborate with corporations? In the best case, employees from corporations would interact in the project like any other contributor. That is, they should use the existing communication channels, such as mailing lists, IRC or developer gatherings. Many companies are good at working "with the community" but the ideal scenario is for a company to be part of the community and to work "in the community", just like other contributors. This is the most effective way for them to make changes to the code and project. Of course, not every corporation will get involved in a project directly. That's why it makes sense for projects to collaborate with corporations in other ways. For example, projects can talk directly to companies to get samples of their hardware in order to add support for them in their software. Projects can also work directly with corporations to find out how their project can better meet the needs of enterprise users.

3 June 2009

Chris Lamb: Checklist for configuring a Debian system

In the spirit of Thomas Limoncelli's Time Management for System Administrators, this is my checklist for setting up a new Debian system. I have added a few notes to the original list to justify their existence and to provide some background information. Whilst you should avoid performing repetitive interactive configuration and defer to the multitude of tools designed for this task, constructing and sharing a checklist can still be an instructive step. It can also be useful in situations where a machine has already been partly configured for you.
Software
  • /etc/apt/sources.list

    • Choose a sensible primary mirror
    • Ensure use of release codenames (eg. "lenny") instead of synonyms
    • Confirm security mirror is enabled
    • Remove references to contrib and non-free
  • Disable installation of Recommends:

    echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/90recommends
    
  • Ensure we are up to date security-wise:

    apt-get update && apt-get dist-upgrade
    
  • Setup and configure locales first to avoid annoying Perl warnings. Don't choose All locales; you almost certainly don't want that.

    apt-get install locales
    dpkg-reconfigure -plow locales
    
  • Install some essential utilities:

    apt-get install vim-nox ntp openssh-server screen most tree bzip2 unzip moreutils dnsutils htop pwgen telnet manpages manpages-dev vrms acl gawk strace curl tcpdump
    
Users
  • Before we create any real users, we configure PAM to reject weak passwords. Custom banned passwords can be added to the dictionary by editing /usr/share/dict/cracklib and running update-cracklib.

    apt-get install libpam-cracklib
    sed -i -e 's ^password # \0 ' /etc/pam.d/common-password
    echo 'password required    pam_cracklib.so retry=3 minlen=6 difok=3' >> /etc/pam.d/common-password
    echo 'password required    pam_unix.so use_authtok nullok md5' >> /etc/pam.d/common-password
    
    (Edit: Please read this response from Steve Langasek regarding this modification on squeeze and Ubuntu 8.10)
  • Configure sudo. I prefer to create a new group instead of re-using adm as that is already used by logfiles.

    addgroup rootusers
    adduser myuser
    adduser myuser rootusers
    apt-get install sudo
    echo 'User_Alias ROOTUSERS  = %rootusers' >> /etc/sudoers
    echo 'ROOTUSERS, root     ALL=(ALL) ALL' >> /etc/sudoers
    
Mail relay Email remains the primary method to asynchronously inform the system adminstrator that their attention is required. It is assumed that the machine will not handle your day-to-day email (or indeed accept any external mail) but will instead simply forward it elsewhere. We also assume a preference for Exim, but the configurion for Postfix is almost identical.
  • First, install the mail packages:

    apt-get install exim4-daemon-light bsd-mailx
    dpkg-reconfigure exim4-config
    
  • During the Exim configuration, choose Internet site and follow all the defaults, ensuring that you only listen on 127.0.0.1 and you are not relaying mail for any other domains.

  • We then configure forwarding to another email address so we don't have to continually poll this machine for issues:

    echo 'root: you@example.com' >> /etc/aliases
    newaliases
    
  • Finally, we test mail delivery:

    echo "Test 1 from $(hostname)"   mail root -s "Test 1 from $(hostname)"
    
The d-i manual has some further advice on this, including the use of "smarthosts".
Miscellaneous
  • Stop Emacs creating backup files everywhere:

    mkdir -p /etc/emacs/site-start.d
    echo '(setq backup-inhibited t)' > /etc/emacs/site-start.d/10no-backup.el
    
  • Configure Munin:

    apt-get install munin-node
    echo 'allow ^123\.123\.123\.123$' >> /etc/munin/munin-node.conf
    /etc/init.d/munin-node restart
    
    For baroque network configurations, you can generate the regular expression line with this script.
  • Configure molly-guard, a tool for preventing accidental shutdowns. As molly-guard cannot detect shutdowns initiated within a combination of GNU screen and SSH, we configure it to always query the hostname:

    apt-get install molly-guard
    echo "ALWAYS_QUERY_HOSTNAME=true" >> /etc/molly-guard/rc
    
