gmane.comp.file-systems.zero-install.devel

Documentation for selections.xml

Thomas Leonard — 2013-06-14T10:19:14

I've put up some documentation for the 0install selections.xml file format here:

  http://0install.net/selections-spec.html

[bug] 0install run --refresh doesn't refreshselections for an app

Tim Cuthbertson — 2013-06-10T07:44:12

When I run `0install run -rv neko, I get:

INFO:0install:Running 0install 2.2 ['-rcv', 'neko']; Python 2.7.3 (default,
Aug  9 2012, 17:23:57)
[GCC 4.7.1 20120720 (Red Hat 4.7.1-5)]
INFO:0install:Checking http://gfxmonk.net/dist/0install/nekovm.xml
INFO:0install:Staleness of app <app neko> is 1 hours

It then proceeds to run the cached app selections - ignoring the new
version of the feed I've uploaded with modified <environment> bindings.

It looks like modifying cmd/run.py:46:
 if do_select or options.gui:
to:
if do_select or options.gui or options.refresh:

Causes selections to be run when `--refresh` is given. This might not be
the best place for the fix though - other commands might want to inherit
the same logic (select, etc).

Cheers,
 - Tim.
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. A cloud service to automate IT design, transition and operations
2. Dashboards that offer high-level views of enterprise serv

Replacing Python: Candidates

Thomas Leonard — 2013-06-09T11:26:30

Following on from our previous discussion, I've done some tests on the
various languages and summarised the results here:

http://roscidus.com/blog/blog/2013/06/09/choosing-a-python-replacement-for-0install/

I know we have people here who know more about these languages than
me, so please comment if I got anything wrong.

I assigned scores to the various aspects and added them up at the end
(which is a bit silly, because they should be weighted) but it was
interesting to see how they tended to balance out (except for Go).

Using zero-install to distribute dev librariesfor linux, win, mac?

Kyle Heath — 2013-06-07T19:16:03

Hi zero-install,

Short Version:
Could zero-install help me distribute a package of dev-libraries in mac,
win, linux flavors that could be easily used by 3rd party developers each
using their platforms native build tools / workflow?  Does anyone have any
experience say building an application with CMake or Xcode or VisualStudio
that links against a library distributed by zeroinstall as binary or source?

Long Version:
When an application is run, it finds all the right versions of its
dependencies because zero-install has patched the environment variables
used by the various language runtimes.  When the zero-install package is
not a binary to be run directly, but a development library... there would
need to be some interface to communicate to the build system the various
configuration decisions that are done via environment variables in the case
of an application (paths to right version of shared / static libraries,
header includes, python modules).  Is there and easy way to export this
config info (perhaps t

Beyond Maven integration

Bastian Eicher — 2013-05-28T18:13:55

I have been thinking about other possible "integration services" for Zero
Install beyond the Maven integration service. I see the following benefits
to providing such services:
- The number of "packages" available via Zero Install increases
significantly.
- We indirectly profit from upstream developers that have committed to
publishing their software using some other package manager.
- Existing users of other package managers might be more easily convinced to
give Zero Install a try if it "allows you to access all your old packages as
well".

Maven was a nice starting point since its basic design matches Zero
Install's side-effect-free philosophy quite nicely. The only downside is
that Maven almost exclusively hosts libraries and not executable programs.
This makes the Maven integration service interesting for developers but not
for end-users.

In the .NET world there is a package manager called NuGet
(http://nuget.org/) which could be considered a rough equivalent to Maven.
It makes it easy for developers t

Thoughts on a faster, smaller zeroinstall-core

Tim Cuthbertson — 2013-05-26T22:43:08

In the interests of:

- 0bootstrap (making available an executable to run a feed when
0install is not yet installed)
- embedding 0install (essentially, other people distributing
executables that act like a customised 0bootstrap)
- launching apps faster
- making the OSX install steps less ridiculous
- allowing a cross-platform 0install-on-a-stick style setup

I've been wondering about a port (or fork) of the core parts of
zeroinstall to some language that will allow it to be distributed as
statically linked native code. This is not (necessarily) the
fully-fledged current UI, but perhaps a command-line only variant -
with perhaps a minimal UI that just pops up a "loading..." screen and
shows the console output, or something equally simple. Whatever UI we
do would likely have to be kept separate on each OS, so as not to
bring in any cross platform UI dependency.

