/srv/irclogs.ubuntu.com/2013/07/03/#ubuntu-devel.txt

=== luist_ is now known as luist
=== mnepton is now known as mneptok
=== LordOfTime is now known as LordOfTime|EC2
=== TheMuso` is now known as TheMuso
=== iulian is now known as Guest48666
=== _salem is now known as salem_
adiejamesh :O02:29
jameshhmm?02:29
adieI had a question, and I was referred to you to ask about it, you got a minute?02:30
jameshsure02:30
adieOkay ^_^02:31
adieI am working on a simple script for IRC client hexchat which keeps track of unread message count in the unity launcher count02:31
adiesimple script: http://pastebin.com/GigD0P4t02:32
adieMy issue is that it works completely fine the first time, but I am unable to unload and reload the script; a reload causes an error, and just breaks02:32
adieI have to restart hexchat commpletely to reload the script02:32
adiedo you know of anything that I need to/can reset that would allow me to reload the script without killing the hexchat?02:32
jameshwhat is the error?02:33
adieupon unloading and reloading the script, I get this error: http://pastebin.com/raw.php?i=dzSafTK402:34
adieIf I were to guess, it would have something to do with hexchat's unnity launcher icon having already been hooked once or something, and it crashes if you try to do it a second time02:35
adienot sure though02:35
jameshthat is a bit weird.02:35
adieAdditional, when I unload the script the last unity count number remains on the icon02:36
jameshI don't have much experience with xchat/hexchat's Python support, but when you say you are reloading it, does that mean the entire Python runtime, or just the script02:36
jamesh?02:36
adiejust the script I think02:36
jameshit seems a bit surprising that those modules would be initialised a second time then02:37
jameshi.e. after the first time you import gi.repository.Unity, future imports should just pick the module object from sys.modules['gi.repository.Unity']02:40
adiehm02:42
adiebrb a second02:42
jameshalso, it isn't obvious how your script would know when it is being unloaded, which might indicate why the read count doesn't change then.02:51
adiehm.02:52
* adie huggles02:53
adieyeah jamesh, I guess I misunderstood what the issue was02:57
adieI thought it was an issue with the unity launcher API, but apparently I cant "from gi.repository import Unity, Gio, GObject, Dbusmenu" twice for whatever reason02:57
adiestrippingn it down to just importinng those modules prevents it fromm loading a second time02:58
adieso I guess I was wastinng your time :< sorry03:00
jameshadie: it certainly sounds like hexchat is doing something weird when you try to reload your script then.03:05
=== Kk2 is now known as kk2
=== salem_ is now known as _salem
=== udienz__ is now known as udienz
pittiinfinity: my recipe? I'm using mk-sbuild + apt-cacher-ng + some symlinks to /tmp in /var/lib/schroot (I have /tmp on tmpfs), nothing that fancy04:45
pittiinfinity: but downloading sbuild schroots does sound like a nice idea04:45
infinitypitti: Oh, it wasn't you who was using distro chroots, then.  Hrm.  I wonder who that was.04:45
=== halfie|zzz is now known as halfie
sarnoldinfinity: security team has distro schroots...04:48
infinitysarnold: Backed by the LP tarballs, I mean.04:48
sarnoldinfinity: is that tarballs of the distros pre-installed?04:49
infinitysarnold: No, the tarballs used by LP buildds.04:49
infinitysarnold: eg: https://api.launchpad.net/1.0/ubuntu/raring/amd6404:49
TheMusoc05:43
* ScottK looks at lamont` and wonders what happened to the weekend.06:01
rsalvetistgraber: xnox: ogra_: slangasek: seems there's sort of a regression with the latest upstart06:11
rsalvetiofonod was started fine with mako before, and upstart-file-bridge is also running just fine06:12
rsalvetiafter update, ofonod is never started (it works fine with maguro though, might be a race somehow), and upstart-file-bridge starts but dies later on06:12
rsalvetifrom logs: upstart-file-bridge:string.c:396: Assertion failed in nih_str_split: str != NULL06:17
=== geser_ is now known as geser
dholbachgood morning06:42
=== Guest48666 is now known as iulian
=== elmo__ is now known as elmo
xnoxrsalveti: is it reproducible with a grouper device?08:20
seb128pitti, hey, could you put https://code.launchpad.net/~peter.ahlgren/ubuntu/raring/obconf/fix-for-1179969/+merge/170065 as work in progress/needs work/rejected?08:20
xnoxrsalveti: as a work around it should be possible to change upstart job (with an override file) to run upstart-file-bridge in foreground (remove expect stanzas & --daemon)08:21
pittiseb128: sounds like "rejected", done08:26
seb128pitti, danke08:26
ogra_rsalveti, bah08:26
* Laney just got a crash report for u-f-b in dist-upgrade ;-)08:27
infinityYeah, lots of us did, there are a few dupe bugs for that already.08:27
Laneyyep, just checked08:27
LaneySo probably not touch specific.08:28
infinityxnox: https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/119721408:29
ubottuLaunchpad bug 1197214 in upstart (Ubuntu) "upstart-file-bridge crashed with SIGABRT in raise()" [Undecided,Confirmed]08:29
jodhinfinity: just fixed it08:30
infinityjodh: That was quick.  Thanks.08:30
jodhinfinity: well, it's fixed upstream so next upload will include it.08:30
seb128is that worth an upload to backport it?08:31
xnoxjodh: infinity: i have a workaround. On my system i was running upstart-file-bridge in foreground, switching to daemon triggered the bug.08:32
infinityI suspect it's worth someone pushing an upload soon, yeah.08:32
xnoxseb128: infinity: I'll make one, after checking jodh's fix. I did TIL.08:32
infinityxnox: Thanks.08:32
seb128xnox, thanks08:32
jodhxnox: https://code.launchpad.net/~jamesodhunt/upstart/bug-1197225/+merge/17276208:32
* xnox runs all of my bridges in foreground08:41
seb128xnox, just backport that fix and install the update :p08:42
