Version: 0.44 - Released on 2010-01-30 13:45:15 UTC
Changes:
- In --console mode, show download progress if stdout is a tty. Suggested by Stephen Paul Weber.
- Canonicalize architectures (Anders F Bjorklund). Different operating systems report different names for the same CPU type (e.g. "Power Macintosh" on MacOSX vs "ppc" on Linux). Map to canonical names.
- If gpg isn't found in $PATH, try gpg2. Reported by Aleksey Lim (the XO-1 laptop uses Fedora 9 with only GnuPG 2).
- Use --fixed-list-mode with gpg. This is the only mode supported by GnuPG 2.
Bug fixes:
- Fixed out-of-date information in man-page.
- Escaped minus signs in man-pages. Lintian complains about this.
- Fixed spelling error in man-page. Reported by lintian.
- If gpg --import returns exit status zero and writes to stderr, just warn.
- When spawning a download subprocess, add zeroinstall to sys.path. Otherwise, it will try to use the system version (or fail if there isn't one). Repored by Lennon Cook.
- Use --batch with gpg --import. Hopefully this will stop gnupg printing messages to stderr about the "trust model" (untested). Reported by Lennon Cook.
- Allow confirm_import_feed to return None. Normally this method is asynchronous, but it might be useful for testing to allow it to perform its work immediately and return None instead. Reported by Aleksey Lim.
Version: 0.43 - Released on 2010-01-23 16:19:36 UTC
New features:
- Add support for xz compressed tars (Rene Lopez)
- Add support for fetching feeds over https (Rene Lopez)
- Added Spanish l10n (Rene Lopez)
- Add support for more types of compression inside a deb (Rene Lopez)
- Allow an Architecture to decide whether to skip <requires> elements.
By default, any <requires> with a "use" attribute will be skipped.
This is mainly to allow programs to specify additional dependencies
for testing with 0test, though it might be useful in the future if we
want optional dependencies. Internally, this means that the solver now
records a list of selected dependencies for each selected component.
Bug fixes:
- Make sure that GTK Builder uses zero-install as the text domain
(Rene Lopez). Removed glade related instructions.
- Fixed format string for "0store verify". Error was "not enough
arguments for format string"
- Fixed some minor errors in the epydoc.
- If some downloads failed, say which ones.
- Removed some legacy code.
- Changed some strings for better i18n (Rene Lopez)
- Fixed error when two instances update a feed at once. The second
instance noticed that the new version it was trying to save was
identical to the one on disk and didn't bother saving it. However, it
also didn't bother parsing the new version, leading to a "can't set
attribute" error message (reported by Neil Graham).
Version: 0.42.1 - Released on 2009-09-11 14:10:41 UTC
- Fix zero-install.ui duplicate object (Rene Lopez). GUI failed to
start on latest Debian/unstable.
- 0desktop now sets the Terminal flag correctly. If a feed declares
terminal/> then put Terminal=true in the .desktop file we generate.
This got lost somehow when zero2desktop became 0desktop. Also,
running a program from the 0manage window tries to locate a suitable
terminal emulator if one is needed.
- In the Preferences box, sort the domains in the list of trusted keys.
Version: 0.42 - Released on 2009-09-06 11:53:06 UTC
New features
- Connect to a key-server to look up trust hints. By default, this is
a service hosted on Google AppEngine, at http://keylookup.appspot.com/
Before, we used a built-in database, which couldn't be updated easily.
The new system also allows us to use a much larger source of information;
in particular the server can tell you if a package is signed by a
member of the Debian project. Hopefully, this can be expanded in future
to include packagers from Fedora, Ubuntu, etc.
- Allow multiple versions of each distribution package (Anders F
Bjorklund). On RPM-based systems, 32-bit and 64-bit versions of a
package may have the same package name, so store a list of (version,
arch) pairs for each name.
Changes
- Always run the built-in copy of the GUI. Originally, the GUI was a
separate program that 0launch downloaded when needed. Later, a copy of
the GUI was bundled to improve the experience for first-time use, but
updates were downloaded. In recent years, the only purpose of this has
been to add new GPG keys to the hints database. Having the GUI as a
separate program added unnecessary complexity, made it harder to
change the API and caused problems with translations. Now that we
contact a key information server to get the hints, there is no longer
any need to update the GUI on its own, so this code has been removed.
"0launch -g" now just opens the preferences dialog box.
- Replaced Glade with GtkBuilder (Rene Lopez). Fixed UI resources
stating that some top level widgets were visible. Fixed the error
when selecting a preferred stability it will be switched to the one
above the selected one. This means that we now depend on GTK >= 2.12,
but that libglade is no longer needed.
- Removed use gtk.FileSelection in favour of gtk.FileChooserDialog (Rene
Lopez).
- Allow https downloads. This was a side-effect of adding support for the
key-info server (which needs to use https), but also works for feeds.
- Try to update an icon if the user presses "Refresh". The icon file
modification date is passed along to avoid unnecessary downloads -
unmodified icons will not be downloaded.
Bug fixes
- Fixed typo in log format string.
- Ensure tempfile is None when a download is unmodified.
- Handle KeyboardInterrupt exceptions correctly. These now need to be
caught explicitly, due to changes in Python.
- If unpacking fails, report stderr from unpacker child process.
Before, stderr was not redirected, so the cause of the error was only
visible if running from a terminal.
- Fixed license output from the GUI. License is LGPL, not GPL.
Python API
- Support specification of a modification date when downloading
resources (frank.richter). A resource will not be downloaded if it
isn't newer than the given modification date.
- Added Handler.confirm_keys to replace confirm_trust_keys. This method
takes a PendingFeed object rather than separate arguments, allowing
extra information to be provided without changing the API in future.
It also takes a function for fetching extra information about a key.
To support both legacy callers and legacy subclasses, the confirm_keys
method dispatches to confirm_import_feed for new-style classes or to
confirm_trust_keys for old-style ones. If you have a custom handler
that overrides confirm_trust_keys, you should now also override
confirm_import_feed. You can continue to override confirm_trust_keys
if you want to support older callers.
Translations
- Make changes to some strings to improve the i18n (Rene Lopez).
- Mark trust messages as translatable.
- Fixed rating menu not showing localized strings (Rene Lopez).
- Import _ into each module rather than using a builtin.
- Marked and modifed strings for i18n (Rene Lopez).
- Wrong variable used for issue file (Anders F Bjorklund).
- Update Swedish translations (Anders F Bjorklund).
- Make more strings translatable (Anders F Bjorklund).
- Use localized timestamp display (Anders F Bjorklund).
Version: 0.41 - Released on 2009-06-27 17:59:21 UTC
UI improvements
- "Compile" is now a sub-menu with Automatic and Manual options. The
Automatic option uses the new "0compile autocompile --gui" feature.
- Improved UI for versions menu. There is now a single popup menu, with
both the stability ratings and the function for opening the cached
copy, and it can be opened by clicking anywhere on a row.
- Moved trust_box.py to gtkui. This allows it to be used by other
programs (e.g. 0compile's GUI).
- Display a warning icon in the trust box for unknown keys.
Keys
- New key for Ilja Honkonen. Previous key has expired.
- Added new GPG key for Thomas Leonard.
Bugs
- Fixed reporting of bad network use config setting.
- When there are no valid signatures, say which feed in the error
message.
- Escape < characters in error messages to notifier.
- Include full stack trace for unexpected errors during background
updates.
- Fixed error with --main=/.
- Don't rely on filesystem's report of symlink length. eCryptfs returns
zero (reported by Dave Arnold).
Translations
- Added spanish translated strings to .desktop and .directory files
(Rene Lopez)
Version: 0.39 - Released on 2009-03-08 13:07:29 UTC
The main features of this release are support for translations and an
alternative system for background updates to work-around features removed in
Ubuntu/Jaunty.
Packagers will need to adjust their scripts to include the translations.
Also, note that Zero Install now depends on Python >= 2.5.
TRANSLATIONS
- Add i18n, gettext translations (Anders F Bjorklund).
- Make more strings translatable (Anders F Bjorklund).
- Add Swedish translation (Anders F Bjorklund).
- Include .mo translation files in releases.
BACKGROUND UPDATES
- Added --systray option to the GUI. Instead of opening the usual
window, display an icon in the system tray and start the download
automatically. Needed on Ubuntu/Jaunty because its new notification
system doesn't allow asking questions in notification messages.
If the notification system doesn't support actions, download anyway.
- If we need to confirm keys in a background check, use --systray. Also,
run the GUI on the root interface, not just the one where confirmation
was needed.
- Don't assume D-BUS is missing just because we can't get the SessionBus.
SystemBus might still be available (this is used to find out whether we
are on-line).
WINDOWS
Zero Install still doesn't work on Windows, but it's getting closer. Help from
someone familiar with this operating system would be much appreciated.
