Colors of Noise

I have released whatmaps 0.0.9 a tool to check which processes map shared objects of a certain package. It can integrate into apt to automatically restart services after a security upgrade.

This release fixes the integration with recent systemd (as in Debian Jessie), makes logging more consistent and eases integration into downstream distributions. It's available in Debian Sid and Jessie and will show up in Wheezy-backports soon.

This blog is flattr enabled.

The seventh Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. We had one remote hacker from NYC which brings the number of attendants up to 9. This is a short summary of what happened during the weekend:

• We decided to abandon Iceowl (based on the standalone calendar sunbird) since Mozilla started to actively remove the code. Unfortunately this leaves us without a proper GUI stand alone calendar client with GSSAPI support.

• The icedove package got a major cleanup including the switch from CDBS to dh and the removal of the rebranding logic. This will hopefully allow us to better keep in sync with upstream. Carsten's git repo usually carries the most up to date version and a automated build of these version is in the works.

• The sogo connector extension for icedove got uploaded and tested including a wiki page

• The Groupware Page got updated

• We discussed the possibility of caldav/carddav servers in Debian using autopkgtest. This resulted in caldav-tester being packaged. It's currently waiting for an updated dependency before it can be uploaded.

• Based on that we added minimal autopkg tests to calypso. The later also gained GSSAPI support.

• OpenChange got updated in experimental (now moved to sid) and got a debug package. There were also some upstream improvements to ease provisioning.

• Dovecot's installation of the Sieve ext_programs was fixed

• SOPE and SOGo got updated to the latest upstream versions

• The SOGo-OpenChange plugin got build against the OpenChange package in experimental

• Giraffe (aka Zarafa packaging) made nice progress including the switch to free artwork and further renaming of the services. For Details on the current state check the wiki page.

• Due to the warm spring we had two nice barbecues for lunch.

Since we had a nice mix of first time Debian contributors, Debian Maintainers and Debian Developers we had lots of room for discussion and co-working which made this an exciting weekend.

One of the replies to the post about Debian's last groupware meeting was from Patrick Ohly of syncevolution fame pointing out that syncevolution already implements calendar autodetection for CalDAV calendars as described in draft-daboo-srv-caldav-10.

While looking at the code I noticed that there's a backend for the N900s calendar by Ove Kåven as well.

When I tried Ove's latest package on my N900 it lead to an immediate crash when doing a:

syncevolution --print-items target-config@webdav calendar

According to Patrick the bug was supposed to be fixed in recent versions so I set up scratchbox and built a newer git snapshot for maemo (sources). This wouldn't crash but didn't show up any items either. It turned out to be a minor bug in calypso returning no content type for REPORT queries which resulted in libneon discarding the whole reply (now already fixed in calypso upstream).

With this out of the way setting up synchronisation is quiet simple:

# Configuration
CALDAV_SERVER=192.168.0.10
syncevolution --configure username=<username> password=<password> \
              calendar/backend=caldav calendar/database=https://${CALDAV_SERVER}:5233/private/my_calendar \
              target-config@webdav calendar
syncevolution --configure --template SyncEvolution_Client sync=none syncURL=local://@webdav username= password= webdav
syncevolution --configure sync=two-way backend=calendar webdav calendar

You should then be able to print the items on the local (N900) and from the remote (CalDAV server) end:

# This lists the current calendar items on the server
syncevolution --print-items target-config@webdav calendar
# This lists the current calendar items on the N900
syncevolution --print-items @default calendar

And from there on sync away:

# initial slow sync
syncevolution --sync slow webdav
# from there on
syncevolution webdav

The syncevolution source code has great documentation about debugging problems (e.g. src/backends/webdav/README). So check that in case you run into problems. The tl;dr version is

SYNCEVOLUTION_DEBUG=1 src/syncevolution loglevel=10 --print-items target-config@webdav calendar

to debug CalDAV related problems. In case you need to run syncevoluton from source be sure to set these beforehand:

export SYNCEVOLUTION_TEMPLATE_DIR=$PWD/src/templates/
export SYNCEVOLUTION_XML_CONFIG_DIR=$PWD/src/syncevo/configs/

On the CalDAV side I used current Calypso git which (with some additional minor fixes) now also interoperates nicely with Iceowl/Icowl-Extension aka Sunbird/Lightning on the desktop side. There's also an ITP for it. So it'll hopefully end up in Debian soon.

Update: in order to do ssl verification with syncevolution/libneon you have to put the CAs certificate to /etc/ssl/certs on the N900 and do a

c_rehash /etc/ssl/certs

otherwise syncevolution won't ve able to verify the server's certificate.

The sixth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. We had one remote hacker from NYC which brings the number of attendants up to nine - an all time high! This is a short summary of what happened during the weekend:

• Sogo 2.0.5 got uploaded to unstable and work on OpenChange support is advancing.

• D-push (the rebranded version of z-push) got split and restructured to better handle different backends. An update in experimental is pending.

• Giraffe's git (the rebranded version of zaraffa) got updated to 7.1. There's some more work needed to get this into the archive though.

• There's been progress on getting Kolab3 into Debian starting with libkolabxml 0.8.4 and libkolab 0.4.2 (also needed by kde-pim).

