Re: Tar balls and binaries have been uploaded

2018-03-04 Thread Scott Kostyshak
On Sun, Mar 04, 2018 at 10:07:07PM +, Jean-Pierre Chrétien wrote:

> Compilation runs fine (no warnings).

Thanks for testing.

> I guess these come from inkscape, not from LyX, right?

I would guess so also.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-03-04 Thread Jean-Pierre Chrétien

Le 26/02/2018 à 17:51, Scott Kostyshak a écrit :

Dear all,

The tar balls and binaries for the upcoming 2.3.0 release have been
uploaded. You can get them here:

   ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/

Can you please compile from the tar ball, and do a basic test of
functionality? Let us know how it goes.


Back to my desktop computer after a trip, here is the status on a Debian stable, 
with TeXLive up-to-date as og 2018-01-04:


Configuration
  Host type:   x86_64-pc-linux-gnu
  Special build flags:  build=release std-regex use-hunspell
  Bundled libraries:boost mythes
  C++ Compiler:g++ (6.3.0)
  C++ Compiler flags:   -fPIC -O2 -std=c++14
  C++ Compiler user flags:
  Linker flags:
  Linker user flags:
  Qt Frontend:
  Qt version:  5.7.1
  Packaging:   posix
  LyX binary dir:  /usr/local/bin
  LyX files dir:   /usr/local/share/lyx-2.3.0

Compilation runs fine (no warnings).

UserGuide.pdf compiles fine.

I still get this kind of warning in the command window when a conversion from 
svgz takes place:


** (inkscape:7474): WARNING **: No cc:license metadata found, derived license 
URI from cc:License: http://creativecommons.org/publicdomain/zero/1.0/

Bitmap saved as: /tmp/lyx_tmpdir.sNFRagSw6769/gconvertCI6769.png
Background RRGGBBAA: ff00
Area 0:0:128:128 exported to 128 x 128 pixels (96 dpi)
Bitmap saved as: /tmp/lyx_tmpdir.sNFRagSw6769/gconvertlg6769.png

I guess these come from inkscape, not from LyX, right?

--
Jean-Pierre




Re: Tar balls and binaries have been uploaded

2018-03-03 Thread Scott Kostyshak
On Fri, Mar 02, 2018 at 12:07:45PM +, Uwe Stöhr wrote:

> Also Google itself does not recommend to use AV software as main step for
> security:
> https://security.googleblog.com/2015/07/new-research-comparing-how-security.html

Just to be clear, that article does not recommend *against* using
anti-virus software. I think the following excerpt is a good
representation of the findings:

  Meanwhile, 42% of non-experts vs. only 7% of experts said that running
  antivirus software was one of the top three three things they do to
  stay safe online. Experts acknowledged the benefits of antivirus
  software, but expressed concern that it might give users a false sense
  of security since it’s not a bulletproof solution.


> Nevertheless, In my opinion the existing
> installer is ready to be announced because only few users in a rare case are
> affected from an issue with MiKTeX. But they can always work.

OK.

> Scott, for the announcement I propose to write that users who have problems
> of getting the UserGuide compiled to a PDF should
> - uninstall LyX _and_ MiKTeX
> - install LyX 2.3.0 using the bundle installer that will automatically
> reinstall MiKTeX

OK.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-03-03 Thread Scott Kostyshak
On Fri, Mar 02, 2018 at 04:44:10PM +, racoon wrote:

> > Scott, for the announcement I propose to write that users who have
> > problems of getting the UserGuide compiled to a PDF should
> > - uninstall LyX _and_ MiKTeX
> > - install LyX 2.3.0 using the bundle installer that will automatically
> > reinstall MiKTeX
> 
> Since in my case an anti-virus software seemed to be the culprit,

This is consistent with my opinion that there are two separate issues
going on, a MiKTeX issue and an anti-virus issue.

> I suggest
> to add that
> 
> - if one has a virus scanner installed and LyX cannot find "latex.exe", as a
> first step just close the installer and rerun it

OK.

