Le weblog entièrement nu

Just an update about sgeps, because it seems to have made a small stir (which is more than I expected).

• Yes, I know about emacs foo.gpg. Admittedly I found out while I was “developing” sgeps, but I kept on my track anyway. The real reason was that I was having fun, but I could also mention that sgeps doesn't store data unencrypted on disk, not even temporarily. I'm not sure about vim foo.gpg. (Update: Joey Hess telle me it does the right thing.) Anyway, I don't want to fire up an editor (or switch to an already opened one) just to get a password.
• I had also found out about pwman too. My script started as pwman.pl but it was renamed later. I like the simplicity of sgeps better, especially the lack of any UI besides the CLI, but pwman is probably good in its own way, but it doesn't fit my usage pattern.
• It seems the Gentoo people don't share my qualms about making very small packages, and apparently sgeps is now packaged for Gentoo Linux.
• Mehdi Dogguy already contributed suggestions (including better error handling) and even a patch implementing sgeps --delete. Thanks to him!
• An anonymous commenter suggests that sgeps should be able to store notes as well as passwords. That wasn't a requirement I initially had, but I won't reject the patch if it comes… He also argues that it should be able to push the password into the X11 paste buffer. Again, why not, if it doesn't break anything.

I've been accumulating passwords recently. More than I could remember all in one go. I even got worried that I'd locked myself out of one of my own servers recently. So I decided to play it safe and store the passwords somewhere. However, plain text files, even on an encrypted disk, aren't the most secure plan, so I tried to go shopping for a tool that would store passwords in encrypted files and wouldn't be too inconvenient to use. I found a few (pwsafe, keysafe, keepassx, yapet and so on), but they all seem to be either graphical or using their own encryption scheme and (presumably) storage format. Being rather nervous about long-term data accessibility, I thus decided to roll my own script, that would be as simple as possible while doing just the required amount of work.

I call the result sgeps, for “simple GnuPG-encrypted password store”. Note the initial s: I didn't invent any wheel.

• Data model: a list of key/value pairs (each being a string);
• Storage: serialisation using Perl's built-in Storable module;
• Encryption: the serialised data is GnuPG-encrypted;
• Hopefully secure: no password stored in plaintext files at any time.

The code comments should give an idea of the capabilities of sgeps:

  # Usage: sgeps --create                     to create the store
  #        sgeps --add <key>                  to add a key/value to the store
  #        sgeps --list                       to list existing keys
  #        sgeps --add --overwrite <key>      to replace a key/value

I trust both GnuPG and Perl to stay around for quite some time, so hopefully I can forget even the passwords I use very rarely and still be able to recover them later. Even in the event of a hard drive dying, since the encrypted store can now be backed up and burnt on DVDs. I “just” need to be careful about my GnuPG key.

Interested people can grab sgeps from its Bazaar branch with bzr branch http://bzr.debian.org/users/lolando/sgeps/trunk/ or browse it on the web interface. I don't plan to make a Debian package for a hundred lines of Perl code, but if anyone is interested, feel free to include it in an existing package (moreutils maybe?).

This month hasn't seen many big changes happen in FusionForge. Notable improvements include an initial search engine for Word files, fixes to the automated builds and tests, and lots of bugfixes.

The biggest news is probably the start of the Coclico project, an initiative bringing together developers and users of several existing forges in order to reduce the gap (and ideally unify the codebase across the forks) and work together in some fields where cooperation is important. Subjects include a generalisation of the current identity/permission/authentication models and systems, data exchange and migration, interoperability, integration of agile development methods inside the forge, and better integration with the desktop applications such as IDEs. The participants include NovaForge, Codendi, and of course FusionForge. The project only officially started early this month, but we hope to be able to demonstrate results soon.

Business as usual apart from that.

Here's another round of the semi-regular bulletin about FusionForge.

First item: FusionForge 4.8.1 was released this week. It's not exactly an important update, but the 4.8 branch had been accumulating fixes over time and we felt that it would be good to push these fixes out. If you don't encounter particular problems, there's probably no need to upgrade in a hurry.