• mozilla-devscripts now handles Iceowl as well so packaging calendaring extensions like this one becomes even more useful.

• Icedove and Iceowl bugsquashing. New versions were uploaded to unstable and experimental. The bug count trends look quiet promising but we really need help for #658664.

• We did some davmail <-> iceowl/icedove interop testing.

• The Groupware Page got updated

• We had some discussions about calendar and addressbook detection and autoconfiguration. For CalDAV/CardDAV there's a specification available already but there seems to be no client implementation in Debian so we started to work on it.

• We had a nice barbecue enjoying the first warm days.

Running Debian on the WeTab with GNOME Shell without an external keyboard works pretty nicely. The on screen keyboard - if enabled via the accessibility menu - folds out automatically in the shell itself within text input fields. To have this within GTK+3/GTK+2 applications you need libcaribou-gtk3-module and libcaribou-gtk-module installed. For other cases I stitched together a small extension that puts a keyboard "Button" prominently into the middle of the panel. Clicking/touching it will fold it out, clicking again will hide it again. You can fetch it from

git clone git://honk.sigxcpu.org/git/gnome-shell-oskb-extension.git ~/.local/share/gnome-shell/extensions/OnScreenKeyboardButton@sigxcpu.org

and activate it via

 gsettings set org.gnome.shell enabled-extensions "['OnScreenKeyboardButton@sigxcpu.org']"

For kinetic scrolling in Iceweasel I'm currently using Grab and Drag which is not yet packaged for Debian.

Thanks to the Debian's GNOME packaging team gnome-shell 3.6 is already available in experimental.

This blog is flattr enabled.

Interactively installing Debian virtual machines with virt-install without having to download anything in advance can already be done by pointing it to a Debian mirror via --location. But you can also add files to the initrd after downloading using --initrd-inject. Upstreams intended use is for kickstart files but we can also feed it a preseed.cfg to automate the whole installation:

virt-install --connect=qemu:///system \
             --location=http://ftp.us.debian.org/debian/dists/stable/main/installer\-i386 \
             --initrd-inject=/path/to/preseed.cfg \
             --extra-args="auto" \
             --name d-i --ram=512 \
             --disk=pool=default,size=5,format=qcow2,bus=virtio

preseed.cfg is a regular preseed file (as described in the Debian Wiki) in your local filesystem. I'm using this one for Squeeze and Wheezy VMs. It must be named preseed.cfg in order for d-i to pick it up from the initrd. This also works for URLs like qemu+ssh://<remotehost>/system/ since virt-install uses libvirt's streaming API to upload the kernel and modified initrd to the remote host.

In case you're running this on an i386 you'll need this fix which already sits in experimental.

This blog is flattr enabled.

This went out to d-d-a already but I figured that this might be of interest here too:

The fifth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. Eight persons attended which is an all time high! This is a short summary of what happened during the weekend:

• We pushed a ESR (extended support release) version of icedove including l10n and the calendaring extension to unstable. By cherry-picking lots of build-fixes from iceweasel we made the testing transition getting rid of the old 3.X version.

• Since iceowl (the standalone calendar) is not maintained upstream anymore we're keeping it in experimental only for now. A new version got uploaded including updated l10n.

• A new upstream version of evolution-mapi was upload to sid fixing an FTBFS.

• d-push 1.5.8 (the rebranded version of z-push) got uploaded to unstable including translation updates and adaption to php 5.4.0.

• Lots of progress was made on packaging SOGo and related components and it's now quiet close to an upload to sid.

• Work on OpenChange included looking into using the version in Debian for SOGo packaging as well as fixing Samba4 issues that broke (among other things) the OpenChange build.

• Progress was made on packaging Zarafa ZCP for Debian (rebranded as giraffe). The packages are working but rebranding is not yet complete.

• About 60 evolution bugs where either closed or commented on.

• As usual the Groupware page got updated.

• The meetings 5th anniversary was celebrated with a barbecue.

I've started uploading snapshots of git-buildpackage to experimental recently. Here's a short list of what changed over the version in wheezy and sid:

• git-buildpackage now has a --git-pristine-tar-commit option that commits a tarball right back to the pristine-tar branch if it's not already there. This makes tracking upstream git and dfsg-clean source handling easier.
• git-buildpackage's --git-upstream-tree now accepts a tree directly without the need to use --git-upstream-branch.
• git-buildpackage's --git-export now parses the exported changelog instead of the working copy. This way we automatically pick up the correct tarballs, branches, etc. reducing the number of options needed.
• Jan Čapek added a --git-postexport hook to allow to mangle the source after exporting it.
• gbp-pull and gbp-fetch now support shallow clones thanks to Markus Lehtonen.
• gbp-pull got a speed up by skipping the checkout for fast-forward. This makes updating large source trees less time consuming.
• git-import-orig and git-import-dsc can now import into bare repositories.
• Russ Allbery updated git-pbuilder to 1.27.
• gbp-pq should be easier to use thanks to the --force and --switch options. It also handles patches without descriptions more robustly.
• The test coverage of the internal test suite increased quiet a bit. We're now generating coverage information during the build in build/cover.
• We're now generating apidocs which also serves as usage examples.

This blog is flattr enabled.