I've changed the Windows-specific portion of ANNOUNCE to include the
advice that you and Uwe give:

---
   The following statements are specific to Windows users:
   - After the installation of LyX, the MiKTeX package manager pops up. You
 can just close it.
   - If you installed a pre-release of LyX 2.3.0, you should uninstall that
 version before installing this newer release.
   - If you have a problem compiling the document Help > User Guide after
 installation, consider uninstalling LyX and MiKTeX, and then using the
 LyX *bundle* installer, which will automatically reinstall MiKTeX.
   - If you have a virus scanner installed and LyX cannot find "latex.exe",
 as a first step just close the installer and rerun it.
---

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-03-02 Thread racoon

On 02.03.2018 13:07, Uwe Stöhr wrote:

Am 02.03.2018 um 08:14 schrieb racoon:


I am quite sure that MiKTeX wasn't the problem in my case.


Well, I worked a lot:


Thanks a lot for your efforts.



Scott, for the announcement I propose to write that users who have 
problems of getting the UserGuide compiled to a PDF should

- uninstall LyX _and_ MiKTeX
- install LyX 2.3.0 using the bundle installer that will automatically 
reinstall MiKTeX


Since in my case an anti-virus software seemed to be the culprit, I 
suggest to add that


- if one has a virus scanner installed and LyX cannot find "latex.exe", 
as a first step just close the installer and rerun it


since this message appears even before LyX is installing this saves a 
lot of work and time compared to the alternatives.


Daniel


Re: Tar balls and binaries have been uploaded

2018-03-02 Thread Uwe Stöhr

Am 02.03.2018 um 08:14 schrieb racoon:


I am quite sure that MiKTeX wasn't the problem in my case.


Well, I worked a lot:

- I asked now as many friends as possible to installer. Nobody had a 
problem but except of one they all installed MiKTeX the first time 
together with LyX. The other one, who had the old MiKTeX, had no problem.


- I own 3 PCs and only hade one problem. Only if one has the old MiKTeX 
and run the update once there is the problem that the automatic package 
installation does not work. But this affects only documents for which 
one needs a LaTeX package that is not yet installed. So in effect this 
is a very rare case and normal users won't see it.


- I checked the installer and my PC with which I build the installer 
with ClamWin and Norton AntiVirus - no viruses or similar found.


So how should I proceed? What people report is a bit obscure for me. 
There is no recipe to reproduce a bug.


Polemic: In general, anti Virus programs make problems and are annoying 
for use developers. These programs block things that are allowed by 
Windows and that are even necessary to install a program. Except of 
CamAV all AV programs are closed source and nobody knows what they 
actually do why and what they report back to their companies. Moreover 
they break for example HTTPS connections and are therefore a security risk:

http://www.zdnet.com/article/google-and-mozillas-message-to-av-and-security-firms-stop-trashing-https/
Also Google itself does not recommend to use AV software as main step 
for security:

https://security.googleblog.com/2015/07/new-research-comparing-how-security.html

Conclusion: I'll invest some more time to force the MiKTeX update to 
avoid the problem I can reproduce. Nevertheless, In my opinion the 
existing installer is ready to be announced because only few users in a 
rare case are affected from an issue with MiKTeX. But they can always 
work. TeXLive users don't have this MiKTeX-only feature.


Scott, for the announcement I propose to write that users who have 
problems of getting the UserGuide compiled to a PDF should

- uninstall LyX _and_ MiKTeX
- install LyX 2.3.0 using the bundle installer that will automatically 
reinstall MiKTeX


regards Uwe


Re: Tar balls and binaries have been uploaded

2018-03-01 Thread racoon

On 01.03.2018 19:31, Uwe Stöhr wrote:

Am 28.02.2018 um 10:25 schrieb racoon:


Strange. I just ran the installer again and now it works.


Have you run MiKTeX update on every run of the installer as the 
installer suggested? If so your virus scanner is not to blame.


I have not yet a solution for this other than to reinstall MiKTeX. That 
MiKTeX changed 3 weeks ago (therefore the RC2 installer has no issues) 
the packaging system one can describe the problem like this:


The LyX installer uses a "key" for the "lock" of the package handling. 
Since the lock was replaced, the installer needs a new key. This key 
works for an updated MiKTeX but not for the old one. On top of this 
problem comes that one needs 2 runs of the MiKTeX update to get the new 
packaging system (lock). And even more there is a bug in the new 
packaging system of MiKTeX and the MiKTeX maintainer is currently away.


