OK, I already bragged that our book on Operating Systems is finally printed and has, thus, been formally published. What I had not yet mentioned is how we planned its physical distribution. Yes, it is available for sale at some UNAM libraries... But coming to UNAM is sadly an option only for people who are in Mexico City. I have been quite busy, and was unable to come up with anything earlier, but I have finally finished setting up a decent although minimal web page for the book. In it, I mention the possible ways you can get your own printed copy of Fundamentos de sistemas operativos:

• If you are in Mexico, the advised way is to call or mail the library at Instituto de Investigaciones Econ micas (+52-55)5623-0080 or ventiiec@unam.mx.
  They will ship the book (they would ship it overseas, but it'd be too expensive!) and are able to process electronic payment opetions.
  The book printed at UNAM has substantive part of its pages printed in color, and let me tell you... It's worth it.
• If you are not in Mexico or you prefer not to deal with a human, you can buy the book from the on-demand printing service lulu.com.
  For cost reasons, it is printed in black and white, but it is the same content (minus two typos ;-) ). Lulu.com is an international company, so they will get it shipped to you cheaper and faster And I have requested the book to be made available to libraries such as Amazon and Barnes and Noble (and was told it should take a couple of weeks to have it ready there).

Of course, the book is and will always be free for downloading, and its sources are online so you can easily derive from it as well. Enjoy! (and please report me any bugs you see!)

Today I was refered to the publication of an "agreement" signed by my university's Rector: The Agreement that establishes the General Guidelines for the Open Access Policy of Universidad Nacional Aut noma de M xico. This is a document we have been waiting and pushing for throughout several years; I got involved in the Network of Digital Collections (Red de Acervos Digitales), RAD-UNAM back in 2011, and am honored to be its current coordinator, but this group has roots back in 2005. And, of course, by then several other people had been working on the topic without formal coordination. Not only we are happy because the agreement explicitly mentions our group as one of The Venues for Open Access publishing and dissemination in UNAM. In its seventh point, it mentions:

In the matters of Open Access, academic entities and university dependencies have the following obligations:
(...)
VII. Promote and support the creation and maintenance of institutional repositories, as well as the deposit of the digital resources produced by its academic community, which should be incorporated into Red de Acervos Digitales de la UNAM
(...)

So... We have done a good job. And there will be surely more to follow! I'm including here a copy of the agreement by itself (without the whole number of the Gaceta UNAM) because I will surely have to refer to it in the future.

Attachment	Size
Lineamientos generales para la pol tica de acceso abierto de la Universidad Nacional Aut noma de M xico	89.83 KB

The first updated in the 0.12.* series of Rcpp is now on the CRAN network for GNU R this morning, and I will push a Debian package. This follows the 0.12.0 release from late July which started to some serious new features. Rcpp has become the most popular way of enhancing GNU R with C++ code. As of today, 461 packages on CRAN depend on Rcpp for making analyses go faster and further. This release once again features contributions from a number of new contributors, with Florian Plaza O ate and Dan Dillon joining the fray with several pull requests each. Kurt Hornik also helped with a fix for a bad interaction between very recent R (3.2.2) changes and Rcpp; another related one was also addressed. A big Thanks! to everybody helping with code, bug reports or documentation, See below for a detailed list of changes extracted from the NEWS file.

Changes in Rcpp version 0.12.1 (2015-09-10)

• Changes in Rcpp API:
  • Correct use of WIN32 instead of _WIN32 to please Windows 10
  • Add an assignment operator to DimNameProxy (PR #339 by Florian)
  • Add vector and matrix accessors .at() with bounds checking (PR #342 by Florian)
  • Correct character vector conversion from single char (PR #344 by Florian fixing issue #343)
  • Correct on use of R_xlen_t back to size_t (PR #348 by Romain)
  • Correct subsetting code to allow for single assignment (PR #349 by Florian)
  • Enable subset assignment on left and righ-hand side (PR #353 by Qiang, fixing issue #345)
  • Refreshed to included tinyformat template library (PR #357 by Dirk, issue #356)
  • Add operator<<() for vectors and matrices (PR #361 by Dan fixing issue #239)
  • Make String and String_Proxy objects comparable (PR #366 and PR #372 by Dan, fixing issue #191)
  • Add a new class Nullable for objects which may be NULL (PR #368 by Dirk and Dan, fixing issue #363)
  • Correct creation and access of large matrices (PR #370 by Florian, fixing issue #369)
• Changes in Rcpp Attributes:
  • Correctly reset directory in case of no-rebuilding but Windows code (PR #335 by Dirk)
• Changes in Rcpp Modules:
  • We no longer define multiple Modules objects named World in the unit tests with was seen to have a bad effect with R 3.2.2 or later (PR #351 by Dirk fixing issue #350).
  • Applied patch by Kurt Hornik which improves how Rcpp loads Modules (PR #353 by Dirk)
• Changes in Rcpp Documentation:
  • The Rcpp.bib file with bibliographic references was updated.

