Thomas Leonard | 14 Jun 2013 12:19
Picon
Gravatar

Documentation for selections.xml

I've put up some documentation for the 0install selections.xml file format here:

  http://0install.net/selections-spec.html

--

-- 
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
Tim Cuthbertson | 10 Jun 2013 09:44
Favicon
Gravatar

[bug] 0install run --refresh doesn't refresh selections for an app

When I run `0install run -rv neko, I get:

INFO:0install:Running 0install 2.2 ['-rcv', 'neko']; Python 2.7.3 (default, Aug  9 2012, 17:23:57) 
[GCC 4.7.1 20120720 (Red Hat 4.7.1-5)]
INFO:0install:Staleness of app <app neko> is 1 hours

It then proceeds to run the cached app selections - ignoring the new version of the feed I've uploaded with modified <environment> bindings.

It looks like modifying cmd/run.py:46:
if do_select or options.gui:
to:
if do_select or options.gui or options.refresh:

Causes selections to be run when `--refresh` is given. This might not be the best place for the fix though - other commands might want to inherit the same logic (select, etc).

Cheers,
 - Tim.

------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. A cloud service to automate IT design, transition and operations
2. Dashboards that offer high-level views of enterprise services
3. A single system of record for all IT processes
http://p.sf.net/sfu/servicenow-d2d-j
_______________________________________________
Zero-install-devel mailing list
Zero-install-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/zero-install-devel
Thomas Leonard | 9 Jun 2013 13:26
Picon
Gravatar

Replacing Python: Candidates

Following on from our previous discussion, I've done some tests on the
various languages and summarised the results here:

http://roscidus.com/blog/blog/2013/06/09/choosing-a-python-replacement-for-0install/

I know we have people here who know more about these languages than
me, so please comment if I got anything wrong.

I assigned scores to the various aspects and added them up at the end
(which is a bit silly, because they should be weighted) but it was
interesting to see how they tended to balance out (except for Go).

--

-- 
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. A cloud service to automate IT design, transition and operations
2. Dashboards that offer high-level views of enterprise services
3. A single system of record for all IT processes
http://p.sf.net/sfu/servicenow-d2d-j
Kyle Heath | 7 Jun 2013 21:16
Picon
Gravatar

Using zero-install to distribute dev libraries for linux, win, mac?

Hi zero-install,

Short Version:
Could zero-install help me distribute a package of dev-libraries in mac, win, linux flavors that could be easily used by 3rd party developers each using their platforms native build tools / workflow?  Does anyone have any experience say building an application with CMake or Xcode or VisualStudio that links against a library distributed by zeroinstall as binary or source?

Long Version:
When an application is run, it finds all the right versions of its dependencies because zero-install has patched the environment variables used by the various language runtimes.  When the zero-install package is not a binary to be run directly, but a development library... there would need to be some interface to communicate to the build system the various configuration decisions that are done via environment variables in the case of an application (paths to right version of shared / static libraries, header includes, python modules).  Is there and easy way to export this config info (perhaps to CMake which can actually generate the native build scripts for mac, win, linux)?

Rambling Side-note: I've been watching zero-install for a couple years and am very impressed...  The ability to easily create and share packages of reusable code seems to make or break the vitality of an opensource community.  As a c++ coder, I am envious of newer languages / code communities that have good tools for publishing and reusing code modules.  I have a theory that the rapid growth of node.js is largely because the npm package manager tool works better than package managers for any other language / community I've seen.  I would love to see such a tool emerge for C/C++.  ;-)
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. A cloud service to automate IT design, transition and operations
2. Dashboards that offer high-level views of enterprise services
3. A single system of record for all IT processes
http://p.sf.net/sfu/servicenow-d2d-j
_______________________________________________
Zero-install-devel mailing list
Zero-install-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/zero-install-devel
Bastian Eicher | 28 May 2013 20:13

Beyond Maven integration

I have been thinking about other possible "integration services" for Zero
Install beyond the Maven integration service. I see the following benefits
to providing such services:
- The number of "packages" available via Zero Install increases
significantly.
- We indirectly profit from upstream developers that have committed to
publishing their software using some other package manager.
- Existing users of other package managers might be more easily convinced to
give Zero Install a try if it "allows you to access all your old packages as
well".

Maven was a nice starting point since its basic design matches Zero
Install's side-effect-free philosophy quite nicely. The only downside is
that Maven almost exclusively hosts libraries and not executable programs.
This makes the Maven integration service interesting for developers but not
for end-users.

In the .NET world there is a package manager called NuGet
(http://nuget.org/) which could be considered a rough equivalent to Maven.
It makes it easy for developers to acquire libraries to use in their
projects.
There is also a package manager for installing software on Windows called
Chocolatey (http://chocolatey.org/) which shares the same package format and
is not restricted to .NET applications. Chocolatey packages usually just
download and execute Setup EXEs (messy) but it also has the concept of "tool
packages" which are much closer to what Zero Install does: A ZIP archive is
downloaded and extracted and all executables found in that ZIP file are
added to the PATH.

