- Pharo-dev - lists.pharo.org

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sean P. DeNigris

Sven Van Caekenberghe-2 wrote > And here is how to do it in Pharoâ¦ It would be great to add something like this to Launcher ----- Cheers, Sean -- Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html

Oct. 25, 2017

Re: [Pharo-dev] Bloc status

by Juraj Kubelka

Thatâs great it works for you. Be careful that using Metacello baseline script does not update the local GIT repositories to the latest versions. Check my recent post in Moose: http://forum.world.st/RTExampleFactory-is-missing-sourceClass-tp4990173p499… <http://forum.world.st/RTExampleFactory-is-missing-sourceClass-tp4990173p499…> So, check in Iceberg that all GIT repositories are up-to-date. Cheers, Juraj > On Oct 24, 2017, at 19:02, Sean P. DeNigris <sean(a)clipperadams.com> wrote: > > Juraj Kubelka wrote >> Or you may share repositories among imagesâ¦ kIceRepository >> sharedRepositoriesLocationString > > That was it! It was > {IcebergSharedRepoFolder}/feenkcom/gtoolkit-visualizer/doc/mondrian/index.pillar > > Now that I can see the presentationsâ¦ Super cool!! Putting more $! in front > of a line -> text auto-shrinks :) > > Two issues: > 1. For the live examples in the Bloc-Pillar tab: "MNU receiver of #gtLiveIn: > is nil" > 2. In the Pillar tab, the headings are unreadable with the dark theme: > <http://forum.world.st/file/t128965/Screenshot_2017-10-24_18.jpeg> > > > > ----- > Cheers, > Sean > -- > Sent from: http://forum.world.st/Pharo-Smalltalk-Developers-f1294837.html >

Oct. 25, 2017

Re: [Pharo-dev] Pharo Process question

by Norbert Hartl

But don't complain for the coming weeks about things not working ;) Norbert > Am 25.10.2017 um 12:16 schrieb Stephane Ducasse <stepharo.self(a)gmail.com>: > > Thanks guys. > Let us move to tonel :) > So I have to watch out then before pushing the button ;) > Stef > > > On Wed, Oct 25, 2017 at 10:10 AM, Guillermo Polito <guillermopolito(a)gmail.com <mailto:guillermopolito@gmail.com>> wrote: > > > On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com <mailto:estebanlm@gmail.com>> wrote: > > > > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com <mailto:stepharo.self@gmail.com>> wrote: > > > > Hi > > > > are the pending PR reevaluated when one PR is integrated? > > Unfortunately not on every integration... We should do it that way but there are some problems with Jenkins allocating space in the master machine. > > Christophe was telling me he would contact the people from jenkins to see if there is a solution for that. > > it was, but Guille disabled it because it was killing the server. > when we jump to tonel we can re-evaluate the problem :) > > Esteban > > > > > Stef > > > > > > > > -- > > Guille Polito > Research Engineer > > Centre de Recherche en Informatique, Signal et Automatique de Lille > CRIStAL - UMR 9189 > French National Center for Scientific Research - http://www.cnrs.fr <http://www.cnrs.fr/> > > Web: http://guillep.github.io <http://guillep.github.io/> > Phone: +33 06 52 70 66 13 <tel:+33%206%2052%2070%2066%2013>