The LyX installer has no chance to detect what MiKTeX packaging system 
is used on the PC. I think the only way is to build a special installer 
for LyX 2.3.0 that forces 2 update runs of MiKTeX. This will assure the 
success but annoys the user since maybe they already updated and 2 dry 
update runs can consume up to 4 minutes installation time in which 
nothing happens. I know how annoyed users are by every single button 
click they have to do unnecessarily. They will be confronted with 8 
additional clicks because of the mentioned bug in MiKTeX. I think 
assuring a working installation is more important but if they refuse to 
do all the clicks I cannot force 2 update runs.


Give me some time to think about this.


I am quite sure that MiKTeX wasn't the problem in my case. In my first 
run of the installer I did not even get to the point where MiKTeX is 
searching for updates. And I just cancelled the installation before 
MiKTeX update was invoked. And I did not update MiKTeX between the first 
and second run and still, on the second, MiKTeX was found even before 
the updating by the installer.


Daniel



Re: Tar balls and binaries have been uploaded

2018-03-01 Thread Scott Kostyshak
On Thu, Mar 01, 2018 at 06:31:37PM +, Uwe Stöhr wrote:
> Am 28.02.2018 um 10:25 schrieb racoon:
> 
> > Strange. I just ran the installer again and now it works.
> 
> Have you run MiKTeX update on every run of the installer as the installer
> suggested? If so your virus scanner is not to blame.
> 
> I have not yet a solution for this other than to reinstall MiKTeX. That
> MiKTeX changed 3 weeks ago (therefore the RC2 installer has no issues) the
> packaging system one can describe the problem like this:
> 
> The LyX installer uses a "key" for the "lock" of the package handling. Since
> the lock was replaced, the installer needs a new key. This key works for an
> updated MiKTeX but not for the old one. On top of this problem comes that
> one needs 2 runs of the MiKTeX update to get the new packaging system
> (lock). And even more there is a bug in the new packaging system of MiKTeX
> and the MiKTeX maintainer is currently away.
> 
> The LyX installer has no chance to detect what MiKTeX packaging system is
> used on the PC. I think the only way is to build a special installer for LyX
> 2.3.0 that forces 2 update runs of MiKTeX. This will assure the success but
> annoys the user since maybe they already updated and 2 dry update runs can
> consume up to 4 minutes installation time in which nothing happens. I know
> how annoyed users are by every single button click they have to do
> unnecessarily. They will be confronted with 8 additional clicks because of
> the mentioned bug in MiKTeX. I think assuring a working installation is more
> important but if they refuse to do all the clicks I cannot force 2 update
> runs.

Thanks for the explanation. That sounds complicated, indeed.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-03-01 Thread Uwe Stöhr

Am 28.02.2018 um 10:25 schrieb racoon:


Strange. I just ran the installer again and now it works.


Have you run MiKTeX update on every run of the installer as the 
installer suggested? If so your virus scanner is not to blame.


I have not yet a solution for this other than to reinstall MiKTeX. That 
MiKTeX changed 3 weeks ago (therefore the RC2 installer has no issues) 
the packaging system one can describe the problem like this:


The LyX installer uses a "key" for the "lock" of the package handling. 
Since the lock was replaced, the installer needs a new key. This key 
works for an updated MiKTeX but not for the old one. On top of this 
problem comes that one needs 2 runs of the MiKTeX update to get the new 
packaging system (lock). And even more there is a bug in the new 
packaging system of MiKTeX and the MiKTeX maintainer is currently away.


The LyX installer has no chance to detect what MiKTeX packaging system 
is used on the PC. I think the only way is to build a special installer 
for LyX 2.3.0 that forces 2 update runs of MiKTeX. This will assure the 
success but annoys the user since maybe they already updated and 2 dry 
update runs can consume up to 4 minutes installation time in which 
nothing happens. I know how annoyed users are by every single button 
click they have to do unnecessarily. They will be confronted with 8 
additional clicks because of the mentioned bug in MiKTeX. I think 
assuring a working installation is more important but if they refuse to 
do all the clicks I cannot force 2 update runs.


