June 2009 - Dillo-dev - lists.mailman3.com

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 07:43:15PM -0700, Kelson Vibber wrote: > On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: >> I'd prefer to have both and to offer as an option from the >> download page (as with Fedora). > > So just to confirm, two dillo packages per OS version / architecture > combination, one compiled with SSL, one compiled without? That's the idea. Starting with the most used ones. >> WARNING: Please don't make the packages yet, I've got a last minute >> security vulnerability email, so maybe the tarball will change >> once more (the last). I'll try to have this solved tomorrow in the >> morning. > > Okay, I'll wait until tomorrow before building anything else. > > The good news is I finally got Fedora 10 i686 running from a USB key, > and was able to build the current package! > > So tomorrow I'll be able to build: > Fedora 10 i686 and x86_64 > RHEL 3 i386 > RHEL 4 x86_64 > RHEL 5 i686 and x86_64 BTW, which is the easier way to install an rpm? Just download and "rpm -ivh <PKG>" or is there a ppa-like thing? -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by kelson＠pobox.com

On Jun 18, 2009, at 7:23 PM, Jorge Arellano Cid wrote: > I'd prefer to have both and to offer as an option from the > download page (as with Fedora). So just to confirm, two dillo packages per OS version / architecture combination, one compiled with SSL, one compiled without? > WARNING: Please don't make the packages yet, I've got a last minute > security vulnerability email, so maybe the tarball will change > once more (the last). I'll try to have this solved tomorrow in the > morning. Okay, I'll wait until tomorrow before building anything else. The good news is I finally got Fedora 10 i686 running from a USB key, and was able to build the current package! So tomorrow I'll be able to build: Fedora 10 i686 and x86_64 RHEL 3 i386 RHEL 4 x86_64 RHEL 5 i686 and x86_64

June 19, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 11:20:51PM +0200, Michal Nowak wrote: > On Thu, Jun 18, 2009 at 9:56 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > > Hi, > > > > ?Working on > > > > ? ?2.- To enable-ssl or not enable-ssl (define what to do). > > > > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: > >> [...] > >> Generally speaking for Fedora, we won't turn on options which are not > >> turned on by default in upstream - it usually brings divergence from > >> upstream and comments in upstream mailing lists (not this one :) ) > >> like: "That poor distroX turned on --enable-coolness so we are not > >> supporting users of this distro at all." > >> > >> Turning on SSL in upstream means more pressure for fixing it, usually > >> :). But I am reading dillo-dev long enough to know it's not that easy. > > [snip] > > > > > ?Obviously the safe option is not to offer ssl-enabled packages, > > but that will mainly have the effect of no https-dpi at all. > > > > ?I'm not quite sure which one would be best. > > ?Comments? > > http://mnowak.fedorapeople.org/dillo2/static/ Good! > Looks like Kelson's having some problems with building, so I > patched-rebuilt-installed Kelson's static FLTK2 SRPM and rebuilt > Dillo2. Now there are present i586 pkgs for F-11, both SSL on/off, BTW, is there a special instruction to install them on RPM systems? I mean something like adding a line to /etc/apt/sources.list in Debian. > tomorrow I can build x86-64 pkgs for F-11 at work. And i386 > packs for F-10 (hopefully there's still the F-10 beast in KVM). WARNING: Please don't make the packages yet, I've got a last minute security vulnerability email, so maybe the tarball will change once more (the last). I'll try to have this solved tomorrow in the morning. > (But treat them as third party ones, don't trust them :). ) What do you mean? -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 11:12:12PM +0200, Devid Antonio Filoni wrote: > In Debian, the package in the repo is built with ssl enabled, I prefer > to have the new package with ssl too. Is possible to just show a > warning opening dillo? Yes it is. You can add a warning in the splash page with HTML. Just try making some changes in IO/about.c See the attached page as an example. I'd prefer to have both and to offer as an option from the download page (as with Fedora). WARNING: Please don't make the packages yet, I've got a last minute security vulnerability email, so maybe the tarball will change once more (the last). I'll try to have this solved tomorrow in the morning. -- Cheers Jorge.-

June 19, 2009

dillo-2.1.tar.bz2

by newman.x＠gmail.com

On Thu, Jun 18, 2009 at 9:56 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > Hi, > > ?Working on > > ? ?2.- To enable-ssl or not enable-ssl (define what to do). > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: >> [...] >> Generally speaking for Fedora, we won't turn on options which are not >> turned on by default in upstream - it usually brings divergence from >> upstream and comments in upstream mailing lists (not this one :) ) >> like: "That poor distroX turned on --enable-coolness so we are not >> supporting users of this distro at all." >> >> Turning on SSL in upstream means more pressure for fixing it, usually >> :). But I am reading dillo-dev long enough to know it's not that easy. [snip] > > ?Obviously the safe option is not to offer ssl-enabled packages, > but that will mainly have the effect of no https-dpi at all. > > ?I'm not quite sure which one would be best. > ?Comments? http://mnowak.fedorapeople.org/dillo2/static/ Looks like Kelson's having some problems with building, so I patched-rebuilt-installed Kelson's static FLTK2 SRPM and rebuilt Dillo2. Now there are present i586 pkgs for F-11, both SSL on/off, tomorrow I can build x86-64 pkgs for F-11 at work. And i386 packs for F-10 (hopefully there's still the F-10 beast in KVM). (But treat them as third party ones, don't trust them :). ) > > > -- > ?Cheers > ?Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 18, 2009

