Conary 2.1.11 is a maintenance release.

• The recreatedb script is now capable of populating the Conary database with packages in the RPM database that are found in the Conary repositories in the installLabelPath. (CNY-3373)

• Added ability to commit changesets without executing capsule implementations. This allows us to build a conarydb which reflects the current state of a system without reinstalling packages through the capsule handler.

• The Java package policies for computing provides and requires are now more efficient. (CNY-3372)

Unfortunately SELinux is so incredibly complex that few people understand it. If anybody can contribute proper SELinux support or tell me what Phusion Passenger is supposed to do to make it play nice with the default policies, then that would be greatly appreciated.

Hongli Lai, principal author of Phusion Passenger, in a mailing list post

At my day job, I’ve been tasked with deploying an application based on the Sinatra framework on one of our production webservers. Because we are a CentOS shop, and Apache is the path of least resistance, I chose to deploy the application using Passenger Phusion, also known as mod_rails.

A colleague of mine set Passenger up pretty easily on our test/QA server, and, after mutually flogging the Apache configuration, got the Sinatra app up and running. We ran the application through QA, and after a week or two, decided that we’d like to beta test this on our actual production server.

We repeated the same steps to get Passenger installed, but this time, nothing worked at all. Trying to hit the web application returned 403 Forbidden. Weird.

Then I remember a salient difference between our test environment and production: SELinux was enabled and enforced on our production system, but not on our QA server. Uh oh. Sure, we could have just disabled SELinux (an easy fix), but then we wouldn’t benefit from SELinux itself. Plus, everything else was running just fine with SELinux enabled, so why shouldn’t Passenger?

Down the RabbitRat Hole

The Passenger “documentation for Apache” notes that you have to set the context of the Passenger codebase
to httpd_sys_content_t. I followed the directions, and things still didn’t work. No problem, I thought, I’ll just turn SELinux down to permissive mode so I can get the audit messages and use audit2allow to make a policy for Passenger! Sensing I had a slam dunk idea, I did just that, generated my own Passenger policy, and … nothing. For some stupid reason, the Passenger backend process kept dying, leading to messages in /var/log/httpd/error_log like these:

[Wed Mar 17 15:39:54 2010] [error] *** Passenger could not be initialized because of this error: Could not connect to the ApplicationPool server: Connection reset by peer (104)

Googling on that error message led me to some lame comments, so I decided to dig into SELinux itself. Lo and behold, the Fedora Project have an excellent FAQ on SELinux, which included something that I suspected might be happening:

Q: I get a specific permission denial only when SELinux is in enforcing mode, but I don’t see any audit messages in /var/log/messages (or /var/log/audit/audit.log if using the audit daemon). How can I identify the cause of these silent denials?

A: The most common reason for a silent denial is when the policy contains an explicit dontaudit rule to suppress audit messages. The dontaudit rule is often used this way when a benign denial is filling the audit logs.

To look for your particular denial, enable auditing of all dontaudit rules:

semodule -b /usr/share/selinux/targeted/enableaudit.pp

Well, it turns out that one of the dontaudit rules governed the reading from and writing to UNIX stream sockets that Passenger uses to talk to its backend. It also seemed to screw up the backend’s ability to set its own signal handlers.

Anyways, after one last run of audit2allow, I had a working policy.

tl;dr – The Phusion Passenger SELinux Policy

Here it is.

module passenger 1.0;
require {
        type httpd_tmp_t;
        type devpts_t;
        type httpd_sys_script_t;
        type security_t;
        type httpd_t;
        type unconfined_t;
        type selinux_config_t;
        type hi_reserved_port_t;
        type httpd_sys_content_t;
        type var_t;
        type cert_t;
        class file { getattr read create append };
        class process { siginh signal noatsecure rlimitinh };
        class unix_stream_socket { read write shutdown };
        class chr_file { read write };
        class capability { setuid dac_override chown fsetid setgid fowner };
        class fifo_file { setattr create getattr unlink };
        class sock_file { write getattr setattr create unlink };
        class lnk_file { read getattr };
        class udp_socket name_bind;
        class dir { write read search add_name };
}
#============= httpd_sys_script_t ==========
allow httpd_sys_script_t cert_t:dir search;
allow httpd_sys_script_t cert_t:file { read getattr };
allow httpd_sys_script_t cert_t:lnk_file read;
allow httpd_sys_script_t devpts_t:chr_file { read write };
allow httpd_sys_script_t httpd_sys_content_t:fifo_file setattr;
allow httpd_sys_script_t httpd_sys_content_t:sock_file { create unlink setattr };
allow httpd_sys_script_t httpd_t:unix_stream_socket { read write };
allow httpd_sys_script_t httpd_tmp_t:fifo_file setattr;
allow httpd_sys_script_t httpd_tmp_t:sock_file { write create unlink setattr };
allow httpd_sys_script_t self:capability { setuid chown fsetid setgid fowner dac_override };
allow httpd_sys_script_t unconfined_t:process signal;
allow httpd_sys_script_t var_t:dir { write read add_name };
allow httpd_sys_script_t var_t:file { read getattr create append };
#============= httpd_t ==========
allow httpd_t hi_reserved_port_t:udp_socket name_bind;
allow httpd_t httpd_sys_content_t:fifo_file { create unlink getattr setattr };
allow httpd_t httpd_sys_content_t:sock_file { getattr unlink setattr };
allow httpd_t httpd_sys_script_t:process { siginh rlimitinh noatsecure };
allow httpd_t httpd_sys_script_t:unix_stream_socket { read write shutdown };
allow httpd_t httpd_tmp_t:fifo_file { create unlink getattr setattr };
allow httpd_t httpd_tmp_t:sock_file { getattr unlink setattr };
allow httpd_t security_t:dir search;
allow httpd_t self:capability { fowner fsetid };
allow httpd_t selinux_config_t:dir search;
allow httpd_t var_t:file { read getattr };
allow httpd_t var_t:lnk_file { read getattr };