Thanks to CRANberries, you can also look at a diff to the previous release As always, even fuller details are on the Rcpp Changelog page and the Rcpp page which also leads to the downloads page, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

A common programming task is to glue (or "join") items together to create a single string. For example: Notice that we have three items but only two commas this can be important if the tool we passing doesn't support trailing delimiters or we simply want the result to be human-readable. Unfortunately, this can be inconvenient in POSIX shell where we construct strings via explicit concatenation. A na ve solution of: ... incorrectly returns ", foo, bar, baz". We can solve this with a (cumbersome) counter or flag to only attach the delimiter when we need it:

---

One alternative is to use the little-known ":+" expansion modifier. Many people are familiar with ":-" for returning default values: By contrast, the ":+" modifier inverts this logic, returning the fallback if the specified variable is actually set. This results in the elegant:

I have finally finished the Portfile for CafeOBJ, which allows users to install CafeOBJ via the usual port command of MacPorts. For one needs to add our local source (which only ships CafeOBJ port), but I hope to get the port into the standard distribution soon. Necessary steps:

• Add the following line to your MacPorts sources.conf, which usually resides in /opt/local/etc/macports/sources.conf:

  http://cafeobj.org/macport/ports.tar.gz

• After that, call the following two commands (as root or with sudo), the first syncronizing the ports, the second one installing CafeOBJ:

  port sync port install cafeobj

This should give you a working installation of CafeOBJ 1.5.3. The port will be updated as soon as 1.5.4 is released (which should be rather soon). Enjoy, and please leave comments and suggestions how to improve the port file here, per email, or at our bug tracker.

I finally gave up and drank the cool-aid of the Bootstrap theme. The main reason was that I noticed the site was basically unusable on any mobile device, including tablet computers like the iPad, which are unfortunately very, very common. Phones wouldn't render the site in a legible way either, unfortunately. The change is rather drastic, so I figured it was important to mention it here. I am not so satisfied pretty exctied with the result: the theme is very basic, if not absent. I actually like that purified form now, and it works across devices now much better. But I do feel I just made my blog look like everyone else that uses Bootstrap. We seem to enter an era where non-graphic designers (like me) are back to building web pages that all look the same, not very different, in a way, from the old days of plain HTML, like the default ikiwiki theme. I did some work to change the look at least minimally, but the top black navbar is really a killer giveaway this is a bootstrap theme. Bootstrap does a lot for the typography, at least when checking the presslabs checklist or the practical typography checklist, but I still had to change the main body width, which helped a lot I think. Anyways, the old Night City theme is still available for download and I could still flip it back on here if I need to.

What changed The new theme keeps the distractions away, but ironically, it's slower than the previous theme even though there are no images and basically no colors at all. On my tests, it now loads in about 3.42 seconds on the "Regular 2G (250Kbps)" simulation of Chromium with 72KB in 12 requests. Whereas my tests with the previous theme were taking 3.25 seconds with 43.5KB in 17 requests. This is due to the Bootstrap CSS, which takes a whopping 19KB itself, but especially because I now load JQuery, which takes a whopping 32.8KB! And that is probably gzip-compressed, as the original is more around 90KB. But at least the thing is readable on phones and tablets now. Compare:

Samsung S3, before

Samsung S3, after I like this: much simpler, purer version on smaller devices. And we see what counts: the freaking text. Of course, on tablets, it doesn't fare as well: the top menu gets wrapped around...

Apple iPad, before

Apple iPad, after Apparently, the fix would be for me to "customize the @grid-float-breakpoint variable" in LESS (which I thought was a pager, but seems to be a CSS preprocessor, graaah). Still, I think it's better that way, more readable, and less crufty.

How it was done After doing a thorough evaluation of all the Bootstrap ikiwiki themes I could find (there are more than 4 at least!), I figured I prefered the Jak Linux one. It seemed to be better implemented than the others, cleaner, and I liked the mean black border on top. Black is cool. Oh, and I liked the subtle footer as well. Subtle is cool. Unfortunately, that theme originally required a custom plugin to have a menu on top, which i thought was silly. So I patched it to make it work with the sidebar plugin, which turned out to be trivially simple: just dump the sidebar content, and make the sidebar page have explicit HTML tags in it that match Bootstrap's required classes. I also added the regular action links in the top navbar, but that does overload it quite a bit. I also did some code cleanups and various other small changes, all of which are available in my personnal git repo.