- Disable root checks when running on Windows. Zero Install makes a few
changes to avoid putting root-owned files in the user's home
directory. Don't do this check on Windows, since os.geteuid doesn't
exist.
- Use Socket.recv to fetch downloads. os.read() doesn't work with
sockets on Windows.
- Get GPG to send output to stdout. Windows version can't cope with
sending output to other file descriptors.
- Don't corrupt downloads on Windows. Need to run Python with "-u" or
stdout gets mangled.
DISTRIBUTION INTEGRATION
- Moved common caching code into new CachedDistribution class. The logic
for caching the RPM and Debian database results was duplicated.
- Use architecture from RPM packages (Anders F Björklund). Similar to
the existing support for Debian packages.
- Support Fink version of dpkg (Anders F Björklund). The Fink version
doesn't support the -f flag, but only the --showformat flag.
- Add tests for RPMDistribution.
- Fixed Debian tests to work on non-Debian distributions. Only Debian's
dash shell expands t to a tab.
SECURITY
- List failed paths in "0store audit" output. This makes it easy to bulk
delete a large number of corrupted implementations (or move them
elsewhere for examination and possible recovery with "0store copy").
OTHER
- More detailed bug reports about why no version could be selected. If
we tried to select one, say what the best option was and why it wasn't
suitable. Otherwise, indicate how many possible implementations were
available.
- Don't try the mirror for "localhost" URLs.
- Minimum Python version is now 2.5. Even Debian/stable has it now.
- Update the copyright year to 2009 in various places.
Version: 0.38 - Released on 2009-01-18 10:39:18 UTC
NEW FEATURES
- Get the LZMA archive decompressor through Zero Install if missing
(suggested by Frank Richter).
- Added --message option to display a hint to the user. This is useful
if the user might be confused about why a download box has suddenly
appeared. Added messages to explain the compile process, and about
getting the LZMA decompressor.
- Added "0store audit" command. Verifies every implementation in each of
the given cache directories, or in all of the default cache
directories if no arguments are given. This will detect any packages
which have been tampered with since they were unpacked.
- Cope better with being run through sudo. If we find ourselves running
as root but $HOME is owned by a user, get root's real home from
/etc/passwd and use that for the configuration and cache files and for
gpg's home. Otherwise, we are likely to create root-owned files in the
user's home directory.
- Log "Missing " at info level, not warning. It's not really
an error to include a feed that doesn't know about your one.
CHANGES
- Use subprocess instead of deprecated popen2 module (reported by Keith
Hopper).
- Fixed some deprecation warnings from Python 2.6.
- Better check for Debian-style distribution. Check for
'/var/lib/dpkg/status', not just '/var/lib/dpkg' (reported by Markus
Rathgeb).
- New key for Eric Wasylishen.
BUG FIXES
- Only cache a "no" icon if the policy returned a fetcher for
downloading the icon. This fixes occasional display of the default
icon even though a feed has an icon (Frank Richter).
- Fixed typo in manpage (Rabbe Fogelholm).
- When changing the network preference, call solve_with_downloads().
recalculate() is deprecated and doesn't update the display properly if
feeds have to be downloaded.
- Versions list didn't work if the solver hadn't reached it. If the
solver doesn't get as far as evaluating a component then we try to
just list all the versions sorted version number, not solver
preference. Due to a type change, this had stopped working.
- Ignore off-line mode setting when the user explicitly clicks Refresh.
- Downloading fixed selections failed if the feed was known. Typo in
selections.py. Added a test to check it.
- --download-only option was ignored if used with --set-selections.
Version: 0.37 - Released on 2008-11-30 16:22:34 UTC
CHANGES
- Include all attributes in selections. XML Meta-data such as the
license and compile command weren't previously included.
- Increase delay before checking for updates If NetworkManager says
we're not connected yet, wait 2 minutes before trying anyway (not 20
seconds).
- zeroinstall.injector.gpg.load_keys(): Use the primary UID for the name
of a key (Frank Richter).
BUGS
- App list box: Get rid of horizontal scrollbar (Frank Richter). Actions are
right aligned, and the app description fills all the width between icon and
actions columns.
- Ensure over_overrides file is flushed before renaming. Reported on ROX
web-site.
- Allow changing the stability rating of implementations in feeds
Before, it tried to save the settings for the interface, not the feed.
- Don't filter out feeds with no machine type when looking for source
code. We treated a missing machine type in a as "any", but that
doesn't match if we're looking for source code.
- Don't treat "src" as an architecture group. After selecting a "src"
package, it assumed this was a 32-bit architecture and tried to find
dependencies to match.
- "Manage feeds" dialog: limit size of icons displayed in list (Frank Richter).
- Fixed last-check-attempt time-stamp code. When checking for updates we
store a time-stamp so that we don't keep re-checking the same feed in
a short period. If the time-stamp file already existed, this code
failed to update it.
UNIT TESTS
- Rename duplicate-named test (Mark Seaborn)
- Tidy: remove some dead test code (Mark Seaborn)
- Tidy: remove unused imports (Mark Seaborn)
- If http_proxy is set it can cause the download tests to fail (Mark
Seaborn)
Version: 0.36 - Released on 2008-11-15 19:30:17 UTC
Note that although some changes have been made to better support Windows,
this is untested. We are still looking for volunteers to test and debug it
on Windows.
- Update the display less frequently while downloading Debian bug
#497569 says downloading uses 100% CPU (Simon Wenner). Not sure if this
is the reason, but we're probably updating the display too frequently
anyway.
- Reject URIs without a path component (e.g. http://host).
- Don't assume an RPM-based distribution just because /var/lib/rpm
exists. Actually check for the /var/lib/rpm/Packages file instead
(reported by Demetrio Girardi).
- Reject obvious attempts to drag archives to 0desktop. People keep
trying to drag .exe, .tar.bz2, etc archives to 0desktop. Reject URLs
ending in these strings with a more helpful error message (rather than
downloading them and complaining that it's not XML).
- Record architecture for Debian packages We used to assume that a
native Debian package had an arch type of '*' (i.e. it would always be
compatible with everything). However, on a mixed 32 and 64 bit platform,
we can't use a 64-bit native library with a 32-bit Zero Install package.
Therefore, take notice of the deb's architecture too. Might need a
similar change for RPMs too.
- Use subprocess to unpack archives. Avoid fork() so it can work on
Windows.
- Don't use fork() for downloads; Windows doesn't support it. Uses
subprocess instead.
Version: 0.35 - Released on 2008-08-16 15:07:22 UTC
Changes since 0.34:
New features:
- Added support for multi-arch We can choose either x86_64 binaries or
i[3456]86 binaries, but we can't mix both in a single process. Also
fixed the sense of the OS and CPU tests so that we now pick the best
OS and CPU match rather than the worst (oops!).
- Added --cpu and --os arguments to 0launch This allows you to choose a
binary for a different host. It's also useful on an x86_64 machine to
run an x86 binary.
Bug-fixes:
- Don't create .desktop filenames with spaces; xdg-desktop-menu gets
confused and gives a misleading error message ("does not
have a proper vendor prefix") if the name contains a space. Reported
by Thomas Formella.
- Allow file:///path feed URIs. This is equivalent to just using /path. Useful
for drag-and-drop from Konqueror. Reported by Matt Lawrence.
- Log a useful warning if a user_overrides file gets corrupted. Don't
know what could cause this, though. Reported on the ROX web-site.
- Cope with os.uname not existing. Some systems don't support it yet.
- Use subprocess instead of fork when running gpg. Some systems don't
yet have support for fork(). Note that the download and unpacking code
still uses fork, however. See "0launch doesn't work on Windows":
- Only try to download each icon once Before, we would keep trying to
download an icon that was missing.
Documentation:
- Improved web-site design.
- Improved epydoc.
GUI:
- Added "Show Cache" button to "0desktop --manage" window.
- Added "0store manage" command to show the GTK cache viewer. The "Show
Cache" button has been removed from the "0launch --gui" dialog box,
since it didn't really belong there.
Python API:
- Removed a load of unused imports. Thanks, pyflakes! Also found a bug.
Note that this is a slight API change, since it was previously
possible to get these symbols from the wrong module without an error.
- Moved CacheExplorer to zeroinstall.gtkui.
- CacheExplorer now takes the iface_cache as an input
- Moved help_box to zeroinstall.gtkui.
- Moved some useful GUI code into zeroinstall.gtkui.gtkutils.
- Added support to model. However, it still isn't supported
yet (see the plash-overlay branch for one option, though).
Version: 0.34 - Released on 2008-06-18 20:49:41 UTC
Command-line interface:
- When running 0launch --set-selections, download any missing
implementations.
- The default algorithm for "0store manifest" is now sha1new.
- Added "0desktop" command (see below).