To install this policy on your SELinux enabled box:

1. Copy and paste the above policy into a file called passenger.te.
2. Run checkmodule -M -m -o passenger.mod passenger.te.
3. Run semodule_package -o passenger.pp -m passenger.mod.
4. Finally, to install the policy, run semodule -i passenger.pp.

Final Thoughts

Having a working policy is great if you want to make things go, but it begs the following questions:

1. Is the policy for Passenger that I’ve generated insecure? How can it be improved?
2. Are there any ways that Passenger Phusion could be improved to fit into the RHEL/Fedora/CentOS base SELinux policy without having to go through such gymnastics, or is this the norm for applications built on Apache?

As Rails and Ruby have been slowly moving into “enterprisey” shops, it would seem that getting it to play nice with the largest commercial Linux distribution would be a priority for, well, someone. Unfortunately, Ruby has had a history of being being second-class at RedHat; after all, RHEL is still using 1.8.5, which was originally released in 2006, and many things—one being Rails—recommend if not require at least 1.8.7.

RedHatters and SELinux gurus: the ball is in your court, now.

I’ll make it quick so I can go back to watching TV:

Announcing my first attempt at a generic Django Developer Kit, a CentOS (powered by rPath’s conary) based software appliance with all you’d need to run a Django project.

Django Developer Kit Appliance

The current images are built on the development stage, which means it includes the very latest Django 1.2 code line straight from the subversion repository. Currently, the following packages make up the base appliance:

• django
• django-ajax-selects
• django-authority
• django-cache-memcached
• django-contact-form
• django-db-postgres
• django-filter
• django-notification
• django-pagination
• django-piston
• django-profile
• django-sorting
• django-tagging
• django-threadedcomments
• file
• gettext
• httpd
• less
• mod_python
• mod_ssl
• mod_wsgi
• mx
• openssh-clients
• openssh-server
• openssl
• PIL
• postgresql-server
• psycopg2
• python-ctypes
• python-markdown
• python-memcached
• python-urlgrabber
• PyYAML
• scgi
• sendmail
• south
• sqlite
• sudo
• tar
• vim-enhanced

I’m still working out the kinks and have decided to not include openssl by default until I have a generic way of generating a certificate for the appliance. I will also be adding tools such as git, mercurial, etc so that people can use the appliance as a testing lab/environment for their own projects.

Once you’ve either installed the appliance or launched on EC2 or ESX, make sure to visit your appliance’s htts://IP:8003 address to configure the administrative interface (log in as admin with password as your password). Then click the Updates plugin to get updates as I will be making changes between now and the time I publish this post.

Download it today!

Conary 2.1.10 is a maintenance release.

• The "conary migrate" command no longer requires interactive mode, and now defaults to yes rather than no. (CNY-3361)
• Added --diff option to verify and showchangeset commands to display output as a git-formatted diff.
• Added --new-files option to verify to include files which were added to the system outside of conary package management. The verifyDirsNoNewFiles configuration option was added to pare down the tree conary looks through for new files.
• Added exceptions and exceptDeps options to RPMRequires.

• Optimized StreamCollection diff and eq operations to use frozen data if available.
• Merged internals of localcs/verify implementation into new classes.
• Flavor objects can now be used with the stdlib "pickle" module.

• SSL XMLRPC connections will now retry before raising an exception (CNY-3369)
• Java requirements for classes depending on other classes for which provides have been dropped no longer propagate as trove or file requirements. (CNY-3362)
• Auto-sourced files will now be fetched through an proxy if the appropriate *_proxy environment variable is set of the a proxy is configured for conary. (RBL-5714)
• Lookaside fixed for files that have identical names but different contents (CNY-3256)
• Jobs would be split inappropriately when capsules were pulled in through dependency resolution (CNY-3367)

Just wanted to update everyone who showed interest in the new release of GNOME Developer Kit I announced yesterday. Based on some preliminary statistics I collected in the (less than) last 24 hours, it seems that the VMware image type got the most download, followed closely by the installable ISO format. I guess that was due to VirtualBox being able to use *.vmdk files and some people opting for the free virtualization tool.