In terms of languages, there are not too many viable choices if we
want to avoid depending on a specific runtime.

 - C/C++/ObjC (obvious, but not ver

fish-shell tab completion

Tim Cuthbertson — 2013-05-23T11:20:15

I've started using [fish-shell](http://fishshell.com/) as my default
shell, so I've added tab completions for the 0install command.

The logic seems a bit busted when it tries to complete options. e.g. I
saw that there is a code path to print out the valid architectures,
but it's not being used when (I think) it should. I don't think this
is particular to fish, I tried zsh as well and it's giving me
completions like `--arch=http://repo.roscidus.com/` when I press tab
after `--arch=`

Thomas, is there any documentation / guidance for the tab completion
code? Any guides for how to call it like a shell would, for better
debugging than hammering the `tab` key and redirecting things to a log
file?

Cheers,
 - Tim.
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers wi

Sticky bit instead of sudoer for sharing?

Chris Hennick — 2013-05-20T00:19:00

At http://0install.net/sharing.html, I notice that everyone has to gain the
ability to sudo into the zeroinst account. Wouldn't the security be tighter
if the sticky bit were instead set on 0store-secure-add, and if there was
no way to sudo as zeroinst except via root? (If the sticky bit for some
reason doesn't work on shell scripts, it can be rewritten as a C program
instead.) That way, 0store-secure-add could still execute with zeroinst's
privileges, but nothing else could.

Also, is there any way to use a hash other than SHA1? SHA1 has some
theoretical issues, and I know the NIST has deprecated it (which I'm
guessing would make it easier for an unpublished SHA1 crack to slip under
the rader).

Sincerely,
Chris Hennick
Trent University
Peterborough, ON, Canada
http://softwetware.blogspot.com/
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easi

Update 0install comparison matrix withListaller

Matthias Klumpp — 2013-05-12T01:36:09

Hi!
In the all the discussion about Ubuntu doing an own app-package
format, people pointed me at the "ZeroInstall compared with other
systems"[1] page and noted that Listaller was missing.
Could someone maybe add it to the comparison matrix? You could even
replace Autopackage, since Autopackage has merged with Listaller.
The values for the matrix for Listaller would be:

Users can install software: yes[2]
Dependencies handled automatically: yes
Automatic upgrading: yes
Libraries shared between programs: yes
Downloads shared between users: no
Multiple versions coexist: partially (depends on the packaging)
Uninstall: yes
Digital signatures: yes
Conflict-free: yes
Decentralised: yes
Non-root install of system: yes
All programming languages: yes
Supports sandboxing: inprogress (multiple solutions exist)
Usable when off-line: yes
Thousands of packages available: no

[2]: Although they need permission from the administrator to be
allowed to do that

The relocation tools from Autopackage live in Listaller currently

"Click packages" for Ubuntu

Thomas Leonard — 2013-05-09T12:36:09

Here's a new packaging system for Ubuntu:

  http://lwn.net/Articles/549704/

The announcement says:

"Barry spent some time looking at 0install, and it wasn't too bad a
fit but we would still need to solve many of the same system
integration problems."

I'll try to find out what these are...


--
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

0release 0.15

Thomas Leonard — 2013-05-06T13:59:54

0release 0.15 released:

  http://0install.net/0release.html

0release automates the process of creating new software releases. It
handles details such as setting the version number and release date,
tagging the release in your version control system and updating your
feed.


New features

- Use 0repo to release if a suitable 0repo repository is registered.
The old options still work, but it will display a warning that they
might go away in future. Please let me know if you can't easily switch
to 0repo for some reason.

- Added --release-version for explicitly setting the release version
number (Tim Cuthbertson).


Changes

- Always depend on 0compile. This avoids needing to use 0launch
internally, which makes unit-testing easiler.