Graphical user interface:
Lots of changes here, many resulting from Matt Lawrence's UI review.
- Added 0desktop command for desktop integration. This is a re-packaged
version of Zero2Desktop, now bundled in with 0launch. Supplying
Zero2Desktop separately meant that the first time a user installed an
application they had to first install the installer, which was rather
confusing.
Packagers: note that for this reason, Zero Install now depends on
xdg-utils rather than downloading it as needed.
- "0desktop --manage" provides a way to display and manage applications
you have added to the menus:
- Run - launches the program.
- Help - displays the program's documentation files.
- Properties - runs "0launch --gui".
- Delete - removes the launcher.
- Gave Zero Install its own submenu in Applications. Instead of having
"Add Zero Install Program" on the Accessories menu, we now have a top-
level "Zero Install" menu with "Add New Program" and "Manage
Programs".
- Use "Component" instead of "Interface" in the main window.
- The list of versions used to have a "Cached" checkbox column
indicating whether that version needed to be fetched or not. Now it
shows the download size, or (cached), (local) or (package), like the
Fetch column in the main window does.
- Added a link button in the bug report dialog to existing bug reports,
so you can see where your report ended up.
- Replaced "Interface Properties" button with a menu button on each row
of the table. This should make the other options (e.g. Compile and
Report Bug) easier to find. The Refresh and Show Cache buttons move
down into the new space, making the window shorter overall. Also,
elide the end of the summary when the window is too narrow, rather
than showing a scrollbar.
Python API:
- Added Selections.download_missing. Starts of download of any
implementations that are missing. Also fetches any required feeds or
keys.
- Added a new zeroinstall.gtkui package for GTK widgets.
- Moved treetips into zeroinstall.gtkui. This class provides a generic
way to display tooltips on a TreeView.
- Added AppListBox widget for managing lists of applications (used by
"0desktop --manage"). You can provide your own object to reuse it to
manage other lists, such as the list of plugins for an application.
Other changes:
- Removed use of deprecated "sets" module. Python 2.6 issues a warning.
- Cope with locales when finding man-pages. Instead of searching for a
man-page, search for a 'man' directory and set $MANPATH. Then man
itself will apply the normal rules for getting the right translation
(suggested by Tuomo Valkonen).
- Don't try a mirror if the download failed because the user aborted it.
- Updated get_details to use subprocess module. Unit-tests were failing
on Python 2.6a3. allpython.sh now tests 2.4, 2.5 and 2.6.
- Don't abort on https or other unknown download URL schemes. Zero
Install would fail to load a feed that contained a download URL with
an unknown scheme. Now, we don't generate an error unless the user
actually tries to download it. Also, added 'https' to the list of
allowed schemes. Reported by Justus Winter.
Version: 0.33 - Released on 2008-05-04 14:29:38 UTC
- Check network status with NetworkManager D-BUS service before doing
background updates. The logic is:
- If we're on-line, check right away.
- Otherwise (offline, connecting, unknown), sleep for 20 seconds and
if we're not offline at the end, go ahead.
This is designed to prevent two problems:
- You log in. 0launch tries to check for updates to everything in your
session while you're still connecting. These things therefore never
get updated.
- You're offline, but 0launch displays notifications about failing to
update from time-to-time.
If you don't use NetworkManager, then the effect of this is to always
delay updates by 20 seconds, which shouldn't cause any problems.
- Added support for getting feeds from mirrors. We start a mirror
download if the primary site fails or takes longer than five seconds
(in which case we try both in parallel). The mirror currently
hard-coded to http://roscidus.com/0mirror.
- Also get GPG keys using the mirror. If we got a feed from a mirror,
get the key from there too.
- When downloading with the GUI, animate the pointer too.
- Moved most of the GUI start-up code into new main.py. This is to make
it easier to test the GUI.
- Disabled Plash support when unpacking for now. Current versions of
unzip and cpio use the fchmod command, which doesn't work under Plash
at the moment. Therefore, Plash support has been disabled. See:
http://thread.gmane.org/gmane.comp.security.plash/83
- Removed IfaceCache.pending set from the Python API. It is no longer
needed for anything, and causes problems with mirrors.
Bug fixes:
- The background checker failed to report errors correctly. This was
caused by an API change in 0.32, which passes an extra argument to
report_error: TypeError: report_error() takes exactly 2 arguments (3
given)
- Updated epydoc comments. Also hid a few fields/methods that shouldn't
have been public.
- Added unit-tests for background updates and fixed a bug they found.
- Better error message for bad HTTP status when downloading.
- Cope with trailing text at the end of tar's version string. Needed
for Mac version. Reported by Anders F Björklund.
- Cope with $PATH not being set.
- Bugfix: error reporting in background handler was broken.
- Bugfix: multiple dependencies on a single library didn't work. If the
same library was required by two components within a single process,
the solver would exit early with None, which was interpreted as False
(i.e. failure to choose a set of versions). This also affects
libraries that depend on themselves. Reported by Sladi.
- Bugfix: trying to run a program without a main attribute gave a
stacktrace.
- Pass through SystemExit exceptions (for Python 2.4) so you don't get a
stack trace on the console.
Version: 0.32 - Released on 2008-02-23 19:46:09 UTC
Changes since 0.31:
GUI changes
- Remove "checking" box from GUI. The checking box isn't very useful now
that we have background update checks in 0launch, so remove it to
simplify the code.
- Added Stop button to cancel current downloads. Refresh All now shades
while solving, forcing you to stop the current download first.
Unselecting the Run/Download button no longer cancels, it just stops
the action from taking place once the download is complete.
- Perform GUI downloads in the main window. Run/Download is now a toggle
button. If you turn it off before the download completes, the action
is not taken.
- When switching to GUI mode, forward any --verbose options.
- GUI monitoring is now based on the console monitoring code, rather
than having its own implementation.
- The GUI now shows the reason why an implementation couldn't be used in
a new column, not in a tooltip.
- Improve progress bar display when downloading. If there are multiple
files being downloaded or we know the total size, show the fraction
done not just a pulse.
- Some internal refactoring:
- Pass Policy objects around instead of using globals.
- GUIPolicy becomes just GUI and no longer subclasses.
Python API changes
- Moved download_impls from Autopolicy to Policy, since it is now useful
for the GUI too.
- When a download fails because it was aborted, give a better error. Now
raises DownloadAborted, so you can check for that and handle it
specially. The GUI silently ignores this error, since the user knows
they just clicked on the Stop button.
- Policy.get_interface() now gives a deprecation warning. This version
just calls the one in iface_cache, which seems to be the only thing
people using it actually wanted. It will go away soon. Also added a
warning when using plain GPG-signatures.
- Allow extra attributes to be set on Selection objects. 0compile 0.12
needs this.
- Allow setting restrictions on all interfaces in the DefaultSolver, not
just on the root.
- Added VersionRangeRestriction subclass of Restriction. This is to
allow other kinds of Restriction. Multi-tester uses this.
- Downloads now manage their own scheduling. Handler just records what's
being downloaded; it doesn't actually forward data and control the
process.
- Moved basedir to support module.
- Imported ROX-Lib's tasks module, with ROX-specific bits removed and
some extras added.
- Replaced Download.on_success callbacks with a tasks.Blocker.
- Added @tasks.async decorator to simplify common code.
- Moved background updates and icon downloading to tasks system.
- Added Handler.wait_for_blocker(). This runs a GLib mainloop until a blocker
fires. Useful for integrating with non-Blocker aware code.
- Changes to many 'start' methods so that they actually manage the whole
process, not just the beginning. Renamed: start_downloading_* -> download_*
Some do more complex workflows. e.g. the download_and_import_feed task
handles downloading the feed, downloading the keys, confirming the keys and
importing the feed.
- Removed old Policy.walk_interfaces().
- Created Solver class with just the logic for picking versions.
Originally, this is what Policy was for, but it ended up handling all
kinds of other things (e.g. it would start a download if a feed was
missing or stale). The new solver also takes in the architecture and
iface_cache objects explicitly rather than finding the singletons
itself.
- Added Policy.solve_with_downloads(). If a solution is ready then it
returns right away. Otherwise, it downloads every feed used, resolving
after each one until there are no more downloads in progress. This
replaces Autopolicy's recalculate_with_dl with a tasks-based one.
- Replaced get_ranked_selections with record_details on Solver.
- Split out fetching code into fetch.py. This makes it easy to download
an implementation, for example, without doing a solve.
- Deprecated support for old-style GPG signatures. Originally, Zero
Install feeds were signed using 'gpg --clearsign'. Later, support was
added for signing by appending a base64-encoded version of the
signature in an XML comment.
- Split parts of Interface out into ZeroInstallFeed. Originally, a feed
and an interface were the same thing. Now, they have a many-to-many
relationship.
- A feed's is now optional.