Here are the preliminary results so far:

1. VMware image: 42 downloads
2. Installable ISO: 26 downloads
3. RAW filesystem image: 17 downloads

About GNOME 2.29.92

Due to the number of downloads and and comments I received, I felt that I should provide with some background on how to install/remove packages and update your system using the conary package management system. So here you go:

The package management system behind the GNOME Developer Kit is called conary and is considered by many as the next generation package management system when compared to some of the popular options out there. One of the reasons behind this claim is the fact that your entire system is actually completely maintained in a versioned state, and conary is always “aware” of what is installed on your system and what files and dependencies make up the entire “set”. This allows for some pretty nifty operations such as rolling back to a specific state of your system.

In order to check for new updates for your system, open a terminal and run the command sudo conary updateall. conary will then check for updates and prompt you to accept the update or not. Please keep in mind that the first time you run conary for the first time, you will experience a delay as your entire system gets analyzed in preparation for the changes that are to take place. All subsequent actions performed will be much faster, I promise. If after a while you don’t feel like waiting for the prompt, add –no-interactive to the update command to have your system updated automatically.

Now, let’s just say that you decided to install something new, such as Banshee. Easy, just run sudo conary update banshee (remember to add –no-interactive for no-hands updates) and voilá!

Want to know what was actually installed on your system? conary q banshee will tell you what version of banshee was installed. How about what files were installed? conary q –ls banshee will give you a list of all the files that were installed and conary q –lsl banshee will give you the long list with file permissions and modes.

Changed your mind and want to remove banshee from your system? sudo conary erase banshee will take care of that. Want to actually roll your system back to the state it was before you installed banshee instead? sudo conary rollback 1 will rollback your system exactly one transaction. Want to go further back? Just increase that number to represent how many transactions to roll back. Want to rollback but don’t remember what point in time you want to go? sudo conary rblist will display a list of all transactions and what was changed. Note that each transaction is preceded by the letter “r“, so if you want to rollback to the point r.15, then use sudo conary rollback r.15 (and don’t forget that “r” or you’ll rollback exactly 15 transactions instead).

How about searching for a package? If it is something that it is already installed on your system, then conary q [package name] will give you the information you want. If the package is not installed on your system yet, then conary rq [package name] is what you need, though since conary does not yet make use of metadata, you’ll need to know the exact name of what you’re looking for. Now, let’s say you want to find out what package provides the command /sbin/service? Use conary q –path /sbin/service to find out that initscripts:runtime=8.81.2-0.11-1 is responsible for providing it (use rq if you want to search the remote repository).

Well, I think this is enough to get you going. You’ll probably want to install Flash and media codecs to enjoy browsing some sites and listening to your media, so let’s apply what we’ve learned so far and run: sudo conary update flashplayer group-codecs

If you’ve stayed with me until now, you may want to read up on what else conary can do or even consider packaging for GNOME Developer Kit. Your help will be greatly appreciated!

UPDATE: Thanks Alberto Ruiz for pointing out that VirtualBox can use .vmdk files, so the VMware image can be used for that purpose.

Thanks to the incredible work of Zhang “Jesse” Sen and Vladimir Melo, a brand new release of the GNOME Developer Kit has been published! “What’s new”, you may ask? Everything, since all packages are built directly from git.gnome.org! But that alone is not what makes this release so cool, but the fact that the final image went through a dramatic “diet”, shedding a lot of its “weight” and going from a 1.4GB monster to less than 700MB of pure GNOME goodness!!!

From Screenshots

Firefox was replaced by Epiphany and codecs and fancy-Nancy stuff was scrapped to make room for a lightweight release for developers and translators!

So go ahead and try the new images today:

• x86  VMware (R) Virtual Appliance 636 MB, SHA1: 4b4266fc1a65189d65efd7f3ac51797396babf78
• x86  Appliance Installable ISO 697 MB, SHA1: c3345cadae9c7338d0b92ba0ad1a187930652357
• x86  Parallels, QEMU (Raw Hard Disk) 644 MB, SHA1: e3dbbff4e65f8e086f422885a24d8ee04bc89f44

Python Testing: Beginner's Guide

I was looking for some material on proper python testing in order to improve my QA skills and after some “Googling” came across “Python Testing: Beginner’s Guide“. My first impulse was to hit Amazon and see if they had it and if I could buy an ebook version. Sadly, they only had the “dead tree” version, so I decided to check if the publisher, PackT Publishing, had an alternative.

Boy, was I glad I hit their web site! Not only there was an ebook version of that book, but they do not password protect them, giving you complete control over your purchase!!! You can also copy text from it, which makes your life really easy when you’re following along and want to copy some of the code being described!

Needless to say I purchased the ebook version and have already allocated my weekend to read it, so you can expect a review next week. In the meantime, here’s a free chapter (PDF) for you to get a taste for the book: Chapter 5: When Doctest isn’t Enough: Unittest to the Rescue

Following the tradition of releasing simultaneously with the Transifex project, I’m pleased to present you the Transifex “Magneto” Appliance 0.8! There are just too many cool features to mention here… so I won’t! Just go ahead and read the release notes instead.