What doesn't work So of course, there are always problems. The first problem is the extra bandwidth usage. Not sure that can be fixed, other than switching to the upcoming Bootstrap 4, which is smaller than Bootstrap 3, bizarrely. The more annoying problems are weird alignment issues. If the screen gets two narrow without kicking some collapse rules in place (the iPad bug above), the navbar rows overflow and look ugly. Even more bizarre, in some cases the right navbar can just completely disappear, in fact, that's the only fix I could find: to assign the hidden-xs and hidden-sm classes to the navbar-right <UL> element. But then it just goes away, which is pretty darn stupid. Still - I assigned the classes to a few actions that seemed low priority, both in the theme and in the sidebar page. Similarly, the search form at the bottom of the page doesn't seem to want to fit in the footer properly. No idea why and I can't bother to figure that one out. I ended up merging this with the backlinks, tags and trails navigation items. Oh, and amazingly enough: comments are simply not rendered at all right now. Oops. I seemed to have picked the single bootstrap Ikiwiki theme that does *not* have comments rendering... Aaaargh. For now I just copy-pasted stuff from the [ramseydsilva][] theme and it looks pretty ugly, but at least it works. I ended up theming comments the same way i did for Night City, which looks pretty good, but is not in sync with the LESS stuff in Bootstrap. I also add to add back trails, backlinks and favicon... looks like the Jak theme wasn't made for a blog after all... but that's now fixed! Another improvement would be to change the font from the canonical Helvetica to something prettier, like suggested in Practical Typography, in the font recommendations section, or the presslabs checklist. So far I have settled on Mozilla's Fira font (which means, yes, one set of objects is actually loading from the CDN, sorry). Feedback welcome.

Follow me on Identi.ca or Twitter or Diaspora* Don t know Retweet? My last post about it introduced this small Twitter bot whichs aims to retweet every tweets from a Twitter account to another one. Retweet

• Retweet 0.3 on Github
• The Retweet project on Github
• The official documentation of the Retweet project

The new features of this release:

• retweet a tweet only if it was already retweeted a number of times you can specify
• define the duration to wait before processing the next tweet to possibly retweet (useful if you want to control the delay between two tweets).

Retweet was created in order to improve the Journal du hacker Twitter account. The Journal du hacker is a Hacker News-like French-speaking website. Especially useful to broadcast news through a network of Twitter accounts, Retweet was also improved to improve pep8 compliance and code readability (wip). The project is also well documented and should be quite simple to install, configure and use. What about you? If you try it, please tell me what you think about it, opening a bug request or ask for new features. Or just write your comment here ;)

It's time for some new music. And given that this artist was suggested to me at least twice by different people I guess I finally have to feature her. This time it's about Sookee, a rapper from Berlin with queer-feministic background. I guess if you listen and see the first song you might know why she was suggested to me, and also why I consider her an important artist to share. So without further delay, here are the songs:

• D.R.A.G.: The saying you're born naked and the rest is drag couldn't be more true. Actually, that quote says it all, even though I try to use this drag to help people get my gender on a more regularly basis these days.
• Spuck auf Rechts: In a time of PEGIDA, of burning refugee centers and even middle-left based political parties doing right-winged propaganda this song is still very much current and important, maybe even more.
• Pro Homo: Wie kann man nur hassen, dass Menschen sich lieben. "How is it possible to hate that people love each other" - is there anything to add to this? I don't think so.

As you can see, Sookee isn't just some artist but transports a lot of messages. And even when you might not understand them because they are in German I hope you get the concept nevertheless. :) Enjoy!

/music permanent link Comments: 0 Flattr this

Over the past few years, a plethora of orchestration frameworks have been exploding onto the scene. Many have been around for quite a while but not all have the same sort of community behind them. For example there's a very interesting option in Joey Hess' Propellor but that is hurt by needing to be able to build Propellor on all the hosts you manage. On the other hand, Ansible is able to operate without installing extra software on your target hosts, but instead it ends up very latency-bound which can cause problems when your managed hosts are "far away". I have considered CFEngine, Chef, Puppet and Salt in addition to the above mentioned options, but none of them feel quite right to me. I am looking for a way to manage a small number of hosts, at least one of which is not always online (my laptop) and all of which are essentially snowflakes whose sparkleybits I want some reasonable control over. I have a few basic requirements which I worry would be hard to meet -- I want to be able to make changes to my hosts by editing a file and committing/pushing it to a git server. I want to be able to manage a host entirely over SSH from one or more systems, ideally without having to install the orchestration software on the target host, but where if the software is present it will get used to accelerate matters. I don't want to have to install Ruby or PHP on any system in order to have orchestration, and some of the systems I wish to manage simply can't compile Haskell stuff sanely. I'm not desperately interested in learning yet more DSLs, but I appreciate that it will be necessary, but I really don't want to have to learn more than one DSL simply to run one frameworks. I don't want to have to learn strange and confusing combinations of file formats. For example, Ansible quite sensibly uses YAML for its structured data except for its host/group lists. It uses Jinja2 for its templating and looping, except for some things which it generates its own looping constructs inside its YAML. I also personally find Ansible's sportsball oriented terminology to be confusing, but that might just be me. So what I'm hoping is that someone will be able to point me at a project which combines all the wonderful features of the above, with a need to learn only one DSL and which doesn't require to be installed on the managed host but which can benefit from being so installed, is driven from git, and won't hurt my already overly burdened brain. Dear Lazyweb, pls. kthxbye.