- Replaced host_distribution with get_host_distribution(). Allows
importing the distro module without automatically regenerating the
cache. This stops the unit-tests from updating the cache in your home
directory (reported by Mark Seaborn).
Security changes
- Trust Thomas Leonard's key for 0install.net by default. This avoids
the distracting confirmation box on the first run when we check for
updates to the GUI. The key can still be removed later.
- Added Thierry Goubier's key.
- Added Lennon Cook's third GPG key.
- Added key for Andreas K. Förster.
Bug fixes
- Set timezone to GMT before unpacking archives. Some zip archives
unpack with different mtimes depending on the TZ setting!
- Better error when downloading if a python import fails.
- The 'extract' argument didn't work with zip archives. Firstly, because
we put it in the wrong place, and secondly because unzip uses it as a
pattern to filter the results, not as the name of the thing to
extract. Reported by Ilja Honkonen.
- When looking up key owners, cope with subordinate keys. The injector
always records the fingerprint of the actual signing key in the trust
database, which may be a subordinate key. However, when looking up the
user information (for the Preferences box) it only looked at the
fingerprints of the primary keys. This meant that it was unable to
display the user details for some trusted keys, and printed "Got
information about key ..., but I only asked about ...!" warnings.
- Don't check that $PATH is writable unless we're actually trying to add
something. This bug could prevent --manpage, etc, from working.
- Open /dev/null for writing, not reading, in unit test (Mark Seaborn).
Old behaviour caused Plash to hang. Plash is now fixed too.
- Removed warning about old GnuPG. Fixes a problem parsing the version
string on SUSE (reported by Thomas Formella).
- Don't try to read dpkg database unless its directory is accessible to
us.
- Change how last-check_attempt is stored. Instead of storing this as an
attribute in the user_overrides document for a feed, use an empty
timestamp file. The time is now read from iface_cache, not stored as a
property on the Interface / ZeroInstallFeed, as it wasn't really a
property of either (it exists before the feeds does, but is a per-feed
value, not per-interface).
- Better error when the download isn't a feed file. Before, we
complained that no GPG signatures were found. Now, we say that it
doesn't look like a feed, and show the start of the file.
- Better error message if we get an httplib exception when downloading.
Packaging
- Fixed Category field "Application" is not a valid category, according
to the current version of the freedesktop.org spec (Jens Peter
Secher).
- Gave Zero2Desktop a better name in the menu ("Add Zero Install
Program"). Also added Utility category to match the Debian package.
Version: 0.31 - Released on 2007-11-18 21:32:28 UTC
NEW FEATURES
- Added support for using installed RPM packages (Stephen Watson).
- Added support for implementation bindings. This is where you have an element directly inside a or rather
than inside a . In this case, it is an input to the implementation,
telling it where to find itself.
- Added --dir option to 0alias to let the user specify the target directory
(Matthew King).
- Added 'langs' to model. The idea is to be able to pick an
implementation that is
best suited to the user's language (in the future).
- Added a feed for Zero Install itself.
This allows the main package to be handled by 0release and other tools more
easily. It should also allow running newer versions than are installed in
your distribution... if you're very careful and not easily confused!
BUG FIXES
- Work-around possible pygtk bug.
- When a local feed is missing, give the user a hint about how to make the
warning go away.
- When sending notifications using D-BUS about new versions being available,
escape XML characters (e.g. "<"). Otherwise, the message is likely to appear
blank.
NEW KEYS
- Added Tuomo Valkonen's key.
OTHER CHANGES
- Use 0release instead of makedist script and setup.py sdist.
Version: 0.30 - Released on 2007-08-16 20:35:47 UTC
UBUNTU PACKAGE
- The shared /var/cache/0install.net/implementations directory and the
zeroinst system user are now created automatically when the package is
installed. However, sharing is still disabled by default. To turn it
on, just follow the remaining instructions in the 0store-secure-add
man-page. Remember to make the script executable. Please test!
SECURITY
- The interface for adding implementations to the system store has
changed. Instead of calling 0store-helper, we call
0store-secure-add-helper. This takes the digest as its only argument,
and requires the .manifest file to already exist.
- A new 0store-secure-add command is installed by default. This is the
command that is called by sudo. It replaces 0store-helper-priv. See
its man-page for details.
- You can no longer add 'sha1' implementations to the system cache. This
algorithm has been deprecated for a long time and should not be used.
- Added Tom Adams's GPG key to the list of known keys.
GUI
- Bugfix: Deleting from the implementation cache in $HOME using the GUI
didn't work because everything is now marked as read-only (reported by
Tom Adams). Note that deleting from the system cache still isn't
possible from the GUI.
- Make the trust dialog box a transient for the main window.
- Make value labels in the trust box selectable.
- Use Glade for various windows.
BUG FIXES
- When we query for information about keys, don't fail if GPG prints
information about a key we didn't request, just print a warning
(reported by Tom Adams). Not sure what causes this.
- Close the file descriptor after copying each file in "0store copy".
For large trees, we could run out of file descriptors!
- Improved error message when we get an IOError reading a feed.
- Better error message if the interface on a <requires> is the empty
string (reported by David A. Ortiz Lozano).
- Remove new-line from tar version (for nicer debug output).
- Added some missing test files to MANIFEST.in (reported by Peter
Santoro). Updated release script to check for this.
- Better error message for syntax errors in digests.
PYTHON API
- AutoPolicy can take a handler argument to use a different Handler.
- The default Handler class now uses GLib's mainloop. This should make
integration with an existing mainloop easier, and opens up the
possibility for timeouts, etc.
- Handler.wait_for_downloads() now uses a GLib mainloop. One minor
effect of this is that errors during downloading are now reported by
calling report_error(), not by throwing the exception from
wait_for_downloads.
- Added Stores.get_first_system_store() as a cleaner way to discover the
system store.
Version: 0.28 - Released on 2007-06-16 20:07:43 UTC
DISTRIBUTION INTEGRATION
Install .desktop file and icon on 'setup.py install'. This makes
Zero2Desktop appear in the menus on some distributions. Added
python-glade2 dependency for Debian package. Zero2Desktop needs it
(reported by Allan Wind).
Two separate methods for integrating Zero Install with native packagers
were added:
You can subclass the new Distribution class for your preferred package
manager. Your class takes a package name and adds
DistributionImplementation objects for versions provided by the package
manager. Currently, only DebianDistribution is provided (works on any
distribution using dpkg, e.g. Ubuntu).
Feed authors can then list native packages in their feeds like this:
If the named package is available then it will be considered as a
possible implementation of the interface. If main is given then it must
be an absolute path.
Note that, unlike a normal implementation, a distribution package does
not resolve to a directory. Any bindings inside <requires> elements for
the interface will be ignored; it is assumed that the requiring
component knows how to use the packaged version without further help.
Therefore, adding distribution packages to your interface considerably
weakens the guarantees you are making about what the requestor may get.
Package implementations still inherit attributes and dependencies from
their parent group. The doc-dir and license attributes may be given, but
'version' and 'released' are read from the native packaging system.
As an alternative to the above (where feed authors provide the
integration), native packages can add themselves to the list of
candidates by creating a file named:
This is treated as an additional feed for IFACE (Jim Ramsay). It can
list either local Zero Install implementations (self-contained
directories) or <package-implementation> elements, as above.
For example, an installer could install ROX-Filer in /opt and create a
symlink to it (/ characters must be escaped as #):
A new stability level of 'packaged' has been added. This is ranked higher than
'stable' (but lower than 'preferred'). Assuming the native installer sets this
in the XML, the native version will be used in preference to other versions by
default.
ALIAS SCRIPTS
Running 0alias with just an alias name (no interface) now edits the policy
for that interface. This replaces the '--versions' option to the alias script,
although the option is still provided for now.
New option: '0alias --resolve SCRIPT' prints the interface URI for a script
previously created by 0alias.
Added --manpage option to 0alias. This displays the man-page for an alias, e.g.
If the argument doesn't look like a 0alias script, it is passed to the system's
man command, so you can do this in your .bashrc file:
alias man="0alias --manpage"
And then do:
$ 0alias foo http://example.com/foo.xml
$ man foo
Currently, the man-page is located in the implementation using some ugly
heuristics. Ideally, the feed should say exactly the man-page is.
FEED FORMAT
Added 'mode' argument to <environment> bindings (requested by Lionel Tricon
for Klik 2).
Added <package-implementation>, as described above.
SECURITY
When creating a temporary directory for extracting an archive, always clear
any special bits. Otherwise, if the parent is set-guid then the tmp directory
will be too, and the post-extraction check will fail because the permissions
are wrong (reported by Markus Kiefer).
Tighten security when following recipes; be more careful about symlinks.
When confirming keys using console mode, trust the new key just for the
required domain, not for all domains. This is the same change that was
made to the GUI in 0.27.
Added Justus Winter's GPG key.