dillo-2.1.tar.bz2

by devidfil＠gmail.com

In Debian, the package in the repo is built with ssl enabled, I prefer to have the new package with ssl too. Is possible to just show a warning opening dillo? Devid On 6/18/09, Jorge Arellano Cid <jcid(a)dillo.org> wrote: > Hi, > > Working on > > 2.- To enable-ssl or not enable-ssl (define what to do). > > > On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: >> [...] >> Generally speaking for Fedora, we won't turn on options which are not >> turned on by default in upstream - it usually brings divergence from >> upstream and comments in upstream mailing lists (not this one :) ) >> like: "That poor distroX turned on --enable-coolness so we are not >> supporting users of this distro at all." >> >> Turning on SSL in upstream means more pressure for fixing it, usually >> :). But I am reading dillo-dev long enough to know it's not that easy. > > Reading forums served on https is handy, so I understand if a > user wants to have it enabled. > > Considering that making a user compile dillo is currently a > complex operation (the apparently simple --enable-ssl switch is > complex because of FLTK2 installation issues), I'd try to provide > the packaged option as an alternative to the main package (not > SSL-enabled). > > Something like: > > --------------------------------------------------------------- > Debian: > > Jaunty, Karmic (click here) > > Fedora: > > F11, F12 (click here) > > --------------------------------------------------------------- > With alpha HTTPS support: > * Note that this is NOT checking certificates, may get stuck > in asking dialogs, but will let you read https forums. > > USE AT YOUR OWN RISK > > Debian: > > Jaunty, Karmic (click here) > > Fedora: > > F11, F12 (click here) > --------------------------------------------------------------- > > > > Obviously the safe option is not to offer ssl-enabled packages, > but that will mainly have the effect of no https-dpi at all. > > I'm not quite sure which one would be best. > Comments? > > > -- > Cheers > Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev >

June 18, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

Hi, Working on 2.- To enable-ssl or not enable-ssl (define what to do). On Thu, Jun 18, 2009 at 10:36:39AM +0200, Michal Nowak wrote: > [...] > Generally speaking for Fedora, we won't turn on options which are not > turned on by default in upstream - it usually brings divergence from > upstream and comments in upstream mailing lists (not this one :) ) > like: "That poor distroX turned on --enable-coolness so we are not > supporting users of this distro at all." > > Turning on SSL in upstream means more pressure for fixing it, usually > :). But I am reading dillo-dev long enough to know it's not that easy. Reading forums served on https is handy, so I understand if a user wants to have it enabled. Considering that making a user compile dillo is currently a complex operation (the apparently simple --enable-ssl switch is complex because of FLTK2 installation issues), I'd try to provide the packaged option as an alternative to the main package (not SSL-enabled). Something like: --------------------------------------------------------------- Debian: Jaunty, Karmic (click here) Fedora: F11, F12 (click here) --------------------------------------------------------------- With alpha HTTPS support: * Note that this is NOT checking certificates, may get stuck in asking dialogs, but will let you read https forums. USE AT YOUR OWN RISK Debian: Jaunty, Karmic (click here) Fedora: F11, F12 (click here) --------------------------------------------------------------- Obviously the safe option is not to offer ssl-enabled packages, but that will mainly have the effect of no https-dpi at all. I'm not quite sure which one would be best. Comments? -- Cheers Jorge.-