Give me some time to think about this.

regards Uwe


Re: Tar balls and binaries have been uploaded

2018-03-01 Thread racoon

On 01.03.2018 18:50, Uwe Stöhr wrote:

Am 01.03.2018 um 17:18 schrieb Scott Kostyshak:


If this is the cause of all the problems, I guess all we can do is put
a note in the announcement. I do not think we can officially recommend
disabling anti-virus during the installation, but at least we can
explain the situation.


I am opposed to this. This is bad advertisement. We deliver a fully 
functional product. There will always be cases with problems restricted 
to software used by some persons. We should not announce this! I mean 
look in the forums of e.g. LibreOffice or InkScape for virus alarms, 
mangled registry settings and the like. Such cases will always happen. 
We are only responsible to things done by the product we deliver.


I am not sure I understand why this is bad advertisement. Maybe you can 
explain this a bit more.


I think, if the situation is explained that might be rather helpful. 
Otherwise we end up with some users being frustrated if they cannot 
install LyX. Worst case, they will not use LyX.


And while true that forums of LibreOffice contain some discussion about 
false positives, they also clarify this on their pages:


https://www.libreoffice.org/about-us/security/

Daniel



Re: Tar balls and binaries have been uploaded

2018-03-01 Thread Uwe Stöhr

Am 01.03.2018 um 17:18 schrieb Scott Kostyshak:


If this is the cause of all the problems, I guess all we can do is put
a note in the announcement. I do not think we can officially recommend
disabling anti-virus during the installation, but at least we can
explain the situation.


I am opposed to this. This is bad advertisement. We deliver a fully 
functional product. There will always be cases with problems restricted 
to software used by some persons. We should not announce this! I mean 
look in the forums of e.g. LibreOffice or InkScape for virus alarms, 
mangled registry settings and the like. Such cases will always happen. 
We are only responsible to things done by the product we deliver.


regards Uwe


Re: Tar balls and binaries have been uploaded

2018-03-01 Thread Scott Kostyshak
On Thu, Mar 01, 2018 at 11:12:33AM +, racoon wrote:

> I am not sure there is anything to be done about this on the LyX side. Apart
> from the privacy hazard this feature seems to be it is also strange that it
> still lets you use the program with limited functionality which leads to
> obvious problems for installers. I will disable this feature and see what
> will happen in the future.

If this is the cause of all the problems, I guess all we can do is put
a note in the announcement. I do not think we can officially recommend
disabling anti-virus during the installation, but at least we can
explain the situation.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-03-01 Thread racoon

On 28.02.2018 23:31, Scott Kostyshak wrote:

On Wed, Feb 28, 2018 at 08:41:43PM +, racoon wrote:

Yes, I can do it. But the earliest is tomorrow morning (so in about 10
hours).

Just to be sure: The virus scanner did not detect anything. And I left the
scanner activated during the second, successful installation process. It is
just that the scanner did not do a deep scan the second time around probably
because the scanner was already familiar with the file or so.


Ah I see. I did not read carefully enough. In that case, since you
already installed rc2, the scanner would also be familiar with it. So
I no longer think it is worth the time to try to reproduce (unless
someone else does) with rc2.

It would be nice if we could find a way to reproduce with the 2.3.0
installer (so that we could perhaps find a solution). Do you know if the
scanner keeps temporary files somewhere?  Maybe if you restart your
computer, the temporary directory will be cleared, and the scanner will
re-scan if you install it again. Otherwise, is there a folder where
Windows typically caches files? Is this something that the virus scanner
might store in the registry? I would guess not, but I have no idea.


So, I have checked but could not find a way to reproduce yet. However, I 
think I know what was going on.


I was using Avast Antivirus and it has a feature called "CyberCapture". 
It is a bit explained here:


https://support.avast.com/en-ww/article/Antivirus-CyberCapture-FAQ/

"CyberCapture is a feature in Avast Antivirus that detects and analyzes 
rare, suspicious files. If you attempt to run such a file, CyberCapture 
locks the file from your PC and sends it to the Avast Threat Lab where 
it is analyzed in a safe, virtual environment."