BUGS
When removing a key with the GUI, don't unexpand all the rows.
load_keys() now copes correctly with an empty list as input (fixes a
stack trace when removing the last key with the GUI).
If 0launch-gui can't connect to the X server, display an error message
and exit (rather than continuing until GTK crashes).
Shade the 'Remove Feed' button for feeds which can't be removed (Jim
Ramsay).
When optimising (0store optimise), make directories temporarily writable
as needed.
Corrected --version output to give LGPL as the license, not GPL (spotted
by mrpouit during Ubuntu package review). Also fixed in man-pages.
PYTHON API
Moved ro_rmtree to support module.
Made Implementation an abstract base class, with the previous
implementation in a new ZeroInstallImplementation sub-class.
Made Dependency an abstract base class, and moved most of the attributes
into the new InterfaceDependency subclass. This is to allow other kinds
of Dependency in future.
Implementation.dependencies is now a deprecated read-only property (it
maps interface names to InterfaceDependency objects). It has been
replaced by Implementation.requires, a list of Dependency objects.
Added helpers.ensure_cached(). This returns a set of selections for the
currently chosen implementations, downloading them first if necessary.
Downloading will use the GUI if available, or the console if not.
If the GUI needs to be refreshed, pass the --refresh option so that only
the 'checking for updates' dialog is shown if no updates are available.
Moved some private code from cli.py to the new
helpers.get_selections_gui(). This invokes the GUI to get a set of
implementations and returns the resulting selections.
Moved some of the 0alias command's code to the new alias.py module as
write_script(), and added parse_script() to read the result.
Moved some duplicated internal functions into support.py.
Version: 0.27 - Released on 2007-04-25 19:15:36 UTC
NEW FEATURES
A .desktop file and an icon are now included in the package. The desktop
file runs Zero2Desktop. Packagers may wish to make this appear in the
menus when the package is installed.
Added '0store optimise' command, which searches for duplicate files and
hard-links them together.
Added new --get-selections and --set-selections options for 0launch.
With --get-selections, 0launch doesn't run the program but instead
prints an XML document to stdout giving details of the selected versions
of the program and its libraries. The --set-selections option reads in
one of these documents from a file and executes the chosen versions
instead of selecting a new set of versions.
SECURITY: KEYS AND DOMAINS
New keys are now trusted on a per-domain basis, not globally. Existing
keys are valid for any domain (but you can remove them if you want).
Added a box showing the trusted keys to the Preferences dialog. This
list can be used to remove keys from the trusted list.
When checking a feed, check that the key is valid specifically for the
feed's domain.
Improved the GUI's new-key trust confirmation box:
- Use bold headings and indentation instead of boxes.
- If only one key is being queried then don't show the notebook tabs,
and use the singular form in the prompt to avoid confusion.
- Only ask the user to trust the key for this particular domain.
- Show information about which keys are already trusted for this domain.
- If the key is already trusted in other domains, display them to the
user.
Added TrustDB.domain_from_url() to get the appropriate trust domain for a
feed. Added get_keys_for_domain().
The trust database is now an XML-format file. The old file will be converted
automatically to the new format on the first run. The new format lists all the
domains in which the key is trusted, or '*' for all domains.
SECURITY: SANDBOXING
The way that 0launch communicates with the GUI has changed. Before, if
the GUI was needed then 0launch would exec() it and the GUI would run
the program. This doesn't work with sandboxes (since the GUI needs to
run with high privileges in order to write to the feed cache and the
trusted keys database, communicate with the X server, etc).
Now, the GUI just selects versions and returns them as an XML document,
which 0launch executes. This even works for the test mode when reporting
bugs (the GUI tells 0launch to test the program; 0launch runs the GUI's
chosen versions and collects the output; 0launch sends the output back
to the GUI).
Removed GUI options which are no longer required (--main and --no-self-update)
and support for passing arguments.
A side effect of this is that the GUI no longer updates itself. Instead,
0launch invokes it on itself first if required. This is now possible
because the 0launch process is still running after the first GUI process
exits.
Due to all these changes to the GUI's API, the interface URI for the GUI
has changed.
SECURITY: IMPLEMENTATION CACHE
We now call fixup_permissions even when using 0store-helper to add
programs to the shared system cache. Therefore, the helper doesn't need
to update the permissions itself.
We're now more strict about permissions of cached items. Even the user cache
is now fully read-only and fully world-readable.
COMMAND-LINE INTERFACE
Make 0alias use the first writable non-cache directory in $PATH, not
just the first one (suggested by Lars Hallberg).
Include the arguments that would have been passed to the program in
the --dry-run output.
New "--dry-run --gui" behaviour: before, --dry-run prevented the GUI
from being run; now the GUI is run, but the program it selects isn't.
API AND CODE CHANGES
Added gpg.load_key() and load_keys() to get information about GPG keys.
Re-factored cli.py to make it more readable. Some operations that used
to call sys.exit(0) on success now just return.
DIAGNOSTICS
There's a new --wrapper option so that you can use debuggers and
tracing tools on programs run through 0launch.
For example, to run 0publish --help, displaying all calls to open(2):
If the program is interpreted (e.g. a Python program), and you want to
debug Python itself, you can do it like this:
$ 0launch --wrapper="gdb --args python"
http://0install.net/2006/interfaces/0publish --help
(gdb) run
Note that the wrapper is executed in the environment selected by the
program; hence, this mechanism can't be used for sandboxing.
If there are no valid signatures, display any invalid ones in the error
message.
Improved error messages for invalid feeds:
- Only display the path of the cached copy when using --verbose.
- Don't include the cached copy's name when the uri attribute is wrong;
this long and useless piece of information was getting displayed twice in
a single error message!
When reporting a bug, insert the text of the last error dialog (if any)
into the 'errors and warnings' area by default.
Only write the text of the bug report to stderr if submitting it fails.
If the user clicks on the test button when reporting a bug, and the
program isn't ready to run, display a better message.
BUG FIXES
Workaround: Python 2.5.1's tarfile crashes if 'name' is None; see Python
bug #1706850.
When checking for updates in the background, close stdout. This prevents
the problem where the caller waits for the program 0launch ran to
produce some output, but the background thread is holding the pipe open.
This is only a partial solution. We should close all the other FDs too.
Fixed a problem where any notification closing causes the background
process to exit, even if it wasn't the notification with our 'Download'
button.
When using the GUI, check for updates to the GUI first if there are
stale feeds.
When saving user_overrides, pick a random name for the temporary file,
not just "$name.new". There may be several background processes trying
to update the 'last-check-attempt' time at once.
When collecting program output for bug reports, cope with invalid UTF-8
being returned.
Version: 0.26 - Released on 2007-02-25 14:15:41 UTC
NEW FEATURES
- If the command '0store-helper' is in $PATH, call that just before
putting a new directory into the user's implementation cache. It
should try to use sudo or similar to put it in the system cache. If it
returns failure (non-zero exit status) then we fall back to storing in
the user cache as before. Thanks to Lennon Cook for submitting some
patches and getting this process started at last!
For instructions on setting things up for sharing, see:
http://0install.net/sharing.html
- Support non-GNU versions of tar and cpio found on Solaris, etc (Shawn
Walker).
- If there are stale interfaces but we can still run, do so. Check for
updates in the background. This avoids the annoying "Checking for
updates" box:
- If there are no updates (the common case), you shouldn't even notice
that it checked at all.
- If an update requires confirming a key, it runs the GUI to do that.
- If downloads are available and we have a (D-BUS) notification system
available, offer a Download button to run the GUI.
- When we start checking for updates on a feed, record the time. In the
GUI, if this time is later than the last checked time, display it
(indicates that a check is in progress or failed).
For more details, see: http://rox.sourceforge.net/desktop/node/384
GUI CHANGES
Added a popup menu to the main window, giving quicker access to the list
of versions and compilation functions.
Added 'Report a Bug...' to the popup menu. You are prompted to enter
some text about what happened and what should have happened. Details
about which versions of everything you have selected are collected
automatically. There is a button to run the program and collect stdout
and stderr too. Reports are sent to a special sf.net tracker. In the
future, publishers will be able to specify which tracker to use in the
feed.
Removed minute and hour freshness options. They were only useful for
testing.
PYTHON API
Use iface_cache.get_interface() rather than policy.get_interface() in
several places where we don't expect to trigger a download. The idea is
that the policy version should become private.
For present-but-stale interfaces, Policy.get_interface() just adds it to
a new stale_feeds field rather than starting the download. recalculate()
checks this at the end and starts them all off, if requested. This is
used by the background updates code.
BUG FIXES
When using --list, sort the results.
If we can't delete something using the cache explorer, show the error in
a dialog box, not on the console.
If the argument to '0store add' isn't a file or directory according to
Python, try to stat() it in case the real error is 'permission denied'.