I would like to build an integration service for NuGet and Chocolatey, but
there is one major technical problem:
Like Maven, NuGet/Chocolatey packages (.nupkg) are just ZIP files in
disguise and the repository servers can tell you the hash of these archives
without having to download them.
However, unlike Maven artifacts (which are JARs), .nupkg files really do
have to be extracted in order to do anything useful with them. This means
the integration service would have to use <archive> instead of <file> and
therefore would need to download and extract each package before it could
calculate its <manifest-digest>.
Since the whole idea of such an integration service is to transparently map
packages of a foreign system to Zero Install feeds without having to convert
them all ahead of time, this download and extract approach is not really a
viable solution. Plus I don't have a server with infinite CPU power, RAM and
network bandwidth available at the moment. ;)

Does anybody have an idea how I could get from a ZIP archive + a hash of the
entire archive to a manifest digest for the extracted archive without
actually having to download the archive? Perhaps (ab)using 0compile?

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
Thomas Leonard | 27 May 2013 20:58
Picon
Gravatar

Re: IP for Maven service changed

On 27 May 2013 19:52, Bastian Eicher <bastian <at> eicher.net> wrote:
> Hello Thomas,
> I am migrating 0install.de and the pom2feed-service to a new server.
> maven.0install.net currently points to 78.47.181.164. This IP will remain
> active until the end of the month.
> The new server is already running an identical instance of the
> pom2feed-service at 37.221.195.119. Could you update the DNS settings of
> maven.0install.net to point to this new IP?

OK, done!

--

-- 
Dr Thomas Leonard        http://0install.net/
GPG: 9242 9807 C985 3C07 44A6  8B9A AE07 8280 59A5 3CC1
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
Tim Cuthbertson | 27 May 2013 00:43
Favicon
Gravatar

Thoughts on a faster, smaller zeroinstall-core

In the interests of:

- 0bootstrap (making available an executable to run a feed when
0install is not yet installed)
- embedding 0install (essentially, other people distributing
executables that act like a customised 0bootstrap)
- launching apps faster
- making the OSX install steps less ridiculous
- allowing a cross-platform 0install-on-a-stick style setup

I've been wondering about a port (or fork) of the core parts of
zeroinstall to some language that will allow it to be distributed as
statically linked native code. This is not (necessarily) the
fully-fledged current UI, but perhaps a command-line only variant -
with perhaps a minimal UI that just pops up a "loading..." screen and
shows the console output, or something equally simple. Whatever UI we
do would likely have to be kept separate on each OS, so as not to
bring in any cross platform UI dependency.

In terms of languages, there are not too many viable choices if we
want to avoid depending on a specific runtime.

 - C/C++/ObjC (obvious, but not very enthusiasm-inspiring, for me at
least. Others may be more keen)
 - a more modern language that compiles to native code. Choices include:
  - D (never used it)
  - Haskell (I've some experience in this, but could be a big learning
curve and discourage casual contributions)
  - Haxe (seems to be an interesting language, has a lot of
compilation targets. Pretty young, likely to be issues in the C++
target, which is the only "native code" one. Has lots of compile
targets, so the same code could in theory produce both a native and a
cross-platform (interpreted) program)
  - Go (I think it still has a stdlib, but it's supposedly embeddable).
  - Vala (tied to gobject, so probably not a good choice for cross-platform)

For my own interest and learning, I had a crack at implementing some
core ZI stuff in haskell a while ago. To test that it was at least
plausible, I made:
 - a binary that runs a (local) selections document.
 - a binary that checks a feed's signature against a GPG key (both local files)

I didn't get into the solver, as that seemed like something haskell
was well suited to (and quite a bit of work). Similarly with the
networking stuff - it's not trivial, but there's little chance it
would be intractable. GPG was my main concern, but it looks like the
openpgp module is a sufficient (if under-documented) native-haskell
implementation that will allow signature verifications without
bringing any dependency on gnupg.

Unfortunately I wrote the code a while ago, and its dev-dependencies
have moved on, so it no longer even compiles. But if anyone's
interested, the code is here:
https://github.com/gfxmonk/zeroinstall-haskell-poc

Unfortunately I don't expect I'd have much time available to work on
such a project, but I'm interested in it as future direction for
getting ZI in more places, and wanted to see what other people's
thoughts on the matter are. Is anyone interested in a native zi-core?
Are there any use cases people have / will have that require it? Do
people have thoughts / preferences on what language it should be in?

Personally, I've encountered at least two specific products now where
teaching the user to use ZI upfront is not plausible / desirable, but
embedding zi-core in a minimal "launcher" program would be very
desirable technically (to manage updates, dependencies, plugins, etc)
while keeping a custom and slick launcher (that we could write
per-platform, since it shouldn't need to change often or be very
complex).