Hm, wasn't there a catchy tune that started that way? Just kidding. But about twenty years ago today I sent this email about a new Debian package upload -- and that makes it (as best as I can tell) the earliest trace of me doing Debian work. It so happened that I did upload two packages in July of 1995 as well, but it was so early in the project that we did not have a mailing list archive for such things yet (!!). And I have a vague recollection that the two in July were an adoption---whereas the post referenced above announced efax as my first new package added to the distribution. And there were more to come ... Anyway, thanks for all the fish! Twenty years with Debian has been a great, great ride. I learned a lot from a lot of fantastic people, and I hope I helped a few people along the way with a package or two I still maintain. Debian remains a truly fabulous project which I hope will go strongly for another 20 (or even 22).

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

I recently received Debian bug report #798350 where the user had a problem with wordpress. After upgrading to version 4.3, the webservers performance degrades over time. The problem is also reported at the wordpress site with bug WordPress ticket 33423 including the fix. I have backported the relevant changeset and uploaded Debian wordpress package 4.3+dfsg-2 which only contains this changeset. For a lot of people, including myself, you probably won t hit this bug but if it impacts you, then try this update.

Review: Dark Currents, by Jacqueline Carey

Series:	Agent of Hel #1
Publisher:	Roc
Copyright:	2012
Printing:	October 2013
ISBN:	0-451-41483-7
Format:	Mass market
Pages:	399

This is another much-belated review. Hopefully I can remember the book well enough to do it justice. Daisy Johanssen has normal urban fantasy problems: her father was an incubus who (somewhat unsurprisingly) didn't stick around, she has to keep careful control of her own demonic side, her father occasionally tries to tempt her to invoke demonic power, and it's possible that she could breach the walls protecting the world from demons and bring about Armageddon. The typical sort of thing. Also, there's an unexplained murder in her home town, a mid-western US resort town whose image does not go well with eldritch murders. Daisy's only official role with the town police department is as a part-time file clerk, but this is urban fantasy, so you know the protagonist is going to be hip-deep in some sort of crime investigation. In this case, that's because the Norse goddess Hel (as distinct from the origin of Daisy's father entirely different thing) also lives here, in a manner of speaking, and Daisy is her liaison. In this case, Hel decides she's the one who should dispense justice. Carey previously has primarily been an epic fantasy writer, and this is her first foray into urban fantasy. (Well, arguably Santa Olivia and its sequel count, but those felt closer to superhero fiction to me.) The language and tone of her epic fantasy is far different than the conventions of either urban fantasy or superhero fiction, and I thought Santa Olivia was somewhat awkward in places. (None of the profanity quite worked, for instance.) Dark Currents felt smoother and more comfortable, aided by a charming mid-western feel. A few of Daisy's first-person narrative quirks wore poorly, such as every reference to "the Seven Deadlies," but Carey did a solid job with a typical out-of-her-depth urban fantasy protagonist. I'm pretty tired of the standard mythology of urban fantasy, and that is a bit of a drawback here: vampires and werewolves both feature, and I think I could happily go ten years before reading another story about vampires or hunky werewolves. Carey adds her own take on ghouls, but it's still pretty similar to lots (and lots) of other series. Thankfully, there's a bit of Norse mythology, a bit of fairy, and one extremely memorable lamia (of the serpent-tail-below-the-waist variety, at least some of the time). Lurine, a reclusive, retired starlet, a friend of Daisy's mother, and Daisy's childhood babysitter, is the lamia in question. She absolutely steals the show. The dynamic between her and Daisy is perfect: Carey resists the urge to ruin it with dark hints or falling-outs to increase tension. Instead, she lets it be a bit quirky, a bit complicated, but full of the reliability of a deep friendship. And Lurine is a wonderful character, the kind that only works as a supporting character because she's best seen through other people's eyes. Daisy's mother just makes the dynamic better. The reader can believe she's the sort of person who would have an ill-advised fling with an incubus, but also the sort of person who could raise a daughter like Daisy without many resources other than sheer grit. She never loses her optimistic outlook on the world, but has enough backbone behind it to make Lurine's friendship with her entirely believable. The plot here is nothing particularly special. Daisy unravels various clues, gets deeper into complicated relationships between various factions, occasionally finds herself in serious trouble, and relies on the help of friends and allies. I would have enjoyed the book more with a lot less Cody and more of the less typical mythology. But the relationships between the female characters, and the sheer persistence of mid-western normality and ordinary life challenges in the face of so much supernatural meddling, help this book stand out from the crowd. Dark Currents is different from most of what Carey has written, and you may be a bit disappointed if you were hoping for the epic sweep of the Kushiel series. But I found myself charmed by it, and will be reading the next book of the series. Followed by Autumn Bones. Rating: 7 out of 10

