Le weblog entièrement nu

This is getting old news, and others have blogged about them before I did, but here's my summary of the recent activity in and around FusionForge.

The early February meeting was a success, and gathered about twenty people on the first day and a dozen or so on the second day (not planned initially). My impression is that there was a healthy mix of FusionForge hackers, FusionForge users, and people from other forge communities (Codendi, NovaForge, and even one representative from nFORGE, from South Korea). I'm not going to repeat all that was said then, especially since the proceedings are online. Beyond the technical points, I'll just advertise PlanetForge again, since everyone present agreed we had lots to share and that this site would be a good and relatively neutral place. If you're into forges, I recommend joining us in that community.

On the purely FusionForge front, news are good too. Most of the major pieces we want to see in the next release (which is probably going to be called 5.0) are in place. The last blocker we had was the merge of the rework of the default theme for better accessibility and easier maintenance and customisability (most of the theming now happens in CSS). This merge has been completed this week, and although there are still a few rough edges, it's mostly done. We'll try to fix most of these rough edges soonish, then start a stabilisation branch towards 5.0, so more experimental work can start again on trunk. For the impatient and the curious, there's a list of new features on the fusionforge.org homepage, and the site is now running code from trunk.

Of course, we're eager to get testers for that, which is why I prepared snapshot packages. They are currently stuck in NEW on their way to the official Debian experimental repository due to the renaming of the source package and the introduction of plenty of new binary packages, but they can already be obtained from my unofficial repository at people.debian.org. The packages are built for Debian unstable, but they seem to run just fine on Lenny if you grab mediawiki from backports.org (only required for the Mediawiki plugin, of course), and libnusoap-php and php-htmlpurifier from Debian testing (they don't drag any extra dependencies).

I'll end this note by reminding people of the announcement I did three months ago: as of this week, Debian Etch is no longer officially supported security-wise, and so neither is GForge 4.5. As far as I know, I was the last person doing that, and my incentives have gone away on the day Etch ceased to be supported, since it was also the day the Adullact forge finally migrated from Etch with GForge 4.5 to Lenny with FusionForge 4.8. If you're still using 4.5, well… I think you should be aware of that.

That more or less wraps it up for now. The next announcement is likely to be about a release candidate…

News is slow this month on the FusionForge development front. We're all busy gathering all the things that we want to go into the next release, but there's no big news from the code. However, there is something of interest.

You may have heard about the Coclico project, which is an initiative aiming at collaboration and convergence between several forge engines, most notably FusionForge, Codendi and Novaforge. That project was started last October, and it holds regular meetings with its members. The next meeting is scheduled for the 2nd of February in Paris, and we thought we could host an open meeting on the 3rd for non-Coclico members, a bit like the forge meeting we had last year (which is when FusionForge was officially born), but with an emphasis on what Coclico did so far. Since most of the FusionForge hackers are in Western Europe, and several are in Paris (especially if we add those who go to Paris for the Coclico meeting), we thought it would also be a good opportunity to gather for a technical and social meeting.

It seems the Coclico open session didn't generate much interest this time (at least, it hasn't so far), so I proposed to hijack the room for this FusionForge meeting, and I didn't hear any objections. I have several themes I'd like to discuss with people, and possibly start implementing during that day:

• database maintenance and schema: unification of the upgrade scripts (including for plugins), cleanup of obsolete stuff, addition of missing constraints, and so on;
• configuration system: my initial prototype didn't raise many objections (at least in its scope), now what to do with the next steps?
• packaging and installation system: what needs to be done to keep the three ways of installation (manual, *.deb, *.rpm) in sync with as little work as possible?
• permissions system: clarification of what happens currently, ideas for evolution;
• plugins and interaction with external software: do we lack stuff that would make this easier?
• roadmap, long-term plans, this sort of things;
• other things that users may want to discuss with hackers?
• possibly drink a beer or two;

…and so on. These are in no way specific to FusionForge, and in fact I think it would be great if hackers/users of other forges were present, because we could benefit a great deal from their experience and plans. But if we find ourselves amongst FF people only, I think these would be good to discuss, possibly write some code for, and go home with a clearer picture of where our efforts should focus in the near future.

