Ian Jackson: Let's Encrypt certificate revocation - panic now!
edited 2020-03-03 15:35 to fix arithmetic error
$ aws ec2 describe-images --owner 136693071363 \
--region us-east-1 --output json \
--query "Images[?Architecture=='arm64'] [?starts_with(Name, 'debian-10-')] max_by([], &Name)"
"Architecture": "arm64",
"CreationDate": "2020-02-10T19:04:55.000Z",
"ImageId": "ami-031d1abcdcbbfbd8f",
"ImageLocation": "136693071363/debian-10-arm64-20200210-166",
"ImageType": "machine",
"Public": true,
"OwnerId": "136693071363",
"State": "available",
"BlockDeviceMappings": [
"DeviceName": "/dev/xvda",
"Ebs":
"Encrypted": false,
"DeleteOnTermination": true,
"SnapshotId": "snap-0d8459c1e3fe12486",
"VolumeSize": 8,
"VolumeType": "gp2"
],
"Description": "Debian 10 (20200210-166)",
"EnaSupport": true,
"Hypervisor": "xen",
"Name": "debian-10-arm64-20200210-166",
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SriovNetSupport": "simple",
"VirtualizationType": "hvm"
Hopefully this helps reduce some of the confusion around the availability of the buster AMIs.
Next up, GovCloud!
Here is my transparent report for my work on the Debian Long Term Support (LTS) and Debian Extended Long Term Support (ELTS), which extend the security support for past Debian releases, as a paid contributor.
In February, the monthly sponsored hours were split evenly among contributors depending on their max availability - I was assigned 20h for LTS (out of 30 max; all done) and 8h for ELTS (out of 20 max; I did 7).
Security work is never completely isolated, typically my work on nodejs impacted jessie/stretch/buster, and my work on netty affected wheezy/jessie/stretch
ELTS - Wheezy
Here is my monthly update covering what I have been doing in the free software world during February 2020 (previous month):
warnings.warn method over logging.warning [...] and to document missing archive keyword argument to the get_bugs call [...].
libmate-desktop library component of the MATE Desktop Environment I submitted a pull request to make the build reproducible in/around various dialogs. [...]
python_example, an example pybind11 module built with a Python-based build system, I suggested sorting the extension sources to ensure a reproducible build in any projects based on this template. [...]
snapd component of the Snappy package manager. Here, I opened a pull request to make the build reproducible. [...]
For the Tails privacy-oriented operating system, I uploaded the following packages to Debian:
0.1.8-5):
dh-python to Build-Depends. (#952366)sphinxdoc:Depends to binary package dependencies. (#832588)tool:pytest section in setup.cfg over plain "pytest".dh-systemd with debhelper version 9.20160709, specify Rules-Requires-Root: no, use secure URL in debian/copyright, update Vcs-Git & Vcs-Browser and bump the package's Standards-Version to 4.5.0.0.2-9):
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to provide the ability to demonstrate these binaries originated from a particular trusted source release: if identical results are generated from a given source in all circumstances, reproducible builds provides the means for multiple third-parties to reach a consensus on whether a build was compromised via distributed checksum validation or some other scheme.
The initiative is proud to be a member project of the Software Freedom Conservancy, a not-for-profit 501(c)(3) charity focused on ethical technology and user freedom.
Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
This month, I:
libmate-desktop library component of the MATE Desktop Environment I submitted a pull request to make the build reproducible in/around various dialog boxes, etc. [...]
snapd component of the Snappy package manager. Here, I opened a pull request to make the build reproducible. [...]
python_example, an example pybind11 module built with a Python-based build system, I suggested sorting the extension sources to ensure a reproducible build in any projects based on this template. [...]