xnoxseb128: yeah, merged upstream, tested properly, now running full test-suite.... uploading soon.08:42
=== yofel_ is now known as yofel
xnoxseb128: infinity: uploaded. Last night the delay between upload and migration to release was... 5 hours. I blame latency in reverse-testing of the $world via autopkgtests.08:48
seb128xnox, thanks08:48
xnox(as it only takes 30minutes to build upstart on armhf)08:49
infinityIt's not hugely urgent, just an annoying apport dialog.  But I could force it to skip rdep tests.08:49
seb128Laney, stgraber, jodh: do you have an opinion on https://code.launchpad.net/~ted/gnome-session/upstart-unity/+merge/172664 ?09:09
Laneynot really; does it work?09:10
seb128Laney, I didn't try yet, it was on my inbox this morning09:11
seb128I didn't follow up the details on what processes are upstart started nowadays09:11
Laneyand the gnome-session-foo commands continue to work?09:13
LaneyIn principle it seems ok to me09:13
LaneyI think the user session jobs were otherwise jiggled to make this work09:13
seb128let me play with it here, I was mostly listing it for comments or in case you guys knew about any gotcha there09:13
Laneyunity's one will need patching too but I guess there will eb an MP for that09:13
Laneyno, lies, it will not09:14
Laneygrr, not getting applications returned in the home lens09:17
cjwatsonxnox: No, it wasn't genuine latency, it was false latency due to a known bug with virtual package handling09:20
cjwatsonxnox: I noticed at some point and forced it09:20
seb128Laney, bug mhr3 about it on #ubuntu-unity please09:20
cjwatsonxnox: The actual autopkgtest only took a few minutes09:20
cjwatsonxnox: jibel is working on the underlying bug09:20
seb128Laney, he will likely want a bustle log09:20
xnoxcjwatson: interesting. thanks.09:20
Laneysecond09:20
Laneyoh wow, my PC hard locked09:22
jibelxnox, I'm testing a fix that will land today.09:23
tseliotpitti: sorry yesterday I forgot to ask you to approve nvidia-settings-319-updates (saucy, NEW, main) which goes together with the package you approved09:38
=== fabo is now known as fabo_away
jodhxnox/doko: any thoughts on https://code.launchpad.net/~jamesodhunt/upstart/fix-libupstart/+merge/172371 ? Possibly a gettext issue?10:03
pittitseliot: oh, we need an -updates for the settings as well? looking10:06
tseliotyep10:06
pittitseliot: why does nvidia-settings-319 and -updates have a different orig.tar.gz?10:07
tseliotpitti: well, it's the same code for now but it will change10:07
pittiyes, I mean nvidia-settings-319_319.32.orig.tar.gz and nvidia-settings-319-updates_319.32.orig.tar.gz differ (gz timestamp or so)10:08
pittilooks ok otherwise10:08
ogra_didrocks, any idea when i can expect a build of https://code.launchpad.net/~phablet-team/phablet-tools/trunk ? seems the merge went in 4h ago10:09
tseliotpitti: they are different tarballs yes. I didn't rename one adding -updates to it. I created the tarball again10:09
didrocksogra_: should be in tomorrow's dailies, any urgency?10:09
pittitseliot: hm, nvidia-settings-{304,319} are in main, -310 is in universe; is that really free software?10:10
ogra_didrocks, it is the one thing blocking us from switching to flipped by default (which was due on monday)10:10
pittitseliot: I had assumed it was for restricted or multiverse10:10
didrocksogra_: ok, let me rerun a daily with this one then10:10
* ogra_ hugs didrocks 10:10
ogra_thanks !10:10
tseliotpitti: -310 should be a transitional package which we still want in restricted10:10
* didrocks hugs ogra_ back10:11
cjwatsonjodh: Look into why libintl isn't being built with -fPIC, I guess10:11
cjwatsoncompiled, that is10:11
pittitseliot: oh, seems -settings is indeed GPL?10:11
tseliotpitti: yes, settings is GPL10:11
pittinone of the .c files have a copyright header, but there's a GPL2 COPYING10:12
tseliotI thought you were referring to the drivers10:12
pittitseliot: so -settings should go into main?10:12
tseliotpitti: yep10:12
pittitseliot: done10:12
tseliotpitti: thanks a lot, now about 31010:12
tseliotpitti: is it nvidia-310?10:12
pittitseliot: sorry, what?10:13
pittitseliot: I was exclusively talking about nvidia-settings-* here10:13
tseliotpitti: ok, never mind then. Thanks again10:13
pittitseliot: heh, yay confusion :) thanks10:13
cjwatsonjodh: Can I see configure output for the 64-bit system in question?10:15
jodhcjwatson: http://paste.ubuntu.com/5839892/10:18
margaHey all.  I prepared some patches for the heimdal package and got reprimanded for not following SRU directions :-/.  I understand most of the concerns except for one: "please could your review the versioning you are using". Could anybody here tell me what versioning I should use? https://bugs.launchpad.net/ubuntu/+source/heimdal/+bug/119170410:20
ubottuLaunchpad bug 1191704 in heimdal (Ubuntu) "KDCs complain about not having enough file handles for /var/lib/heimdal-kdc/heimdal" [Undecided,New]10:20
xnoxmarga: Under https://wiki.ubuntu.com/StableReleaseUpdates#Procedure, point 5.1. links to https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging with examples of version numbers.10:21
xnoxmarga: since heimdal is at the same version number in precise/quantal/raring, use the example that encodes ubuntu release version number from a debian version number10:22
margaok, thanks.10:23
margaactually precise is different, quantal/raring are exactly the same and saucy has a different debian revision.  Still, I'll read the guidelines and follow them. Sorry for not finding them myself.10:23
xnoxmarga: 1.6~git20120403+dfsg1-2ubuntu0.12.04.1   is probably gonna be the version number for precise SRU.10:23
xnoxmarga: precise is indeed different =) getting cross-eyed looking at those version numbers.10:24
margaSo, should I leave it as it is for precise?10:25
xnoxmarga: so precise could use "ubuntu0.1" suffix, and quantal/raring need to use ubuntu0.13.04.1 / ubuntu0.13.10.110:25
margaOk, good.10:25
margaI'll do this.  Thanks.10:25
