IRC Logs for #crux-devel Sunday, 2014-07-06

*** mavrick61 has quit IRC02:48
*** mavrick61 has joined #crux-devel02:49
*** deus_ex has quit IRC04:49
*** frinnst_ has joined #crux-devel04:54
*** frinnst has quit IRC04:58
*** mike_k has joined #crux-devel05:25
teK__hey folks from core: how about updating lzo to 2.08? :)07:44
Romsteroh and 2.0.7 is a security release.07:48
Romster2.07 sorry07:48
RomsterPOTENTIAL SECURITY ISSUE. CVE-2014-460707:49
RomsterteK__, your not in core?07:49
teK__ I am root, nothing more :]08:06
teK__and http://crux.nu/Main/About says I am not, too ;)08:06
Romsteryour root you can do it...08:08
Romsterhonestly why aren't you?08:08
teK__yeah but we have the unwritten convention not to mess around with other people's ports ;)08:08
teK__speaking of which, anyone heard from sepen?08:09
Romstercore is dev team i'm pretty sure you fall in dev being root.08:09
Romsterheck no08:09
Romsterworried about him08:09
teK__10 a.m.? TIme for icecream \o/08:09
nrxtxmaybe someone also could fix #974 in pkgmk by the time or is it easier to supply a patch? :D08:10
teK__looks innocent08:11
jueteK__: thanks, we simply missed that because I forgot to add a rule to our ck4up on crux.nu08:11
jueteK__: done now, update of lzo will follow soon08:12
teK__another report \o/ ;-)08:12
teK__hi jue! :)08:12
teK__would mind me fixing/pushing the fix for FS#974?08:14
juehmm, not sure about that, maybe we run into other side effects?08:18
teK__what's on your mind?08:18
RomsterteK__, is on a roll.08:19
Romstermorning jue08:19
juenothing specific yet08:20
juegood moring08:20
nrxtxjue: might there be programs relying on a changed timestamp due to the strip command applied by the package managment?08:21
Romsteri'm not sure. perhaps you could use a .nostrip option to not change the date to pkgmk08:24
teK__my guess would be that there may be programs that expect the (binary) files not to be changed after building, but not the other way round08:24
Romsterso it works as is for everything else.08:24
Romsteror a new file .nostripdate08:25
Romsterthat one port is a really rare case.08:25
Romsteri've not seen it before.08:25
teK__i cannot think of a scenario where not updating the timestamp would hurt the build process. besides compressing the man pages this is the last step before everything is packed up, so there should be no harm at all.08:25
Romsterperhaps all source files need to be uncompressed using the current time?08:26
Romsterthan the archive provided time08:27
Romsteror maybe pkgadd should use the current time of installing on all files in the built archive.08:28
nrxtxRomster: better not :D08:29
Romsteron another note has anyone really hard back from sepen after contacting him?08:29
Romsterregarding his ports.08:29
teK__I don't think there is a valid email address atm to contact him08:29
nrxtxat all other commands preserved timestamps are used in pkgmk except for strip08:29
teK__crux.nu aliases says: sepen:      sepen@crux-arm.nu08:30
teK__and that is dead08:30
nrxtxeven pkgadd preserves timestamps08:30
juewell, the propper fix for the go port seems to be avoid touching the binary files at all, so it seems much more natural to me to use the .nostrip option08:30
jue+to08:30
Romsterget pitillo to poke sepen to join here for a discussion to see what is going on.08:30
teK__I'd also rather not change file's metadata than do change it08:30
Romsternrxtx, that would mean strip should also preserve to keep consistency08:32
nrxtxyeah thats what i think, since it's done in all other places08:32
Romsterjue, thoughts for making strip also preserve timestamps since everything else does ^08:33
nrxtxcurrently it's prevented by using .nostrip, but results in larger files08:33
Romsteryou can post-install strip the binaries08:33
Romsteralthough not ideal.08:33
jueyou can do manually strip them in the Pkgfile08:34
Romsteror override strip in the Pkgfile for that port?08:34
jueno just strip them, that was the usual way in the beginning of CRUX08:34
Romsterah good one jue just manually strip them in the Pkgfile and just have .nostrip skip the /usr/bin/.*08:34
jueyep08:35
Romsternrxtx, easy enough solution. but wouldn't it make sense for strip to keep the timestamps?08:35
Romstersorry last bit is directing to jue08:36
juewhy? that would be a special case in our building process, we never preserve any dates but use the install-, compile- etc. times08:37
Romsteri'm all for consistency but jues solution for go is acceptable08:38