From Transifex v8.0 featutes

As far as the appliance goes, the most important thing to know is that I dropped MySQL and replaced it with Postgresql, so if you’re thinking of updating an existing deployment, you’ll have to backup your data and handle the restoration process. If you’re installing for the first time, choose from the following image types:

• Installable ISO (x86)
• Installable ISO (x86_64)
• VMware (x86)
• VMware (x86_64)
• Amazon EC2 Small (ami-af8669c6)
• Amazon EC2 Large (ami-b7a54ade)

The appliance is pre-configured with 2 unique users: editor and guest (with passwords editor and guest respectively) and several projects for you to play!  To keep it up to date, log in to the web based administrative interface by connecting to your appliances url using https and adding port 8003 at the end. Then, login as admin (the initial password is password but you’ll be prompted to change it during the initial wizard). I can proudly say that the Transifex Appliance has been downloaded several hundred times in the last 2 months and is currently being used by several companies and projects that are either test driving Transifex or decided to host their own instance like the Xfce project for their translations!

As always the development branch of the appliance will follow the development code line of Transifex and provide a playground for anyone who wants to help out the project, such as the tasks created ahead of the upcoming Google Summer of Code. Download the appliance today and see why projects such as Meego, LXDE, Xfce, Fedora, and many more chose Transifex to manage their translations!

With the GNOME 2.30 release just around the corner, translators are feverishly working hard to get the desktop completely translated into a multitude of different languages! But unless you’re comfortable building the application you’re trying to translate on your own (or perhaps the entire desktop), you’re pretty much doing what I call “blind translations.”

From Screenshots

The good news is that you don’t have to do any compiling to play with the very latest GNOME applications! Just download the GNOME Developer Kit and start translating knowing that you can actually see what you’re translating!

Borrowing from a previous post I wrote, just what is the GNOME Developer Kit? It is a continuous build of GNOME packages all bundled up into a distribution (in this case, Foresight Linux) and distributed in a few different formats that you can either install or run in a virtual environmen.

So if you’re a translator or writing docs, imagine being able to see the application you’re trying to translate running right in front of you! As the GNOME Developer’s Kit already comes with a lot of tools such as gettext, intltool and poEdit, you got your work cut out for you!

So don’t just sit there! Go download your GNOME Developer Kit today!

Ten songs listened to this morning by yours truly, in alphabetical order.

1. “About to Happen”, Siouxsie
2. “Adnan’s”, Orbital
3. “Adventures in Solitude”, The New Pornographers
4. “Again Today / Hiding My Heart”, Brandi Carlile
5. “All That I’m Good For”, Hem
6. “All That Makes Us Human Continues”, BT
7. “All the Old Showstoppers”, The New Pornographers
8. “All of the Things That Go to Make Heaven and Earth”, The New Pornographers
9. “Ambassador”, Noe Veneble
10. “The Antikythera Mechanism”, BT

This idea was gleefully stolen from Slacktivist, which itself is an alternate version of a the “it’s-Friday-Morning-so-post-the-next-ten-random-songs-played-on-your-iPod” meme.

My wife found her smartphone screen cracked recently. AT&T told her to suck it up and buy a new phone, and the local independent shop couldn't fix her phone. I had a great deal of trepidation about sending the phone off to some random place I googled, but in the end sent it off to Jet City Devices in Seattle.

They turned the repair in about an hour from the phone's arrival on a Saturday (!) afternoon, and had it back in the mail same day, so that it arrived back in North Carolina on Monday with a new screen.

Good Work!

Puteţi asculta Canonul cel Mare aici.

(if you cannot read above this line: it’s a link to the Great Canon of St. Andrew of Crete, officiated during the first week of the Great Lent).

Did you know that the same individual mandate that Senate Republicans have been recently attacking in the proposed health care reform legislation was initially proposed by Republican lawmakers as a part of an alternate bill during Clinton’s failed health care reform initiative in 1993? Neither did I.

Digging around on this, I found an article from the American Prospect by Paul Starr that was written just after the collapse of that initiative. He notes that

The collapse of health care reform in the first two years of the Clinton administration will go down as one of the great lost political opportunities in American history. It is a story of compromises that never happened, of deals that were never closed, of Republicans, moderate Democrats, and key interest groups that backpedaled from proposals they themselves had earlier co-sponsored or endorsed.

It is also a story of strategic miscalculation on the part of the president and those of us who advised him. In 1993, 23 Republican senators, including then-Minority Leader Robert Dole, cosponsored a bill introduced by Senator John Chafee that sought to achieve universal coverage through a mandate that is, a mandate on individuals to buy insurance. Nearly every major health care interest group had endorsed substantial reforms—grandiose ones, in fact. The American Medical Association (AMA) and Health Insurance Association of America (HIAA), the two great, historic bastions of opposition to compulsory health insurance, both went on record in support of an employer mandate and universal coverage. Even the U.S. Chamber of Commerce endorsed an employer mandate, as did many large corporations. Other groups came out variously for reform options that ran along a spectrum from Canadian-style, single-payer programs on the left to managed competition and medical savings accounts and radical changes in tax policy on the right. Under the circumstances, it was easy to believe the country was ready for substantial reform and that a market-oriented, consumer-choice approach to universal coverage, positioned in the center, could become a platform for consensus.