Added some extra debug statements to try and track down a bug where
'0launch --feed' gets the wrong feed target (reported by Michael Siegel
on Debian/stable, but I can't reproduce it even in a Debian/stable
chroot).
When run with -v, log the 0launch version, arguments and Python version.
Fixed a bug where --import didn't actually import the interface if it
had to ask for confirmation of the key first.
Updated the GUI's trust_box to call trust_db.notify(), rather than
calling process_pending on the policy directly.
Cancelling a download only logs at info level, not warning.
DEB PACKAGES
Added a work-around for pycentral. If run as root, Python would put .pyc
files in pycentral's source directory (next to the .py files) instead of
using the per-python-version directory with the pre-compiled .pyc files.
Updated debian/compat version to 5 (shouldn't affect anything, but
the Ubuntu reviewers wanted it changed).
Version: 0.25 - Released on 2007-01-23 22:07:53 UTC
New features:
- Added support for uncompressed .tar files and .tar.lzma archives (suggested
by Daniel Carrera).
- Added iface_cache.get_cached_signatures().
- Missing GPG keys are now downloaded in the background. This means that
several can be downloading at once, and the GUI doesn't freeze while getting
them.
- Added Policy.process_pending(), which takes whatever action is required to
deal with the pending feeds, and TrustDB.notify() so that Handler can resume
the process after adding a key.
- The iface_cache now contains an explicit list of PendingFeed objects,
representing feeds that have been downloaded but are not yet trusted.
- Allow chains of modifiers without numbers in version strings.
E.g. "1-rc2.0-pre-post" is now valid.
- Instead of always adding implementations to the user's store, try writing to
the first of the system stores. Only use the user store if unsuccessful. This
makes it easy for root to install things for users (at least, until we have
the set-uid helper). The system store will be created world-readable, and
anything stored in it will be read-only. User stores honour the user's umask
as usual.
GUI enhancements:
- Renamed 'Execute' to 'Run' (suggested by Daniel Carrera).
- Show cached signatures in the GUI's interface properties, if available.
- Changed window title from "Dependency Injector" to "Zero Install".
- Moved process bar next to buttons so that it doesn't rearrange the dialog
when it appears.
- Moved global preferences into a separate dialog box to simplify user interface.
Hints database:
- Added Daniel Carrera's GPG key to the hints database.
- Added Eric Wasylishen's key to the known keys database.
- Added automatic-converter script's key to hints DB.
Bug fixes:
- Updated to cope with Python 2.5:
- Convert mtimes from floats to ints (reported by Gary M. Witscher).
- Cope with slightly different output from optparse
- Ignore user-overrides for implementations that no longer exist. Caused a
problem with the cache viewer because the version wasn't set.
- Fixed cached size calculate for implementations without manifests.
- Fixed bug in error reporting of unknown stability level names.
- If trusting a key throws a non-SafeException, show a stack trace.
- Stream from gpg.check_stream may or may not be the one passed in. Check
before closing!
- Don't call gobject.type_register(IconAndTextRenderer) for PyGTK >= 2.8.0, as
it causes a deprecation warning (reported by Stephen Watson).
- Since we only inc the window count on show(), don't dec it on destroy()
unless it was shown first.
- Display the full stack trace even for 'safe' exceptions when --verbose is
used.
- Give a proper error when attempting to download an implementation with an
unknown digest algorithm, and *before* doing the download.
- Link 0launch man-page to 0store man-page for more information about FILES.
- Added a 'version-modifier' attribute for s. If present, its
value is appended to the version. This allows the use of modifiers without
breaking older versions of the injector.
- Added support for 0compile's min-version attribute, so that instead of
complaining that the version selected is too old, we actually select a
suitable version in the first place.
- Make XDG_CACHE_DIRS default to /var/cache, not the empty list. This makes it
easier to create live CDs with the required interfaces pre-cached (you no
longer have to set XDG_CACHE_DIRS to make it work).
- When opening the cache explorer, import GTK only after forking, so that ATK
doesn't crash when accessibility is being used (reported by Guillaume
Millet).
- Added support for .cab archives (requested by Thomas Formella).
- Check that 'gpg' is available, as Python's execvp gives a useless error
message if not (reported by Adam Metcalf).
- Better message than "Unsupported machine type" for source code.
- Split Properties dialog into two tabs.
- Added a list area displaying the feeds.
- Remote feeds can now be added, and feeds can also be removed.
- Added new key for Lennon Cook (previous one lost).
- Added 'Compile' button to interface properties window. This will compile a
binary using 0compile and register it as a feed, if source is available.
Python API changes:
- Added lots of documentation for epydoc. See:
http://0install.net/python-api/html/index.html
- Store metadata (extra attributes) on Dependency objects. This is needed by
0compile to indicate whether a dependency is just build-time, or whether it
should be copied to the binary.
- Removed unused reader.get_singleton_text.
- Marked reader's process_depends parse_time and merge_attrs functions as private.
- cli.main takes an argument, instead of using sys.argv
Version: 0.23 - Released on 2006-09-28 09:48:18 UTC
This release is mainly focussed on supporting the new 0compile program, which creates binary packages from sources. For details, see:
http://0install.net/0compile.html
- Added --source command-line option to 0launch, and corresponding 'src' boolean to the Policy constructor. This tells the policy to select an implementation of the root interface with a machine type of 'src'. Dependencies must be compatible with the current machine type, as normal, not 'src'.
- If you try to --import an interface without a uri, give a proper error message instead of an assertion failure.
- Added 'metadata' field to implementations. This contains a map from attribute names to values. Any attributes in the interface are recorded, not just the known ones (released, id, etc) and are inherited from parent groups in the
usual way. If the attribute has a namespace then the key is in the form namespaceURI + space + localName.
Version: 0.22 - Released on 2006-08-28 11:48:40 UTC
- Added '0store copy' command. This copies a possibly-untrusted directory structure into (by default) your cache, checking that it matches the requested digest. This is useful if you notice that a user you don't fully trust already has a program you were about to download - you can safely get a copy from them.
A little more work may be needed to make this completely robust. When ready, the injector can be made to check for suitable directories to copy automatically before starting a download.
This is also useful for sys-admins wanting to copy user downloads into the shared cache to avoid duplication, and should one-day be used in the SetUID script to let this happen automatically.
- Don't warn about interfaces that have changed even though their modification time hasn't. This warning is no longer useful (since modification times come from the signatures now) and causes problems when the cache format changes.
- When caching interfaces with XML signatures, do not add a last-modified attribute. We can get the date directly from the signature when we need it, and modifyingn the XML just invalidates the signature.
A side-effect of this is that we can now cope with non-ASCII characters in XML-signed interface files (Pythons's StringIO copes badly with unicode).
- If received data isn't GPG signed then log the actual data at 'info' level.
- 0store now shows the full stack-trace on error if --verbose is given.
- Fixed error message about bad digest syntax.
- Allow the required digest to be passed to verify() so that temporary directories can be checked too.
- Fixed skipping of '.manifest' files when generating the manifest with non-SHA1 algorithms (the .manifest was included, making the verification fail).
- When using '0store add', still check that we have the right unpacking tool available. Don't try to include the filename in the exception - we don't know what it is at this point!
- If we can't choose a full set of implementations right now, switch to GUI mode so the user can sort it out. We always did that if we were about to
download something, but now we also do it if we're off-line and no suitable version is cached, or if there isn't a suitable version at all (e.g., they're all the wrong arch).
- Added Lennon Cook's key to the hints database.
We also need a sponsor for the Debian package (to upload it to the main repository). Any volunteers?
Version: 0.21 - Released on 2006-05-29 13:54:01 UTC
Changes since 0.20:
- Added 'type' and 'start-offset' attributes to elements.
'type' gives the MIME type of the resource. If missing, the type is
guessed from the archive's URL (as before).
'start-offset' gives the number of bytes to skip at the beginning of the
download.
These new attributes allow some self-extracting archives to be
processed, such as autopackages.
- Added support for zip archives.
- Changed GUI interface to new name. This allows us to use the new XML
signature format (not understood by old versions of the injector) and to
make new releases without having to keep compatibility support for very
old versions (which will continue to use the old interface).
- Updated 0store man-page.
- Queuing of 'confirm trust' boxes wasn't working (partly because boxes
were removed from the queue when shown, rather than when closed, and
partly because the constructor caused them to be shown even before they
reached the queue!).
- When downloading a .bz2 archive, warn if bunzip2 isn't installed.
- For local implementations, show (local) in the 'Fetch' column instead of
(cached).
- Added Dennis Tomas's key.
There is a sample interface here for Visual-ldd:
http://0install.net/tests/Visual-ldd.xml
Running this interface downloads a binary in Autopackage format. It
requires injector version 0.21 or later. It does not install or require
any autopackage components.