Romsternrxtx> at all other commands preserved timestamps are used in pkgmk except for strip08:38
jueIMO it would be inconstistent to perserve timestamps juts for the strip step08:38
Romstergoing by nrxtx statement08:38
Romsteri haven't looked for myself.08:39
Romsterok so nrxtx just work around it in go.08:39
nrxtxRomster: yeah keep it as it is currently working with the nostrip solution08:40
Romsteri don't spend enough time looking into everything. and even though i have been though pkgmk numerious times i do't recall what commands change/keep the timestamps.08:40
Romsterand strip -d or what have you in the build()08:41
juethe longer I think about the starting problem with the go port, the more I'm against the suggested solution, IMO the only clean solution is to keep the binaries as they are08:41
Romsteri can't see why go would be so paranoid on timestamps08:42
nrxtxpkgutils.cc line 43408:43
nrxtxpreserve time when extracting files/install pkg08:43
Romsteris it like make if source files are newer than binary it will recompile?08:43
nrxtxRomster: it is this paranoid08:43
juenrxtx: that's a complete different story, currently we are talking about building packages not installing08:43
Romsteragreed that is not related to pkgmk08:44
nrxtxjue its the way the oackages are built and installed -> files are created -> strip changes some of the timestamps -> bsdtar keeps it while building the package, pkgadd will preserve the created/touched dates when installing08:45
Romsterso what happens is strip binary files and there date is set newer because of that than the rest of the files in the go port?08:45
Romsterwhat is the date differences between files in go?08:45
Romstera few milliseconds?08:46
juewell, it might be a longer time diff between building and installing, just think at our ISO for example08:46
jueinstalling and building are not related in any way08:46
Romsternrxtx, you could also not mess with .nostrip and use touch $PKG/usr/bin/* with some relative timestamp08:46
Romstertrue08:46
nrxtxjue: understand what i wanted to explain its the chain of commands preserving it except for the strip part08:47
jueno, I see that differently08:48
jueevery step in the build process creates their own timestamp08:48
juethe compiler, the install program08:48
juewe neve preserve any timestep in our build process08:49
juewhy for the strip part?08:49
nrxtxyou do preserve them you can even check that :D08:49
Romsteronly the timestamp of extraction?08:50
Romsterof sources08:50
juenrxtx: what? not during the build process08:50
nrxtxif you install a pkg it will have time timstamps of compile/build time :D08:50
juenrxtx: I give up, you're mixing building/installing08:51
nrxtxyou'll have the dates of the $PKG dir08:51
nrxtxjue: i'm only talking of the way from $PKG to installing it08:51
Romsteranother words every step in the build process creates there own time stamp including strip.08:51
nrxtxnot of compiling install it to $PKG08:52
jueRomster: yep08:52
Romsterbut technically strip is done after build08:52
nrxtxstrip is done by pkgmk after the files are copied to $PKG08:52
Romsterbefore footprint is generated.08:52
Romsterso because files have been touched at some point they have the current timestamp.08:53
Romsterbecause they got changed in some way recently08:53
Romsteri get what jue is trying to explain.08:53
Romsterwe preserve the extracted timestamp but any build process that modifies files in any why get the timestamp updated.08:54
nrxtxyou'll have all files in $PKG so build() is done timestamps are fine, then strip run by pkgmk changes the timestamps in $PKG08:54
nrxtxRomster: yes but build process not of the software but of the package08:55
Romsterso just work around it since go is the only port that is affected by this.08:56
nrxtx1. Build 2. install to $PKG -> build() of pkgfile done -> 3. strip by pkgmk changing $PKG timestamp integrity -> 4. Build package08:57
Romster4. generate footprint 5. compress package 6. test footprint diff with built archive.08:58
Romsterwhat jue is saying nrxtx is that any part of pkgmk that does something to a file updates the timestamp.08:59
Romsterwhich means it got modified recently.08:59
Romsterbut in your case you have too fool go into thinking its not changed.09:00
Romsterwith a compiler you usually don't strip binaries?09:01
nrxtxyeah i think it should preserve information as good as possible, and currently strip is the only thing of pkmk changing the timestamps after build() is completed :D09:01