Debian's libvirt in unstable finally passes the Technology Compatibility Kit (libvirt-tck) for qemu:///system:

Files=59, Tests=1579, 315 wallclock secs ( 0.77 usr  1.02 sys + 31.40 cusr 10.14 csys = 43.33 CPU)
Result: PASS

We're running libvirt's internal test suite since 0.9.0 but this doesn't launch any real virtual machines to check things like suspend, resume, snapshotting, migration and it doesn't create storage pools and volumes or networks. This means a lot of testing was done manually with each release.

libvirt-tck provides a framework to perform these kinds of integration testing between libvirt and it's drivers, comes with hundreds of testcases already and it's easy to set up since it's available in experimental:

apt-get install -t experimental libvirt-tck

Edit /etc/libvirt-tck/default.cfg if you don't want to use the default connection URI. Then just run libvirt-tck:

libvirt-tck

Since this is supposed to stress libvirtd and the hypervisor and since it creates and deletes storage pools, networks and virtual machines it's recommended to run this on a dedicated system to make sure the tests don't blow away any precious config.

If a test fails one can debug that single test using:

LIBVIRT_TCK_CONFIG=/etc/libvirt-tck/default.cfg prove --verbose /usr/share/libvirt-tck/tests/hooks/051-daemon-hook.t

This already revealed errors in our package like a missing parted build dependency breaking the creation of disk based storage pools, bugs in libvirt, crashes in QEMU and minor errors in the test suite itself. We're currently cheating a bit since the tests for hooks and nwfilter are currently disabled due to license problems with the used Perl modules.

libvirt-tck can easily be integrated into Jenkins since it can now use libtap-formatter-junit-perl to generate JUnit XML. To do so simply configure a free-style software project to execute these commands:

rm -f libvirt-tck.xml
sudo libvirt-tck --timer --format junit --force > libvirt-tck.xml

allow Jenkins to run libvirt-tck as root

jenkins ALL=(ALL) NOPASSWD: /usr/bin/libvirt-tck --timer --format junit --force

and configure it to publish a JUnit test result report.

Currently I'm only running the tests for qemu:///system so any help running and debugging this for LXC, VirtualBox or XEN is very welcome.

Many thanks go to Salvatore Bonaccorso for packaging the missing Perl modules needed by libvirt-tck.

During todays very interesting Puppet Skills Exchange given by Christian Hofstaedtler at Debconf 11 it was recommended to syntax check puppet manifests in git commit hooks. Since I wanted to do the same some time ago and I couldn't find anything that does manifests, ruby and erb I wrote some hooks that can be either used on commit or on the remote site when receiving the update. The git archive of this can be found at:

git clone git://honk.sigxcpu.org/git/puppet-helpers.git

This blog is flattr enabled.

Due to two totally different bugs in tip22 the d-i netinstall images for IP22 (SGI Indy) and IP32 (SGI O2) won't boot the installer correctly.

Tip22 is responsible for merging a minimal loader, kernel and initramfs into a single ELF or ECOFF binary, depending on the architecture. This can then be fetched by the machine's ARC PROM via tftp.

A fixed tip22 has been uploaded to unstable and updated images are available from here until we can get this fixed via stable-proposed-updates.

This blog is flattr enabled.

This went out to d-d-a a couple of days ago already but I figured that this might be of interest here too:

The fourth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. This is a short summary of what happened during the weekend:

• We pushed new versions of icedove and iceowl to unstable fixing several issues with gnome-shell in the later. Unstable now ships packages based on Thunderbird's current 3.1 branch.

• The iceowl-l10n language package got resurrected (currently sitting in NEW) providing translations for iceowl-extension and (in a yet incomplete way) for iceowl. (Update: it's already in unstable now)

• We've done Citadel ↔ ice{dove,owl} interop testing and bug fixing.

• Work was done on Citadel's event driven SMTP client and IPv6 compatibility

• The z-push package got updated to 1.5.1. The patent restrictions are resolved now and we're closer to resolving the trademark issues. So hopefully an upload to main can happen real soon now.

• SOGo packaging made nice progress. Remaining issues involve linking against GNUTLS to resolve the OpenSSL GPL license incompatibility, and handling of the embedded copies of JavaScript libraries.

• We updated the groupware overview page.

• We were invited by the FrOSCon organizers to join their barbecue. Many thanks for that!

In order to ease creation of remote repositories to publish your Debian packaging work git-buildpackage ships gbp-create-remote-repo: If you run

gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/%(pkg)s.git'

from inside a git repository it will create a remote repository on git.debian.org in the given directory, push your debian, upstream and pristine-tar branches into it and set up branch tracking so you can easily use gbp-pull or git pull to update your local repository from there. '%(pkg)s' will be replaced by the source packages name. If you want to be more explicit you can use:

gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/foo.git'

so no substitution will take place. In case you only want to push to that repository but not pull from there you can use the --no-track option so gbp-create-repo won't set up any branch tracking.

If you specify the remote-url-pattern via gbp.conf calling:

gbp-create-remote-repo

is enough to create a repo on your favorite git server. The default is to create new repositories in the collab-maint repository on alioth.debian.org.

This feature is available in your $PATH since 0.5.16 (it was shipped in examples/ before) and was inspired by the Debian OCaml Maintainers dom-new-git-repo work.