A follow-up for the rewrite of the SCM subsystem: I now consider the Bazaar and Git plugins complete. The missing part, in both cases, was a proper integration of a repository browser and the collection of commit statistics; since one of my clients wants to use Bazaar and another one wants Git, both features have been completed recently. The code still lives on a branch based off 4.8 (for people who need a 4.8-based instance), but it's also been pushed into trunk so the next release will have it natively.

Another branch I've been working on (for clients) was about making the Mediawiki plugin able to handle one wiki per project rather than one shared wiki. This is now possible with yet another 4.8-based branch, where the wiki creation is completely automated. A nice feature is that the FusionForge identification is used as a basis for Mediawiki, with different groups on the wiki depending on project membership and role in the forge. That allows specifying wiki permissions in a simple way, for instance to say that only project members can create new pages, authenticated users can only edit existing pages, and non-authenticated users are read-only. This code will be pushed to trunk in the coming weeks.

Thanks to Alain Peyrat, we now have a buildbot running Hudson for unit tests and a few other things. The coverage isn't complete yet, but we hope to increase it as time passes. It's already proven useful, by ensuring at least correctness of PHP syntax, encoding and line-endings.

I think that's about it for this time. Business as usual.

I have a problem with Debconf, but it's far from specific to Debconf. If anything, it's specific to me. I have a short term memory for people, and I tend to forget faces, names and nicknames. And their mappings. Which means that people I haven't seen in a few years tend to get blank looks, puzzled frowns and/or awkward greetings from me. Sometimes I know the face but it takes me a while to put a name on it, sometimes a nickname pops up, sometimes just a feeling that I've met a person for such-and-such occasion in such-and-such place. Sometimes I get it all rushing back at me after a few minutes.

This has happened a few times already at this Debconf, and is likely to happen again, except for people who'd be hard to forget (colourful shirts, memorable hairstyles and exuberant personalities tend to stick in my memory). This is bothering me as much as you, and I would like to apologise to all people I'm likely to offend. Sorry, all of you. Whoever you are.

Welcome to this month's FusionForge news batch.

I did a presentation of FusionForge at the Libre Software Meeting (Rencontres Mondiales du Logiciel Libre, in French) earlier this month, to explain where we come from and where we hope to go. Many people attended despite the talk being early on the morning following the formal dinner, and the questions showed interest, which is encouraging for the project as a whole. I don't think the talk has been recorded, but the summary and slides are available on the RMLL website.

The big news, though, is that I'm currently at the Debian Conference, Debconf, and that I also attended Debcamp before that. Debcamp is a very productive get-together of developers from all across Debian, and I took the opportunity to get help from them. I spent the first few days refactoring some of the code that was duplicated between the CVS and Subversion plugins, and the result is that version control plugins are now much easier to implement. Case in point: I managed to get the attention of a few users of other tools, and since they only had to implement small specific parts, we now have almost complete plugins for Bazaar, Darcs and Git, and Mercurial will probably follow. CPOLD was done too, but mostly as a proof of concept. If you're around, come and see me, we'll finish the support for your favourite tool together. Or even start it (I haven't started on Arch and Monotone for lack of perceived interest, but I'm quite open to these tools too). In both cases, I promise it won't take long.

This code currently only lives on a temporary branch based off FusionForge 4.8, but I'll port that to trunk and commit it in the coming weeks.

La dixième conférence Debian, cette année à Cáceres (Espagne), commence officiellement demain. Moi j'y suis arrivé depuis quelques jours déjà, après trois jours de moto avec deux membres de la cabale italienne (qui essaient d'infiltrer la française, d'ailleurs).

Donc ça fait quelques jours que je suis au Debcamp, le rassemblement des geeks Debian qui viennent pour travailler ensemble. Et même pour des gens habitués au mail et aux messageries instantanées, se retrouver autour d'une table constitue un gain énorme en productivité. Et ça marche bien : bientôt sur vos écrans, une annonce sur ce que j'ai fait de mon temps, mais visiblement de nombreux pans de Debian ont pas mal progressé aussi. Et ça n'empêche pas de boire une bière le soir, voire de jouer à des jeux qui nous font passer pour des malades.