debian-installer package to allow all arguments from sources.list files (such as [check-valid-until=no]) in order that we can test the reproducibility of the installer images on the Reproducible Builds own testing infrastructure. (#13)
openstack-pkg-tools to fix a curious issue where packages built differently if they built "too fast" for example, if we built for both Python 3.7 and Python 3.8 but the installation of the latter occurs within the same wall clock second of the former, the Python 3.8 version will not overwrite the Python 3.7 version and lead to a shebang of #!/usr/bin/python3.7, whilst if it does not occur within the same second, the shebang will be overwritten
to #!/usr/bin/python3.8. (#952762)
#include directives), designate (embedded build path), javatools (nondeterminstic parsing of command-line variables), mate-desktop (build timestamps), msgpack-c (embeds build path), pynwb (embedded timestamps in test files), python-oslo.reports (nondeterminstic/random numbers), snapd-glib (embedded build path) & xavs2 (embedded timestamps).
Meson.build example to the SOURCE_DATE_EPOCH documentation [...], replacing instances of "anyone can" with "anyone may" [...], correcting/improving the logic to skip commits when generating drafts [...][...][...], etc.
In our tooling, I also made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues, including uploading version 137 to Debian:
sng image utility will return 1 if there are even minor errors in the file. (#950806)classes2.dex, classes3.dex from .apk files. (#88)str.format if we are just returning the string. [...]Command.VALID_RETURNCODES. [...]hsd, a blockchain-based top-level domain DNS protocol implementation that underpins Handshake and worked on some initial packaging. (#952472)
Debian LTS
This month I have worked 18 hours on Debian Long Term Support (LTS) and 12 hours on its sister Extended LTS project.
cacti (CVE-2020-8813), golang-go.crypto (CVE-2020-9283), netty, nodejs (CVE-2019-15605), nova (CVE-2015-9543), ntp, otrs2 (CVE-2019-11358)), php-horde-data (CVE-2020-8518), proftpd-dfsg, python-bleach (CVE-2020-6802), python-django, python-pysaml2, qtbase-opensource-src (CVE-2015-9541), ruby-rack, salt, sudo, systemd (CVE-2020-1712), waitress (CVE-2020-5236), wpa (CVE-2019-5061) & yara
1.10.7-2+deb9u8 to Debian stretch and 1.11.28-1~deb10u1 for Debian buster to address CVE-2020-7471, a potential SQL injection vulnerability.
2.2.10-1) New upstream security release. (#950581)
6.0~rc1-2 Add support for Transport Layer Security added in Redis 6.x (#951255) and add a comment regarding why we export a MAKEFLAGS variable in debian/rules.
5.0.7-2:
2.13+dfsg-2) Fix a regression in handling of CVE-2015-1197 with respect to the --no-absolute-filenames argument by reverting part of an upstream commit. (#946267 #946469)
0.14.0-6) Set the Bug-Database, Bug-Submit, Repository and Repository-Browse upstream metadata fields and rely on pre-initialised dpkg-architecture variables in debian/rules.
1.5.22-1 New upstream release.1.5.22-2 Apply a patch to fix build failures on the s390x architecture. (#950777)20.0.4-2 Set the upstream metadata fields (Repository, Repository-Browse, etc.), bump Standards-Version to 4.5.0.20.0.4-3 Specify that the gunicorn binary package provides the httpd-wsgi3 virtual package. (#952706)4.0.23-2:
future=+lfs to DEB_BUILD_MAINT_OPTIONS to support operating on large files. (#949665)gitlab-ci.yml.Rules-Requires-Root: no and bump the Standards-Version to 4.5.0.4.0.23-3 Drop quotes from DEB_BUILD_MAINT_OPTIONS export line. (#951037)
4.7.6-1) on behalf of Alexandre Rossi.