Implementing the hardening When packaging in Debian, is very common to see the lintian messages 'hardening-no-relro' and 'hardening-no-fortify-functions' in some softwares written in C or C++. To solve these issues, we can use the 'blhc' tool (apt-get install blhc). Please, get the revision 1.11-9 of the icmpinfo package. You can get this revision from http://snapshot.debian.org or from http://eriberto.pro.br/debian/icmpinfo. As a shortcut, you can use the following command:

$ dget -u http://eriberto.pro.br/debian/icmpinfo/icmpinfo_1.11-9.dsc

The icmpinfo 1.11-9 is almost clean for lintian (in 2015-09-07, Standards-Version 3.9.6). The only problem is:

W: icmpinfo: hardening-no-relro usr/sbin/icmpinfo

To track the problem I will use blhc over the .build file:

$ blhc icmpinfo_1.11-9_amd64.build
LDFLAGS missing (-Wl,-z,relro): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -o icmpinfo recvping.o print.o err.o icmpinfo.o pid.o

Note that the problem is some missing options (-Wl,-z,relro) for LDFLAGS when building icmpinfo (for newbies, in GCC, -o is used to indicate the name to be used for the final binary after the compilation). If you are using the DebHelper compat 9 (debian/compat=9) and the DebHelper 9 (debhelper >= 9 in Build-Depends field in d/control), some variables as CFLAGS, LDFLAGS, CPPFLAGS and CXXFLAGS will be automatically passed during calls to dh_auto_* programs (yes, you should use the new and reduced d/rules format - see as example the debian/rules of the icmpinfo 1.11-9; if you still have doubts, $ man dh). Now, we need discover the reason why the LDFLAGS is being changed between its generation by the Debian build system and its utilization by the upstream's source code. So, we need to check the upstream Makefile. There is in Makefile (after a 'quilt push -a', to apply all current patches):

LDFLAGS= $(CFLAGS)
OBJECTS= recvping.o print.o err.o icmpinfo.o pid.o
TARGET = icmpinfo
$(TARGET): $(OBJECTS)
 $(CC) $(LDFLAGS) -o $@ $(OBJECTS) $(LDLIBS)

Hummm... The LDFLAGS content generated by Debian is being dropped by Makefile because it is saying that "LDFLAGS = CFLAGS content". This line is a problem because the upstream Makefile needs to take and use the CFLAGS and LDFLAGS independently. To fix the issue, you can use this patch:

--- icmpinfo-1.11.orig/Makefile
+++ icmpinfo-1.11/Makefile
@@ -20,13 +20,13 @@ VERS = 1.11
 
 RM = rm -f
 
-LDFLAGS= $(CFLAGS)
+#LDFLAGS= $(CFLAGS)
 
 OBJECTS= recvping.o print.o err.o icmpinfo.o pid.o
 TARGET = icmpinfo
 
 $(TARGET): $(OBJECTS)
- $(CC) $(LDFLAGS) -o $@ $(OBJECTS) $(LDLIBS)
+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $(OBJECTS) $(LDLIBS)
 
 tgz: clean
 rm -f CHECKSUMS.asc

After a 'debuild' is a fact the problem is solved and the lintian is happy. See the blhc results:

$ blhc ../icmpinfo_1.11-9_amd64.build
$

Now, we can improve the hardening. To see the current status, we can use the 'blhc --all' command. See here:

blhc --all ../icmpinfo_1.11-9_amd64.build
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o recvping.o recvping.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o print.o print.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o err.o err.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o icmpinfo.o icmpinfo.c
CFLAGS missing (-fPIE): cc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -c -o pid.o pid.c
LDFLAGS missing (-fPIE -pie -Wl,-z,now): cc -Wl,-z,relro -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -o icmpinfo recvping.o print.o err.o icmpinfo.o pid.o

Well, we know that CFLAGS and LDFLAGS are present. Now, we can force the DebHelper to pass some extra options to make hardening better. Generally, is only needed to add the following line to debian/rules:

export DEB_BUILD_MAINT_OPTIONS = hardening=+all

See the results (after a new debuild command):

$ blhc --all ../icmpinfo_1.11-9_amd64.build
$

More examples Let me to show other example. I will use the mac-robber 1.02-3 (however, I disabled the Makefile.patch in debian/patches/series). After a debuild, the following lintian messages are presented:

W: mac-robber: hardening-no-relro usr/bin/mac-robber
I: mac-robber: hardening-no-fortify-functions usr/bin/mac-robber

Using blhc:

$ blhc ../mac-robber_1.02-3_amd64.build 
CFLAGS missing (-g -O2 -fstack-protector-strong -Wformat -Werror=format-security): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c
LDFLAGS missing (-Wl,-z,relro): gcc -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c