Oct. 25, 2017

Re: [Pharo-dev] Pharo Process question

by Stephane Ducasse

Thanks guys. Let us move to tonel :) So I have to watch out then before pushing the button ;) Stef On Wed, Oct 25, 2017 at 10:10 AM, Guillermo Polito < guillermopolito(a)gmail.com> wrote: > > > On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com> > wrote: > >> >> >> > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com> >> wrote: >> > >> > Hi >> > >> > are the pending PR reevaluated when one PR is integrated? >> > > Unfortunately not on every integration... We should do it that way but > there are some problems with Jenkins allocating space in the master machine. > > Christophe was telling me he would contact the people from jenkins to see > if there is a solution for that. > >> >> it was, but Guille disabled it because it was killing the server. >> when we jump to tonel we can re-evaluate the problem :) >> >> Esteban >> >> > >> > Stef >> > >> >> >> > > > -- > > > > Guille Polito > > Research Engineer > > Centre de Recherche en Informatique, Signal et Automatique de Lille > > CRIStAL - UMR 9189 > > French National Center for Scientific Research - *http://www.cnrs.fr > <http://www.cnrs.fr>* > > > *Web:* *http://guillep.github.io* <http://guillep.github.io> > > *Phone: *+33 06 52 70 66 13 <+33%206%2052%2070%2066%2013> >

Oct. 25, 2017

[ANN] LAM Research upgraded to Platinum Membership

by Marcus Denker

The Pharo Consortium is very happy to announce that LAM Research has upgraded to Platinum Member status. About - LAM Research: http://www.lamresearch.com - Pharo Consortium: http://consortium.pharo.org The goal of the Pharo Consortium is to allow companies and institutions to support the ongoing development and future of Pharo. Individuals can support Pharo via the Pharo Association: http://association.pharo.org

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

>> >>> Would it not be cleaner if the signature was next to the resource ? Like >>> >>> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >>> >>> Or is that the next step ? >>> >> >> Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not >> use SSLâ¦ >> >> The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, >> the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. >> >> But of course these things are never 100% guarantees, they just make it harder to do bad things. > > Ah, OK, I understand, I just think that a shorter/simpler/easier-to-remember URL for the signature would be better. > I will put them on pharo.org <http://pharo.org/> later, too (in a dedicated directory). And link them from the download page. Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, > the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. > > But of course these things are never 100% guarantees, they just make it harder to do bad things. Ah, OK, I understand, I just think that a shorter/simpler/easier-to-remember URL for the signature would be better. > Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ ^^^^ Attack vector

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > Great! > > And here is how to do it in Pharo: > > signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. > hash := signature first. > signedFile := signature second. > url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. > ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" > file := FileLocator temp / url file. > self assert: file exists. > self assert: (signedFile match: url file). > file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" > self assert: (hash sameAs: sha256 hex). > Nice! > Would it not be cleaner if the signature was next to the resource ? Like > > http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt > > Or is that the next step ? > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not use SSLâ¦ The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. But of course these things are never 100% guarantees, they just make it harder to do bad things. Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

Great! And here is how to do it in Pharo: signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. hash := signature first. signedFile := signature second. url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" file := FileLocator temp / url file. self assert: file exists. self assert: (signedFile match: url file). file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" self assert: (hash sameAs: sha256 hex). Would it not be cleaner if the signature was next to the resource ? Like http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt Or is that the next step ? > On 25 Oct 2017, at 09:53, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > How to validate a Pharo6 download with the example of the mac download: > > 1) get the checksum file (note: uses SSL): > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… > > 2) download Pharo: > http://files.pharo.org/platform/Pharo6.1-mac.zip > > with sha256sum installed, you can do: > > sha256sum -c Pharo6.1-mac.zip.sha256.txt > > and it prints: > > Pharo6.1-mac.zip: OK > > Marcus > > >> On 24 Oct 2017, at 17:34, Marcus Denker <marcus.denker(a)inria.fr> wrote: >> >> Hi, >> >> A tiny first step: I added sha256 chechsums for all downloads created by the Pharo6 build process >> >> https://ci.inria.fr/pharo/ >> >> This step: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/ >> >> now creates .sha256.txt files, e.g for the mac: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… >> >> This allows to check that downloads from the file server are indeed the same files that the build server created. >> http://files.pharo.org/platform/ >> http://files.pharo.org/image/60/ >> >> >> As I said, just a very first step. >> >> TODO: >> - pgp signatures >> - insert into website >> - SSL for files.pharo.org >> - do it Pharo7 >> - â¦. >> >> So: more to come! >> >> Marcus > >

Oct. 25, 2017