This blog is flattr enabled.

Since waiting for long running builds is boring and having to check if the build already finished distracts one from doing other stuff, git-buildpackage 0.5.16 reports the build status of a package via desktop notifications if python-notify is installed:

To disable this feature use:

[git-buildpackage]
notify = off

in your ~/.gbp.conf.

This blog is flattr enabled.

To make xul-ext-nostalgy work with icedove 3.1 I finally wanted to update to a new upstream version. The git repository is tracking upstream's svn via git-svn which works great but when I typed

git svn rebase

I got a

Connection refused: Can't connect to host 'frisch.fr': Connection refused at /usr/lib/git-core/git-svn line 2310

The svn upstream repo moved to google code. It took me a moment to figure out that this can be fixed easily with:

 git config svn-remote.svn.url http://nostalgy.googlecode.com/svn/
 git config svn-remote.svn.rewriteRoot svn://frisch.fr/nostalgy
 git svn rebase

Just replace the url with the new svn repository url and set rewriteRoot to the old svn repository url and you're done.

This blog is flattr enabled.

When reviewing packages from mentors.debian.net I like to have them under version control so I can easily compare different versions, write patches and clean up autogenerated files. So when looking at a package I do a

git-import-dsc --download http://mentors.debian.net/debian/pool/main/x/xul-ext-firetray/xul-ext-firetray_0.2.8-1.dsc

This command first fetches the files via dget from devscripts and then imports the upstream sources onto the upstream branch (upstream by default) and the debian modifications onto the debian branch (master by default). I can then invoke git-buildpackage as usual. Since this works incrementally I can import newer versions into the same repository and use git diff to see the changes.

If I'd like to hack on a random Debian package (say xul-ext-nostalgy) I usually use:

git-import-dsc --download xul-ext-nostalgy

This uses apt-get source to fetch the source package and imports it into git using the same branch layout as described above so I can use all the familiar git commands to generate patches, etc..

This blog is flattr enabled.

Let's say you want to clone a git repository that has the debian packaging on master and the upstream source is kept on upstream/master (since it tracks upstream's master branch). You can simply use git clone or you can do a

gbp-clone --upstream-branch=upstream/master --pristine-tar git://git.debian.org/git/pkg-lvm/multipath-tools.git

This will additionally set up master, upstream/master and pristine-tar to track the corresponding remote branches. There's no --debian-branch option in the above example since master is the default.

If you want to safely update these branches at a later point invoke

gbp-pull --upstream-branch=upstream/master --pristine-tar

from inside the repository. This will only update the branches if they can be fast-forwarded. If the repository has a debian/gbp.conf describing the branch layout a call to

gbp-pull

is enough.

In case somebody else wants to jhbuild current GNOME 3 prereleases on Debian here's the current set of dependencies and the jhbuildrc I'm using. With the necessary fixes applied upstream now this allows me to build gnome-shell, gnome-control-center and others via

jhbuild build <program>

It needs libmozjs3d-dev from experimental for the shell but the rest comes out of squeeze.

For a security update of a shared library to take effect processes need to be restarted in order to use the libraries from the newly installed package. The openssl and freetype updates got me thinking again if I caught all the affected services on servers and desktops/laptop systems I'm running.

So I put together a small script that takes a package name and scans /proc/pid/maps for processes that map libraries from this package, it then looks for init scripts in these packages. It can also hook into apt and restart the services after the upgrade. Since the mapping to the init scripts is quite dumb at the moment this should be used with a bit of caution though.

The script whatmaps can be fetched form here. Debs are also available. Besides Debian packages it also handles RPMs and already proved useful since it pointed me to clamav being possibly affected by the recent bzip2 advisory.

Many team maintained packages in Debian are maintained in Subversion which makes a lot of sense if people agreed on a common workflow. If you want to use git to work on these packages you can still do so with a bit of configuration without changing anything for the other team members. Let's take system-config-printer as example. git-svn can be used to checkout the svn repository:

git svn clone svn+ssh://svn.debian.org/svn/pkg-gnome/ -T packages/unstable/system-config-printer -t tags/system-config-printer system-config-printer

Since the pkg-gnome team keeps all the packages in one huge SVN repository and splits the directories by release first and then by package the above command uses -T to point git-svn to system-config-printer's trunk and -t to point it to the tags directory. In simpler repositories where trunk, branches and tags are subdirectories of the same base directory using --stdlayout instead is enough.