- Clarify what Fail does.


Bug fixes

- Expand $RELEASE_VERSION in generated binary feeds too.

- Added missing test dependency on make.

- Use 0repo's merge code rather than 0publish's. 0repo's version has a
better API and is more up-to-date.



--
Dr Thomas Leonard        http

0repo 0.1

Thomas Leonard — 2013-05-02T17:16:39

I've made an initial release of 0repo for testing:

  http://www.0install.net/0repo.html

Some things need to be more robust / better documented... let me know
if it works for you...


--
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1

0install 2.2

Thomas Leonard — 2013-05-02T13:31:14

0install 2.2 is out now:

  http://0install.net/injector.html

No big changes this release, since most effort has been on 0repo
instead. But, this is the first release done using 0repo :-)


Changes

- Cope with missing selections.xml when running an app. This shouldn't
happen, but you might decide to share apps between machines by
checking just the requirements files into version control. Requested
by Tim Cuthbertson.

- Replaced "Zero Install" XDG submenu with a single normal menu entry.
There's now an Add button in the list window, so that can be used for
both, and you can now also drag-and-drop directly to the list, which
seems more natural. Apart from being a bit cleaner, this should work
better on systems which don't have menus (e.g. GNOME 3, Unity).


Bug fixes

- Fixed <file> downloads. We forgot to seek to the beginning of the
stream before reading it, so the target file always ended up empty.
Unfortunately, the unit-test only checked that the file existed.

- Fixed support for HTTP chunked encoding

[patch] fix recipe step

Tim Cuthbertson — 2013-04-30T23:19:09

Sadly, when actually using a <file> recipe step in a real feed for the
first time I discovered my initial implementation was broken - it only
ever created empty files because it always read from the end of the
downloaded stream.

Patch attached.

Regards,
 - Tim.
------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1_______________________________________________
Zero-install-devel mailing list
Zero-install-devel< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/zero-install-devel

Zero Install - Maven integration service

Bastian Eicher — 2013-04-30T14:16:44

The Zero Install - Maven integration service (pom2feed-service) is now ready
for testing!

Some sample commands if you want to see it in action:
0install run http://maven.0install.net/org/projectlombok/lombok/
0install download
http://maven.0install.net/org/apache/commons/commons-email/

Please let me know if you find any Maven artifacts that the service is
unable to provide a proper feed for.

The Maven Plugin (that automatically creates a feed for your local project
using pom2feed-service to resolve the dependencies) will be ready soon.

< at >Thomas:
Could you add http://maven.0install.net/key.gpg to the key server for the
domain maven.0install.net ?


------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net

0repo - status

Thomas Leonard — 2013-04-27T10:45:32

I've created a Git repository for 0repo and checked in some initial code:

  https://github.com/0install/0repo

The README shows how to use it.

It's not ready for production use, but it is ready for testing and
feedback, so please try it out!

The basic steps for testing it are:

Get the software:

$ git clone git://github.com/0install/0repo.git
$ 0install add 0repo 0repo/0repo.xml

Create a repository:

$ gpg --gen-key
$ 0repo create my-repo my-key
$ cd my-repo
$ vi 0repo-config.py
$ 0repo register

(registering it stores the base URL and path
~/.config/0install.net/0repo/repositories.json)

Import your existing feeds:

$ cd ~/my-old-repositority
$ 0repo add *.xml

You should now have a my-repo/public directory with a load of signed
feeds, a catalog.xml, a public GPG key, and some stylesheets, ready
for upload to your web-hosting.


--
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

--------------

Domain 0install.net broken/stolen?

Frank Richter — 2013-04-24T08:20:43

Hello,

it seems 0install.net was somehow compromised… the window turns up
empty for me, however, the source code appears *very* suspicious:

<html><head><title>0install.net</title></head><frameset
rows="0,*"><frame scrolling="no" frameborder="0" noresize
src=""><frame scrolling="auto" frameborder="0"
src="http://searchlabel.com/?o=kvx18ebr22&u=0install.net
<view-source:http://searchlabel.com/?o=kvx18ebr22&u=0install.net>"></frameset></html>

-f.r.
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr_______________________________________________
Zero-install-devel mailing list
Zero-install-devel< at >lists.sourceforge.net
https://lists.sourceforge.