Version: 0.20 - Released on 2006-05-01 11:43:20 UTC
There are many new features in this release!
RECIPES
Perhaps the most useful addition is the new <recipe> element, which can
be used in place of an <archive>. It downloads packages from multiple
sources and unpacks them on top of each other to form a single
implementation. E.g.:
This can be used as a poor-man's patch, by creating an archive
containing just the files you want to overwrite. In future versions we
may support other operations in recipes, such as applying a delta.
It may also be useful for supporting automatic conversion of klik
recipes to Zero Install interfaces, since klik works in this way. For
packages designed for Zero Install it is better to use dependencies,
though, as it is more efficient and allows you to upgrade or change the
versions of the individual libraries.
In the GUI, we now show archive names in the download box, not interface
names, since recipes mean there may be multiple downloads for each
interface.
MANIFESTS
Another new feature is that manifests are no longer hard-coded to be
'sha1' everywhere. If the 'hashlib' module is installed (it is included
in Python 2.5 and available separately for older versions) then the new
'sha256' hash is available. I took the opportunity to fix a couple of
problems with the manifest format:
- Directory mtimes are no longer included. I can't think of anything
that relies on this and it causes problems with archives that don't
include all the parent directories.
- When listing the children of a directory, regular files are now listed
before subdirectories. This was just a bug in the old code, but
probably isn't too serious.
Of course, these changes don't apply when using the old 'sha1' hash, as
that would invalidate all our existing archives. Instead, the new
'sha1new' algorithm uses the new format with the old hash. So, we
currently have:
- sha1 - available in all versions (least secure)
- sha1new - requires injector >= 0.20
- sha256 - requires injector >= 0.20 and hashlib (most secure)
One other minor change is that the test for newlines in manifest files
is no longer just an assertion (so it can't be optimised out).
RESTRICTIONS
There is a new <version> element with 'before' and 'not-before'
attributes to limit the set of acceptable versions chosen for a
<requires> element, e.g.:
In future, we may allow other kinds of restriction (such as disabling
a block of versions known not to work with a particular program).
In the GUI, if an implementation is unusable then we now show the reason
in a tooltip.
DEB SUPPORT
In addition to the .tgz, .tar.bz2, .zip and .rpm formats we already
support, Zero Install can now unpack .deb archives. For this to work,
you need the 'ar' program installed. It's part of the binutils package
(on Debian at least) and the injector will warn you before downloading
a .deb if you don't have it.
INTERFACE FILES
In addition to the new <version> element above, interfaces can now have
<homepage> elements, which are shown as clickable links in the
properties box.
If a min-injector-version attribute is set on the root element, versions
of the injector older than that will refuse to run it with a helpful
error message telling the user to upgrade, instead of failing in some
mysterious way. Obviously, this check isn't performed by previous
releases of 0launch, so setting this value to 0.20 or lower is fairly
pointless.
We now reject 'main' attributes which start with '/' in interfaces. This
prevents an easy mistake when making interfaces where you are actually
running the local version of something!
The documentation on the file format has been extended. See:
http://0install.net/injector-specs.html
PYTHON LIBRARY API CHANGES
Implementing recipes required some API changes to the download system. I
don't think anyone else is using this API directly, but if you are
you'll need to update your code. The GUI has been updated to work with
new system, but it should still support the old one too.
Added get_best_source() method to Policy (just picks the first one at
present).
Allow on_success functions to be set on Download objects. They are used
to process the data when the download is complete, rather than returning
the stream from error_stream_closed() and letting the caller handle it.
This also allows a single download to be used by different bits of code.
Added RetrievalMethod as a base class for DownloadSource and Recipe.
Added a manifest.verify() function and moved most of the code to there
from cli.py. This is used by the new 'Verify integrity' menu action on
the cache browser, which provides a graphical version of '0store
verify'.
Version: 0.19 - Released on 2006-03-26 17:51:05 UTC
Changes since 0.18:
- Various optimisations (replaced DOM with expat parser, removed unused
imports, moved some imports to only happen when needed, etc). This
roughly doubles its speed in my tests. For details, see:
- Moved bulk of 0launch to cli.py, so that it can be pre-compiled (faster).
- Added Interface.get_metadata() to fetch any elements from the interface
not recognised by reader.py. This can be used to get and
elements, for example.
- Added policy.get_icon_path(), which returns the path of a cached icon
for an interface, or starts a download if there isn't one already.
- Removed 'sources' from model.Interface. It is covered by metadata now.
- Bugfix: Didn't exit if window was closed using the window manager's
close button.
- Bugfix: Returned success (0) if window was closed by pressing Escape.
- Added a 'Cache explorer' to show the cached interfaces and implementations.
The aim is to make it easy to find things to delete when you need more
disk space.
- Downloading and show icons in the GUI. We always try to load icons as
PNG format. This reduces the risk from buggy image loaders, since only
flaws in the PNG loader will now affect us.
Version: 0.18 - Released on 2006-02-05 11:11:30 UTC
I've put up a new release of the Zero Install Injector (0.18):
http://0install.net/injector.html
Note: The web-site navigation has been changed a bit so that the menu
is on the side rather than at the top. Hopefully this makes it easier to
see where you are!
Lots of changes this time:
- Moved 0launch-gui inside 0launch/zeroinstall, so that you get a copy included
with each release of the injector. This bundled copy appears as an additional
(local) feed. The idea is that the injector won't need to fallback to console
mode on the first run. Because the local copy is only a feed, the injector
will still check for and use updates to the GUI as usual.
- Now that the GUI is bundled, we don't need to trust my key by default.
Instead, the first time the GUI is used you will be prompted to confirm that
you trust my key. This probably gives people a better introduction to the key
system (rather than leaving them thinking that there are no checks!).
- If we have 'pola-run' available[1], use it to sandbox the archive extraction
process (tar, cpio, etc) for extra security. If not, we just run them as
normal.
- Added support for fetching archives using ftp, not just http.
- Added support for extracting RPM archives. This is useful when binaries are
only available in this format, but you will need the rpm2cpio and cpio
commands.
- Added support for XML comment signatures. These are specially formatted
comment blocks at the end of the XML containing a base64 encoded string which
is a GPG detached signature.
The base64 encoding ensures that people can't sneak XML special characters
into the signature (which would be ignored by GPG but might confuse XML
parsers).
The result of vertifying an XML-signed file is the original data (with the
signature), not the data alone (as it is with the old signatures). This is
possible because the signed version is now valid XML.
Try loading the http://0install.net/tests/Tgif.xml interface in your browse to
see the benefit of this! However, it's best to stick with the old format for now
so that people using older versions don't have problems.
The 0publish command (in sf.net subversion only at the moment) can help you create
signatures in the required format.
- Changed default freshness from one week to one month.
- Added --offline option to force off-line mode.
- ppc64 can use ppc32 binaries.
- Clarify remote and local interface names (suggested by Tony Houghton).
- Use GPG's --no-secmem-warning option to stop GPG printing a pointless warning
on some systems (reported Peter Santoro).
- Added " " (space) to the whitelist of allowed characters in the 'extract'
archive (reported by Ilja Honkonen).
- Renamed -a to -f to match --feed long name.
- Ensure that the three standard file descriptors (stdin, stdout and stderr)
exist, opening /dev/null if not. Otherwise, future open() calls are likely to
use them for other things, causing odd effects (Thomas Leonard).
Let me know if you spot any problems (and remember that you can test
subversion checkouts too now). Have fun!
[1] pola-run is part of plash (the Principle of Least Authority shell), available from http://plash.beasts.org/.
Version: 0.17 - Released on 2005-10-16 14:58:35 UTC
The main new feature is improved support for feeds. In particular, people can provide interfaces listing binaries for particular platforms. The main interface then lists these feeds, eg:
You should also refresh the GUI (0launch -rg) to get support for the new system.
Feed changes:
- Each feed now has its own unique name, rather than all feeds having their 'uri' the same as the interface they feed into. A feed should now have a <feed-for interface='...'> to give this information instead.
- When refreshing, also refresh feeds.
- 0launch now has support for removing feeds; the option is now called --feed rather than --add-feed to reflect this change.
- Items in Interface.feeds are now Feed objects, not strings. Each feed also has 'arch' and 'user_override' fields.
- Interfaces can now contain <feed> elements (before, only user_overrides could add feeds).
- If a feed can't be imported, log a warning rather than aborting.
Also, some changes to architecture handling:
- Don't assume Linux-x86 compatibility by default. Instead, wait for people to complain and add the systems that *do* work (see arch.py for details).
- Allow * wildcard for os or machine in arch attributes.
- Ignore feeds for incompatible architectures.
Debugging:
- If a stability setting is invalid, and contains upper-case letters, hint about using lower-case (suggested by Ken Hayber).