It was easy to believe, but it turned out to be wrong.

Read the whole thing if for no other reason then to be reminded that the seeds of political nihilism were sown far earlier than you may want to imagine.

Conary 2.1.9 is a bug fix release.

• The NO_PROXY environment variable no longer applies to conary proxies. (CNY-3360)

rBuild 1.2.2 is a maintenance release.

• The "rbuild rebase" command now saves product definition files in the latest version supported by the associated rBuilder, rather than the latest version supported by the installed rpath-product-definition. (RBLD-298)

• The "rbuild rebase" command now fails when the rBuilder does not support the product definition schema version only if the schema version is being changed. (RBLD-297)

Associated with rBuild 1.2.2, rpath-product-definition 4.0.1 is a maintenance release.

• The compatibility interfaces created for RPCL-63 are now compiled. (RPCL-64)
• The api1 module now properly sets __all__ to include all public interfaces.
• The preMigrateVersion property now reflects the version of the product definition as found in the serialized XML representation prior to applying all migrations. (RPCL-66)
• Older versions of product definition XML data can now be saved. (RPCL-67)

Conary 2.1.8 is a maintenance release.

• Added abort-on-error to conary rollback command which causes rollback be aborted if any pre scripts fail. (CNY-3327)
• Fixed bug introduced in Conary 2.1.0 which caused conary to ignore ownership differences for executable files. (CNY-3354)
• When SetModes() is called twice, honor the last invocation with regard to setuid and setgid, including if neither setuid nor setgid is set. Also, make it possible to override setuid and setgid bits in a derived package. (CNY-3344)
• Fixed a bug in Conary 2.1.0 which caused updates to fail because a temporary table persisted across jobs. (CNY-3339)
• Changed default behavior of imageGroup flag in group recipes so that checkOnlyByDefaultDeps is now set to True (CNY-3356)

Conary 2.1.7 is a maintenance release.

• Conary now allows configuration files that appear to be encoded in Windows Code Page 1252 if they do not have other specific characteristics of binary files. (CNY-3353)

• CheckinCallback was moved from cvc.py to commit.py, in order to prevent the conary package from depending on conary-build. (CNY-3314)
• Zero epochs are no longer stored as NULL in the troveInfo. (CNY-3350)
• A file descriptor leak caused by a circular dependency in the update code has been fixed. (CNY-3352)

Conary 2.1.6 is a maintenance release.

• A bug in the getChangeSetFingerprints call that resulted in fingerprints different from those calculated by Conary proxies has been corrected.
• Rollbacks no longer fail if a file type changed before and after the relevant update has been appliend. (CNY-3340)
• Ghost files that are part of rpm capsules are marked as being part of the changeset (as opposed to being included in the capsule). The proxy code that injects contents was made aware of that, to avoid creating incomplete changesets. (CNY-3346)

Conary 2.1.5 is a maintenance release.

• PythonSetup now respects the r.macros.pyver if it is set; r.macros.pyver now reflects the currently running version of python if it is not set by other means. (CNY-3325)
• The documentation for the Automake build action was corrected. (CNY-3329)
• A bug in unusual commit paths, that would cause repositories to not store file contents for contents which were part of capsules as well as part of normal troves, was fixed. (CNY-3332)
• RPM capsules properly update when files stayed the same between old and new versions of the RPM. (CNY-3335)
• Ghost symlinks shared between multiple capsules being packaged together as part of the same conary source component no longer cause the build to fail. (CNY-3336)

The local orienteering club, BOK, is organizing an A-meet (i.e. a national event), February 20-21. I’ve signed up to be one of the setter/vetters.

It’s very interesting how we decided to make sure we minimize the risk for mistakes when setting up controls, and in a way it’s an OCD-er’s dream. There are at least three setters that will go out and hang ribbons where the controls are placed. Then, two other persons (the vetters) have to go and vet (approve) the location chosen by the setter. Setters have the liberty to move the control from where the course designer suggested the location to be, for example if a feature is missing or is too dangerous to get to; vetters should try hard not to move controls, unless they were set wrong.

This gives you triple accountability for a control’s location, not to mention that some of the club members will have a practice run of the courses the week prior to the meet (which happens to be next weekend).

Today I spent more than 4 hours vetting. Now I am barely moving. Probably getting into the warm house after all that time in the balmy 34-36°F (1-2°C) did not help much. However, this is exactly what I need, hopefully the small injuries I’ve been accumulating over the past couple of months will eventually go away to let me go back to running on a more regular schedule.

I’ve also worked on a solution to download data from an Sportident box on a Linux computer (it might work on Windows too, since it’s written in python, and I believe pyserial does work on Windows. It has sound to alert users if their download was unsuccessful (more about that in a future post), and generates a PDF for the splits and total time; I think the printing part is going to be the one that will cause most of the problems, I seem to have bad luck with printers in general. (The printing part would definitely not work on Windows). At some point I will publish the code, maybe someone else has a use for it.