I'd therefore like to invite interested people to mark the 3rd of February on their agendas. The meeting will take place in Issy-les-Moulineaux (near Paris, within reach of the tube). If you're interested, please get in touch with us (#FusionForge on the FreeNode IRC network, or the fusionforge-general mailing-list), so we can have a rough estimate of how many people to expect. The meeting room is provided by France Télécom, and they're probably going to need numbers if not names. Further details will be announced when known.

I normally don't relay security announces for GForge or FusionForge on this blog, but I will make an exception this time: Alain Peyrat found several places in the code with insufficient input sanitizing, which can cause cross-site scripting vulnerabilities (CVE-2009-3303). It's been fixed in the 4.7 and 4.8 branches as well as the trunk of FusionForge (and in Debian Sid and Squeeze), and updated Debian packages for GForge 4.5 and 4.7rc2 have been released for users of the Etch and Lenny distributions.

The reason I make an exception for announcing this here is to remind people that I appear to be the only one maintaining code for GForge 4.5. I do that for two reasons: first, because I'm the maintainer of the package in Debian, and Debian Etch has GForge 4.5, and Etch is supported for security fixes; second, because I also admin/maintain an instance for a client of mine, so I need to backport the fixes anyway, and making them public is no bother. Both of these reasons are going to vanish sometime in the not too distant future: security support for Etch will end in February, 2010, and I hope to have migrated my client's forge to FusionForge 4.8 by then too. A direct consequence is that I will probably stop maintenance for GForge 4.5 in the coming months (at least I'll stop doing it in my free time).

So if you're still using GForge 4.5, you should really consider upgrading to something supported, either GForge AS (free download from the GForge Group) or FusionForge (free as in Free Software). Both have an upgrade path. Obviously I think FusionForge is a better choice, but my position is probably biased.

This month hasn't seen many big changes happen in FusionForge. Notable improvements include an initial search engine for Word files, fixes to the automated builds and tests, and lots of bugfixes.

The biggest news is probably the start of the Coclico project, an initiative bringing together developers and users of several existing forges in order to reduce the gap (and ideally unify the codebase across the forks) and work together in some fields where cooperation is important. Subjects include a generalisation of the current identity/permission/authentication models and systems, data exchange and migration, interoperability, integration of agile development methods inside the forge, and better integration with the desktop applications such as IDEs. The participants include NovaForge, Codendi, and of course FusionForge. The project only officially started early this month, but we hope to be able to demonstrate results soon.

Business as usual apart from that.

Here's another round of the semi-regular bulletin about FusionForge.

First item: FusionForge 4.8.1 was released this week. It's not exactly an important update, but the 4.8 branch had been accumulating fixes over time and we felt that it would be good to push these fixes out. If you don't encounter particular problems, there's probably no need to upgrade in a hurry.

A follow-up for the rewrite of the SCM subsystem: I now consider the Bazaar and Git plugins complete. The missing part, in both cases, was a proper integration of a repository browser and the collection of commit statistics; since one of my clients wants to use Bazaar and another one wants Git, both features have been completed recently. The code still lives on a branch based off 4.8 (for people who need a 4.8-based instance), but it's also been pushed into trunk so the next release will have it natively.

Another branch I've been working on (for clients) was about making the Mediawiki plugin able to handle one wiki per project rather than one shared wiki. This is now possible with yet another 4.8-based branch, where the wiki creation is completely automated. A nice feature is that the FusionForge identification is used as a basis for Mediawiki, with different groups on the wiki depending on project membership and role in the forge. That allows specifying wiki permissions in a simple way, for instance to say that only project members can create new pages, authenticated users can only edit existing pages, and non-authenticated users are read-only. This code will be pushed to trunk in the coming weeks.

Thanks to Alain Peyrat, we now have a buildbot running Hudson for unit tests and a few other things. The coverage isn't complete yet, but we hope to increase it as time passes. It's already proven useful, by ensuring at least correctness of PHP syntax, encoding and line-endings.