  • Monitor disk S.M.A.R.T. attributes:

    apt-get install hddtemp smartmontools
    sed -i 's ^#start_smartd=yes start_smartd=yes ' /etc/default/smartmontools
    /etc/init.d/smartmontools start
    
  • Setup backups - I'm quite partial to backupninja because it automates most of the tedious SSH configuration. I adjust the time of the backup to when I'm likely to be around to fix issues and cut down on email noise by not reporting successful backups:

    apt-get install backupninja hwinfo debconf-utils rdiff-backup
    sed -i -e 's ^when = everyday at 01:00 when = everyday at 9:30 ' /etc/backupninja.conf
    sed -i -e 's ^reportsuccess = yes reportsuccess = no ' /etc/backupninja.conf
    ninjahelper
    
  • Filesystems

    • In /etc/fstab, check noatime is enabled on all filesystems, and acl where needed.
    • Use tune2fs to adjust how much of the disk is reserved for the superuser - the default of 5% is excessive for large volumes.
  • Reboot. You should be prompted by molly-guard before your computer restarts.

Aigars Mahinovs: Google Wave

So, the latest buzz on the web is all about Google Wave. I would urge everyone developing stuff for the Internet and technological people depending on the Internet for their daily work, to watch that introductory video. The concept is frankly mind-blowing. If this is done right and embraced by all the right people, Google Wave could be the new platform concept that could be used to create new generation of email, instant messaging, collaboration software (CMS, wiki, Sharepoint, workflow, ), blogging software and forum software and do all that while integrating back with current technologies, like Twitter and RSS feeds. It remains to be seen what parts will be open source and federated and what parts will remain Google-only services. For example, I am convinced that Spelly the spellchecker bot and Rozy the automatic translation bot will be hard to impossible to federate. This being Google, it is practically a given that the code will be good, but a bit hard to understand and contribute to. Management of the free software community and proprietary community relations will likely be the key to the success of this technology. I love the technology itself - imagine that you have a web blog. The blog software makes each your blog post a wave. When people leave comments on the post, these comments show up in your email inbox. You can reply to people right from there. By default your replies will show up on your blog and also show up in the email inboxes of the commenter, but you also have the option to mark your reply private and only send it to the commenter. Also it looks to be possible to choose to host all the data yourself or to make Google host all your blog and comment data and make your blog just be a frame where this data is displayed in, possibly allowing you to use very, very minimal system resources to maintain the blog even in a case of Slashdotting. I hate blogs without comments, let s replace them all. I would also love to see replacements to Microsoft Exchange and Microsoft Sharepoint be built using Wave technology with a full support to ODF if possible. Imagine collaborative document editing in OpenOffice using this technology in the backend. It would be one huge project, but it should be possible. Companies currently pay hundreds of thousands of dollars to set up MS Exchange+Sharepoint+Active Directory to be able to simply share documents in their Intranet and see who edited a document (no live editing, no change tracking). It is possible to make a much better product with ODF and Google Wave and it is possible to earn a bunch of money supporting such a product for companies that need support contracts. If it would be possible to licence spellchecking and translation services from Google in a way where a box is installed in customers data centre and the data to be spellchecked and translated never leaves that data centre, then I believe that people would be willing to pay for this superior spellchecking and translation experience. We need open source products that people can depend on. We also need ways for business people to sell services with an easily visible added value so that they can make money and contribute their developer work hours back to the open source projects. We (the free software community) have great ways to get a positive feedback loop with users that can develop software, but when our users have no interest in developing anything, the feedback loop breaks and free software growth slows down. There is a lot of untapped potential in this area - we just need to find a way to convert needs and demands of non-developers into code. I m gonna stop this rant before it diverges even further off topic, but the main point is - go watch the Google Wave demo, read the tech specs and think how you could integrate that into your free software project. Useful wave discussions (will update as I find more):