Cheers,
 - Tim.

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
Tim Cuthbertson | 23 May 2013 13:20
Favicon
Gravatar

fish-shell tab completion

I've started using [fish-shell](http://fishshell.com/) as my default
shell, so I've added tab completions for the 0install command.

The logic seems a bit busted when it tries to complete options. e.g. I
saw that there is a code path to print out the valid architectures,
but it's not being used when (I think) it should. I don't think this
is particular to fish, I tried zsh as well and it's giving me
completions like `--arch=http://repo.roscidus.com/` when I press tab
after `--arch=`

Thomas, is there any documentation / guidance for the tab completion
code? Any guides for how to call it like a shell would, for better
debugging than hammering the `tab` key and redirecting things to a log
file?

Cheers,
 - Tim.
Attachment (0001-Add-fish-shell-command-completion.patch): application/octet-stream, 3114 bytes
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Zero-install-devel mailing list
Zero-install-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/zero-install-devel
Chris Hennick | 20 May 2013 02:19
Picon
Favicon

Sticky bit instead of sudoer for sharing?

At http://0install.net/sharing.html, I notice that everyone has to gain the ability to sudo into the zeroinst account. Wouldn't the security be tighter if the sticky bit were instead set on 0store-secure-add, and if there was no way to sudo as zeroinst except via root? (If the sticky bit for some reason doesn't work on shell scripts, it can be rewritten as a C program instead.) That way, 0store-secure-add could still execute with zeroinst's privileges, but nothing else could.

Also, is there any way to use a hash other than SHA1? SHA1 has some theoretical issues, and I know the NIST has deprecated it (which I'm guessing would make it easier for an unpublished SHA1 crack to slip under the rader).

Sincerely,
Chris Hennick
Trent University
Peterborough, ON, Canada
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
Zero-install-devel mailing list
Zero-install-devel <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/zero-install-devel
Matthias Klumpp | 12 May 2013 03:36
Gravatar

Update 0install comparison matrix with Listaller

Hi!
In the all the discussion about Ubuntu doing an own app-package
format, people pointed me at the "ZeroInstall compared with other
systems"[1] page and noted that Listaller was missing.
Could someone maybe add it to the comparison matrix? You could even
replace Autopackage, since Autopackage has merged with Listaller.
The values for the matrix for Listaller would be:

Users can install software: yes[2]
Dependencies handled automatically: yes
Automatic upgrading: yes
Libraries shared between programs: yes
Downloads shared between users: no
Multiple versions coexist: partially (depends on the packaging)
Uninstall: yes
Digital signatures: yes
Conflict-free: yes
Decentralised: yes
Non-root install of system: yes
All programming languages: yes
Supports sandboxing: inprogress (multiple solutions exist)
Usable when off-line: yes
Thousands of packages available: no

[2]: Although they need permission from the administrator to be
allowed to do that

The relocation tools from Autopackage live in Listaller currently, and
are packaged in some distributions. This information might be helpful
for 0install too, since both solutions need relocatable apps.

Cheers,
   Matthias

[1]: http://0install.net/comparison.html

--

-- 
Debian Developer | Freedesktop-Developer
KDE-Developer    | GNOME-Contributor
I welcome VSRE emails. See http://vsre.info/

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
Tim Cuthbertson | 11 May 2013 08:49
Favicon
Gravatar

Fwd: `0manup`, Tool for generating manifest-digests

I've tried generating <manifest-digest> values based on manually
unpacked directories in the past, but my main memory is of it never
working quite right - zero install does a few things differently to
`tar` defaults, and I generally get it wrong. So usually I just put in
an "TODO" manifest-ID and let zero install tell me when it tries to
run it that it expected manifest "BLAH" but got "TODO". That's not
exactly a great way to do it.

So here's a script I whipped up yesterday that follows recipes and
populates <manifest-digest> tags. And implementation `id` attributes,
if they are manifest-based. And `size` attributes where missing. It's
not thoroughly tested, but it's pretty simple and seems to work.

For simplicity it will not download files itself, but relies on them
being availabe in the current directory - i.e an implementation
relying on "http://example.com/libfoo-1.2.3.tgz" will be processed
only if it finds `libfoo-1.2.3.tgz` in the current directory. It works
with all the new <recipe> step types, and offers you an opportunity to
pause before it deletes the temporary implementation dir (for manual
verification, useful when developing recipes).

http://gfxmonk.net/dist/0install/0manup.xml
https://github.com/gfxmonk/0manup/blob/master/0manup

I think it would be good to see this code integrated into 0publish (or
similar), but I wasn't sure where best to place it or how its
functionality should be triggered by the user. Thomas, any ideas?

Cheers,
 - Tim.

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may

Gmane