xnoxnp10:25
ogra_didrocks, looking at the changelog at https://launchpad.net/ubuntu/saucy/+source/phablet-tools/0.14+13.10.20130703-0ubuntu1 ... does jenkins not use dch to append its  "automatic snapshot" message ? looks a bit messy ..10:51
ogra_(not highly important indeed, but it looks a bit mangled)10:52
didrocksogra_: it does10:52
ogra_weird10:52
didrocksit does that for every content10:52
didrocksevery commit messages removes lines, one entry per commit10:52
didrocksogra_: I bet sergiusens added in his commit message multiple *10:53
ogra_yes, since it were multiple commits merged into one10:53
didrocksogra_: see: http://bazaar.launchpad.net/~phablet-team/phablet-tools/trunk/revision/11910:53
didrocksyep10:53
didrocksand as the decision was to take only commit messages to trunk, that's what we end up with :)10:54
ogra_right ... if i call dch here on such a file it simply appends to it10:54
didrocksyep, no magic reformatting10:54
dokojodh, why does it try to link with libintl.a, and not libintl.la (or the system one)?   Maybe first check the config.log why the tests have different outcome on i386 and amd6411:08
=== oSoMoN_ is now known as oSoMoN
jodhdoko: ok11:09
=== MacSlow is now known as MacSlow|lunch
cjwatsonjodh: That looks like configure was run with --with-included-gettext11:33
cjwatsonTBH, for projects that use gettext where I'm upstream, I switched to AM_GNU_GETTEXT_EXTERNAL a while back, and people can install gettext if they're really using a system that lacks it11:33
cjwatsonWay less hassle all round11:33
jodhcjwatson: I think it must be distcheck that is adding --with-included-gettext, but seemingly only on 64-bit.11:47
cjwatsonMight just be something about the set of packages installed.  However, do you ever care about building upstart on a system that lacks gettext?11:48
cjwatsonI'd argue you don't and that sidestepping the whole issue with AM_GNU_GETTEXT_EXTERNAL is the right thing to do.11:48
bainHi i am trying to compile gtk+3.0 source package on raring12:06
baindid build-dep install and apt-get source gtk+3.012:07
bain./configure and make is resulting in these errors12:07
bainundefinged reference to <various ubuntumenuproxy module api's>12:08
baincan some one help did i miss  a configure switch? i can see that the code exists in the gtk/ folder... just not getting compiled12:08
cjwatsonthe usual way to call the build system starts with 'debian/rules build', not ./configure and make12:09
cjwatson(you may want to remove the source directory and unpack it afresh now, though)12:09
bainah ... ok will try and report ... thanks12:09
=== MacSlow|lunch is now known as MacSlow
=== ChrisTownsend1 is now known as ChrisTownsend
baincjwatson, it worked thanks...12:34
=== greyback is now known as greyback|lunch
rbasakWhen we sync from Debian, do we run dep8 tests? I have a failing dep8 test in puppet AFAICT - which is holding me back from introducing an unrelated delta (another test).12:51
=== oSoMoN_ is now known as oSoMoN
=== greyback|lunch is now known as greyback
xnoxrbasak: talk to #ubuntu-release, it can be hinted to ignore dep8 failure.13:11
xnoxrbasak: and yes, we run all autopkgtest =)13:11
rbasakxnox: so we do normally do it?13:11
xnoxrbasak: no, but we do have facility to ignore autopkgtest failure and migrate packages to -release.13:12
cjwatsonRunning DEP-8 tests is unrelated to where the package came from.13:12
rbasakxnox: I wondered because I thought it might help me pin down the cause (ie. my environment vs. something broken elsewhere).13:12
rbasakSo in general we always run dep8 tests when we sync from Debian, right?13:12
cjwatsonIt doesn't matter where the package came from.13:12
rbasakI actually found the cause since I asked that question, but it'd still be useful to understand in the future.13:13
cjwatsonSo "yes".13:13
cjwatsonHowever, I don't see puppet on either http://people.canonical.com/~ubuntu-archive/proposed-migration/update_excuses.html or https://jenkins.qa.ubuntu.com/view/Saucy/view/AutoPkgTest/ .13:13
rbasakHere it was because apache2 is still on 2.2 in Ubuntu, and Debian have changed how it works in 2.4 and puppetmaster-passsenger won't work with the old one. It just so happens that zul did the merge yesterday but it hasn't gone through to saucy yet.13:13
xnoxrbasak: you can run autopkg test exactly as in the jenkins lab using scripts from lp:auto-package-testing13:13
cjwatsonIndeed, we're in the middle of the Apache 2.4 transition.  If this is causing trouble, your best bet is really to help move the transition along faster, since it's likely to need a number of hands.13:14
xnoxrbasak: apache2.4 is stuck in saucy-proposed with the rest of packages that are already using 2.4, until the remaining 2.2 ones are transitioned to 2.4 as well.13:14
rbasakIs there a report for outstanding work?13:14
xnoxrbasak: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=66195813:15
ubottuDebian bug 661958 in release.debian.org "transition: apache2 2.4" [Normal,Open]13:15
xnoxsee all the blocked bugs.13:15
=== wedgwood_away is now known as wedgwood
rbasakxnox: thanks. What do we need in Ubuntu to get apache2 2.4 into saucy? All of those fixed, or a selection?13:19
cjwatsonProbably all13:19
cjwatsonAlthough I expect some will be removed rather than fixed - would prefer that to be as agreed with Debian though13:20
cjwatsonI plan to be following along with removals13:20
xnoxrbasak: so for apache2.4 to migrate, we need to well satisfy http://people.canonical.com/~ubuntu-archive/proposed-migration/update_output.txt see the last try to migrate apache2 together with a bunch of fixed packages.13:21
xnoxrbasak: that gives a concise list of packages that are blocking transition. Those that are in main, are probably betters targets to help write patches for in debian and/or ubuntu.13:22
rbasakxnox: thanks13:23
* rbasak is struggling to understand that13:27