nrxtxbut keep it as is i'll keep the workaround09:02
Romsterstrip is also the only ting that actually changes the files by removing debug symbols?09:02
Romsterhence updated timestamp09:02
Romsterbecause they are now modified.09:03
Romsteras of right now.09:03
Romsteri think that is what jue is getting at.09:03
nrxtxhehe it's ok i think jue will kill me if i mention it once again :D09:04
Romsteri'm not taking sides i'm trying to understand the reasoning and logic.09:04
juenrxtx: I'll not ;)09:06
nrxtxmy logic is preseve as much information as possible even if changes are done, the other side is to keep it changed since really changes are done already09:06
Romsterfind "$pkgdir/usr/"{lib/go/pkg,bin} -type f -exec touch '{}' +09:07
Romsteri see arch gets around it that way09:07
nrxtxjue: just close the ticket with a link to the irc log of the discussion, if anone else gets at this problem09:08
Romstermay not work though as that is done in package and strip is done after build()09:08
nrxtxRomster: you got it :)09:08
Romsterwhat a pain09:09
jueseriously, compressisng manpages and stripping binaries are both parts of our build process09:10
Romsteruse .nostril .* perform strip in the build() process then touch the rest of the files in $PKG09:10
Romster.nostrip09:10
juein early days of CRUX we've done that in every port maunally09:10
Romsterso basically you removed redundancy in build09:11
jueand Per added the functions to strip and compress man-pages to simplify things09:11
Romstersomeimtes i wish ./configure automatically added --prefix=/usr --mandir=/usr/man to every port.09:12
Romsterand set DESTDIR to make09:12
Romsterbut then other corner cases and yes abstraction that crux does not want.09:12
Romsterbe like econfigure then09:13
nrxtxlike go is a corner case now :D it took me while to figure out what was messing up the timestamps :D09:14
Romstermaybe a blurb should be in the devalopment docs for pkgmk packagers stating that any commands such as strip will update the timestamps.09:14
Romsterwhich may have side effects on such ports as go09:15
nrxtxbut i got a nice insight into pkgutils :D09:15
Romsterhehe09:15
nrxtxRomster: the example file you have for versionsort is it static or updated regularly?09:19
Romsterits currently static i'm in the process to make it dynamic. if your after something in particular i can do it for you.09:22
Romsterthinking of returning json results for a search for others to use on there sites/tools.09:23
nrxtxmy main problem is the mapping of crux port name -> to your (file, version) combination09:33
Romsterah i'll solve that by a database table of file names off source and name as the key.09:34
Romsterunless you want to do that table yourself then see what file version is at.09:35
Romsterin the end it'll be search able by crux port name and return file versions and locations.09:36
nrxtxi thought about using the md5sums file names, but then i also have to split it up myself, where you already have splitting logic09:36
nrxtxif you create it its nice then i can query it directly09:36
Romsteri have also yet to mark file versions from project site, projects site official mirrors and 3rd party mirrors.09:36
Romsterincase some rouge mirror decides to up the version number then i'll make it give a warning it's not from a official source. and not return that as the project version.09:37
nrxtxi'm currently rewriting the frontend part in go, adding login and stuff which is a part for notifications in future09:38
Romsterbe able to query and return from said port name among md5sum and filename09:38
Romsterso you want to incorporate my project into yours for that side. i was thinking of a login for notifications as well, though i could then make mine generic and not crux based. while you do the crux side of it.09:39
nrxtxi either need query by filename e.g. abcd-1.0.tar.gz or repo/port combination09:39
Romsterin that case it would be best if you used the .md5sum files and query the files off versionsort09:39
nrxtxok i'll keep that in mind09:40
Romsterfilename md5sum perhaps i should really keep project name but then soem crux Pkgfiles don't always follow the project name exactly. ie xorg.09:40
Romsterwhat would work best09:40
Romsteri do intend to have a login and track fileversions off said project sites.09:41
nrxtxthe type of notifications are not yet specified, but they will be only crux portdb releated09:41