June 18, 2009

dillo-2.1.tar.bz2

by jcid＠dillo.org

On Thu, Jun 18, 2009 at 09:01:39PM +0200, Devid Antonio Filoni wrote: > On Thu, Jun 18, 2009 at 6:57 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > > Hi, > > > > ?Working on: > > > > ? ? 1.- Solve the OpenSSL license issue and upload rc3. > > > > > > On Thu, Jun 18, 2009 at 05:24:25PM +0200, Devid Antonio Filoni wrote: > >> On Wed, Jun 17, 2009 at 11:45 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > >> > On Wed, Jun 17, 2009 at 10:01:12PM +0200, Devid Antonio Filoni wrote: > >> > [...] > >> > ?Devid: please send me the .deb and its directions when done. > >> DONE! You can find it at https://launchpad.net/~d.filoni/+archive/ppa > >> . However I found an error checking my package using lintian: > >> > >> E: dillo: possible-gpl-code-linked-with-openssl > >> N: > >> N: ? ?This package appears to be covered by the GNU GPL but depends on the > >> N: ? ?OpenSSL libssl package and does not mention a license exemption or > >> N: ? ?exception for OpenSSL in its copyright file. The GPL (including version > >> N: ? ?3) is incompatible with some terms of the OpenSSL license, and therefore > >> N: ? ?Debian does not allow GPL-licensed code linked with OpenSSL libraries > >> N: ? ?unless there is a license exception explicitly permitting this. > >> N: > >> N: ? ?If only the Debian packaging, or some other part of the package not > >> N: ? ?linked with OpenSSL, is covered by the GNU GPL, please add a lintian > >> N: ? ?override for this tag. Lintian currently has no good way of > >> N: ? ?distinguishing between that case and problematic packages. > >> N: > >> N: ? ?Severity: serious, Certainty: wild-guess > >> > >> Can you please fix it? > > > > ?AFAIS, the only program that links to OpenSSL is the https dpi. > > i.e. The ssl-enabled dillo binary doesn't link to it. > > ? ? https.filter.dpi links to it. > > > > ?IANAL, but it looks like giving permission for this dpi is enough, > > and it's already done in its sources (dpi/https.c): > > > > ?* [...] > > ?* As a special exception permission is granted to link the code of > > ?* the https dillo plugin with the OpenSSL project's "OpenSSL" > > ?* library, and distribute the linked executables, without including > > ?* the source code for OpenSSL in the source distribution. You must > > ?* obey the GNU General Public License, version 3, in all respects > > ?* for all of the code used other than "OpenSSL". > > ?* > > ?*/ > > > > > > ?Please let me know if this is _really_ enough or if some extra > > legal formula must be added somewhere else. > It should be enough, at least this is what I see for example at > http://lists.octality.com/pipermail/cherokee/2008-November/009408.html > (take a look in that page for more infos) Good! After reading it and the suggested URLs, especially [1], it looks like our current tarball (rc2) is enough. No new tarball is needed! I consider this point solved, so let's move to the second one... [1] http://www.openssl.org/support/faq.html#LEGAL2 -- Cheers Jorge.-

June 18, 2009

dillo-2.1.tar.bz2

by devidfil＠gmail.com

On Thu, Jun 18, 2009 at 6:57 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: > Hi, > > ?Working on: > > ? ? 1.- Solve the OpenSSL license issue and upload rc3. > > > On Thu, Jun 18, 2009 at 05:24:25PM +0200, Devid Antonio Filoni wrote: >> On Wed, Jun 17, 2009 at 11:45 PM, Jorge Arellano Cid<jcid(a)dillo.org> wrote: >> > On Wed, Jun 17, 2009 at 10:01:12PM +0200, Devid Antonio Filoni wrote: >> > [...] >> > ?Devid: please send me the .deb and its directions when done. >> DONE! You can find it at https://launchpad.net/~d.filoni/+archive/ppa >> . However I found an error checking my package using lintian: >> >> E: dillo: possible-gpl-code-linked-with-openssl >> N: >> N: ? ?This package appears to be covered by the GNU GPL but depends on the >> N: ? ?OpenSSL libssl package and does not mention a license exemption or >> N: ? ?exception for OpenSSL in its copyright file. The GPL (including version >> N: ? ?3) is incompatible with some terms of the OpenSSL license, and therefore >> N: ? ?Debian does not allow GPL-licensed code linked with OpenSSL libraries >> N: ? ?unless there is a license exception explicitly permitting this. >> N: >> N: ? ?If only the Debian packaging, or some other part of the package not >> N: ? ?linked with OpenSSL, is covered by the GNU GPL, please add a lintian >> N: ? ?override for this tag. Lintian currently has no good way of >> N: ? ?distinguishing between that case and problematic packages. >> N: >> N: ? ?Severity: serious, Certainty: wild-guess >> >> Can you please fix it? > > ?AFAIS, the only program that links to OpenSSL is the https dpi. > i.e. The ssl-enabled dillo binary doesn't link to it. > ? ? https.filter.dpi links to it. > > ?IANAL, but it looks like giving permission for this dpi is enough, > and it's already done in its sources (dpi/https.c): > > ?* [...] > ?* As a special exception permission is granted to link the code of > ?* the https dillo plugin with the OpenSSL project's "OpenSSL" > ?* library, and distribute the linked executables, without including > ?* the source code for OpenSSL in the source distribution. You must > ?* obey the GNU General Public License, version 3, in all respects > ?* for all of the code used other than "OpenSSL". > ?* > ?*/ > > > ?Please let me know if this is _really_ enough or if some extra > legal formula must be added somewhere else. It should be enough, at least this is what I see for example at http://lists.octality.com/pipermail/cherokee/2008-November/009408.html (take a look in that page for more infos) > ?TIA. > > -- > ?Cheers > ?Jorge.- > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev > Devid

June 18, 2009

dillo-2.1.tar.bz2

by kelson＠pobox.com

corvid wrote: > Kelson wrote: >> http://www.hyperborea.org/software/dillo/rpms/fltk2-2.0.x.r6403-0.2.src.rpm > > We should use >= 6525 Oops! Wrong link! That's what I used to build the 2.0 packages last October. I meant this one: http://www.hyperborea.org/software/dillo/rpms/fltk2-2.0.x.r6786-0.1.src.rpm -- Kelson Vibber Hyperborea.org - SpeedForce.org

June 18, 2009