2 June 2009

Christian Perrier: On localization

An old friend is ranting about localization. I first considered not really reaction to Joey's post, mostly because he has very true points...and particularly when he has about the same reaction than mine about a recent post in ou mailing lists. So, I will stick to react to one part of Joey's post...the one I consider really inaccurate. "everyone uses the software in English anyway" Really, Joey, really, that's completely untrue. Of course, I do live in a country that very well known (or at least that has the reputation) for being deeply ignorant in English language. But, really....*all* computers I see around me, both in my personal life *and in my professionnal life* are nearly completely localized. It's probably now well know that I spend most of my professionnal time....providing desktop systems (or managing the people who provide them) to users in ONERA, "the French Aerospace Lab". That means about 2000 users in a scientific environment where the use of English is much more developed than the average environment. Most of these users speak a fairly decent English and are perfectly able to understand that language in some way. About 80% of these systems are Windows-based and 20% are Linux-based. Probably more than 95% of them are localized in French. Even on Windows systems, we mostly integrate free software. And for *each* of them, the most important feature we need, besides software being free, is it to be localized in French. I bet our friends from Extremadura can say the same. The success of Linux-based free systems there also happened because the software is available in Spanish. And, of course, there are tons of similar stories and counter-examples (M nchen, Bhutan, Venezuela, etc.). So, really, please don't spread out that idea. Oh, yes, geeks *do* use their software in English (and, even here, I need to be convinced if I remember well what I saw at conferences in Germany or Spain, for instance). And, yes, it's very well widespread among geeks that using software in English is "better" or "easier". Which I indeed always fight and will fight until I die..:-). We certainly agree that these l10n needs put a high load on development and sometimes slow it down. and, for sure, we sometimes need to make a balance and I really thank you for giving me the credit to try doing that balance. Anyway, all this (including your rant) had to be said and it's interesting to have that small discussion (I just should not start writing down a blog entry at 23:00...:-)) See you soon, hopefully, Joey !

Joey Hess: on localization and progress

In this post I will say some things about localization that I've never felt it was politic to say before. (It still isn't, but what the hey.) But I first want to mention that one of the reasons Christian Perrier is awesome is because he manages to steer projects in ways that avoid (most of) the problems below, and because he has managed to scale rather impressively far. But not far enough that these things haven't gotten under my skin. So, I hate localization. Hate, hate, hate. I wish it would die. I wish everyone spoke the same language. I hate that we have to be politically correct about it, to the point that even if everyone does speak English (hello, Denmark?), we still have to worry about localization into their native language. I especially hate that, after we waste time and resources doing that, everyone uses the software in English anyway (hello, most of Europe). I hate that the typical best effort localization of software is typically so incomplete that it's not actually usable by people who really do need the translation. Either because "best effort" == 80% translated, which is sometimes worse than 0%, or because the documentation doesn't get translated too. And that even with what we consider a complete translation, there are still all sorts of English bits that nobody would ever consider translating. Such as the names of commands, of command-line switches, of markup keywords and configuration files. I hate that translating software and documentation always involves bolting an enormous, nasty build system onto its side, and that the bulk of translations always greatly outweighs the size of the code. I hate that these systems constantly produce deltas that I have to avoid cluttering my commits with. I hate the expectation that every programmer somehow become an expert in internationalization, rather than letting them devote their time to something they're good at. But none of that is what really bothers me about localization. What really, really bothers me is that I often see the need to localize code inhibiting that code becoming better. Just two examples: (PS, I also hate that we have to keep "l10n" and "i18n" straight, and that the words are so unwieldly in this f5g modern English that we represent them based on their length.)

Adeodato Sim : Minirok 2.0 out, apparently popular among disenchanted Amarok users

Yesterday I released Minirok 2.0, which is basically a port of Minirok 0.9 to KDE4, with a couple nice features thrown in, like undo support in the playlist, which I can t live without. Minirok is a very simple audio player written in Python and modeled after Amarok 1.4 (the interface is almost identical). I ve been told by several people already that they ve happily migrated to it from Amarok, after being dissatisfied with the 2.x series. Beware, though, that Minirok is very simple, has limited functionality by design, and may not be what you re looking for. For example, there s no collection built from tags, only a tree view of the filesystem. See the homepage for details. Minirok is known to work well with KDE 4.2 and Qt 4.5, which are both in Jaunty and Squeeze already, but it should work with KDE 4.1 and Qt 4.4 as well. The package is already in unstable, feel free to grab it from here for other distrubtions. A note for users upgrading from 0.9: Last.fm submissions are disabled by default now, instead of enabling themselves opportunistically upon the presence of lastfmsubmitd (which could be not configured). If you want Minirok to continue submitting to Last.fm, you ll have to enable it in the preferences dialog.