Since in SVN based packaging the upstream sources usually aren't kept in the repository git-buildpackage needs to know where to find them and how to combine things in the build-directory:

cd system-config-printer
cat <<EOF >.git/gbp.conf
[git-buildpackage]
# Build in a separate build-area
export-dir = ../build-area/
# Look for tarballs in ../tarballs
tarball-dir = ../tarballs/
# Overlay the upstream sources on top of it
overlay = True
# Don't use pristine-tar
pristine-tar = False
# Compression type of the tarball
compression = bzip2

Like with svn-buildpackage the orig-tarball is expected to be found in ../tarballs where you should put it now e.g. using the get-orig-source target of debian/rules (yes, git-buildpackage should support this implicitly). You can then work on the package as usual using all the nifty git commands like git-rebase, etc. and build the package (in this case using git-pbuilder):

git-buildpackage --git-pbuilder

or if you don't want to export the current branch's HEAD of your git repository but your working copy (which might contain uncommitted changes) to the build-area instead use:

git-buildpackage --git-pbuilder --git-export=WC

The built packages can then be found in ../build-area. Once the package is ready pushing the changes into the SVN remote repository is as simple as:

git svn dcommit
git svn tag -m"Tagging system-config-printer (1.2.3-0.2)" 1.2.3-0.2

The last command appropriately tags the new version. This saves a bit of typing. In order to fetch changes others have made use:

git svn rebase

I got tired of having to authenticate as root to change printer settings like paper size or printout mode via a GUI. Since system-config-printer uses PolicyKit things like allow myself to change printer settings when logged into the system should be possible without having to mess with cupsd.conf or sudo, are they?

Which printer related actions are governed by PolicyKit:

pkaction | grep printer

shows about the following if you have cups-pk-helper installed. The later is used by system-config-printer to interface with PolicyKit:

org.opensuse.cupspkhelper.mechanism.printer-enable
org.opensuse.cupspkhelper.mechanism.printer-local-edit
org.opensuse.cupspkhelper.mechanism.printer-remote-edit
org.opensuse.cupspkhelper.mechanism.printer-set-default
org.opensuse.cupspkhelper.mechanism.printeraddremove

So org.opensuse.cupspkhelper.mechanism.printer-local-edit seems to be what I'm looking for. Let's change the policy for this action:

cat <<EOF >/etc/polkit-1/localauthority/50-local.d/99-local.pkla 
[EditPrinters]
Identity=unix-user:foo
Action=org.opensuse.cupspkhelper.mechanism.printer-local-edit
ResultAny=no
ResultInactive=no
ResultActive=yes
EOF

This allows user foo to perform the action org.opensuse.cupspkhelper.mechanism.printer-local-edit if the user is logged into a local interactive session. The pklocalauthority(8) manpage has all the details. PolicyKit will pick up the configuration file changes on the fly. Lets see if this worked by getting the process id of the running system-config-printer and checking via pkcheck if the process is authorized to use that action:

PID=$(ps a | awk '/[p]ython .*system-config-printer/ { print $1 }')
pkcheck --action-id org.opensuse.cupspkhelper.mechanism.printer-local-edit --process $PID
echo $?

If pkcheck returns with a zero return value everything is fine and user foo won't need any password to modify local printer settings from now on.

Check the output of pkaction(1) to list more actions that can be setup this way.

Chris reports back to Debian duty: `Since one week I'm back from NYC where I enjoyed a very nice Debconf. It was my second one after last year in Cáceres. When I unpacked all my luggage - three weeks in the US need some stuff - I found these cute green guys between my clothes. Did they break their UFO and use my airplane to travel with me? Anyway. Thanks to all who made Debconf10 in New York possible. It was a great conference! And last but not least: "Happy Squeeze Freeze"' I too enjoyed DC10 a lot.

Git-buildpackage 0.5.6 in experimental got rid of it's pbuilder/cowbuilder examples and added Russ's nice git-pbuilder script. I'm very happy how this turned out, now building with cowbuilder is as simple as:

# Initially create a cowbuilder environment once
git-pbuilder create

# Build the package
git-buildpackage --git-pbuilder

# At a later point update the cowbuilder environment with new versions
git-pbuilder update

Or for another distribution:

DIST=lenny git-pbuilder create 
git-buildpackage --git-pbuilder --git-dist=lenny

The new version also better interacts with dch from devscripts. So things like:

git-dch --bpo|--qa|--nmu

are now also supported when adding new changelog sections. Git-dch now detects new upstream version numbers automatically and bumps the version accordingly. In order to get this working I finally fixed the tag format.

Since the current version in unstable should get a chance to move to testing first, I've uploaded 0.5.6 to experimental.

Those old school ones among us that still need a printer who are new school enough to want to get rid of HAL should try system-config-printer from experimental. After replacing hal-cups-utils by system-config-printer-udev aptitude tells me:

    The following packages will be REMOVED:
      hal{u} hal-info{u} 
    0 packages upgraded, 2 newly installed, 2 to remove and 121 not upgraded.

Which means faster startup times and one daemon less on Squeeze's GNOME desktop. The new version also uses PolicyKit instead of gksu for finer grained permission control.

Git-buildpackage 0.5.0 in experimental fixes quiete some bugs related to the import of upstream sources and Debian source packages. By getting rid of a complete source tree copy it also got about 50% faster when doing so. Since the code changed quiete a bit in that area it'd be great if some of you could give it some testing before I'll push it to unstable.

I've just added a simple afs plugin to krb5-auth-dialog. It just calls either aklog or afslog after acquiring or renewing your Kerberos ticket to get you into your AFS cell. To activate it use

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [afs]

and restart krb5-auth-dialog. A package with the above enabled has been uploaded to Debian. Thanks to the test account in the global2000.at cell provided by Jörg Herzinger I could test this easily and I have to say that AFS looks like a cool thing.

The slides of my talk about git-buildpackage at the Mini Debconf 2010 in Berlin are now available.