I've so far identified ten sources for IMDB title IDs for movies in
the public domain or with a free license. This is the statistics
reported when running 'make stats' in the git repository:
249 entries ( 6 unique) with and 288 without IMDB title ID in free-movies-archive-org-butter.json
2301 entries ( 540 unique) with and 0 without IMDB title ID in free-movies-archive-org-wikidata.json
830 entries ( 29 unique) with and 0 without IMDB title ID in free-movies-icheckmovies-archive-mochard.json
2109 entries ( 377 unique) with and 0 without IMDB title ID in free-movies-imdb-pd.json
291 entries ( 122 unique) with and 0 without IMDB title ID in free-movies-letterboxd-pd.json
144 entries ( 135 unique) with and 0 without IMDB title ID in free-movies-manual.json
350 entries ( 1 unique) with and 801 without IMDB title ID in free-movies-publicdomainmovies.json
4 entries ( 0 unique) with and 124 without IMDB title ID in free-movies-publicdomainreview.json
698 entries ( 119 unique) with and 118 without IMDB title ID in free-movies-publicdomaintorrents.json
8 entries ( 8 unique) with and 196 without IMDB title ID in free-movies-vodo.json
3186 unique IMDB title IDs in total
The entries without IMDB title ID are candidates to increase the
data set, but might equally well be duplicates of entries already
listed with IMDB title ID in one of the other sources, or represent
movies that lack a IMDB title ID. I've seen examples of all these
situations when peeking at the entries without IMDB title ID. Based
on these data sources, the lower bound for movies listed in IMDB that
are legal to distribute on the Internet is between 3186 and 4713.
It would be great for improving the accuracy of this measurement,
if the various sources added IMDB title ID to their metadata. I have
tried to reach the people behind the various sources to ask if they
are interested in doing this, without any replies so far. Perhaps you
can help me get in touch with the people behind VODO, Public Domain
Torrents, Public Domain Movies and Public Domain Review to try to
convince them to add more metadata to their movie entries?
Another way you could help is by adding pages to Wikipedia about
movies that are legal to distribute on the Internet. If such page
exist and include a link to both IMDB and The Internet Archive, the
script used to generate free-movies-archive-org-wikidata.json should
pick up the mapping as soon as wikidata is updates.
As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.
It finally happened
On the 6th of April 2017, I finally took the plunge and applied for Debian Developer status. On 1 August, during DebConf in Montr al, my application was approved. If you re paying attention to the dates you might notice that that was nearly 4 months ago already. I was trying to write a story about how it came to be, but it ended up long. Really long (current draft is around 20 times longer than this entire post). So I decided I d rather do a proper bio page one day and just do a super short version for now so that someone might end up actually reading it.
How it started
In 1999 no wait, I can t start there, as much as I want to, this is a short post, so In 2003, I started doing some contract work for the Shuttleworth Foundation. I was interested in collaborating with them on tuXlabs, a project to get Linux computers into schools. For the few months before that, I was mostly using SuSE Linux. The open source team at the Shuttleworth Foundation all used Debian though, which seemed like a bizarre choice to me since everything in Debian was really old and its boot-floppies installer program kept crashing on my very vanilla computers.

SLUG (Schools Linux Users Group) group photo. SLUG was founded to support the tuXlab schools that ran Linux.

Ubuntu 4.10 default desktop Image from distrowatch
Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you re interested in Java, Games and LTS topics, this might be interesting for you.
Debian Games
domain_host variation.--print-sudoers feature.
For the past few years I've hosted a service for spam-testing blog/forum comments, and I think it is on the verge of being retired.
The blogspam.net service presented a simple API for deciding whether an incoming blog/forum comment was SPAM, in real-time. I used it myself for two real reasons:
struct
Here is my monthly update covering what I have been doing in the free software world in October 2017 (previous month):
diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues.
strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build.
buildinfo.debian.net is my experiment into how to process, store and distribute .buildinfo files after the Debian archive software has processed them.
Halloween is here, time to upload a new set of scary packages of TeX Live. About a month has passed, so there is the usual big stream up updates. There was actually an intermediate release to get out some urgent fixes, but I never reported the news here. So here are the accumulated changes and updates.