Making Light:

[F]amously-crackpot Whole Foods CEO John Mackey has now made himself sufficiently repellent that I very much doubt I’ll ever feel like spending a dime in one of his stores again. Not content with peddling rich-guy “libertarian” attacks on health-care reform, asserting that climate change is a fraud designed to “raise taxes and increase regulation, and in turn lower our standard of living and lead to an increase in poverty,” comparing unionization to herpes, and getting caught playing sockpuppet games on financial message boards, Mackey is now…charging his employees more for food if they fail to meet his arbitrarily-chosen cholesterol, blood pressure, and body-mass index criteria.

The original article at Jezebel dryly observes:

Because if public health research has taught us anything, it’s that reducing people’s buying power totally makes them healthier. Stay classy, Whole Foods.

Fraser Speirs:

What you’re seeing in the industry’s reaction to the iPad is nothing less than future shock.

For years we’ve all held to the belief that computing had to be made simpler for the ‘average person’. I find it difficult to come to any conclusion other than that we have totally failed in this effort.

The iPad bashing reminds me of how hardcore gamers made fun of the Nintendo Wii near its release. Nintendo made a game system for non-gamers, and there are tons more of them than folks who care about polygons, shaders and fps. Nintendo made serious money on that system, and continues to do so because for every serious gaming enthusiast, there’s about four people who just want to play virtual bowling with their friends.

Case in point: my step-mother. She would love the iPad. As far as I know, all she has every used her computer for are the following tasks:

• Play solitaire (or some game like it)
• Read her email
• Browse the web

I don’t doubt there are many other people whose requirements for a personal computing device are about as pithy.

Yesterday I attended my first TriZPUG meeting to check out Kurt Grandis‘ talk on Fabric, “a Python library and command-line tool for streamlining the use of SSH for application deployment or systems administration tasks.”

It was pretty cool to see a bunch of guys who share the same interests take some time on a Thursday to hang out, drink beers, and chat about python, django, zope, and other stuff. After the original talk was over and some of the other lightening talks that succeeded it was over, a couple of things became very clear to me:

• There was a real need to make it easier for system administrators and OPS people to handle the difficult task of deploying and maintaining systems, cloud or not;
• Some of the tools and/or tool implementations presented were being used in an attempt to minimize this pain, but you were still pretty much had no control over what made its way to the systems in the end of the process;

Having been using rBuilder Online to manage and maintain my Transifex Appliance, and being somewhat “spoiled” with the ability of having fine grained control over the entire software stack and having the option of deploying my final “product” on several different cloud environments, I couldn’t help but offer to speak a bit about my experience. I sure hope my impromptu presentation didn’t come across as being “just a sell’s pitch” and I definitely tried my best not to sound like I was selling something. I truly feel that the technology developed here at rPath can solve many of the typical issues that people have getting their product through the many different life cycles and eventually out the door and into the hands of their customers!

Today I started going through Fabric’s documentation and am already making plans to include it in some of the test automation tools we’re developing here!

Anyhow, after my presentation there was a quick intro to epdb, the “Extended Python Debugger”, a very cool python debugger developed by an ex-rPathian and something I use on a daily basis! Turns out that the epdb currently packaged for Foresight Linux was outdated, so I spent a few minutes during my lunch today to update it. If you’re running Foresight, just run conary update epdb=:2-devel or wait for it to make its way to the stable label. If you’ve never heard of epdb, I strongly suggest you give it a try!

I’m working on building an HTPC based on Foresight and xbmc/boxee using Conary+rBuild. I could really use your help.

It’s called Tapatio. If you are interested in lending a hand with packaging, etc. please let me know by joining the mailing list.

Thank you.

rBuild 1.2.1 is a maintenance release.

• The product definition facade no longer uses the internal BaseDefinition class. (RBLD-289)
• The RbuilderClient class is kept around for backwards compatibility, and the _getRbuilderClient internal method has been made backward compatible with the earlier interface. (RBLD-290)
• searchPath entries without a troveName specification in the product definition are considered label search paths, and properly handled, both by the conary and the rmake facade. conaryfacade's internal _findPackageInGroups method was renamed to _findPackageInSearchPaths, to clearly indicate that packages are looked up on labels too. (RBLD-294)
• A dependency on urllib internals that is not consistent between Python versions has been resolved; previously, some successful calls to rBuilder resulted in errors. (RBLD-295)

Over at TPM, a longtime reader and former Republican Hill staffer takes the pulse of Obama and our current Congress and concludes that

This isn’t an argument about the merits of policy. It’s all politics. Ask yourself, is it easier to pass a difficult, complex legislative agenda when the country is under stress if the opposition party is seen as the Party of Bush, or if the opposition party is able to begin redefining itself as the party of populism, or of un-Washingtonism, or of fiscal restraint? Give the opposition party a fresh start, for free, and you’ve bought yourself all manner of trouble. That’s really the only transformative development Obama has presided over so far. (emphasis mine)

This is exactly why many of my Republican friends call themselves “conservative” instead of Republicans. This is why Michael Steele bumbles around begging the base to “come back” to the party fold. This is why Sarah Palin continues to be popular in spite of all her flaws. This is why Massachussetts voted Brown into office. This is why 2009 was the Summer of the Teabaggers.