It was a great conference that I really enjoyed being at. Thanks a lot to all who made that event possible and happen!

Krb5-auth-dialog now sends DBus signals when you acquire or renew your Kerberos ticket granting ticket and when the ticket expires. When using OpenAFS This can e.g. be used to trigger a call to aklog on ticket renewal. It's simple to catch the DBus signals from a Python script:

import dbus
bus = dbus.SessionBus()
bus.add_signal_receiver(tgt_renewed_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_renewed")
bus.add_signal_receiver(tgt_acquired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_acquired")
bus.add_signal_receiver(tgt_expired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_expired")

The tgt_*_handler will then be called when the signal is received. The shipped Python example allows to execute a script already:

tgt-signals.py -q --acquired-action=aklog --renewed-action=aklog

Krb5-auth-dialog also got a plugin system so you could use a loadable module for these kind of things instead. It already ships a PAM plugin that can be used to run some typical actions like calling pam-afs-session or getting kx509 set up.

You need to tell krb5-auth-dialog which plugins to load via gconf. To load the dummy and PAM plugins use:

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [pam,dummy]

Since I'm not using AFS or kx509 myself I'd be interested to know if this works out as expected.

If you want to write your one plugins you can use the dummy plugin as a basis.

A package with the above enabled has been uploaded to Debian experimental.

gnome-activity-journal recently entered Debian and it could become a great tool to keep track of hacking activities. The underlying zeitgeist can log these and other events and make the information available via DBus. I couldn't find a data provider that feeds the information about Git commits to it so I wrote a simple post commit hook. This way one can easily see when one worked on a source repository:

Now is there a nice way to store additional information like current branch or commit message along with that?

Fedora uses Plymouth to provide a flicker free boot for quiet some time now. Debian has packages in experimental but it took some patches to get these working. After adding a Debian logo the boot splash actually looks quiet nice. The initramfs and init scripts do need some more work but it's basically working. Thanks a lot Daniel for merging these so quickly!

To enable Plymouth you first need to set up KMS in the initramfs. For an intel based card you can do this by either adding

i915 modeset=1

to /etc/initramfs-tools/modules or by setting

i915.modeset=1

on the kernel command line. Then install plymouth, set a default theme and update the initramfs:

aptitude install plymouth plymouth-plugins-all
plymouth-set-default-theme solar
update-initramfs -u

Finally add splash to the kernel's command line (e.g. by adding it to /etc/default/grub).

Afterwards reboot and you should see the solar flares:

We're still not fully there yet since we need a newer gdm for a flicker free handover. Fortunately the Debian GNOME maintainers have already prepared a new package in svn. We also need proper support for encrypted disks, asking for the passphrase works with this fix but cryptsetup needs support for it.

In case somebody wants to run KDE together with some GTK+ based applications (like Iceweasel or Icedove) having a consistent style as well as look and feel between KDE and GTK+ applications is a nice thing to have. QtCurve together with xsettings-kde and gtk-qt-engine makes this easily possible:

aptitude install gtk-qt-engine kde-config-gtk-style qtcurve xsettings-kde

Then adjust the following settings:

• Settings->System-Settings->Appearance, Style set Style to QtCurve
• Settings->System-Settings->Appearance, GTK Styles under Use another style: select QtCurve
• Settings->System-Settings->Appearance, GTK Styles under Firefox and Thunderbird click Install scrollbar fix...

Log off and right back in. Now your GTK+ applications should blend nicely into the QtCurve KDE look. xsettings-kde additionally bridges KDE settings like double click speed and icon theme via xsettings to GTK+ applications.

Now back to using gnome-shell...

Here are some more examples of libguestfs usage:

What kernels, modules and packages are in a (currently powered off) libvirt based virtual machine vmfoo:

virt-inspector -c qemu:///system vmfoo

Show free space in virtual machine vmfoo:

virt-df -c qemu:///system vmfoo

List file systems:

virt-list-filesystems -c qemu:///system -l vmfoo

Edit /etc/passwd in vmfoo:

virt-edit -c qemu:///system lenny-base-clone /etc/passwd

Tell guestfish to mount all filesystems of virtual machine vmfoo for more complex inspection and manipulation tasks like LVM operations, partitioning, resizing or filesystem check or creation:

guestfish $(virt-inspector -c qemu:///system --ro-fish vmfoo)

Debian packages are still on alioth.

I've finally updated the libguestfs Debian packages to 1.0.84 getting them back in sync with upstream. Download instructions are on the pkg-libvirt's wiki page.

Fetching files from a vm image with guestfish is as simple as:

guestfish --ro -a lenny-base-clone.img -m /dev/debian/root download /etc/passwd /tmp/passwd

After hacking around #561991 by running debirf as root we now do pass the testsuite again. The new version includes fuse support as well as the hivex tools to manipulate windows registries.

The source for the Debian package is available at git.debian.org. The next step will be to split out the appliance so we can fetch that one via http and upload libguestfs to contrib.

Here's a short overview of 3.0 source format support in git-buildpackage 0.4.64:

• git-import-dsc & git-import-dscs import 3.0 (quilt and native) format packages.
• git-import-orig: imports gzip and bz2 compressed archives. Other formats will be enabled once pristine-tar supports them (#499489).
• git-buildpackage handles creating gzip, bzip2, lzma and xz compressed tarballs with the --git-compression option although it could get a bit smarter and autodetect the compression type.