Security of XML processing in Python

Thomas Leonard — 2013-04-23T10:27:26

Just noticed this new warning about the safety of Python's XML parsers:

http://docs.python.org/2.7/library/xml.html#module-xml

"The XML modules are not secure against erroneous or maliciously
constructed data. An attacker can abuse vulnerabilities for e.g.
denial of service attacks, to access local files, to generate network
connections to other machines, or to or circumvent firewalls."

The DOS ones (using lots of CPU time, etc) don't worry me much, since
you could just kill the process if it happened, though if future
versions of Python offer the chance to stop this we should take it.

For the external entity problems, it looks like we've escaped: we
mainly use expat directly, and it doesn't expand external entities
unless you explicitly specify a handler. The other parser we sometimes
use, minidom, also isn't affected.


--
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

-----------------------

Some performance improvements

Thomas Leonard — 2013-04-20T16:22:29

I did a little benchmarking and noticed things had got a bit slow. I
just committed some changes with reduce the launch time for apps.

My test-case was "0install run -wecho 0publish" (which goes through
the whole process of running 0publish, but then actually runs "echo",
so we don't count 0publish's own startup time).

Before: 207 ms
After: 115 ms (or 96 ms with Python 2)

(using "python2 -S" I get 76 ms, but I guess that isn't safe in general)

Also, the "runenv.py" launcher got faster:

Before: 93 ms (56 ms with Python 2)
After: 61 ms (48 ms with Python 2)

If we want to go much faster than this, we'll need to switch to a C
launcher. "python3 -c 1" alone takes 47 ms.

The two changes were:

- We now delay initialising gobject until we need it. If the saved
selections are still valid, we don't need gobject at all. Note: if you
use 0install as a library AND you use gobject, make sure you do
gobject.threads_init() before using gobject. You might have got away
with this in the past by doing "import zeroinsta

Zero Install - Maven integration service

Bastian Eicher — 2013-04-15T22:31:59

Simon and I are currently putting the finishing touches on our Zero Install
- Maven integration service, called "pom2feed".
pom2feed consists of two parts: pom2feed-service and pom2feed-plugin

pom2feed-service is a Web Service that provides a transparent 1-to-1 mapping
between Maven artifacts and Zero Install feeds. In order to get a feed for
org.apache.commons:commons-email you would request
{POM2FEED-SERVICE-URL}/org/apache/commons/commons-email/
The service gets versioning metadata, dependencies, file sizes and hashes
from the Maven Central repository without needing to fetch the actual JAR
files.

pom2feed-plugin is a Maven build plugin. It automatically generates a local
Zero Install feed after compiling a Java program, mapping Maven dependencies
to appropriate <requires> tags.
Note: Using pom2feed-plugin is not required for pom2feed-service to be of
use, however it jumpstarts the creation of Zero Install feeds for Java
developers using Maven as their build tool.


We are still facing two open question

0repo - design

Thomas Leonard — 2013-04-15T09:39:45

So after a bit of thought, here's my current plan for 0repo. If you
can see any problems with this, or have a better idea, please shout!


Requirements

- Multiple users can manage a set of feeds (without e.g. signature problems)

- Release process must be fully scriptable

- Release tools can be pointed at a repository and get all the
configuration they need

- There's a standard, easy way for a developer to create a new repository

- Repositories are always consistent (no missing keys, missing
stylesheets, invalid URIs, etc)

- Files can be hosted on a dumb web host

- 0mirror can get a list of all feeds to mirror

- Some way to test changes to a repository before going live

- Support both archives hosted within the repository and archives
hosted externally


Design proposal

Everyone is currently storing their repository under source control
(Git or Mercurial). That seems useful. It makes it easy to track
changes, roll back, and support concurrent modifications by multiple
users. Also, you can use e.g. g