- Pharo-dev - lists.pharo.org

Re: [Pharo-dev] Pharo Process question

by Norbert Hartl

But don't complain for the coming weeks about things not working ;) Norbert > Am 25.10.2017 um 12:16 schrieb Stephane Ducasse <stepharo.self(a)gmail.com>: > > Thanks guys. > Let us move to tonel :) > So I have to watch out then before pushing the button ;) > Stef > > > On Wed, Oct 25, 2017 at 10:10 AM, Guillermo Polito <guillermopolito(a)gmail.com <mailto:guillermopolito@gmail.com>> wrote: > > > On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com <mailto:estebanlm@gmail.com>> wrote: > > > > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com <mailto:stepharo.self@gmail.com>> wrote: > > > > Hi > > > > are the pending PR reevaluated when one PR is integrated? > > Unfortunately not on every integration... We should do it that way but there are some problems with Jenkins allocating space in the master machine. > > Christophe was telling me he would contact the people from jenkins to see if there is a solution for that. > > it was, but Guille disabled it because it was killing the server. > when we jump to tonel we can re-evaluate the problem :) > > Esteban > > > > > Stef > > > > > > > > -- > > Guille Polito > Research Engineer > > Centre de Recherche en Informatique, Signal et Automatique de Lille > CRIStAL - UMR 9189 > French National Center for Scientific Research - http://www.cnrs.fr <http://www.cnrs.fr/> > > Web: http://guillep.github.io <http://guillep.github.io/> > Phone: +33 06 52 70 66 13 <tel:+33%206%2052%2070%2066%2013>

Oct. 25, 2017

Re: [Pharo-dev] Pharo Process question

by Stephane Ducasse

Thanks guys. Let us move to tonel :) So I have to watch out then before pushing the button ;) Stef On Wed, Oct 25, 2017 at 10:10 AM, Guillermo Polito < guillermopolito(a)gmail.com> wrote: > > > On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com> > wrote: > >> >> >> > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com> >> wrote: >> > >> > Hi >> > >> > are the pending PR reevaluated when one PR is integrated? >> > > Unfortunately not on every integration... We should do it that way but > there are some problems with Jenkins allocating space in the master machine. > > Christophe was telling me he would contact the people from jenkins to see > if there is a solution for that. > >> >> it was, but Guille disabled it because it was killing the server. >> when we jump to tonel we can re-evaluate the problem :) >> >> Esteban >> >> > >> > Stef >> > >> >> >> > > > -- > > > > Guille Polito > > Research Engineer > > Centre de Recherche en Informatique, Signal et Automatique de Lille > > CRIStAL - UMR 9189 > > French National Center for Scientific Research - *http://www.cnrs.fr > <http://www.cnrs.fr>* > > > *Web:* *http://guillep.github.io* <http://guillep.github.io> > > *Phone: *+33 06 52 70 66 13 <+33%206%2052%2070%2066%2013> >

Oct. 25, 2017

[ANN] LAM Research upgraded to Platinum Membership

by Marcus Denker

The Pharo Consortium is very happy to announce that LAM Research has upgraded to Platinum Member status. About - LAM Research: http://www.lamresearch.com - Pharo Consortium: http://consortium.pharo.org The goal of the Pharo Consortium is to allow companies and institutions to support the ongoing development and future of Pharo. Individuals can support Pharo via the Pharo Association: http://association.pharo.org

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

>> >>> Would it not be cleaner if the signature was next to the resource ? Like >>> >>> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >>> >>> Or is that the next step ? >>> >> >> Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not >> use SSLâ¦ >> >> The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, >> the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. >> >> But of course these things are never 100% guarantees, they just make it harder to do bad things. > > Ah, OK, I understand, I just think that a shorter/simpler/easier-to-remember URL for the signature would be better. > I will put them on pharo.org <http://pharo.org/> later, too (in a dedicated directory). And link them from the download page. Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, > the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. > > But of course these things are never 100% guarantees, they just make it harder to do bad things. Ah, OK, I understand, I just think that a shorter/simpler/easier-to-remember URL for the signature would be better. > Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:33, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > > >> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: >> >> Great! >> >> And here is how to do it in Pharo: >> >> signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. >> hash := signature first. >> signedFile := signature second. >> url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. >> ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" >> file := FileLocator temp / url file. >> self assert: file exists. >> self assert: (signedFile match: url file). >> file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" >> self assert: (hash sameAs: sha256 hex). >> > Nice! > >> Would it not be cleaner if the signature was next to the resource ? Like >> >> http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt >> >> Or is that the next step ? >> > > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not > use SSLâ¦ > > The âstack vectorâ ^^^^ Attack vector