My favorite this time is wallcalendar, a great class to design all kind of calendars, it looks really well done. I immediately will start putting one together.
On the font side there is the new addition coelacanth. To quote from the README: Coelacanth is inspired by the classic Centaur type design of Bruce Rogers, described by some as the most beautiful typeface ever designed. It aims to be a professional quality type family for general book typesetting. And indeed it is beautiful!
Other noteworthy addition is the Spark font that allows creating sparklines in the running text with LaTeX.
Enjoy.
New packages
algobox, amscls-doc, beilstein, bib2gls, coelacanth, crossreftools, dejavu-otf, dijkstra, ducksay, dynkin-diagrams, eqnnumwarn, fetchcls, fixjfm, glossaries-finnish, hagenberg-thesis, hecthese, ifxptex, isopt, istgame, ku-template, limecv, mensa-tex, musicography, na-position, notestex, outlining, pdfreview, spark-otf, spark-otf-fonts, theatre, unitn-bimrep, upzhkinsoku, wallcalendar, xltabular.
Updated packages
acmart, amsmath, animate, arabluatex, arara, babel, babel-french, bangorexam, baskervillef, beebe, biblatex-philosophy, biblatex-source-division, bibletext, bidi, bxjaprnind, bxjscls, bxpapersize, bytefield, classicthesis, cochineal, complexity, cooking-units, curves, datetime2-german, dccpaper, doclicense, docsurvey, eledmac, epstopdf, eqparbox, esami, etoc, fbb, fei, fithesis, fmtcount, fnspe, fonts-tlwg, fontspec, genealogytree, glossaries, glossaries-extra, hecthese, hepthesis, hvfloat, ifplatform, ifptex, inconsolata, jfmutil, jsclasses, ketcindy, knowledge, koma-script, l3build, l3experimental, l3kernel, l3packages, langsci, latex2man, latexbug, lato, leadsheets, libertinust1math, listofitems, luatexja, luatexko, luatodonotes, lwarp, markdown, mcf2graph, media9, newtx, novel, numspell, ocgx2, overpic, philokalia, phonenumbers, platex, poemscol, pst-exa, pst-geometrictools, pst-ovl, pst-plot, pst-pulley, pst-tools, pst-vehicle, pst2pdf, pstool, pstricks, pstricks-add, pxchfon, pxjahyper, quran, randomlist, rec-thy, reledmac, robustindex, scratch, skrapport, spectralsequences, tcolorbox, tetex, tex4ht, texcount, texdoc, tikzducks, tikzsymbols, toptesi, translation-biblatex-de, unicode-math, updmap-map, uplatex, widetable, xcharter, xepersian, xetexko, xetexref, xsim, zhlipsum.
Build-Kernel-Version field in .buildinfo files that can be generated with a new dpkg-genbuildinfo --always-include-kernel option. (#873937).class file to be stale if it shares the same
timestamp of the .clj. We thus adjust the timestamps of the .clj to always
be younger. (#877418)dh_strip_nondeterminism: Log which handler processed a file.
(#876140)bin/strip-nondeterminism: Print a warning in --verbose mode if no
canonical time specified.debian/watch.rustc on Jenkins for the reproducible-html-build-path-prefix-map-spec job.health_check: Include the running kernel version when reporting multiple kernel installed in /boot.
Reproducible Builds Summit 3 next week in Berlin
Next week from Tuesday, the 31st of October until Thursday, November 2nd, we'll have the 3rd Reproducible Builds summit in Berlin, to improve collaboration both between and inside projects, expand the scope and reach of reproducible builds to more projects and to brainstorm designs on tools enabling users to get the most benefits from reproducible builds.
We're again expecting contributors from around twenty projects and we're still having some free seats available. If you want to join this meeting, please register by sending us a short mail briefly describing why (eg. by stating you involvement in some project). We also have some funding available to further rextend the diversity of our community, so please also contact us if you think you cannot make it for financial reasons!