We need to verify what is the problem in Makefile with CFLAGS, CPPFLAGS and LDFLAGS when generating the binary 'mac-robber' (just recalling, -o mac-robber in GCC command). See:

linux_notstatic: 
 $(CC) -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c

There are no references to CFLAGS, CPPFLAGS and LDFLAGS. To solve the problem, we need patch the Makefile to make this:

linux_notstatic: 
 $(CC) $(CFLAGS) $(LDFLAGS) $(CPPFLAGS) -D_FILE_OFFSET_BITS=64 -o mac-robber mac-robber.c

As last example, is possible that the Makefile is overriding the content sent by DebHelper when building. See this line from a hypothetical Makefile:

CFLAGS = -g -Wall

As you can see, the Makefile is redefining CFLAGS; consequently, it is discarding any previous content sent by DebHelper. To solve this issue, we can use the following patch:

-CFLAGS = -g -Wall
+CFLAGS += -g -Wall

So, the content received from DebHelper will be added to '-g -Wall'. Default parameters As curiosity, to see the basic parameters created by DebHelper as hardening, use the command:

$ dpkg-buildflags

To see the all parameters, use the command:

$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags

More information More information about the hardening can be viewed at two places: https://wiki.debian.org/Hardening https://wiki.debian.org/HardeningWalkthrough I hope this help. Enjoy!

I had the wonderful privilege to go camping and hiking with my kids scouting group, the Pathfinders of Tantallon SDA church. The day started with a quick trip to Pugwash with one of the leaders to bring back some chairs to their school, and then we headed back out to Blomidon to meet up with the group. Click the photo below to start the slideshow.

The road trip started early to fetch some chairs click to start

FTP assistant Another month passed and another statistic arrives: This month I marked 408 packages for accept and rejected only 32 of them. Almost like last month I had to send 14 emails to maintainers. Squeeze LTS This was my fourteenth month that I did some work for the Squeeze LTS initiative, started by Raphael Hertzog at Freexian. As anybody else visited Debconf15, I got assigned a workload of 17h this month. I spent some time to prepare an upload of php5, which I did to people.d.o to let others do some tests with the package. I also uploaded some DLAs

• [DLA 290-1] xmltooling security update Thorsten Alteholz
• [DLA 290-2] opensaml2 security update Thorsten Alteholz
• [DLA 292-1] libstruts1.2-java security update Thorsten Alteholz
• [DLA 296-1] extplorer security update Thorsten Alteholz
• [DLA 297-1] wesnoth-1.8 security update Thorsten Alteholz
• [DLA 298-1] roundup security update Thorsten Alteholz

The patch for [DLA 290-1] was prepared by Ferenc Wagner. As opensaml2 needed a rebuild with the new version of xmltooling, that upload got [DLA-290-2] instead of an own DLA-number. This month I also had another term of doing frontdesk work. So I answered questions on the IRC channel and looked for CVEs that are important for Squeeze LTS or could be ignored. Other stuff As $WORK needed some time this month, my other activities had been almost nil. But expect more to come in September .

I have about 18 personal hosts, all running the Jessie release of Debian GNU/Linux. To keep up with security updates I use unattended-upgrades. The intention is that every day, via cron, the system will look for updates and apply them. Although I mostly expect it to handle security updates I also have it configured such that point-releases will be applied by magic too. Unfortunately this weekend, with the 8.2 release, things broke in a significant way - The cron deamon was left in a broken state, such that all cronjobs failed to execute. I was amazed that nobody had reported a bug, as several people on twitter had the same experience as me, but today I read through a lot of bug-reports and discovered that #783683 is to blame:

• Old-cron runs.
• Scheduled unattended-upgrades runs.
• This causes cron to restart.
• When cron restarts the jobs it was running are killed.
• The system is in a broken state.

The solution:

# dpkg --configure -a
# apt-get upgrade

I guess the good news is I spotted it promptly, with the benefit of hindsight the bug report does warn of this as being a concern, but I guess there wasn't a great solution. Anyway I hope others see this, or otherwise spot the problem themselves. In unrelated news the seaweedfs file-store I previously introduced is looking more and more attractive to me. I reported a documentation-related bug which was promptly handled, even though it turned out I was wrong, and I contributed CIDR support to whitelisting hosts which was merged in well. I've got a two-node "cluster" setup at the moment, and will be expanding that shortly. I've been doing a lot of little toy-projects in Go recently. This weekend I was mostly playing with the nats.io message-bus, and tying it together with sinatra.