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

> On 25 Oct 2017, at 10:23, Sven Van Caekenberghe <sven(a)stfx.eu> wrote: > > Great! > > And here is how to do it in Pharo: > > signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. > hash := signature first. > signedFile := signature second. > url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. > ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" > file := FileLocator temp / url file. > self assert: file exists. > self assert: (signedFile match: url file). > file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" > self assert: (hash sameAs: sha256 hex). > Nice! > Would it not be cleaner if the signature was next to the resource ? Like > > http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt > > Or is that the next step ? > Already there. But a signature like that is not a guarantee if it is downloaded from the same serverâ¦ especially of that server does not use SSLâ¦ The âstack vectorâ that a checksum protects against is the compromise of a download server, especially untrusted mirrors. For that, the checksum needs to come from some other (trusted) source. E.g. normally it is inlined on the download website. But of course these things are never 100% guarantees, they just make it harder to do bad things. Marcus

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Sven Van Caekenberghe

Great! And here is how to do it in Pharo: signature := 'https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu…' asUrl retrieveContents findTokens: Character separators. hash := signature first. signedFile := signature second. url := 'http://files.pharo.org/platform/Pharo6.1-mac.zip' asUrl. ZnClient new url: url; downloadTo: FileLocator temp. "somewhat slow" file := FileLocator temp / url file. self assert: file exists. self assert: (signedFile match: url file). file readStreamDo: [ :in | sha256 := SHA256 hashStream: in ]. "very slow" self assert: (hash sameAs: sha256 hex). Would it not be cleaner if the signature was next to the resource ? Like http://files.pharo.org/platform/Pharo6.1-mac.zip.sha256.txt Or is that the next step ? > On 25 Oct 2017, at 09:53, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > How to validate a Pharo6 download with the example of the mac download: > > 1) get the checksum file (note: uses SSL): > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… > > 2) download Pharo: > http://files.pharo.org/platform/Pharo6.1-mac.zip > > with sha256sum installed, you can do: > > sha256sum -c Pharo6.1-mac.zip.sha256.txt > > and it prints: > > Pharo6.1-mac.zip: OK > > Marcus > > >> On 24 Oct 2017, at 17:34, Marcus Denker <marcus.denker(a)inria.fr> wrote: >> >> Hi, >> >> A tiny first step: I added sha256 chechsums for all downloads created by the Pharo6 build process >> >> https://ci.inria.fr/pharo/ >> >> This step: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/ >> >> now creates .sha256.txt files, e.g for the mac: >> >> https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… >> >> This allows to check that downloads from the file server are indeed the same files that the build server created. >> http://files.pharo.org/platform/ >> http://files.pharo.org/image/60/ >> >> >> As I said, just a very first step. >> >> TODO: >> - pgp signatures >> - insert into website >> - SSL for files.pharo.org >> - do it Pharo7 >> - â¦. >> >> So: more to come! >> >> Marcus > >

Oct. 25, 2017

Re: [Pharo-dev] Pharo Process question

by Guillermo Polito

On Tue, Oct 24, 2017 at 9:49 PM, Esteban Lorenzano <estebanlm(a)gmail.com> wrote: > > > > On 24 Oct 2017, at 21:47, Stephane Ducasse <stepharo.self(a)gmail.com> > wrote: > > > > Hi > > > > are the pending PR reevaluated when one PR is integrated? > Unfortunately not on every integration... We should do it that way but there are some problems with Jenkins allocating space in the master machine. Christophe was telling me he would contact the people from jenkins to see if there is a solution for that. > > it was, but Guille disabled it because it was killing the server. > when we jump to tonel we can re-evaluate the problem :) > > Esteban > > > > > Stef > > > > > -- Guille Polito Research Engineer Centre de Recherche en Informatique, Signal et Automatique de Lille CRIStAL - UMR 9189 French National Center for Scientific Research - *http://www.cnrs.fr <http://www.cnrs.fr>* *Web:* *http://guillep.github.io* <http://guillep.github.io> *Phone: *+33 06 52 70 66 13

Oct. 25, 2017

Re: [Pharo-dev] [ANN] sha256 checksum for Pharo6 downloads

by Marcus Denker

How to validate a Pharo6 download with the example of the mac download: 1) get the checksum file (note: uses SSL): https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… 2) download Pharo: http://files.pharo.org/platform/Pharo6.1-mac.zip with sha256sum installed, you can do: sha256sum -c Pharo6.1-mac.zip.sha256.txt and it prints: Pharo6.1-mac.zip: OK Marcus > On 24 Oct 2017, at 17:34, Marcus Denker <marcus.denker(a)inria.fr> wrote: > > Hi, > > A tiny first step: I added sha256 chechsums for all downloads created by the Pharo6 build process > > https://ci.inria.fr/pharo/ > > This step: > > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/ > > now creates .sha256.txt files, e.g for the mac: > > https://ci.inria.fr/pharo/job/Pharo-6.0-Update-Step-5-Publish/lastSuccessfu… > > This allows to check that downloads from the file server are indeed the same files that the build server created. > http://files.pharo.org/platform/ > http://files.pharo.org/image/60/ > > > As I said, just a very first step. > > TODO: > - pgp signatures > - insert into website > - SSL for files.pharo.org > - do it Pharo7 > - â¦. > > So: more to come! > > Marcus

Oct. 25, 2017