Russell Coker: How not to write the way dumb people think smart people write

Don Marti has written an amusing and informative little post about the way that ill-educated people use phrases in print [1]. The one example that didn t fit with the tone of his post was the use of half mast to refer to a flag on land, that one is used often enough (both in print and verbally) that intelligent people will make that mistake. Here are some that he missed:

  1. The expression bailing them out can be used to refer to someone who helps someone escape from a difficult situation. That might refer to bailing water from a leaky boat or might refer to posting bail to secure someone s release from prison while awaiting trial. It certainly doesn t refer to baling which is the creation of a bundle (such as a bale of hay). I m sure that a farmer would appreciate some help at baling time, but such help would hardly qualify as rescue from a difficult situation.

  2. The expression woe is me is used (usually in a sarcastic manner) to refer to someone who feels that their situation is sorrowful. It is not whoah is me , I suspect that the word whoah was invented long after the expression woe is me became commonly used.

  3. Made up words such as worserer and worstest. I can understand that people such as Keith Olbermann [2] may find it a challenge to describe some of the bad people in the world, but he is articulate enough to rise to that challenge while using real words.

Can anyone add any more to this list?

1 June 2009

Stephan Peijnik: sphinx-aware Enums in Python

As I promised to keep you updated on recent developments on update-manager I am writing this article. Just as a disclaimer: I am not going to write about any recent developments here, but would rather like to point at a piece of code I added to update-manager that could be useful in other applications too. Now, as the title suggests there are sphinx-aware Enums in update-manager. Enums are common constructs in other programming languages like C and allow simple creation of constants with, for example, ascending values (first constant has value 0, second has value 1 and so on). Python unfortunately does not include support for Enums itself, but I found it rather easy to write classes that emulate such a construct. Nothing is new about Enums in Python and there are probably quite a few different implementations out there, but I believe mine is different. The sphinx-aware part means that my implementation automagically updates the docstrings of the created instances and thus allows sphinx autodata method to include sensible information in generated API documentation. I could go on writing about and praising my method, but I believe a short example gives you a better idea how my implementation works and what I wanted to achieve with this. Have a look at this page, which is part of update-manager s new API documentation. You should see rather well-looking documentation of the UpdateManager.Backend.RELOAD_CACHE_STATUS NegativeEnum, the defined constants, their values and some additional information about each value now. Still, nothing too fancy, HTML documentation generated from docstrings. What makes this special is the code from which it was generated:
RELOAD_CACHE_STATUS = NegativeEnum(
  BEGIN = "Started reloading package cache",
  DONE = "Finished reloading package cache")
This not only gives us a RELOAD_CACHE_STATUS enum, along with the RELOAD_CACHE_STATUS.BEGIN and RELOAD_CACHE_STATUS.DONE, but also some documentation, included in RELOAD_CACHE_STATUS docstring, that can be used by sphinx. You can find the Enum code, which is rather short and should be quite easy to understand, here. I hope you find this code as useful as I do.

31 May 2009

Wouter Verhelst: COBOL

According to The Registry, COBOL is now slightly over 50 years old. I wish I could say I never wrote a single line of COBOL, but I can't. In college, I was taught COBOL for three long years. Even though I've managed to purge most of that knowledge from my brain (good riddance), I still have nightmares about the horrible way in which one writes COBOL. I wish I could say COBOL is dying, but it isn't. People still write new COBOL today. I mean, seriously, there's a standard called 'COBOL 2002. 'Nuff said. I wish I could say COBOL isn't a problem, but it's the sole source of most of the Y2K issues way back when. Its features invite many of the kind of horribly wrong coding styles which cause bugs; Y2K is just one. I wish I could say COBOL code is pretty, but it isn't. Just to give one example: the first 7 characters of every line of code in each and every COBOL program are 0x20. That is, space. Nothing. Utterly useless. There is no reason for this in modern environments, yet it's still there. Note why I dislike significant whitespace. Another example is the fact that you can't just say 'foo = 1 + 1'. Instead, you have to say 'MOVE 1 TO FOO', and then add a second statement that says 'ADD 1 TO FOO'. I'll just use english if I want to write a novel, thank you. I wish I could say I didn't care about COBOL anymore, but for some weird reason, I do. And just in case you were confused: no, I do not have warm, fuzzy feelings for COBOL. If there was a button that would nuke all the COBOL code on the planet, would I push it? Probably not immediately. I'm sure it would take time for me to recover from the sheer joy of knowing that this button actually exists, before I'll be physically capable of keeping my hands steady for the amount of time required for me to actually be able to push it. COBOL is proof of either the absense of any deity, or the existence of the devil. Given the chance, no sane person, let alone a sane deity, would allow the creation of such an abomination. At least I don't have to deal with it anymore. That part is not going to change. Ever.

Next.

Previous.