rbasak* i386: 389-admin, 389-admin-console, 389-ds...13:28
xnoxrbasak: yeah britney output is criptic. Given a package, it checks how many package where uninstallable before and after introducing said package. The number should stay the same or go down. If it goes up, they are listed.13:28
rbasakIs that the list? Are all the packages in that list blocking migration, so it'll shrink as packages are fixed?13:28
cjwatsonThat means that promoting that set of packages (apache2 etc.) renders those packages uninstallable.13:28
cjwatsonFix them and that list will indeed shrink.13:28
rbasakGot it. Thanks!13:29
=== _salem is now known as salem_
mterryHow does one download a package from debian NEW?  I can't find the link13:49
Laneymterry: you can't, intentionally13:50
LaneySee if there's a VCS listed13:50
mterryLaney, I thought that might be the case.  OK13:50
mterrygood idea13:50
=== tkamppeter_ is now known as tkamppeter
rbasakSo the dep8 test for puppetmaster-passenger fails for me because it uses apache 2.2 out of saucy. But if it were to use -proposed, it'd work because it'll pull in apache 2.4, right? And go through to saucy?14:32
rbasak(assuming there aren't any other issues)14:32
cjwatsonrbasak: you can always try it :)  the tests on jenkins.qa.ubuntu.com should use -proposed14:42
cjwatsonrbasak: indeed e.g. https://jenkins.qa.ubuntu.com/view/Saucy/view/AutoPkgTest/job/saucy-adt-apport/ARCH=amd64,label=adt/lastSuccessfulBuild/artifact/results/log shows it looking at -proposed14:43
rbasakThanks. I'll test against -proposed locally, and if that works then I'll upload. Worst case is that it'll end up stuck in -proposed, and I can guess it's no worse to wait if that happens.14:44
cjwatsonyou're going to be waiting either way, it seems14:45
=== freeflyi1g is now known as freeflying
sladenogra_: Flipped Root Image ...  would be a more FRUITy name15:08
sladenogra_: Flipped Root Ubuntu Image for Touch15:09
=== wedgwood is now known as wedgwood_away
ogra_sladen, haha15:09
=== wedgwood_away is now known as wedgwood
tedgcjwatson, click is telling me I don't have ubuntu-sdk-13.10.  I swear I do.  How to I tell it so?  :-)15:11
cjwatsontedg: --force-missing-framework15:12
cjwatsontedg: I wasn't aware that any package delivered the necessary file in /usr/share/click/frameworks/ yet ...15:12
tedgAh, I thought it was checking the debian package15:13
tedgubuntu-sd15:13
tedgubuntu-sdk15:13
cjwatsonNope15:13
cjwatsonCan't load the system package database15:14
tedgAh, okay.15:14
cjwatsonPlus I'm not sure there's any guarantee that the current version is actually "13.10" yet15:14
cjwatsonSo for now, --force-missing-framework is rational15:14
tedgYup, that's fine with me.  I just thought it was user error :-)15:14
=== Ursinha is now known as Ursinha-afk
tedgcjwatson, Is there a way to know that camera-app.desktop is the desktop file?15:47
tedgcjwatson, I was expecting a manifest that'd either point to it, or a generic name.15:48
cjwatsontedg: Not hooked up yet, but I'm expecting the manifest to declare a hook (something like https://click-package.readthedocs.org/en/latest/hooks.html) naming the desktop file15:49
cjwatsonSo you might have "hooks": { "desktop": "camera-app.desktop" }15:50
cjwatsontedg: If you want to tell me where the file ought to be linked to, I could start on figuring out whether the current hooks interface can properly express that15:51
cjwatson(And whether any further actions need to be taken, or if it's just "make a symlink")15:51
smartboyhwHey guys, where is the source code of the bot that you guys use to sign-in patch pilots?15:51
tedgcjwatson, I think we'll want to build a new desktop file.  i.e. replace the Exec line with something like "click-launch" or something so that we can add the apparmor profiles automagically.15:52
tedgcjwatson, Where we wouldn't want applications doing that themselves.15:52
cjwatsontedg: Ah.  I was hoping we wouldn't have to do that, but oh well15:52
xnoxsmartboyhw: ask on #ubuntu-irc or check IRC topics on wiki.u.c, it's linked there somewhere.15:52
cjwatsonI've been trying to avoid having to build a templating language into click15:52
cjwatsonBut we could use Exec lines to run sed over things, I suppose15:53
=== _ffio_ is now known as bsd_freak
tedgcjwatson, I don't think we'd have to do that.  I think we could just read the desktop format and modify it.15:53
tedgExactly.  Sed or a utility, or whatever.15:53
cjwatsontedg: I thought the point was to hook this into application.upstart and have that apply the profile15:53
tedgcjwatson, Sure that works for the Unity usecase, but I don't think we'll get other DE's doing that.  And it'd be nice if they could use Click as well.15:54
xnoxtedg: i would have hoped, that xdg-open file://*.desktop works which takes the desktop file, applies any necessory apparmor/upstartfication and launches the desktop file.15:55
cjwatsontedg: OK, so if I can get a path-and-file-format-level spec for what I'm supposed to do here, I can have a go at implementing it15:55
xnoxtedg: and based on the current DE it could do less or more....15:55
cjwatsontedg: I'm expecting that the first couple of hooks we write here will need modifications to the core, since it's pretty minimal at the moment15:55
xnoxtedg: cause inherently, launching a desktop file under upstart/apparmor is independent off using click package or .deb15:55
=== kk2 is now known as Kk2
cjwatsonOne problem is that the path to the executable is not known15:56
cjwatsonSo either we need to substitute the installation path into the Exec field (could be hairy) or we need something that sticks the app's unpack directory on the front of $PATH before executing15:57
cjwatson(which then means your executable has to be at the top level of the app)15:57
tedgYeah, that's why I was thinking something like "click-launch com.ubuntu.foo"15:57
cjwatsonRight, but that just moves the problem around15:57