Once the taint of eight years of Republican rule presided over by possibly the worst president in history is removed from the political petri dish as well as the American people’s collective memories, the culture of populism grows fast and furious into the strain of “conservative” that exists today. Not a new GOP, but something else entirely. Something that reflexively says “no” to everything proposed by the Democrats, no matter how reasonable or “bipartisan”.

We cannot live like this forever.

Just wanted to tease you guys out there about a new feature that the Transifex guys are working on these days: Translation Reviews! Have you ever wandered if your translations conform to the standard vocabulary that your team uses? Have you ever wanted someone to take a look at what you’ve done before sending in your final work for commit approval?

From Transifex v8.0 featutes

Now, mind you this is still very alpha code but that is probably a good thing since you can play with it and give your feedback on how to improve it. As always, you can get this in an easy to consume format by using the Transifex Appliance Developer edition… or you can join the Xfce translators who are already enjoying Transifex latest code!

Don’t let Ted Kennedy down.

In case you’ve missed it, the Xfce project has been using their own installation of Transifex to manage their translations online! Translators can now visit http://translations.xfce.org and keep up with the action!

From Transifex v8.0 featutes

I’ve been contributing with translations for the Brazilian Portuguese language for quite some time now, and have been a strong supporter for the Transifex project as well, so I was thrilled to learn they were “working together”! But there is a second reason why I’m mentioning this on my blog:

Turns out that Nick Schermer, maintainer for http://translations.xfce.org, is using my Transifex appliance too!!! Moreover, he chose to use the appliance built from the development branch to get the very latest bits being committed to the development branch of Transifex. It has been a win-win-win (yes, 3 times!) relationship so far for all parties involved, for:

• Xfce gets a ready to run, batteries included, Transifex appliance with all the latest and coolest features without having to build things by hand.
• Transifex gets tons of excellent feedback for this version still in development and work out all the kinks before the next release.
• My appliance has also enjoyed of tons of excellent feedback and is now more robust and ready for consumption.

From Transifex v8.0 featutes

Some of the cool features that you can expect from the next version of Transifex (and that the over 200 registered Xfce translators are already enjoying) are:

• Better support for Lotte, the online translations editor, and the removal of the 100-strings limitation;
• Automatic translation suggestions within Lotte;
• Support for translation teams;
• New timeline history for tracking contributors, teams, and projects activities;
• Top Translators “hit list” for your bragging rights

From Transifex v8.0 featutes

The Transifex Appliance (developer image) has been updated almost on a daily basis, so those out there already using it can keep it updated using the web based appliance management tool or running conary updateall. As always, you can expect a stable release the very same day that Transifex releases the upcoming 0.8 version! I’d love to hear from all of you appliance users out there. Just drop me a line or a comment here and I’ll do my best to improve your experience.

Conary 2.1.4 is a maintenance release.

• A redundant check that could trigger an assertion error in the lazy cache code has been removed. (CNY-3331)

Conary 2.1.3 is a maintenance release.

• Conary now stores RPM obsolete information as troveinfo data. (CNY-3328)

• Building rpm capsules properly eliminates dependencies in the RPM namespace that are also discovered by Conary. (CNY-3318)

conary-policy 1.0.27 is a maintenance release.

• All destdir policies have been audited, and modified as necessary, to correctly handle capsules, in preparation for enabling destdir policies for capsules. (CNY-3320)
• The new WarnScriptSharedLibrary policy looks at capsule scripts for possible instances of modifying the ld.so.conf, when used with Conary 2.1.2 or later. (CNP-185)

Conary 2.1.2 is a maintenance release.

• Conary now runs all destdir policies for capsule packages. Previously, it disabled destdir policies to avoid unintentional modification; now all destdir policies should take capsules into account and some destdir policies are required. (CNY-3320)
• Scripts from capsules are now written as files that are not packaged but are available for inspection during the packaging process, and policy can investigate script files. (CNY-3321)

• Committing relative changesets with multiple specifications for a single fileId no longer causes a repository traceback when those specifications are part of different troves. (CNY-3316)

Our friends Gwenn and Nick Mangine are houseparents for an children’s home in Jacmel, Haiti and were there when the quake struck. They have a blog, and have been reporting on the aftermath. CNN even interviewed the Mangines and used their photographs for a story on Jacmel.

I recently released a plugin for XChat-GNOME (and XChat) which adds support for the messaging menu in Ubuntu. This was a fun little side project of mine, I use xchat-gnome very heavily and have really been craving integration with the messaging menu.

When I started working on this, I wanted to make sure it was a standalone plugin that didn’t need to be built inline with xchat sources and didn’t require changes to xchat. In the process I ran accross a couple pieces of the XChat plugin API that hadn’t been implemented in xchat-gnome yet. This meant of course I needed to patch xchat-gnome, and send those patches upstream.

Both of these were trivial changes to xchat-gnome, and I didnt expect any problem getting them accepted. I had to implement the “GUI FOCUS” command which has been merged already (bug).   And I had implement the win_ptr argument to xchat_get_info, which lets the plugin get a pointer to the GtkWindow (bug).

