October 2017 - Pharo-dev - lists.pharo.org

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, > the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. > > But of course these things are never 100% guarantees, they just make it harder to do bad things. Ah, OK, I understand, I just think that a shorter/simpler/easier-to-remember URL for the signature would be better. > Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ ^^^^ Attack vector

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > Great! > > And here is how to do it in Pharo: > > signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. > hash := signature first. > signedFile := signature second. > url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. > ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" > file := FileLocator temp / url file. > self assert: file exists. > self assert: (signedFile match: url file). > file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" > self assert: (hash sameAs: sha256 hex). > Nice! > Would it not be cleaner if the signature was next to the resource ? Like > > http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt > > Or is that the next step ? > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not use SSLâ¦ The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. But of course these things are never 100% guarantees, they just make it harder to do bad things. Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

Great! And here is how to do it in Pharo: signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. hash := signature first. signedFile := signature second. url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" file := FileLocator temp / url file. self assert: file exists. self assert: (signedFile match: url file). file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" self assert: (hash sameAs: sha256 hex). Would it not be cleaner if the signature was next to the resource ? Like http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt Or is that the next step ? > On 25 Oct 2017, at 09:53, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > How to validate a Pharo6 download with the example of the mac download: > > 1) get the checksum file (note: uses SSL): > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… > > 2) download Pharo: > http://files.pharo.org/platform/Pharo6.1-mac.zip > > with sha256sum installed, you can do: > > sha256sum -c Pharo6.1-mac.zip.sha256.txt > > and it prints: > > Pharo6.1-mac.zip: OK > > Marcus > > >> On 24 Oct 2017, at 17:34, Marcus Denker <marcus.denker(a)inria.fr> wrote: >> >> Hi, >> >> A tiny first step: I added sha256 chechsums for all downloads created by the Pharo6 build process >> >> https://ci.inria.fr/pharo/ >> >> This step: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/ >> >> now creates .sha256.txt files, e.g for the mac: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… >> >> This allows to check that downloads from the file server are indeed the same files that the build server created. >> http://files.pharo.org/platform/ >> http://files.pharo.org/image/60/ >> >> >> As I said, just a very first step. >> >> TODO: >> - pgp signatures >> - insert into website >> - SSL for files.pharo.org >> - do it Pharo7 >> - â¦. >> >> So: more to come! >> >> Marcus > >

Oct. 25, 2017

Re: [Pharo-dev] Pharo Process question

by Guillermo Polito

On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com> wrote: > > > > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com> > wrote: > > > > Hi > > > > are the pending PR reevaluated when one PR is integrated? > Unfortunately not on every integration... We should do it that way but there are some problems with Jenkins allocating space in the master machine. Christophe was telling me he would contact the people from jenkins to see if there is a solution for that. > > it was, but Guille disabled it because it was killing the server. > when we jump to tonel we can re-evaluate the problem :) > > Esteban > > > > > Stef > > > > > -- Guille Polito Research Engineer Centre de Recherche en Informatique, Signal et Automatique de Lille CRIStAL - UMR 9189 French National Center for Scientific Research - *http://www.cnrs.fr <http://www.cnrs.fr>* *Web:* *http://guillep.github.io* <http://guillep.github.io> *Phone: *+33 06 52 70 66 13

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

How to validate a Pharo6 download with the example of the mac download: 1) get the checksum file (note: uses SSL): https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… 2) download Pharo: http://files.pharo.org/platform/Pharo6.1-mac.zip with sha256sum installed, you can do: sha256sum -c Pharo6.1-mac.zip.sha256.txt and it prints: Pharo6.1-mac.zip: OK Marcus > On 24 Oct 2017, at 17:34, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > Hi, > > A tiny first step: I added sha256 chechsums for all downloads created by the Pharo6 build process > > https://ci.inria.fr/pharo/ > > This step: > > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/ > > now creates .sha256.txt files, e.g for the mac: > > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… > > This allows to check that downloads from the file server are indeed the same files that the build server created. > http://files.pharo.org/platform/ > http://files.pharo.org/image/60/ > > > As I said, just a very first step. > > TODO: > - pgp signatures > - insert into website > - SSL for files.pharo.org > - do it Pharo7 > - â¦. > > So: more to come! > > Marcus

Oct. 25, 2017

Re: [Pharo-dev] Bloc Feedback

by Aliaksei Syrel

Hi Sean, lBasicExamples > - #exampleShapes, select the yellow shape with red border -> inspector -> > Transformations Tab -> Click on Composition -> "ShouldNotImplement: > #multiplyOn: should not have been implemented in BlCompositeTransformation" I don't understand how you guys find these kind of bugs :D Fixed, thanks! - In BlLinearLayoutExamples class>>#exampleVerticalLeftCenterRightRTL - the yellow sub-element does not appear at all. Maybe it should do a `c > vertical exact: 100.` like its siblings? This is a bug of the default extent of the element and its geometry. Element had default extent of 50@50 while geometry 1@1. Recently we added a smarter change recording mechanism that collects all extent/position changes within a frame and then merges them together in order to produce a single notification event. Since in that example we request element's size to be (50@50) there will be effectively no change in extent, so no event is produced and geometry does not adapt itself to match element's size => geometry's extent stays 1@1 and only a tiny yellow dot is rendered :) Wrote a test and changed default element size to be (0@0). - All BlAnimationExamples lead to deprecation warnings and DNU's, but *do not > even attempt* #exampleBallsAnim or face endlessly multplying debugger > windows! Indeed :) A short answer is that it is expected, taking into account a class comment :D [image: Inline images 1] A bit longer answer would require to read the following document https://drafts.csswg.org/css-transforms/#interpolation-of-transforms <https://drafts.csswg.org/css-transforms/#interpolation-of-transforms> to get an idea of what is going on. The point is that animating transformations like translation, scale or rotation is very non trivial. It requires us to decompose a resulting transformation matrix, interpolate decomposed values at animation time "t" and finally recompose it back as matrix :) The only missing piece left is interpolation of matrix decomposition, so we are not far away from having animation examples work again. Below is a screenshot of a composite transformation consisting of translations separated by scale and applied rotation on top of all. Note that resulting translation is not (20, 20) as one would think, instead it depends on scale and rotation which causes the initial problem. Also, one can see that "scaling" matrix components on the main matrix diagonal are not equal to (2, 2) because of rotation... However, once done we will have a powerful transformation library! [image: Inline images 1] BlTextEditElement class>>#exampleText > - insert some characters and then press [delete] -> "Error: Illegal > sub-sequence end index: 44" > - There is aBlSelectionHandler, but I can't seem to select any of the > text Aha, I forgot about it, thanks! At this point BlTextEditElement is only used internally by Moldable Editor so I will probably move it away from Bloc. Thanks for the feedback :) Cheers, Alex On 24 October 2017 at 11:01, Tudor Girba <tudor(a)tudorgirba.com> wrote: > Hi, > > Indeed, instance variables is what we are mainly concerned with as well. > We keep on trimming, but it still feels like too many variables. > > Cheers, > Doru > > > > On Oct 24, 2017, at 8:59 AM, Nicolai Hess <nicolaihess(a)gmail.com> wrote: > > > > > > > > 2017-10-24 2:04 GMT+02:00 Sean P. DeNigris <sean(a)clipperadams.com>: > > Tudor Girba-2 wrote > > > Thanks for the feedback! > > > > But of course! Thanks for pushing Bloc :) IMHO a clean low-level graphics > > framework is the linchpin to unleash a tremendous amount of creativity in > > the Pharo community. I have several dream projects that I placed on > > long-term hold after getting stuck in Morphic quicksand :/ > > > > > > Tudor Girba-2 wrote > > >> - How would one do e.g. a ticking clock in Bloc? The only possibly > > >> relevant > > >> example I see is BlAnimatedCursor. Is that a typical usage? One thing > > >> that > > >> I'm not sure how to translate to a BlElement is that the cursor seems > to > > >> be > > >> responsible for starting and stopping the animation via #activateOn:, > > >> which > > >> doesn't exist for an element. How would one prevent an element's > > >> animation > > >> from continuing to run after a space was closed? > > > What do you mean? > > > > I guess I mean what is the Bloc version of #step that would enable us to > do > > e.g. Squeak's mouse-eyes-tracking-the-cursor or Lively Kernel's clock: > > <http://forum.world.st/file/t128965/Chromium5.png> > > > > > > Tudor Girba-2 wrote > > >> - BlElement has 278 instance-side methods. A frequent battle cry > against > > >> Morphic was the bloated Morph class with 899. Definitely an > improvement, > > >> but > > >> are we "there yetâ? > > > What do you mean? > > > > Is there a consensus on a maximum number of instance-side methods before > a > > class becomes impossible to understand, and if so where does BlElement > fall > > on that scale? > > > > > > > > > > I dont think this number alone is a problem. As long as the > "responsibility" of this > > class is well structured. > > A problem with the Morph class is, that it acts as many things at once. > > A structured container, a model, a view, a graphical object, a widget > base ... > > > > About BlElement, I am more afraid about the number of instance variables > > > > > > ----- > > Cheers, > > Sean > > -- > > Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.ht > ml > > -- > www.tudorgirba.com > www.feenk.com > > "Sometimes the best solution is not the best solution." > > >