cjwatsonIt still needs to know what the entry point is15:57
jdstrandtedg: couldn't this be a function of the sdk? iirc, it creates a desktop file. why can't it create it to use your launcher?15:57
cjwatsonjdstrand: That means that an app can be manually created to ignore the launcher, ignore apparmor profiles, etc.15:58
tedgcjwatson, Yes, but it means that we do it in a place that is independent of the DE.15:58
cjwatsonjdstrand: Pretty sure your team would be unhappy about that15:58
tedgIt's all contained in "click packages"15:58
tedgWe could figure out the path that is relative to the right directory for the right version, etc.15:59
cjwatsontedg: Even so, we'd still need something to hook that into the list of installed applications15:59
jdstrandcjwatson: sure, but we could have an automatic check for that15:59
tedgSure, and that would be putting the desktop file in /usr/share/applications.  So that desktop file would be a generated one that would call back into the click system.16:00
jdstrandwell, manual check first, that is made automatic later16:00
cjwatsonjdstrand: The server isn't going to have any checks for 13.1016:00
cjwatsonjdstrand: So anything that can be mandated automatically rather than requiring checks is a very definite win16:00
jdstrandcjwatson: I realize that. everything is gated on manual review. there will be tools though for those reviewers, that would grow into automatic checks16:00
cjwatsontedg: Can't be /usr/share/applications/ - /usr will be read-only16:00
cjwatsonjdstrand: Honestly, I would rather have a design that doesn't require checking16:00
cjwatsonAs a strong design principle16:00
tedgcjwatson, heh, okay, /opt/com.ubuntu.click/desktop-files :-)16:01
cjwatsontedg: Isn't there a ~/.local/share/applications/ or something?16:01
jdstrandI appreciate that point, but I thought that click was supposed to be generally reusable in other places16:01
jdstrandif it isn't, fine16:01
tedgcjwatson, yeah, we could do that as well.16:01
cjwatsontedg: We may end up having multiple click paths, so I'd like to avoid the dash/launcher/whatever having to know to look in click-specific paths16:01
cjwatsonjdstrand: well, it is, but saying "click packages must be launched using 'click launch com.ubuntu.foo'" doesn't seem to impede that16:02
tedgcjwatson, Hmm, yeah.  Seems like it shouldn't have to be per-user for some cases though.16:02
cjwatsonjdstrand: And doing this kind of thing in the SDK means that it's hard to change16:03
cjwatsonjdstrand: If we need to change some bit of the app/launcher glue (hopefully it would never change, but ...), then we have to rebuild all apps and it all gets very boring16:03
tedgcjwatson, I guess we could have the "installer" check to see if it's installed first.  And perhaps some cases the install is just creating that desktop file.16:03
tedgcjwatson, What I worry about there though is that the hook effectively needs to run as the user then, not the click installer user.16:04
cjwatsonI'm still thinking of how per-user apps ought to work16:04
cjwatsonBut I'm beginning to come round to the possibility that maybe most hooks actually want to run as the user16:04
cjwatsonBecause if the system partition is read-only, most system hooks can't do much anyway16:04
tedgHmm, interesting.16:04
cjwatsonHowever there's the matter of packages preinstalled on the system partition16:05
tedgSeems like those wouldn't be per-user, right?16:05
cjwatsonOne option is to have a "register" kind of step where you register the system-installed packages in a user's list16:05
cjwatsonIn bulk16:05
jdstrandcjwatson: er read-only> this is something sbeattie and I have been thinking about with apparmor profiles too. I had figured that they would be tucked in /opt somewhere as writable be the click package user16:05
jdstrandI don't have an implementation suggestion, but I'm not keen on loading user owned policy16:06
cjwatsonOTOH I think I've heard people say that at least some core apps shouldn't be entirely removable (i.e. if you remove them it just means it flips back to the version in the system partition)16:06
cjwatsonjdstrand: No, I agree on that part16:06
cjwatsonSo maybe we need both user and system hooks16:06
cjwatsonHaving to put things in /opt is annoying though, because /opt's layout is not really typically friendly to being loaded in bulk by the system.  Do we have any subdirectory of /var or something that's guaranteed to be on the user-data partition?16:08
cjwatson(And that isn't transient, like something bind-mounted off /run)16:08
jdstrandmaybe /var/cache? I've not been part of these image layout conversations though16:08
tedgI'm not sure, perhaps rsalveti has info there?16:08
jdstrandfwiw, I was not suggesting the sdk handle it, I was just tossing the idea out there. the 'click launch' seems fine (feels slightly out of scope though...)16:12
ogra_jdstrand, tedg, stgraber  is the person defining the image layout16:13
mterryzul, for python-amqp, why run just that one test?16:13
ogra_as he implements the image based updates and readonly filesystem stuff now16:13
zulmterry:  havent figured out how to run the rest of the tests in a buildd yet16:13
cjwatsonI can see it as in scope; at least for demonstration purposes.16:14
mterryk16:14
cjwatsonI could implement it without it necessarily having to be the way apps end up being launched.16:14
cjwatsonThat said, "click launch" would run as a user, and the apparmor profile still has to have been generated and stashed somewhere first, so I don't think I can implement it yet.16:15
jdstrandcjwatson: sbeattie will be starting on the click hook imminently16:16
=== wedgwood is now known as wedgwood_away
=== wedgwood_away is now known as wedgwood
jdstrandcjwatson: the first cut for the demo may very well be putting it in /etc/apparmor.d, but we recognize that will need to change16:17