Personally I'm much looking forward to this event. The reproducible builds crowd is really a lovely bunch of people and thus I expect us to have some great discussions, some cool ideas and also some concrete actionable plans as a result of it. Totally worth it!
Talk about Reproducible Builds at OSSE in Prague tomorrow
Tomorrow, Wednesday, October 25th I'll be giving a talk at OSSE in Prague about the current status of Reproducible Builds and why we are not 'there' yet. I'd be glad to have a chat with you if you are there!
chrome-container, since it will not be reachable via 127.0.0.1 as is (rightfully) assumed by default.
If we want Warden authentication stubbing to work (as we do, since our application uses Devise) and transactional fixtures as well (e.g. rails handling database cleanup between tests without database_cleaner gem) we also need to ensure that the application server is being started by the tests and the tests are actually run against that server. Otherwise we might run into problems.
Getting the containers ready
Assuming you already have a container setup (and are using docker-compose like we do) there is not that much to change on the docker front. Basically you need to add a new service called chrome and point it to an appropriate image and add a link to it in your existing web-container.
I ve decided to use standalone-chrome for the browser part, for which there are docker images provided by the selenium project (they also have images for other browsers). Kudos for that.
...
services:
chrome:
image: selenium/standalone-chrome
web:
links:
- chrome
The link ensures that the chrome instance is available before we run the tests and that the the web-container is able to resolve the name of this container. Unfortunately this is not true for the other way round, so we need some magic in our test code to find out the ip-address of the web-container. More to this later.
Other than that, you probably want to configure a volume for you to be able to access the screenshots, which get saved to tmp/screenshotstype: :system and js: trueconfig/puma.rb which most likely collides with the necessary settings. You can ensure these settings yourself or use rails from branch 5-1-stable which includes this change. I decided for the latter and pinned my Gemfile to the then current commit.
Register a driver for the remote chrome
To register the required driver, you ll have to add some lines to your rails_helper.rb:
if ENV['DOCKER']
selenium_url =
"http://chrome:4444/wd/hub"
Capybara.register_driver :selenium_remote do app
Capybara::Selenium::Driver.new(app,
:url => selenium_url, :browser => :remote, desired_capabilities: :chrome )
end
end
Note that I added those lines conditionally (since I still want to be able to use a local chrome via chromedriver) if an environment variable DOCKER is set. We defined that environment variable in our Dockerfile and thus you might need to adapt this to your case.
Also note that the selenium_url is hard-coded. You could very well take a different approach, e.g. using an externally specified SELENIUM_URL, but ultimately the requirement is that the driver needs to know that the chrome instance is running on host chrome, port 4444 (the containers default).
Configure capybara to use the appropriate host and driver
The next step is to ensure that javascript-requiring system tests are actually run with the given driver and use the right host. To achieve that we need to add a before-hook to the corresponding tests or we can configure rspec accordingly to always include such a hook by modifying the rspec-configuration in rails_helper.rb like this:
RSpec.configure do config
...
config.before(:each, type: :system, js: true) do
if ENV['DOCKER']
driven_by :selenium_remote
ip = Socket.ip_address_list.detect addr addr.ipv4_private? .ip_address
host! "http://# ip :# Capybara.server_port "
else
driven_by :headless_chrome
end
end
Note the part with the ip-address: it tries to find an IPv4 private address for the web-container (the container running the tests) to ensure the chrome-container uses this address to access the application. The Capybara.server_port is important here, since it will correspond to the puma instance launched by the tests.
That heuristic (first ipv4 private address) works for us at the moment, but it might not work for you. It is basically a workaround to the fact that I couldn t get web resolvable for the chrome container which may be fixable on the docker side, but I was to lazy to further investigate that.
If you change it: Just make sure the host! method uses an URI pointing to an address of the web-container that is reachable to the chrome-container.