Overall I am very impressed with the plugin API for XChat, it is really awesome to be able to get access to the GtkWindow.

If you are running Lucid or Karmic, you can install it from from my xchat-gnome PPA:

sudo add-apt-repository ppa:ken-vandine/xchat-gnome
sudo apt-get update
sudo apt-get install xchat-gnome-indicator


If you use xchat instead of xchat-gnome, just change the package name in that last command:

sudo apt-get install xchat-indicator


To get the source, file bug reports or feature requests, check out the project page on launchpad.

On his latest post titled “Foresight Linux is dead?“, Thilo Pfennigs rightly asks the question that many of the current Foresight Linux users may be asking themselves. With the current stable release dated as of May 2009 and no explicit roadmap stating when the next release will be published, is it really safe to say that Foresight Linux is indeed dead?

In order to properly answer this question, one must first take a look at what the year of 2009 reserved for this young distribution. Born out of Ken Vandine’s desire to follow the GNOME project as close to the upstream source as possible and introduce all the latest and coolest applications out there to the desktop before anyone else, Foresight was for a while synonymous to bleeding edge Linux done right!

Powered by the revolutionary Conary package management system and a small but talented and determined crew of developers, Ken was able to ship a new version of the distribution the same day that a GNOME release was published, a feat that no other distribution was able to keep up, even those enjoying of large hordes of developers and user base. Foresight was the first distribution to include several trend setter applications out there to the default installation, such as Banshee, F-Spot, Tomboy, Gwibber, Pulse Audio, PackageKit, among many others! And since the distribution followed a rolling release cycle, users did not have to wait for a major release in order to get the very latest bits.

Even if DistroWatch’s numbers weren’t impressive, those who took the time to test drive the distribution fell in love with the community, package selection, and most likely the possibilities that the underlying Conary technology provided for those inclined to do a little packaging or package maintenance. If you were a GNOME user/fan and didn’t mind the small sized, hand picked repository of supported packages, then you’d probably feel right at home! Sure there were KDE, Xfce, Fluxbox, Openbox packages available but those were mostly supported by some of the core users who didn’t mind doing the heavy lifting.

Then came 2009 and with it the major financial crisis the shook many companies around the world, creating a massive layoff wave for most of the first quarter. Sadly, approximately 75% of the active developers that comprised Foresight’s core developer base were part of the many casualties, including Ken Vandine, the heart and soul of the distribution! By late February these developers had already joined the ranks of companies such as Red Hat and Novell to do package and kernel management. Ken himself was quickly nabbed by Canonical to join their Desktop Experience Team, concluding then the completely dismemberment of the seasoned Foresight team!

Deprived of its core developers who were now devoting their time to working for their respective new companies, Foresight’s run at being a bleeding edge distribution and being able to keep up with the release schedules of GNOME (and all of its dependencies) quickly spiraled down toward what looked like certain doom. António “Doniphon” Meireles, second in charge of the distribution and holder of all the knowledge related to how all parts worked together became the sole guardian and maintainer of all packages. Have you ever tried to sync up and maintain all the modules that make up the X.org stack by yourself? How about making sure that every single package in the repository is properly compiled and linked to a newer version of Python?

Unfortunately for many of our loyal users expected point releases stopped from happening on time and deadlines were never met. Having been using Foresight Linux as my primary and only distribution for the last 3 years, I myself started to wonder if 2009 would mark the end of it all.

It took a few months for the remaining developers and users to get over the deep scars left from the massive exodus suffered early last year, but our user base proved to be very resilient and new developers stepped up to fill in the gaps. António was still doing the heavy lifting but this new crop of developers took upon themselves to bring the distribution closer to its former shape.

Slowly but surely milestones were achieved and the development branch eventually caught up with the latest GNOME packages. As of 2 weeks ago the development branch was pretty stable and I believe that only a few minor issues with PolicyKit were blocking a new release. Some massive work has also been done to pave down the way for Foresight 3.0, a major move that will allow for a more modular platform that can be used to derive other distributions, leveraging the flexibility and functionality provided by Conary. Moreover, the “Boots” project was kicked off to bring a Fedora based distribution completely managed by Conary, which should free up the time our developers spend maintaining some of the more complex stacks of the operating system and let them focus on making your desktop “freaking cool!”

So to answer the original question posted by Thilo, “is Foresight Linux dead?” I can gladly say “Far from it!” I predict that the Foresight community will rally together in 2010 to get back to being the most GNOMEic and bleeding edge distribution out there! As the Foresight Community Manager I can honestly say that we have always been and will always be a niche distribution! We don’t have the man power that distributions such as Ubuntu, Fedora, Mandriva or OpenSuse have to provide the same level of documentation or user support. We obviously cannot afford to have the same depth of package variety in our repositories or  claim to have the expertise and time to resolve all issues that manage to get filed in our tracking system. But I can guarantee one thing: Foresight is here to stay!

If you want to try a revolutionary package management system and want to be part of a an exciting crew, come hang out with us on #foresight at Freenode. We will help you get started and I promise you that you’ll be able to contribute in no time.

Expect great things from Foresight Linux this 2010!