I think that's about it for this time. Business as usual.

Welcome to this month's FusionForge news batch.

I did a presentation of FusionForge at the Libre Software Meeting (Rencontres Mondiales du Logiciel Libre, in French) earlier this month, to explain where we come from and where we hope to go. Many people attended despite the talk being early on the morning following the formal dinner, and the questions showed interest, which is encouraging for the project as a whole. I don't think the talk has been recorded, but the summary and slides are available on the RMLL website.

The big news, though, is that I'm currently at the Debian Conference, Debconf, and that I also attended Debcamp before that. Debcamp is a very productive get-together of developers from all across Debian, and I took the opportunity to get help from them. I spent the first few days refactoring some of the code that was duplicated between the CVS and Subversion plugins, and the result is that version control plugins are now much easier to implement. Case in point: I managed to get the attention of a few users of other tools, and since they only had to implement small specific parts, we now have almost complete plugins for Bazaar, Darcs and Git, and Mercurial will probably follow. CPOLD was done too, but mostly as a proof of concept. If you're around, come and see me, we'll finish the support for your favourite tool together. Or even start it (I haven't started on Arch and Monotone for lack of perceived interest, but I'm quite open to these tools too). In both cases, I promise it won't take long.

This code currently only lives on a temporary branch based off FusionForge 4.8, but I'll port that to trunk and commit it in the coming weeks.

Quick heads-up about FusionForge. The main news of course is that 4.8 has been released upstream (and uploaded to Debian experimental). We'll keep fixing major bugs on that branch of course, but our focus is now on trunk.

We're finding it tedious to deal with legacy code, so one of the goals we have now is to clean up the codebase to bring it more in line with good practice. That's going to take some time, though, because there's lots of code. Some of that code, however, seems unused (it's been broken for some time without anyone complaining), so it's likely that we'll deprecate and/or remove bits of code unless someone steps forward to maintain it (or at least bring it into shape). In particular, we're looking at the MySQL support (which hasn't been maintained for years) and some of the old visual themes which are going to require some work to keep working with some changes we're planning in the way the pages are displayed.

This should make maintenance easier for the implementation or integration of new features down the line. Which will be the subject of a future post, when a currently undercover French Forge Cabal actually starts producing concrete results. Watch this space.

It's been too long since the last blog post about FusionForge, but we haven't sat on our hands and lots of things happened. This is a brief summary:

• About 900 commits in total over the trunk and the two currently active branches.
• Three minor bugfix versions were released, and the currently stable version is 4.7.3.
• A branch has been started to stabilise the code in prevision for the upcoming 4.8 release. Two release candidates have been published already, the final version should happen in the coming weeks.
• Feature-wise, 4.8 will add a tag cloud for project classification, better reporting for downloads, and a new version of the phpwiki plugin. It will also include the beginnings of an automated test suite.
• 4.7.3 is in Debian unstable, 4.7.2 in testing, 4.8rc1 is in experimental. Don't be fooled by the packages still being called gforge, it's just that they haven't been renamed to fusionforge yet.

Not bad for a start, eh? But we've also kept true to our promise and started merging lots of things from various local branches and patches. Among what's been committed to trunk so far are the following features, coming from various existing or upcoming instances of GForge/FusionForge.

• A script for migrating data from an existing GForge AS instance to FusionForge. It's not a turn-key solution, and it requires some manual intervention for working, but it does most of the job.
• New extratabs plugin, allowing project administrators to define new tabs for their projects, pointing at arbitrary URLs.
• New projectlabels plugin, allowing site administrators to define labels as chunks of arbitrary HTML and stick that HTML onto some projects (useful for "project of the month" stuff).
• Refreshed globalsearch plugin, allowing cross-forge project searches.
• Command-line data injectors to populate a FusionForge database with data coming from another system.
• A more consistent automated self-test suite using Selenium.

Other great things are afoot, and they'll be described here in due time.

Hot from the oven: FusionForge 4.7 was just released. The release notes follow. If you have local enhancements based on a previous version of GForge, now is the time to port them to the 4.7 codebase and submit them, so they can be merged in time for the next version!