Piwik told me that people are still sharing my post about the state of GNOME-Software and update notifications in Debian Jessie. So I thought it might be useful to publish a small update on that matter:

• If you are using GNOME or KDE Plasma with Debian 8 (Jessie), everything is fine you will receive update notifications through the GNOME-Shell/via g-s-d or Apper respectively. You can perform updates on GNOME with GNOME-PackageKit and with Apper on KDE Plasma.
• If you are using a desktop-environment not supporting PackageKit directly for example Xfce, which previously relied on external tools you might want to try pk-update-icon from jessie-backports. The small GTK+ tool will notify about updates and install them via GNOME-PackageKit, basically doing what GNOME-PackageKit did by itself before the functionality was moved into GNOME-Software.
• For Debian Stretch, the upcoming release of Debian, we will have gnome-software ready and fully working. However, one of the design decisions of upstream is to only allow offline-updates (= download updates in the background, install on request at next reboot) with GNOME-Software. In case you don t want to use that, GNOME-PackageKit will still be available, and so are of course all the CLI tools.
• For KDE Plasma 5 on Debian 9 (Stretch), a nice AppStream based software management solution with a user-friendly updater is also planned and being developed upstream. More information on that will come when there s something ready to show ;-).

I hope that clarifies things a little. Have fun using Debian 8!

---

UPDATE: It appears that many people have problems with getting update notifications in GNOME on Jessie. If you are affected by this, please try the following:

1. Open dconf-editor and navigate to org.gnome.settings-daemon.plugins.updates. Check if the key active is set to true
2. If that doesn t help, also check if at org.gnome.settings-daemon.plugins.updates the frequency-refresh-cache value is set to a sane value (e.g. 86400)
3. Consider increasing the priority value (if it isn t at 300 already)
4. If all of that doesn t help: I guess some internal logic in g-s-d is preventing a cache refresh then (e.g. because I thinks it is on a expensive network connection and therefore doesn t refresh the cache automatically, or thinks it is running on battery). This is a bug. If that still happens on Debian Stretch with GNOME-Software, please report a bug against the gnome-software package. As a workaround for Jessie you can enable unconditional cache refreshing via the APT cronjob by installing apt-config-auto-update.

What happened in the reproducible builds effort this week: Toolchain fixes Dmitry Shachnev uploaded sphinx/1.3.1-6 with improved patches from Val Lorentz. Chris Lamb submitted a patch for ibus-table which makes the output of ibus-table-createdb deterministic. Niko Tyni wrote a patch to make libmodule-build-perl linking order deterministic. Santiago Vila has been leading discussions on the best way to fix timestamps coming from Gettext POT files. Packages fixed The following 35 packages became reproducible due to changes in their build dependencies: apache-log4j2, dctrl-tools, dms, gitit, gnubik, isrcsubmit, mailutils, normaliz, oaklisp, octave-fpl, octave-specfun, octave-vrml, opencolorio, openvdb, pescetti, php-guzzlehttp, proofgeneral, pyblosxom, pyopencl, pyqi, python-expyriment, python-flask-httpauth, python-mzml, python-simpy, python-tidylib, reactive-streams, scmxx, shared-mime-info, sikuli, siproxd, srtp, tachyon, tcltk-defaults, urjtag, velvet. The following packages became reproducible after getting fixed:

• binutils-m68hc1x/1:2.18-7 by Santiago Vila.
• boa-constructor/0.6.1-15 by Santiago Vila.
• brian/1.4.1-3 by Yaroslav Halchenko.
• criticalmass/1:1.0.0-3 by Santiago Vila.
• cvs-buildpackage/5.25 by Santiago Vila.
• fcrackzip/1.0-6 uploaded by Adam Borowski, original patch by Reiner Herrmann.
• filters/2.54 prepared by Joey Hess, fixed by Marius Gavrilescu.
• fsvs/1.2.6-2 by Santiago Vila.
• fte/0.50.2b6-6 by Santiago Vila.
• gcc-mingw-w64/15.7 by Stephen Kitt.
• ircd-hybrid/1:8.2.8+dfsg.1-1 by Dominic Hargreaves.
• leveldb/1.18-3 uploaded by Laszlo Boszormenyi, patch by Reiner Herrmann.
• libavg/1.8.1-2 uploaded by Dimitri John Ledkov, original patch by Reiner Herrmann.
• lynx-cur/2.8.9dev6-4 uploaded by Axel Beckert, patch by Reiner Herrmann.
• maildir-utils/0.9.12-3 by Norbert Preining
• pd-iemnet/0.2-1 by IOhannes m zm lnig.
• photopc/3.05-8 by Santiago Vila.
• postgresql-plproxy/2.6-1 uploaded by Christoph Berg, report by Dhole.
• prometheus-pushgateway/0.2.0+ds-2 uploaded by Mart n Ferrari, original patch by Chris Lamb.
• shelxle/1.0.740-1 uploaded by Daniel Leidert, fixed upstream.
• sigil/0.8.7+dfsg-2 by Mattia Rizzolo.
• sks-ecc/0.93-5 by Santiago Vila.
• smartlist/3.15-25 by Santiago Vila.
• snd/11.7-4 by Santiago Vila.
• solarwolf/1.5-2.1 by Graham Inggs.
• sphinx/1.3.1-6 uploaded by Dmitry Shachnev, patches by Val Lorentz.
• tla/1.3.5+dfsg1-2 by Santiago Vila.
• zapping/0.10~cvs6-10 by Santiago Vila.