cjwatsonjdstrand: Incidentally, what's the specific reason why user-owned policy is bad?  I get that we don't want an app to be able to modify its own policy, but that's not quite the same as being user-owned16:17
cjwatsonMy understanding of the security policy is that we're principally trying to defend the user against malicious apps16:18
=== bsd_freak is now known as babaji
jdstrandcjwatson: you're right that they are different. loading policy is a privileged operation currently. one example of why it would be bad is that an unprivileged non-admin user would be able to modify one of these files and override system policy16:19
jdstrandor write new system policy16:20
jdstrandit is thorny. we don't have user profiles yet. we just can't allow it now16:20
cjwatsonIf you can override system policy, I can understand the restriction16:21
jdstranduser profiles are planned, but it is not for 14.0416:22
cjwatsonI just wanted to check that it wasn't actually a fig leaf - for example if you were trying to prevent the app from overwriting its own policy in the case of a policy leak, which could equally well be used to write a new desktop file for itself :)16:22
cjwatsonsbeattie: For the record, don't worry too much about polishing the edge of your code that interfaces with click16:23
jdstrandit doesn't have to do with the app16:23
cjwatsonjdstrand: OK, good, I understand correctly then16:23
cjwatsonsbeattie: I more or less expect to have to munge the interface about a bit, and I'm happy to take a lump of code that does the policy-specific work and then deal with the integration16:23
cjwatson(In fact it's arguably easier for me to deal with it that way, just at the moment)16:24
jdstrandcjwatson: the desktop file is an interesting consideration though. where do we expect them to live? currently, we figure things in /opt will not be writable by the user (DAC would protect against that too, but this is another layer), and then app data is in XDG dirs.16:25
jdstrandbut we don't want the .desktop file to be modifiable16:26
cjwatsonjdstrand: This is one reason I'm hoping not to have to run any processing over them, because then the desktop file can just live in /opt16:26
jdstrand(by the app-- the user could if desired)16:26
jdstrand /opt is great by me :)16:26
cjwatsonjdstrand: But, a desktop file in .local/share/applications/ wouldn't be modifiable by the app either, surely16:26
cjwatson(Or whatever)16:26
jdstrand.local/share/applications will not be allowed, and would be acceptable too16:27
jdstrandso long as it isn't in .local/share/<app id> :)16:27
cjwatsonI am on board with the general principle that an app should not be able to modify itself.  We may have to argue about the details :)16:27
* jdstrand nods16:27
cjwatsonOh, indeed, no, that wouldn't buy us anything even if I thought it were a good idea16:27
jdstrandthough I think we are in agreement :)16:27
cjwatsonI want to avoid anything where elements of the system have to iterate over lots of app directories, as much as possible16:28
cjwatsonThat kind of code tends to be really tedious and doesn't usually fit well with existing facilities16:28
jdstrandI don't particularly care on the implementation detail as long as it is cleanly separated from the app's writable area16:28
jdstrandcjwatson: yep, cool16:29
cjwatsonI prefer models where bits of the app get linked or copied into single system- or user-owned directories16:29
cjwatsonIdeally linked16:29
jdstrandcjwatson: I might mention, and I don't think this conflicts with anything we've said, we are trying to make it so apps can't enumerate what other apps are installed16:30
jdstrandcjwatson: an app shouldn't need read access for /usr/share/applications, /opt/.../wherever or .local/share/applications anyway, but thought I'd mention the principle16:31
cjwatsonI guess then you need them not to be able to list either /opt/click.ubuntu.com or whichever directory we put the per-user links in, and you need them not to be able to execute /usr/bin/click16:31
cjwatsonOr talk to the relevant PackageKit API16:31
jdstrandthat's correct16:31
jdstrandthat is all handled by default16:31
cjwatsonAssuming that you're doing positive permissions rather than negative permissions, and I assume that because I believe you're generally sane :-), that shouldn't be a problem16:31
jdstrandthat's accurate16:32
jdstrandwell, sane is probably for discussion, but...16:32
=== Ursinha-afk is now known as Ursinha
cjwatsonJust remember that the ability to list any directory that's used as the target of a hook might permit implicitly enumerating at least a subset of apps16:32
jdstrandI'm not up on "any directory that's used as the target of a hook"16:34
jdstrandour current templates will do things like /opt/click.ubuntu.com/@{APPNAME}/@{APPVERSION}/16:35
jdstrandwhere @{APPNAME} and @{APPVERSION} are declared in the manifest16:35
jdstrandI also understand that the exact path may change, based on earlier discussions16:35
mdeslaurwe can't use .local/share/applications...it needs to be outside the home directory16:36
jdstrandmdeslaur: why, I feel like I missed something?16:36
mdeslaursince the home directory can be encrypted, click packages needs to be able to clean out unused versions of packages16:36
mdeslaurto do that, it needs to be able to enumerate what each user has16:37
jdstrand(ok, not the app confinement concern :)16:37
jdstrands/the/a/16:37
mdeslaurno, not an app confinement concern16:37
mdeslauralso, the launcher list is outside the home directory, and it presumably needs to fetch icons and stuff from the desktop files16:38
mdeslaurbecause the lock screen launcher needs to work16:38
cjwatsontarget of a hook> What I mean is that if there's a system-provided hook that says "apps which provide the 'foo' facility get a named file symlinked into this directory", then enumerating that directory gives you a partial list of installed apps16:38