Release notes for FusionForge 4.7

This is the first public release of FusionForge. FusionForge is based on GForge, and started as an identical copy, with only a name change to avoid confusion with the proprietary versions of GForge (known as GForge Advanced Server or GForge AS). As such, it benefits from mature code and known-good infrastructure, and builds on it for the future.

This 4.7 release is focused on bringing the recent evolutions out to the community in an official stable release. This should provide a solid base as a starting point for community-based development, making it easier for enhancements to be maintained. The FusionForge name was chosen to reflect this: this is a community effort, and we hope to hear about your improvements. Contributing these improvements would make their future long-term maintenance easier for everyone.

Major changes since previous versions (of GForge) include:

• Support for PHP5.
• Support for PostgreSQL 8.x.
• Translations are now managed by gettext.
• Support for several configurations running on the same code.
• Improved security, no need for PHP register_globals.
• Available as full install CD.
• New wiki plugins (using MediaWiki or phpWiki).
• New online_help plugin.
• New phpwebcalendar plugin.
• New project hierarchy plugin.

Things to keep in mind when installing:

• FusionForge is based on GForge, and the renaming is quite recent. So the code still contains lots of references to GForge. This will be fixed as time passes.
• Full text search using the primitives provided by PostgreSQL 8.3 isn't quite complete yet.
• Not all plugins are packaged for all distributions yet.

Things to keep in mind when upgrading:

• Since internationalisation was changed from a hand-made system to standard gettext, locally customised translations will no longer override standard ones. This will be addressed in a future release.

For more up-to-date information, please visit http://fusionforge.org/ or http://fusionforge.fusionforge.org/ -- you can even join us on IRC from there!

-- The FusionForge development team

(Ceci est juste un résumé en français de l'annonce complète en anglais.)

Au début, il y avait SourceForge, un logiciel libre développé par une boîte qui s'appelait (à l'époque) VA Linux Systems. Ce logiciel était utilisé par plein de gens, et développé de manière plus ou moins collaborative. Un jour, VA Linux Systems a décidé que les nouvelles versions de SourceForge (à partir de la version 3) ne seraient plus libres (et qu'elles s'appelleraient Sourceforge Enterprise Edition). Plusieurs personnes sont donc parties avec la dernière version libre (celle qui aurait pu devenir la version 2.6), avec dans l'idée de maintenir ce code.

Il y a donc eu GForge, un logiciel libre développé entre autres par une boîte qui s'appelle le GForge Group. Ce logiciel était utilisé par plein de gens, et développé de manière collaborative, notamment par votre serviteur. Un jour, le GForge Group a décidé que les nouvelles versions de GForge (à partir de la version 5) ne seraient plus libres (et qu'elles s'appelleraient GForge Advanced Server). Mais comme l'hébergement du projet était maintenu ouvert, les versions 4.x ont pu être maintenues de manière libre et collaborative.

Pendant ce temps, l'appellation "GForge Advanced Server" s'est faite de plus en plus rare, et des noms plus équivoques sont apparus : "GForge AS", "GForge Express Edition" (ou "GForge EE") et, plus récemment, "GForge Community Edition", aucun de ces logiciels n'étant libre (même si certains sont disponibles en téléchargement gratuit et qu'on peut même jeter un œil aux sources).

Comme cette ambiguïté prêtait à confusion (certains utilisateurs ont installé une version propriétaire en croyant installer un logiciel libre), les principaux développeurs de la version libre de GForge (Christian Bayle, Alain Peyrat et moi-même) ont décidé de... partir avec le code, et de renommer le projet de développement et de maintenance de ce code libre.

Le résultat s'appelle FusionForge, et il est hébergé sur FusionForge.org. Nous avons plein d'idées, mais un des buts majeurs (qui a justifié le nom) est que nous allons chercher à réintégrer dans le code commun des fonctionnalités qui ont été développées localement par des utilisateurs mais non publiées. Ça tombe bien, nous sommes déjà en relation avec plusieurs de ces utilisateurs institutionnels qui semblent intéressés par cette convergence.