One loose end is the handling of multiple upstream tarballs (#561071, #561072). I'd be great to hear from people already using this feature how this can best be added into the gbp workflow.

The newer kids in town gbp-clone, gbp-pull (for keeping the repo up to date when using team maintenance) and gbp-pq (for managing the quilt patch-queue) don't care about the underlying source package format. These three are a bit underdocumented in the manual but information about the workflow is in the wiki.

Release 1.0beta1 of Iceowl-extension (also known as Lightning), the calendaring extensions for Icedove, is now available in experimental. This version works with Icedove 3.0.1 which also lives in experimental at the moment.

Open TODOs for Iceowl:

• reenable standalone build
• don't use internal cairo
• finish branding

Iceowl's current packaging git is here:

http://git.debian.org/?p=users/agx/iceowl.git

Any help on the above issues is greatly appreciated. Other open tasks that need fixing in order to get things in shape for Squeeze:

• Updating icedove-l10n and iceowl-l10n - both packages are looking for a maintainer
• Adding an icedove-dev package for 3.0 ...
• ... so we can build Enigmail for Icedove 3.0

I've just uploaded Icedove 3.0 to Debian experimental. The package is heavily based on Alexanders work in Ubuntu and Chris did most of the hard work.

It's currently named icedove-3.0 so you can (for now) install this version in parallel to Icedove 2. This version copies over your Icedove 2 profile so it doesn't get messed up.

As long as the package is sitting in new you can grab it from the pkg-mozext repository:

deb http://pkg-mozext.alioth.debian.org/packages sid/i386/
deb http://pkg-mozext.alioth.debian.org/packages sid/all/

We now need help with going through the Debian bugreports against Icedove.

If you want to help out: grab a bug, check if it's fixed in Icedove 3 and if it is, simply mark it as fixed in 3.0~rc2-2 in the bts:

bts fixed <bugnumber> 3.0~rc2-2

Once we're confident the package doesn't break everything we'll rename the binary package to icedove so it replaces the default Icedove on upgrades.

If you want to help out with patches: Git is here

git clone git://git.debian.org/pkg-mozilla/icedove.git

As already mentioned on <pkg-libvirt-discuss@lists.alioth.debian.org> libvirt 0.7.4-2 (currently in experimental) runs qemu and kvm processes as libvirt-qemu:kvm instead of root allowing you to use features like bridged networking without having to run the emulator itself with full privileges.

Kvm 88+dfsg-3 supports ksm to safe memory when running several similar virtual machines. On a recent linux kernel just do a

echo 1 > /sys/kernel/mm/ksm/run

to activate it. Then run two similar virtual machines and see how /sys/kernel/mm/ksm/pages_shared increases.

Thanks to work of Jan and Micheal Debian now also ships kvm's stable branch qemu-kvm.

As of git-buildpackage 0.4.60 gbp-pull supports --redo-pq which additionally recreates the patch-queue branch after a pull. Now you can keep your clone fresh with one command.

Inspired by tools developed by Debian's OCaml maintainers git-buildpackage now ships gbp-pull that can be used to keep your debian-, upstream- and pistine-tar branch up to date when doing team maintenance.

I added a short explanation on howto handle backports with git-buildpackage to the GBP workflow page.

git-buildpackage 0.4.57 adds gbp-clone to /usr/share/doc/examples/. If you use it instead of git pull it will automatically set up your upstream and pristine-tar branches. This was inspired by the helper scripts the ocaml team uses.

git-import-orig now calls a postimport hook which can be used to call git-dch after import so I could remove the hardcoded dch call.

The slides of my talk about libvirt at dc9 are now available.

git-buildpackage 0.4.55 now ships gbp-pq for easier serializing of git patch queue branches into quilt patch series and vice versa. It's currently in /usr/share/doc/git-buildpackage/examples/. I'll move it to /usr/bin/ once I feel a bit more confident that this is the right interface.

I've worked a bit on Richard's libguestfs Debian packages They now also provide perl and python bindings as well as a debug package and the appliance is built using debootstrap/debirf. The wiki has the necessary apt/sources.list (packages are currently available for i386 only).

The source for the Debian package is available at git.debian.org so please send patches to wrap more of the available language bindings into Debian packages.

If you're interested in updates on this as well as other virtualization related stuff in Debian what about joining the pkg-libvirt-discuss list.

As of version 0.4.53 git-buildpackage's git-import-orig supports --fast-import. This uses git fast-import to import the new upstream version and speeds up imports by about a factor of two.

It's not as well tested as importing without --fast-import so please be careful and file bugreports if it fails.

As a result of the 2nd Debian Groupware Meeting snapshot builds of the Thunderbird 3.0 release branch could be rebraned and build for Debian as Icedove. We'll continue to upload snapshots. See the pkg-mozext maintainers page for download instructions.