Version: 0.16 - Released on 2005-09-20 19:43:54 UTC
The main changes are:
- Arch support. Binaries are ranked depending on how well they fit your
platform. To avoid breaking anything that was working, we assume all
platforms support Linux-i386 binaries (at a low priority). If you
don't like it, edit arch.py (it's only a few lines long). Patches
to better support other platforms welcome.
- Provide more information about the key used to sign an interface. This
is displayed by new versions of the GUI.
- Instead of merging feed information into the main interface in the
reader code, load each feed as a separate interface and consider all
of them when choosing the best implementation. This allows keeping
information about different feeds separate, and allows non-local
feeds. For example, someone could put up a ROX-Filer-Solaris feed
(hint, hint ;-) and the main one could list that as a feed.
- If no system caches are configured, default to checking
/var/cache/0install.net/implementations.
- Allow 'default' attribute on bindings. If the variable
is not already set when binding, assume it was set to this. Provide
default defaults for some common environment variables (PATH,
XDG_CONFIG_DIRS and XDG_DATA_DIRS).
- Cope with cycles (interfaces requiring themselves).
- Throw an exception if we find an invalid object type (eg, a block
device) while generating a manfiest, instead of just printing a
warning and continuing.
TODO list:
- Bundle a copy of the injector-gui interface and implementation and
install to /var/cache. That way, we never have to fall back to console
mode, because a GUI version is always available.
- Provide an interface for adding non-local feeds (you have to edit the
user_overrides file at present).
- Provide a compile-from-source option. My plan is that you have a
source interface (eg, http://.../ROX-Filer-src) which depends on
everything needed to build. When executed, it builds a new release and
adds it as a local feed.
There is also a new version of the GUI.
The main new feature is an improved trust box, which shows the interface URI and any known information about the key.
Version: 0.15 - Released on 2005-08-26 19:39:38 UTC
Added --main option, for packages containing multiple executables.
For example, if the default MAIN is bin/svn then using --main=svnadmin
will run .../bin/svnadmin instead. Combined with AddApp 0.5, this also
means that ROX panel applets are now supported.
You can give a third argument to 0alias for this, to create launchers
which use a different main program.
0launch now allows local interfaces as well as remote URIs. This allows
things like this (for a CVS checkout of ROX-Filer):
$ 0alias rox-cvs ROX-Filer.xml
Here, the 'rox-cvs' command will always launch the version given in that
XML file, leaving the normal 'rox' command unaffected. If you want to
add a CVS copy to the main list, use --add-feed as before.
You can set a released="YYYY-MM-DD" attribute on an implementation, and
it will appear in the GUI (it is only used for display). For CVS
versions, you could set it to 'Snapshot', for example.
'main' is now an attribute of individual implementations, not
interfaces. This gives packagers a bit more flexibility to cope with
layout changes between versions. However, preserving the layout is still
a good idea, as people may still be relying on it.
Setting main= on the root element still works as before, as it is
inherited, and 'interface.main' is still supported for backwards
compatibility from Python code, so I don't recommend that you take
advantage of this new feature for a bit, as people with older versions
won't be able to run your programs if you do.
We use --no-same-owner with GNU tar 1.13.92 (reported to work by Peter
Prohaska).
Plus various minor bugfixes.
Yesterday, I made a new release of the GUI (0.12). New features here:
- If we check for updates and none are found, but we still need to
download something (eg, because the user cancelled last time), prompt
instead of downloading automatically (reported by Jonatan Liljedahl).
- When an error box is shown while checking for updates, wait for the
box to be closed before continuing.
- Use -V for version, and -v to increase logging (like 0launch).
- Show release dates, if available (requires injector 0.15).
- Better text formatting for interface details window.
- Added tooltips to implementations list.
There's also a new release of Archive, for people who found it
complained about there being no ROX-Lib.
Version: 0.14 - Released on 2005-08-14 20:03:15 UTC
Mandrake and SuSE 9.3 RPMs are available.
We now allow running local interface files directly. These files
are not signed, and may contain relative implementation paths (like
".").
This is useful when running a program directly (not though zero
install), but the program depends on libraries which should be fetched
this way. For example, this will be the case when using a CVS version of
a program. So, you'd do:
$ cd myprog-cvs
$ 0launch ./myprog.xml
and it would download all the dependencies and set up the environment
variables, and then run the main executable from that directory.
Doing this doesn't add the new version to the cached list. In fact, the
interface doesn't even need a URI specified to be used like this, which
might be useful for people who want their program to use 0launch for
libraries, but not for the program itself.
If you *do* want the CVS version to be added to the master list of
available versions (so that if another program does '0launch
http://myprog' or uses it as a library it can use the CVS version), do
this:
$ cd myprog-cvs
$ 0launch --add-feed myprog.xml
Now, whenever 0launch looks up this interface, it will also read in the
myprog.xml file, making that version available too. If you want to try
this out, I've added a ROX-Filer.xml file to ROX-Filer's CVS.
(the stability is marked as 'developer', so it will only be selected if
you set that as your preferred stability for ROX-Filer)
I've removed the old 'local_interfaces' configuration directory, which
also let you add local versions, but only by creating XML files with
silly names manually, and keeping them up-to-date.
Each line is the name of a directory for cached implementations. These
directories are read from but not written to. This makes it easier to
share downloads between users (this is Part I of hashdrop support).
Finally, a bugfix: it should now cope with multi-line version strings
from tar (Piero Ottuzzi).
The GUI has also been updated. I removed the ID column (no point scaring
people!) and improved the layout a bit, and added support for PyGTK 2.0
(before, you needed 2.2 or later). There are also tooltips for each field so you don't have to open the properties window to get more information.
Version: 0.11 - Released on 2005-06-19 16:03:29 UTC
- When starting the GUI (either due to --gui or because we want to use
the network), 0launch no longer tries to update the GUI itself.
This prevents the problem where:
1. You try to run a program.
2. The injector decides it's time to update, so it starts the GUI.
3. The injector notices it's time to update the GUI.
4. The network is down, so the update fails.
Instead, newer versions of the GUI (0.7 or later) will check for
updates to themselves. After installing this release you should
refresh the GUI (0launch -rg), since if you have an older version
you'll never get automatic updates.
- When switching to GUI mode due to needing a download, we now pass
--refresh to it. This ensures that we refresh all interfaces at once
(which means the user gets annoyed by the dialog less often).
Also, I'm hoping to update the GUI so that it displays a simpler
"checking for updates" dialog in this case (which can be expanded to
the full dialog), and which continues automatically if there aren't
any updates.
- As a handy short-cut, if --gui is used with no interface, we edit the
policy for the GUI itself.
Version: 0.10 - Released on 2005-06-12 11:31:42 UTC
- Added 0store command, for low-level cache manipulation. Sub-commands
are:
- add (add a directory or archive to the cache manually)
- find (print the path of an item)
- list (show caches; currently there is only the user's one)
- manifest (display the manifest for a directory)
- verify (check an item still matches its digest)
- Archives in .tar.bz2 format are now supported.
- Added FILES section to 0launch man-page, showing the location of the
config and cache files.
- Allow symlinks in manifest files (and therefore archives).
- Give URL in error messages for failed downloads.
- When accessing an interface with the wrong URL, throw an exception
instead of just printing a warning (use --import to import from a
different URL).
- Bugfix: Added missing 'fingerprint' property to ValidSig.
Note that because implementations are currently cached as your own user
they are writeable. Therefore, "0store verify" will often fail (for
example, Python drops .pyc files all over the place to speed up loading).
"0store verify" will display a diff between the original structure and
the current one so you can see what changed.
Version: 0.9 - Released on 2005-05-30 13:18:47 UTC
User-level changes to the injector:
- The license is now LGPL (was GPL).
- Added man-pages for 0launch and 0alias.
- --quiet has gone. We are now quiet by default.
- --verbose can be repeated for debug-level output.
- Bugfix: the error about trying to upgrade to an older version didn't
display correctly.
Developer-level changes:
- The interface modification time now comes from the GPG signature, not
an XML attribute. This means you don't have to remember to keep
updating the timestamp manually. However, you might want to continue
doing so for the benefit of people using older versions of the
injector.
- Added --import (update interface cache from a local file). This allows
you to test an interface without having to upload it to a web server
and then download it again. It could also be used to install from a
CD, etc.
- Path interfaces (not URIs) are no longer allowed. Now you can use a
real URI and use --import for testing.
- The huge Policy class has been split into Policy (choosing versions),
Handler (interacting with user/system) and iface_cache (caching and
interfaces).
- Verbose output is now handled by python's logging module.
There was also a new release of the GUI (0.5) yesterday:
- Added support for older versions of PyGTK (2.2.x).
- Uses the locally-installed version of the injector, instead of
downloading a second copy (too confusing!).
Finally, there is a new AddApp ROX application to create ROX wrappers
for injector-based programs:
