August 2017 - Pharo-dev - lists.pharo.org

Re: [Pharo-dev] Bloc: Safe to Store SSH Passphrase in Pharo?

by Norbert Hartl

> Am 31.08.2017 um 12:52 schrieb Peter UhnÃ¡k <i.uhnak(a)gmail.com>: > > So you do not put passphrases on your ssh keys? > > Not always. > > Because you don't give the private key away why protect it? So imagine you have development process that includes a jenkins that needs to build the source and therefor needs access to the repository. What do you do? > > I give it a password-less ssh key, encrypted in some manner. (I do not know what Jenkins offers, but both Travis and GitLab(Runner) support file/data encryption.) > Adding the build server a password on top of the key would make no difference. If you have access to one, you have the access to the other. > So deal with it outside of the image. It is the same situation as a sandbox and key chain access. Exactly what I was meaning. Norbert

Aug. 31, 2017

Re: [Pharo-dev] Bloc: Safe to Store SSH Passphrase in Pharo?

by Tim Mackinnon

To further her add to what Peter is saying - in GitLab you can add secret variables (which are encrypted) and can be referenced only during the build process. So you can call your image with the value of one of these variables. Which is fine if you don't persist the value. I'm wondering if we have a concept of "transient" variables that don't persist on image save? Then iceberg could use one of those, and expect you to pass that value through on the command line of Pharo? I was toying with the idea of having an encrypted vault in my image (to hold multiple values for convenience) and I would then pass an unlock value on the command line - but I would need some way to ensure that value isn't persisted? Is this where a plugin might help? Something to save a value transiently only during image execution? Tim Sent from my iPhone On 31 Aug 2017, at 12:52, Peter UhnÃ¡k <i.uhnak(a)gmail.com> wrote: >> So you do not put passphrases on your ssh keys? > > Not always. > >> Because you don't give the private key away why protect it? So imagine you have development process that includes a jenkins that needs to build the source and therefor needs access to the repository. What do you do? > > I give it a password-less ssh key, encrypted in some manner. (I do not know what Jenkins offers, but both Travis and GitLab(Runner) support file/data encryption.) > Adding the build server a password on top of the key would make no difference. If you have access to one, you have the access to the other. > > Peter >

Aug. 31, 2017

Re: [Pharo-dev] Bloc: Safe to Store SSH Passphrase in Pharo?

by Peter UhnÃ¡k

> > So you do not put passphrases on your ssh keys? > Not always. > Because you don't give the private key away why protect it? So imagine you > have development process that includes a jenkins that needs to build the > source and therefor needs access to the repository. What do you do? > I give it a password-less ssh key, encrypted in some manner. (I do not know what Jenkins offers, but both Travis and GitLab(Runner) support file/data encryption.) Adding the build server a password on top of the key would make no difference. If you have access to one, you have the access to the other. Peter

Aug. 31, 2017

Re: [Pharo-dev] I disabled notifications from github

by Dimitris Chloupis

There are websites that let you automate gmail. For example you could make a small task that when you received a email for the pharo repo with the words "pull" and "request" automatically you will forward the email to the mailing list. I have used IFFT https://ifttt.com/collections/google The link I provided has the applets but it also allow you to make your own applets with a set of wizards Alternatives to IFFT https://zapier.com/ https://automate.io/ https://github.com/huginn/huginn etc On Thu, Aug 31, 2017 at 12:26 PM Esteban Lorenzano <estebanlm(a)gmail.com> wrote: > they were far too much. > I will comeback when I find a solution for the only two cases I would like > to inform to this list: > > 1) there is a new Pull Request (so people can go and take a look) > 2) there is a new merge into development (so people know the change has > been integrated) > > Esteban >

Aug. 31, 2017

I disabled notifications from github

by Esteban Lorenzano

they were far too much. I will comeback when I find a solution for the only two cases I would like to inform to this list: 1) there is a new Pull Request (so people can go and take a look) 2) there is a new merge into development (so people know the change has been integrated) Esteban

Aug. 31, 2017

Re: [Pharo-dev] Bloc: Safe to Store SSH Passphrase in Pharo?

by Esteban Lorenzano

you are all confused :) Sean talks about storing the passphrase for SSH, not the HTTPS user/pass. Nevertheless both, passphrase and user/pass needs to be stored on Pharo and then they are not safe. Now, how can we reliable store passwords in Pharo? This is a good thing we need to solve before blame Iceberg :P So far, we can do just two things to avoid this problem: - do not store the passwords on Pharo, which means we need to introduce them each time we use it (not very confortableâ¦ and btw this can be not working on ssh mode, I didnât test). - use ssh keys without password protection. I have to be honest: since I never used password protection of ssh keys in my life, I never seen this problem until Norbert pointed it to me :P I will be glad to have a general solution for password storing in Pharo. But that would be like creating a keychain, isnât? Also, the openness of our system makes the problem even harderâ¦ :S cheers, Esteban > On 31 Aug 2017, at 10:29, Denis Kudriashov <dionisiydk(a)gmail.com> wrote: > > But ssh agent not working for you? > > I work with Iceberg without extra configuration in image. No problems for me. But I am on Mac. > So image now only keeps github password for pull requests. > > (Only problem with latest Mac update is that I am now manually add ssh keys after any reboot: ssh-add -A). > > 2017-08-31 3:32 GMT+02:00 Sean P. DeNigris <sean(a)clipperadams.com <mailto:sean@clipperadams.com>>: > https://github.com/pharo-vcs/iceberg/blob/master/README.md <https://github.com/pharo-vcs/iceberg/blob/master/README.md> suggests to > configure Iceberg with the "Use Custom SSH Keys" setting, part of which > seems to include pasting one's SSH Key Passphrase into Pharo's settings. Is > that a good idea (i.e. is that safe)? > > > > ----- > Cheers, > Sean > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html <http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html> > >

Aug. 31, 2017

Re: [Pharo-dev] Writeup: how to contribute to Pharo

by Marcus Denker

> On 31 Aug 2017, at 00:06, Nicolai Hess <nicolaihess(a)gmail.com> wrote: > > Hi, > > I am now able to use iceberg on windows, thanks for the help. > > But I am still a bit unsure about how the review and contribution workflow should work. > > up to pharo 6 I just load a latest image, > - load the slice from a fogbugz number and was able to review the change > - or create a slice and upload it to the inbox > > in pharo 7 > - what is the equivalent to "getting the latest image" (and being able to load and review a fix), > up to pharo 6 I just > - load the latest image in pharolauncher (or from the command line). > - opened the inbox repository. > - load and review change/fix > - throw away this change (close image without save) > - reopen that image to move on with the next item to review. > > But now, do I have to update my local branch for every new pull request ? And how do I do this ? In other git project I would, I would > fetch upstream, checkout master, merge with upstream/master, push the master to my fork origin > How should this be done with my pharo 7 fork ? (And do we only work on the development brach instead of the master)? > > And do I this only in the command line or do I manage my fork (and keep it up to date) from within pharo with iceberg ? > How do I actually access the pull requests from within pharo ? Maybe I am stupid, but I just can not find it. > I would like do this steps, (as I was used to it from the prior contribution process, by loading code from the inbox) > - Just look at the changes > - apply the changes > - throw away this changes, and move one with the next fix review > > And the same for creating a fix / pull request. Do I need to be up to date with my own fork, or only the local copy of the pharo repository ? > Again, for pharo 6 I would just load a latest image, make my changes / code fixes and create a slice. Save to the inbox -> done. > And looking at iceberg, I have really no clue how to upload a fix. > > I see that other people are using the new process, and I feel a bit lost and closed out of the pharo 7 development process, as I am at the moment unable to understand how this work. > Are there any other resources I missed ? > Hi, Cyril send already the links to the descriptionâ¦ I have to admit that i am myself in the âthis is very very slow and cumbersomeâ phase of thingsâ¦ we need to streamline the process (I manage to do last week one pull request and this week one, this is not the speed that i want ;-) Marcus

Aug. 31, 2017

Re: [Pharo-dev] [pharo-project/pharo] 19880-0-senders-of-String---isLegalInstVarName-isLegalClassName-inviolateInstanceVariableNames (#226)

by Marcus Denker

the test failing is GT.Tests.Playground.GTPlaygroundBasicTest.testSettingBindings which is not related -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/pharo-project/pharo/pull/226#issuecomment-326230571

Aug. 31, 2017

Re: [Pharo-dev] Maybe better pinning messages? (inspired by [Pinning Objects in Pharo])

by Pavel Krivanek

2017-08-31 10:24 GMT+02:00 Denis Kudriashov <dionisiydk(a)gmail.com>: > Hi. > > We now have very generic message names: > - pin > - unpin > - setPinned: > - isPinned > > Problem that they collide with possible domain related names. > For example I implemented pinning of tabs in Calypso and I found that I > overrides #pin and #isPinned messages. Then I fix it with different names. > Probably menus also uses pin word but without overrides > > What you think about renaming pinning messages? Something like: > - pinMemory > I would use pinInMemory -- Pavel > - unpinMemory > - isMemoryPinned > - setPinnedMemory: > - pinMemoryDuring: (if we will introduce it) > > I think it is easy to do now because not much code uses pinning >

Aug. 31, 2017

Re: [Pharo-dev] Bloc: Safe to Store SSH Passphrase in Pharo?

by Denis Kudriashov

But ssh agent not working for you? I work with Iceberg without extra configuration in image. No problems for me. But I am on Mac. So image now only keeps github password for pull requests. (Only problem with latest Mac update is that I am now manually add ssh keys after any reboot: ssh-add -A). 2017-08-31 3:32 GMT+02:00 Sean P. DeNigris <sean(a)clipperadams.com>: > https://github.com/pharo-vcs/iceberg/blob/master/README.md suggests to > configure Iceberg with the "Use Custom SSH Keys" setting, part of which > seems to include pasting one's SSH Key Passphrase into Pharo's settings. Is > that a good idea (i.e. is that safe)? > > > > ----- > Cheers, > Sean > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html > >

Aug. 31, 2017