jdstrandmdeslaur: so, this is probably just chalked up to 'that will be handled via a system security update', but I hadn't really considered crafted/malicious icons16:39
cjwatsonmdeslaur: .local/share/applications/ won't be the registry of what each user has16:39
jdstrandthat could trigger stuff outside of confinement16:39
mdeslaurjdstrand: meh, no different than anything else the app could provice16:40
mdeslaurprovide16:40
mdeslaurcjwatson: oh, sorry, I misunderstood then16:40
cjwatsonmdeslaur: It seems unfortunate that encrypting one's home directory wouldn't imply encrypting the list of which apps one has installed16:40
cjwatsonmdeslaur: Existence proof: "pornview"16:41
mdeslaurcjwatson: quite...but I'm not the one who decided to put your list of installed apps on the lock screen :P16:41
jdstrandmdeslaur: well, yes and know. taking the kernel out of it, the app is providing an image that is displayed outside of confinement by unity. most of what an app can do is within confinement16:41
jdstrands/know/no/16:41
jdstrand(weird typo)16:41
cjwatsonmdeslaur: Although I suppose the actual app is in /opt/ anyway16:41
cjwatsonmdeslaur: So I guess it should be somewhere outside /home, but in user-owned mode 700 directories, to at least discourage casual snooping16:42
cjwatsonmdeslaur: Then click running as root can still prune things16:43
mdeslaurcjwatson: yes...I believe the plan at some point was to use accountsservice to store that16:43
cjwatsonmdeslaur: Huh, nobody told me.  Reference?16:43
mdeslaurtedg: ?16:43
mdeslaur^16:43
cjwatsonI'd been planning something really high-tech like, you know, a directory16:43
mdeslaurcjwatson: I blame either a rumour from ted, or my faulty memory :P16:44
cjwatsonAnd actually it would be a right pain to have to go and talk to some other service for click's registry of installed apps16:44
mdeslaurcjwatson: oh, I was referring to the launcher items, not the list of installed apps16:44
cjwatsonOh, right.  This is why I keep trying to get a spec out of Ted ;-)16:44
ogra_squeeze harder :)16:45
mdeslaurhehe16:45
cjwatsonmdeslaur: (Your ideal lock screen makes the device invisible, right?)16:45
mdeslaurcjwatson: hehe, well, I think the launcher on the lock screen is cool....as long as the paranoid/enterprise users can enable a "safe" lock screen in the settings somewhere16:46
mdeslaurI don't include myself in the list of paranoid people :P16:46
slangasekcjwatson: so I can't think of any reason not to put MokManager in the existing shim binary package; can you?17:05
sergiusenscjwatson: from the above conversation, the how to launch a click installed app from a DE is not solved, right? Do you know who owns that if so?17:10
cjwatsonslangasek: seems fair to me; I guess it needs a separately-signed EFI binary17:13
slangasekyep17:13
slangasekshould the signed binary go to shim-signed?17:13
slangasekimplies we need to consistently get both binaries signed in a timely manner, I guess17:13
cjwatsonsergiusens: I think I own it, although it may involve me continuing to have lively debate with Ted ;-)17:14
cjwatsonsergiusens: It's a demo blocker so a high priority for me17:15
cjwatsonslangasek: Is there a reason we might want to handle them on different schedules, such as one changing much more frequently than the other?17:15
slangasekcjwatson: given that they come from the same source, and updating the source will render any -signed package non-rebuildable until a new signed binary is available, I don't think so17:16
slangasekI'm only (mildly) concerned about the prospect of one binary getting stuck in the SysDev submission queue17:16
cjwatsonOh, because we take care that we're shipping signatures for current binaries17:17
slangasekoh, but now I'm confused17:17
slangasekthe MokManager.efi in http://www.codon.org.uk/~mjg59/shim-signed/shim-signed-0.2.tgz isn't signed by Microsoft17:17
* slangasek rewinds and looks to see how this is actually being validated17:18
stgraberslangasek: any reason we can't have MokManager.efi signed by the Ubuntu key and started by shim/grub instead?17:18
slangasekstgraber: well, it looks like that might actually be how it's meant to work17:18
cjwatsonhttp://www.techrepublic.com/blog/australia/shim-delivered-to-allow-small-linux-distros-to-boot/1579 seems to imply that there's a separate ephemeral private key17:18
slangasekyes17:18
slangasekI know that there /is/ such an ephemeral private key, I just forgot how it was being used17:19
slangasekso I guess the only thing is to make sure MokManager.efi ends up in the right place on the disk17:19
cjwatsonSo have shim spit out a raw-uefi object in its build and suck the signed object into shim-signed, I guess17:19
stgraberah, ephemeral private key used to sign MokManager.efi with the public half in the valid key list in shim would do the trick too, then we don't need to do anything with the resulting .efi17:19
sergiusenscjwatson: well if you own it I'm confident I can track the blueprint for click... not worried on who actually ends up doing the grunt work, just where I'm supposed to be looking at17:19
slangasekstgraber: right, that seems to be how it's already wired up17:20
cjwatsonUnless it must be a separate key rather than the Ubuntu one17:20
slangasekcjwatson: it doesn't /have/ to be a separate key, but the shim build already spits it out signed by the ephemeral key, so maybe that's simpler than resigning with the Ubuntu key?17:20
cjwatsonslangasek: Oh, right, even easier than17:21
cjwatson*then17:21
cjwatsonsergiusens: I plan to get it done this coming week, one way or another17:21
=== jelmer_ is now known as jelmer
=== wedgwood is now known as wedgwood_away
=== wedgwood_away is now known as wedgwood
* tedg is back18:43
tedgcjwatson, mdeslaur, yeah the apps on the launcher would be in account service.18:43
tedgBut I'm not sure that means you need the desktop files if they were created in the user's home directory.18:44