As of version 0.4.47 git-buildpackage exports these environment variables to a called posttag hook:

• GBP_TAG: the tags name
• GBP_BRANCH: the branch you were on when creating the tag
• GBP_SHA1: the sha1 of the commit the tag was created at

This allows you to write posttag hooks that push out only the changes that correspond to the created tag. For a simple example see the GBP Manual. Using such a hook makes team maintenance a lot easier since you can't forget to push out the commits and tags for a newly uploaded package while making sure you don't push out any other changes.

The current state of multipath support in Debian Installer's RC2 for Lenny is documented here. The netinst works fine if you use the patched grub (#442382). Unfortunately the CD images are currently broken due to missing libaio udeb.

The easiest way to get the patched grub into your system is via http://tinyurl.com/mpgrub/inst_i386.sh as described in the README.

The recently updated multipath-tools 0.4.8-14 support disks >2TB and also work with kernels more recent then Debian's 2.6.26.

New upstream versions of virtinst and virt-manager are available via Debian's experimental distribution. All the bugfixes we carried as patches have been applied upstream by Cole Robinson, which is great. New features include disk- and newtork-I/O graphs and direct support for installing paravirtualized Debian Lenny Xen Guests via:

   virt-install -n xenfoo1 -r 96 --disk path=/path/to/file,device=disk,size=1 --location=http://ftp.nl.debian.org/debian/dists/testing

While Debian's Iceweasel ships a nice search engine for Debian packages it doesn't have one for the bug tracking system (which I tend to use more frequently). So I stitched together a simple search engine following the Opensearch specificaton. To install it in Firefox/Iceweasel go here.

sapgui-package allows you to build a Debian package out of the SAP GUI for Java by simply running:

make-sgpkg PlatinGUI-Linux-710r7.jar

You can then install the resulting Debian package via:

dpkg -i sapgui_7.10rev7_i386.deb

The 'guistart' and 'guilogon' binaries are available as 'sapguistart' and 'sapguilogon' in your path.

Once a new release comes out simply repeat the above steps and all users on your system(s) will enjoy the new version. This has been tested with 7.10r6 and 7.10r7.

The source code is available via:

git clone http://honk.sigxcpu.org/git/sapgui-package.git/

An ITP has already been filed.

When following Debian changelogs (e.g. via apt-listchanges or update-manager) one often wonders what an actual commit messages actually means or how a bug got actually fixed. Currently finding this information is cumbersome:

• Find out the version control system of the package, either via the PTS or via debian/control.
• Browse it's VCSs revision history either by using the web interface or by cloning the repository.
• Try to locate the correct commit from it's commit message. Hopefully it's the same as in the changelog and hopefully it mentions the bug number - otherwise: tough luck!

However this process can be automated if a package uses the following format for changelog entries:

* [commitd] changelog message

e.g.:

* [fed3f3d] fixed segfault during daemon startup (Closes: #7005180)

then you can use Cl2vcs to locate the exact commit that corressponds to that changelog entry. Cl2vcs uses the PTS to parse the packages Vcs-Browser URL to create a link back to the commit.

If you maintian your package in Git, creating this type of changelog entry is simple: You can tell git-dch to include N digits of the commit's SHA1 (the commit id) using the --id-length option, e.g.:

git-dch --release --auto --id-length=7

This way git-dch will include the first 7 digits of the commit's SHA1 (this options can of course also be specified in gbp.conf). Packages already using this are e.g. libvirt and calendarserver.

Note: a possibly useful extension of the above format would be:

 * [commitid1,commitid2,commitid3] changelog message 

so several commits can make up a changelog entry. For Subversion this would then look like:

 * [r123,r125.r127] cleanup whitespace errors

The nice thing about d-i is that it's even more flexible then one thinks. Usually an autopartitioning recipe looks like:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
filesystem{ ext3 }
mountpoint{ / } .

But what if you want a to set a filesystem label. That's easy:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
label{ root }
filesystem{ ext3 }
mountpoint{ / } .

This sets the label root on the ext3 filesystem that will be mounted as /. You can set any variable here and the text between the curly braces ends up in $<partition>/<var> ready for partman to pick it up. See partman-auto-recipe for the full details.

The label allows to mount the filesystem by it's label instead of it's device name, so /etc/fstab looks like:

 LABEL=root /     ext3  defaults,errors=remount-ro,relatime 0 1
 LABEL=home /home ext3  defaults,relatime,user_xattr        0 2

Very handy if you insert partitions later which would change the numbering or work with partimage snapshots that should work on PATA and SATA. However this currently isn't supported by d-i since it can only create filesystem labels but can't write them to /etc/fstab. With the patches from #488321 and #488322 this can be done with:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
label{ root }
labeled_mount{ }
filesystem{ ext3 }
mountpoint{ / } .

You also need to fixup mount since it will otherwise segfault during d-i's initial deboostrap run (#488312). Now support for labels on swap devides needs to be added to d-i.

Nothing earth shaking in this release:

• [bf8738f] add --git-tag-only (Closes: #485114)
• [b06bcf0] document git-import-dscs
• [c1deeb2] add epoch to dch call (Closes: #483718)
• [6640ac7] Fix typo (Closes: #484243)

''--git-tag-only'' allows you to create a tag without having to build the whole project again - useful for large packages. You can either clone from:

git clone http://honk.sigxcpu.org/git/git-buildpackage.git/

or fetch the package from the Debian Archive once it went through the new queue. The updated documentation is available here