Romsterbut to try and cover it for crux name= searches as well and quite possibly arch slackware gentoo the big names by indexing there build files.09:41
Romstersure your only doing for crux, i'm starting with crux then expanding.09:42
Romsteri could easily have a search by distro package name table.09:43
Romsterthen yu can search for versions by querying crux name=09:43
Romsteryou*09:43
Romsterbut then duplicate Pkgfile name= would sometimes not be the same project so i'd have to have do say query crux contrib/boost09:44
nrxtxyes09:44
Romsterin case someone else had that port and its at a different version.09:44
Romsteris that satisfactory to you?09:44
Romsterwont happen straight away though but i'll work on that.09:45
Romsterthat means you can deal with the crux side while i focus on the sorting itself that's a win/win situation.09:46
nrxtxi'm happy if i get if it is out of date or not and can also redirect to your page if details are need, just notify me if you have a first version around which i can try since i have no code for that i'll fit it to your interface09:47
Romsterbasically front page will be like http://www.findthatfile.com/ but only better and list files in highest to lowest version order off project site.09:47
Romsteri'd return an array of versions found off project/trusted mirror, and listing othermirrors as untrusted until file is verified correct. and track it's e-tag/modified size time data off head of server response.09:49
Romsterthe other major feature will me meta4 files of all mirrors for easy downloading.09:49
Romsterauto generated.09:49
Romsteralong with the urls and green dots saying there ok an responding. checked daily.09:50
Romsterthat that fail will get removed off the results.09:50
Romsterthose that*09:50
Romsterbut really i got along way to that yet.09:50
Romsteri'l work on a mongo database and get it to report versions i've scraped daily as a starting point.09:51
Romsterthat you can query.09:51
Romsteri can focus on a login system much later and just sign up on yours for monitoring my ports. by my maintainer line09:52
nrxtxdon't have a timelime for all that, as i'm just doing it to learn go, but if it helps crux than that's fine :)09:53
Romsterwell i'm doing this for myself as i got so many ports then i decided why not offer it as a service for all of crux09:57
Romsterthen why stop there when that's all working then major distros09:57
Romstereven smaller ones if someone asks. and i'd likely already have the results for them09:57
Romsterby that stage.09:57
Romsterand by tracking the larger distros i'll have a good source of mirrors.09:58
Romsteri have no time line this is all just done in my own time.09:58
Romsterbut perhaps you could show me examples of how go operates, might use go if it isn't that difficult.09:59
nrxtxsure just highlight/query me if you are at that point10:07
Romsterk10:12
*** heroux has quit IRC12:38
*** heroux has joined #crux-devel13:22
jaegerhrmm... I made a video about installing CRUX and selecting the proper kernel drivers but my mic pics up my breathing too much. will have to figure out how to fix that15:37
jaegerfrinnst: you commented that the setup instructs the user to run rejmerge after an upgrade; I don't see that in the setup script, am I missing it?15:59
frinnstIm sure i saw it16:18
jaegerAh, it doesn't specifically mention "rejmerge", it says Further, when this script has completed the upgrade you need to go though the rejected files in /var/lib/pkg/rejected/ and upgrade them manually if needed. See the pkgadd(8) man page for more information about /etc/pkgadd.conf.16:19
frinnstahhh16:19
frinnstyeah that was it16:19
jaegerWe could easily add (or use rejmerge) to that or something like it16:19
*** deus_ex has joined #crux-devel16:19
frinnstyeah sounds good16:19
jaegerhttp://pastebin.com/9ECfbiG3 <-- any objections to this going into setup-helper?16:21
Romsteryo need a wind filter a stocking over a strainer or something in front of the mic16:41
Romstermv -f $ROOT/etc/ports/compat-32{.inactive,} bobo there.16:43
Romster$ROOT/etc/ports/compat-32.rsync{.inactive,}16:43
Romsterbut yes that would solve the rejmerge for those that have them enabled. +116:43
jaegeryeah, barring my typo I think it should suffice17:00
Romsteryep17:13
jaegerhttp://pastebin.com/ip120gEG <-- suggestion for adding rejmerge to the upgrade text in setup18:59
frinnstlooks good jaeger19:04
*** mike_k has quit IRC20:15
*** frinnst has joined #crux-devel20:54

Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!