Debcamp, c'était une centaine de personnes. La Debconf elle-même est prévue pour accueillir environ le triple. Donc une centaine de personnes sont arrivées aujourd'hui, et encore autant sont prévues pour demain. L'ambiance change du tout au tout, et l'énergie est presque palpable dans l'air. Ça parle un mélange de toutes les langues (en changeant au milieu des phrases quand un nouveau arrive dans une conversation), ça se retrouve après des années même s'il ne s'est écoulé que quelques jours depuis la dernière conversation électronique, ça s'échange des idées, ça les met en place, des trucs géniaux apparaissent en une heure, et les conférences elles-mêmes n'ont même pas encore commencé. Donc ça va être encore plus concentré quand tout ça devra se faire en-dehors des présentations.

Ma dernière Debconf remonte à la Debconf 6, et je me rappelle maintenant pourquoi je regrettais de ne pas avoir assisté aux suivantes.

Quick heads-up about FusionForge. The main news of course is that 4.8 has been released upstream (and uploaded to Debian experimental). We'll keep fixing major bugs on that branch of course, but our focus is now on trunk.

We're finding it tedious to deal with legacy code, so one of the goals we have now is to clean up the codebase to bring it more in line with good practice. That's going to take some time, though, because there's lots of code. Some of that code, however, seems unused (it's been broken for some time without anyone complaining), so it's likely that we'll deprecate and/or remove bits of code unless someone steps forward to maintain it (or at least bring it into shape). In particular, we're looking at the MySQL support (which hasn't been maintained for years) and some of the old visual themes which are going to require some work to keep working with some changes we're planning in the way the pages are displayed.

This should make maintenance easier for the implementation or integration of new features down the line. Which will be the subject of a future post, when a currently undercover French Forge Cabal actually starts producing concrete results. Watch this space.

It's been too long since the last blog post about FusionForge, but we haven't sat on our hands and lots of things happened. This is a brief summary:

• About 900 commits in total over the trunk and the two currently active branches.
• Three minor bugfix versions were released, and the currently stable version is 4.7.3.
• A branch has been started to stabilise the code in prevision for the upcoming 4.8 release. Two release candidates have been published already, the final version should happen in the coming weeks.
• Feature-wise, 4.8 will add a tag cloud for project classification, better reporting for downloads, and a new version of the phpwiki plugin. It will also include the beginnings of an automated test suite.
• 4.7.3 is in Debian unstable, 4.7.2 in testing, 4.8rc1 is in experimental. Don't be fooled by the packages still being called gforge, it's just that they haven't been renamed to fusionforge yet.

Not bad for a start, eh? But we've also kept true to our promise and started merging lots of things from various local branches and patches. Among what's been committed to trunk so far are the following features, coming from various existing or upcoming instances of GForge/FusionForge.

• A script for migrating data from an existing GForge AS instance to FusionForge. It's not a turn-key solution, and it requires some manual intervention for working, but it does most of the job.
• New extratabs plugin, allowing project administrators to define new tabs for their projects, pointing at arbitrary URLs.
• New projectlabels plugin, allowing site administrators to define labels as chunks of arbitrary HTML and stick that HTML onto some projects (useful for "project of the month" stuff).
• Refreshed globalsearch plugin, allowing cross-forge project searches.
• Command-line data injectors to populate a FusionForge database with data coming from another system.
• A more consistent automated self-test suite using Selenium.

Other great things are afoot, and they'll be described here in due time.

Quand j'étais petit, mon papy me racontait l'histoire du type qui était mort à 1000 ans et celle de celui né à 40 ans. Et ça me faisait beaucoup rire.

Eh ben aujourd'hui, c'est pas pour me vanter, mais j'ai à la fois 20 ans, 40 ans et 100000 ans. Et 32. Et c'est pas demain la veille que ça va se reproduire, donc fiesta !

(Le monde se divise en 10 catégories : ceux qui comprennent le binaire et ceux qui se creusent la tête.)