Define tests with type: :system and js: true
Last but certainly not least, you need actual tests of the required type and with or without js: true. This can be achieved by creating tests files starting like this:
RSpec.feature "Foobar", type: :system, js: true doSince the new rspec-style system tests are based around the feature-specs which used to be around previously, the rest of the tests is exactly like it is described for feature specs. Run the tests To run the tests a commandline like the following should do: docker-compose run web rspec It won t make a big noise about running the tests against chrome, unless something fails. In that case you ll see a message telling you where the screenshot has been placed. Troubleshooting Below I add some hints about problems I ve seen during configuring that: Test failing, screenshot shows login screen In that case puma might be configured wrongly or you are not using transactional fixtures. See the hints above about the rails version to use which also includes some pointers to helpful explanations. Note that rspec-rails by default does not output the puma startup output as it clutters the tests. For debugging purposes it might be helpful to change that by adding the following line to your tests:
ActionDispatch::SystemTesting::Server.silence_puma = falseError message: Unable to find chromedriver This indicates that your driver is not configured properly, because the default for system tests is to be
driven_by selenium, which tries to spawn an own chrome instance and is suitable for non-dockerized tests.
Check if your tests are marked as js: true (if you followed the instructions above) and that you properly added the before-hook to your rspec-configuration.
Collisions with VCR
If you happen to have tests that make use of the vcr gem you might see it complaining about not knowing what to do with the requests between the driver and the chrome instance. You can fix this, by telling VCR to ignore that requests, by adding a line where you configured VCR:
VCR.configure do config # required so we don't collide with capybara tests config.ignore_hosts 'chrome' ...
These dates are inclusive, ie. the summit will be 3 full days from "9 to 5".
Best arrive on Monday October 30th and leave on the evening of Thursday, 3rd
at the earliest.
Meeting content
===============
The exact content of the meeting is going to be shaped by the
participants, but here are the main goals:
- Update & exchange about the status of reproducible builds in various
projects.
- Establish spaces for more strategic and long-term thinking than is possible
in virtual channels.
- Improve collaboration both between and inside projects.
- Expand the scope and reach of reproducible builds to more projects.
- Brainstorming / Designing several things, eg:
- designing tools enabling end-users to get the most benefits from
reproducible builds.
- design of back-ends needed for that.
- Work together and hack on solutions.
There will be a huge variety of topics to be discussed. To give a few
examples:
- continuing design and development work on .buildinfo infrastructure
- build-path issues everywhere
- future directions for diffoscope, reprotest & strip-nondeterminism
- reproducing signed artifacts such as RPMs
- discussing formats and tools we can share
- sharing proposals for standards and documentation helpful to spreading the
reproducible effort
- and many many more.
Please think about what you want discuss, brainstorm & learn about at this
meeting!
Schedule
========
Preliminary schedule for the three days:
9:00 Welcome and breakfast
9:30 Meeting starts
12:30 Lunch
17:00 End of the official schedule
Gunner and Beatrice from Aspiration will help running the meeting. We will
collect your input in subsequent emails to make the best of everyone's time.
Feel free to start thinking about what you want to achieve there. We will also
adjust topics as the meeting goes.
Please note that we are very likely to spend large parts of the meeting away
from laptops and closer to post-it notes. So make sure you've answered any
critical emails *before* Tuesday morning! :)
--env-build option for testing builds under different sets of
environment variables. This is meant to help the discussion over at
#876055 about how we should deal with different types of
environment variables in a stricter definition of reproducibility._shell_ast module and merge it into shell_syn.
With the development of TLCockpit continuing, I found the need for and easy exchange format between the TeX Live Manager tlmgr and frontend programs like TLCockpit. Thus, I have implemented JSON output for the tlmgr info command.
While the format is not 100% stable I might change some thing I consider it pretty settled. The output of tlmgr info --data json is a JSON array with JSON objects for each package requested (default is to list all).