The package is not in yet in unstable, but linux/4.2-1~exp1 is now reproducible! Kudos to Ben Hutchings, and most fixes are already merged upstream. Some uploads fixed some reproducibility issues but not all of them:

• bochs/2.6-3 by Santiago Vila.
• oolite/1.82-1 by Nicolas Boulenguez.
• openjdk-7/7u85-2.6.1-1 uploaded by Matthias Klose, original patch by Emmanuel Bourg.
• python-dtcwt/0.10.1+dfsg1-2 uploaded by Ghislain Antony Vaillant, original patch by Chris Lamb.

Patches submitted which have not made their way to the archive yet:

• #797432 on torus-trooper by Reiner Herrmann: set locale to C when sorting source file list.
• #797437 on flow-tools by Chris Lamb: use pre-defined hostname and date of the latest debian/changelog entry in build string.
• #797505 on cloudprint by Chris Lamb: remove embedded .pyc files.
• #797506 on comix by Chris Lamb: remove embedded .pyc files.
• #797508 on litl by Chris Lamb: remove date from documentation generated with LaTeX.
• #797518 on gyoto by Chris Lamb: set date in documentation generated with LaTeX to the latest debian/changelog entry.
• #797539 on cadabra by Chris Lamb: use date of the latest debian/changelog entry as build time.
• #797543 on xotcl by Chris Lamb: sort source list in Makefile.
• #797579 on ferret-vis by Chris Lamb: use date of the latest debian/changelog entry as build time.
• #797711 on libkinosearch1-perl by Niko Tyni: sort source list in Build.PL.
• #797871 on xbae by Chris Lamb: use date of the latest debian/changelog entry as build time.

reproducible.debian.net Some bugs that prevented packages to build successfully in the remote builders have been fixed. (h01ger) Two more amd64 build jobs have been removed from the Jenkins host in favor of six more on the new remote nodes. (h01ger) The munin graphs currently looks fine, so more amd64 jobs will probably be added in the next week. diffoscope development Version 32 of diffoscope has been released on September 3rd with the following new features:

• A new --fuzzy-threshold option to specify the TLSH score used as cut-off for fuzzy matching. Specifying 0 will disable fuzzy-matching entirely. Suggested by Jakub Wilk.
• A new --new-file option to treat absent files as empty. This make diffoscope a great tool to look at the content of an archive at once by comparing it with a non-existent file (example). Suggested by Jakub Wilk.
• Comparisons of symlinks and devices given on the command line is now possible.
• Default values are displayed in --help.

It also fixes many bugs. Head over to the changelog for the full list. Version 33 was released the day after to fix a bug introduced in the packaging. Documentation update Chris Lamb blessed the SOURCE_DATE_EPOCH specification with the version number 1.0 . Lunar documented how the .file assembler directive can help with random filenames in debug symbols. Package reviews 235 reviews have been removed, 84 added and 277 updated this week. 29 new FTBFS bugs were filled by Chris Lamb, Chris West (Faux), Daniel Stender, and Niko Tyni. New issues identified this week: random_order_in_ibus_table_createdb_output, random_order_in_antlr_output, nondetermistic_link_order_in_module_build, and timestamps_in_tex_documents. Misc. Thanks to Dhole and Thomas Vincent, the talk held at DebConf15 now has subtitles! Void Linux started to merge changes to make packages produced by xbps reproducible.

A second maintenance release 0.1.4 of our RcppDE package, following on the heels of the recent 0.1.3. release arrived on CRAN today. RcppDE is a "port" of DEoptim, a popular package for derivative-free optimisation using differential optimization, to C++. By using RcppArmadillo, the code becomes a lot shorter and more legible. This version changes the package-internal code to use Rcpp Attributes which makes things a little simpler (and possibly more robust as well). Courtesy of CRANberries, there is also a diffstat report for the most recent release.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Todays Debian Jessie's update brings a fix in Akonadi that you certainly want in your system.

There was a bug in Akonadi that made it leak files. And if you use Kmail you will certainly want to keep reading: most of us who tested it before pushing it to testing (and now to stable) removed more than 4 GiB of useless data from our homes.

The bug that makes Akonadi leak files gets solved with the latest stable update (and has been in testing for a couple of months already). But you need to purge the leaked files. It's pretty easy: with your normal user account just run:

akonadictl fsck

That's all. After a while you will get back a lot of disk space. Note that you don't need the Akonadi fix in order to run this tool and recover your space. The fix just makes sure this won't happen again.