Oct. 25, 2017

Re: [Pharo-dev] Bloc status

by Tudor Girba

Hi, > On Oct 25, 2017, at 12:02 AM, Sean P. DeNigris <sean(a)clipperadams.com> wrote: > > Juraj Kubelka wrote >> Or you may share repositories among imagesâ¦ kIceRepository >> sharedRepositoriesLocationString > > That was it! It was > {IcebergSharedRepoFolder}/feenkcom/gtoolkit-visualizer/doc/mondrian/index.pillar > > Now that I can see the presentationsâ¦ Super cool!! Putting more $! in front > of a line -> text auto-shrinks :) > > Two issues: > 1. For the live examples in the Bloc-Pillar tab: "MNU receiver of #gtLiveIn: > is nilâ Which live examples raise the MNU? Doru > 2. In the Pillar tab, the headings are unreadable with the dark theme: > <http://forum.world.st/file/t128965/Screenshot_2017-10-24_18.jpeg> > > > > ----- > Cheers, > Sean > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html > -- www.tudorgirba.com www.feenk.com âProgramming is executable philosophy."

Oct. 25, 2017

[Pharo 7.0-dev] Build #226: 20569-Update-Layout-class-comment

by ci-pharo-ci-jenkins2＠inria.fr

There is a new Pharo build available! The status of the build #226 was: SUCCESS. The Pull Request #385 was integrated: "20569-Update-Layout-class-comment" Pull request url: https://github.com/pharo-project/pharo/pull/385 Issue Url: https://pharo.fogbugz.com/f/cases/20569 Build Url: https://ci.inria.fr/pharo-ci-jenkins2/job/Test%20pending%20pull%20request%2…

Oct. 25, 2017

Re: [Pharo-dev] [ANNOUNCE] ParrotTalk release/design change considerations

by Ben Coman

If I google... parrottalk protocol nothing seems related. So what is ParrotTalk? P.S... since this is not "part of" pharo, [pharo-users] would be a better place for discussion than [pharo-dev]. Could you re-announce there, with some description of use cases and who/where the protocol is used? cheers -ben On Wed, Oct 25, 2017 at 1:42 AM, henry <henry(a)callistohouse.club> wrote: > Please excuse all the low-level detail, if inappropriate to the > discussion. The protocol changes are here specified. > > > - HH > > > On Tue, Oct 24, 2017 at 13:40, henry <henry(a)callistohouse.club> wrote: > > In order to bring ParrotTalk-3.6 support, alongside historical 3.5 > support, the frame header stays the same and the processing of the > ProtocolOffered would select "ParrotTalk-3.6" to use the compact protocol > of > > - ProtocolOffered { offered, preferred } > - ProtocolAccepted { accepted } > - IWant|GiveInfo|ReplyInfo { vatId, domain, publicKey, cryptoProtocols, > dataEncoders } > - IAm|ReplyInfo { vatId, domain, publicKey, cryptoProtocol, dataEncoder, > dhParam } > - Go { cryptoProtocol, dataEncoder, dhParam, signature } > - GoToo { signature } > > Using eLinda : > > http://www.squeaksource.com/Cryptography/elinda-HenryHouse.14.mcz > > Above the FrameBuffer, below the SessionOperations for each version of the > protocol, an ELindaSession could be inserted. This session think would have > the stacks for each protocol version SessionOperation registered by > protocol in a Tuple, for eventual callback. When the ProtocolOffered comes > in we publish the tuple frame, with set selected version, to route to the > correct SessionOperation to support each version of the protocol. > > With a non-specific vatId required, anonymous connections would be > supported. > > - HH > > > On Tue, Oct 24, 2017 at 12:52, Stephane Ducasse <stepharo.self(a)gmail.com> > wrote: > > Hi henry thanks for this announce. Can you tell where such protocols are > used? Stef On Tue, Oct 24, 2017 at 6:33 PM, henry wrote: > Hi all, > > I > am happy to announce the release of version 3.5 of ParrotTalk, for Squeak > > and Pharo, found here: > > http://www.squeaksource.com/ > Cryptography/ParrotTalk-zzz.2.mcz > > It follows this specification: > > https://github.com/ZiroZimbarra/callistohouse/blob/master/docs/ > ParrotTalkFrameDesign-3.5.pdf > > One item of note, in version 3.5, the > system connecting to a server, sending > the IWant msg, must know the vatId > of the system being connected to. I am > considering changing this to > version 3.6 by removing one round-trip in > messaging. Therefore, these > messages would be combined: IWant/GiveInfo, > IAm/ReplyInfo. I will keep > ProtocolOffered and ProtocolAccepted to allow > eLindaSession to support > both versions: 3.5 and 3.6. > > Thoughts please? > > - HH > >

Oct. 25, 2017