[ TLPackageObj, TLPackageObj, ... ]
The structure of the JSON object TLPackageObj reflects the internal Perl hash. Guaranteed to be present keys are name (String) and avilable (Boolean). In case the package is available, there are the following further keys sorted by their type:
[
"installed" : true,
"doccontainerchecksum" : "5bdfea6b85c431a0af2abc8f8df160b297ad73f6a324ca88df990f01f24611c9ae80d2f6d12c7b3767308fbe3de3fca3d11664b923ea4080fb13fd056a1d0c3d",
"docfiles" : [
"texmf-dist/doc/latex/base/README.txt",
....
"texmf-dist/doc/latex/base/webcomp.pdf"
],
"containersize" : 163892,
"depends" : [
"luatex",
"pdftex",
"latexconfig",
"latex-fonts"
],
"runsize" : 414,
"relocated" : false,
"doccontainersize" : 12812184,
"srcsize" : 752,
"revision" : 43813,
"srcfiles" : [
"texmf-dist/source/latex/base/alltt.dtx",
....
"texmf-dist/source/latex/base/utf8ienc.dtx"
],
"category" : "Package",
"cataloguedata" :
"version" : "2017/01/01 PL1",
"topics" : "format",
"license" : "lppl1.3",
"date" : "2017-01-25 23:33:57 +0100"
,
"srccontainerchecksum" : "1d145b567cf48d6ee71582a1f329fe5cf002d6259269a71d2e4a69e6e6bd65abeb92461d31d7137f3803503534282bc0c5546e5d2d1aa2604e896e607c53b041",
"postactions" : [],
"binsize" : ,
"longdesc" : "LaTeX is a widely-used macro package for TeX, [...]",
"srccontainersize" : 516036,
"containerchecksum" : "af0ac85f89b7620eb7699c8bca6348f8913352c473af1056b7a90f28567d3f3e21d60be1f44e056107766b1dce8d87d367e7f8a82f777d565a2d4597feb24558",
"executes" : [],
"binfiles" : ,
"name" : "latex",
"catalogue" : null,
"docsize" : 3799,
"available" : true,
"runfiles" : [
"texmf-dist/makeindex/latex/gglo.ist",
...
"texmf-dist/tex/latex/base/x2enc.dfu"
],
"shortdesc" : "A TeX macro package that defines LaTeX"
]
What is currently not available via tlmgr info and thus also not via the JSON output is access to virtual TeX Live databases with several member databases (multiple repositories). I am thinking about how to incorporate this information.
These changes are currently available in the tlcritical repository, but will enter proper TeX Live repositories soon.
Using this JSON output I will rewrite the current TLCockpit tlmgr interface to display more complete information.
I was playing around with parsing JSON in Scala, and got spray-json as recommendation from my Senpai. My aim was parsing some nested structure like:
"key1" : "value1",
"key2" : "subkey1" : "subval1", "subkey2" : "subval2"
into a nested Scala case class:
case class SubClass(subkey1: String, subkey2: String)
case class MainClass(key1: String, key2: SubClass)

import spray.json._
object MyJsonProtocol extends DefaultJsonProtocol
implicit val subclassFormat = jsonFormat2(SubClass)
implicit val mainclassFormat = jsonFormat2(MainClass)
import MyJsonProtocol._
Using this parsing can be done in the usual way:
val jsonstr = """
"key1" : "value1",
"key2" : "subkey1" : "subval1", "subkey2" : "subval2"
"""
val jsonAst = jsonstr.parseJson
val gotit = jsonAst.convertTo[MainClass]
If the input is from a JSON array of the above arrays:
[
"key1" : "value1",
"key2" : "subkey1" : "subval1", "subkey2" : "subval2"
,
"key1" : "value10",
"key2" : "subkey1" : "subval10", "subkey2" : "subval20"
]
the only change necessary is to call
val gotit = jsonAst.convertTo[List[MainClass]]
Next.