tedgFor instance, we could pull the data out of /opt18:44
=== roaksoax_ is now known as roaksaox
=== roaksaox is now known as roaksoax
=== chiluk` is now known as chiluk
KaleoTrevinho: any news on https://bugs.launchpad.net/ubuntu-ui-toolkit/+bug/1180402 ?19:33
ubottuLaunchpad bug 1180402 in Ubuntu UI Toolkit "qmlscene based apps are not recognised as separate apps by Unity (launcher and alt-tab)" [High,Confirmed]19:33
=== seb128_ is now known as seb128
=== bschaefer_ is now known as bschaefer
apacheloggerare there any plans to push alsa* 1.0.27 into saucy?21:01
jdstrandsbeattie: what are your thoughts on moving /etc/apparmor.d/abstractions/ubuntu-sdk-base out of apparmor and into apparor-easyprof-ubuntu?21:38
jdstrandsbeattie: (I would do it, just wondering what you think)21:39
jdstrandsbeattie: another thought is to remove /etc/apparmor.d/abstractions/ubuntu-sdk-base and support abstractions in easyprof21:40
sbeattiejdstrand: what do you mean by support abstractions in easyprof?21:41
jdstrandsbeattie: I think in the short term moving the abstraction out to apparmor-easyprof-ubuntu makes some sense. I think easyprof support for abstractions needs thought21:41
sbeattieI'm okay with moving it.21:41
jdstrandsbeattie: something like /usr/share/apparmor/easyprof/abstractions(|vendor/version)21:42
jdstrandsbeattie: the other option is to just treat policygroups like abstractions21:42
jdstrandsbeattie: I'm just thinking that the ubuntu-sdk-base abstraction will likely needed frequent updates21:43
sbeattieah, that was the question I was just forming, was how you see them as different...21:43
jdstrandmaybe it is easier to shove them all into a policygroup and be done with it21:43
jdstrandwe'll get versioning for free then21:44
sbeattiehrm, so that's a lifecycle question. as we iterate on policygroups and other easyprof bits, the generated policies will need to be updated.21:44
sbeattienot just when the click package is initially installed21:44
jdstrandsbeattie: yes, but that is different from what I am asking21:44
jdstrandI added a work item to figure that out21:44
jdstrandoh, I see what you mean21:45
jdstrandif it is in an abstraction, we get reload for free21:45
sbeattiewell, almost for free, but yes.21:45
jdstrandhmm21:45
sbeattie(modulo when policy is reloaded versus the easyprof package upgrade)21:46
jdstrandso, I figured we would have some sort of a hook that when apparmor-easyprof-ubuntu is updated, it would regenerate the policy21:47
jdstrand(so we would have similar behavior as with apparmor upgrades)21:47
jdstrandthat is actually somewhat complicated21:48
jdstrandcause of the readonly image21:48
sbeattieyeah. hrm.21:49
jdstrandwell, I knew that was a complicated question, which is why I added a work item21:49
jdstrandlet's punt for now21:49
jdstrandwe can assume we have to be able to regenerate policy21:49
jdstrandfor when we update policy groups, etc21:49
jdstrandso, pretend we are in a magical land where we have that21:50
sbeattiealright. anyway, I have no issue with moving the abstraction to the ubuntu-easyprof package in the short term.21:50
jdstrandsbeattie: right, but considering the magical land, does it make sense to just put it in a policygroup and remove the ubuntu-sdk-base abstraction?21:51
jdstrandI think it does21:51
sbeattiedoes easyprof support having a template incorporate a policygroup automatically?21:52
sbeattie(I don't think so, but I'm not that versed in the details)21:52
sbeattieIt would be nice to have all the ubuntu-sdk templates (assuming qml, html5, etc get different templates) get a common base level of ubuntu-sdk policy without having to repeat themselves.21:54
jdstrandsbeattie: not in the way you are thinking. but there are two ways of dealing with that: use a non-magicpath #include and just having the sdk pre-fill in templates21:55
jdstrandsbeattie: s/templates/policygroups/21:55
jdstrandie, user doesn't pick those21:55
sbeattieyeah, fair point.21:56
jdstrandsbeattie: so, right now, I was thinking put all of ubuntu-sdk-base into qmlscene21:56
jdstrandbut I could also just add a sdk-base policy group21:56
jdstrandsbeattie: this all came about because I was thinking about how fast I am updating this policy21:57
jdstrandsbeattie: then it occurred to me, we will have versioned policy for templates and policygroups, but it will depend on non-versioned abstractions21:58
jdstrandand that seemed like it would get messy quickly21:58
jdstrandI'm not super-keen on an absolute path for an #include21:59
jdstrandcause while unlikely to be a maintenance problem, it seems possible21:59
sbeattieyeah. I think when I drew up the sdk-base abstraction, I was trying to leave open the possibility that we moved to a different interpreter than qmlscene, but I probably wasn't very fastidious about that.22:00
jdstrandsbeattie: but as it is witht he email I sent to the SDK team/ubuntu-devel@, I recommended the sdk just add qmlscene to the manifest file automatically22:00
sbeattieand I think the stuff I had pulled out was common to qmlscene and the other interpreter I was playing with.22:01
jdstrandsbeattie: well, I think your instinct was correct-- it is how we profile after all and I certainly didn't think anything of it until recently22:01
jdstrandI see22:01
jdstrandwell, so we can have an sdk-base policy group, and the SDK can add both sdk-base and qmlscene22:01
sbeattiethat works for me.22:02
jdstrandI figure the SDK will do that sort of thing a lot once it gets smart22:02
jdstrandit will pick qmlscene-sqlite automatically for regular QML apps and qmlscene-webview for html522:02
jdstrandok, I'll do that then22:03
jdstrandsbeattie: (add sdk-base as a policy group)22:03
sbeattiejdstrand: excellent, thanks!22:03
jdstrandI'll update the man pages/docs/etc too22:03
=== salem_ is now known as _salem

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!