It also states that

"CyberCapture is able to handle large files, but it may take longer to 
deliver such files to the Avast Threat Lab."


So, here is what I think happened. Avast did not recognize the large 
file and send it to its server which took quite a bit. I believe there 
was a colored frame with "Avast CyberCapture" around the installer while 
Avast still locked the installer but I kept going on with the 
installation which led to the installer not being able to communicate 
with my system and detect latex.


I am not sure there is anything to be done about this on the LyX side. 
Apart from the privacy hazard this feature seems to be it is also 
strange that it still lets you use the program with limited 
functionality which leads to obvious problems for installers. I will 
disable this feature and see what will happen in the future.


Daniel



Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon
Or it might be even enough to just download a fresh file... I'll try in 
a bit.


Daniel

On 2018-02-28 23:31, Scott Kostyshak wrote:

On Wed, Feb 28, 2018 at 08:41:43PM +, racoon wrote:

Yes, I can do it. But the earliest is tomorrow morning (so in about 10
hours).

Just to be sure: The virus scanner did not detect anything. And I left the
scanner activated during the second, successful installation process. It is
just that the scanner did not do a deep scan the second time around probably
because the scanner was already familiar with the file or so.


Ah I see. I did not read carefully enough. In that case, since you
already installed rc2, the scanner would also be familiar with it. So
I no longer think it is worth the time to try to reproduce (unless
someone else does) with rc2.

It would be nice if we could find a way to reproduce with the 2.3.0
installer (so that we could perhaps find a solution). Do you know if the
scanner keeps temporary files somewhere?  Maybe if you restart your
computer, the temporary directory will be cleared, and the scanner will
re-scan if you install it again. Otherwise, is there a folder where
Windows typically caches files? Is this something that the virus scanner
might store in the registry? I would guess not, but I have no idea.

Thanks,

Scott



Re: Tar balls and binaries have been uploaded

2018-02-28 Thread Scott Kostyshak
On Wed, Feb 28, 2018 at 08:41:43PM +, racoon wrote:
> Yes, I can do it. But the earliest is tomorrow morning (so in about 10
> hours).
> 
> Just to be sure: The virus scanner did not detect anything. And I left the
> scanner activated during the second, successful installation process. It is
> just that the scanner did not do a deep scan the second time around probably
> because the scanner was already familiar with the file or so.

Ah I see. I did not read carefully enough. In that case, since you
already installed rc2, the scanner would also be familiar with it. So
I no longer think it is worth the time to try to reproduce (unless
someone else does) with rc2.

It would be nice if we could find a way to reproduce with the 2.3.0
installer (so that we could perhaps find a solution). Do you know if the
scanner keeps temporary files somewhere?  Maybe if you restart your
computer, the temporary directory will be cleared, and the scanner will
re-scan if you install it again. Otherwise, is there a folder where
Windows typically caches files? Is this something that the virus scanner
might store in the registry? I would guess not, but I have no idea.

Thanks,

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon
Yes, I can do it. But the earliest is tomorrow morning (so in about 10 
hours).


Just to be sure: The virus scanner did not detect anything. And I left 
the scanner activated during the second, successful installation 
process. It is just that the scanner did not do a deep scan the second 
time around probably because the scanner was already familiar with the 
file or so.


Daniel

On 2018-02-28 21:30, Scott Kostyshak wrote:

On Wed, Feb 28, 2018 at 07:20:38PM +, racoon wrote:


Uwe and racoon, do you recommend going forward with the release? Why was
the above not a problem for rc2?


My guess is that I did not have the virus scanner activated when installing
rc2 but can't say for sure.


We've decided to delay the release.

racoon, I'm sorry to ask you to spend more time on this (especially now
that you have things working and probably do not want to change
anything), but would you be willing to uninstall 2.3.0 and see if you
can reproduce the issue with the 2.3.0rc2 installer (e.g. having the
virus scanner activated)? I'm curious in whether there is a difference
between 2.3.0rc2 and 2.3.0. I do not blame you if you do not want to
touch your working installation. You've already been so helpful in
testing.

Scott



Re: Tar balls and binaries have been uploaded

2018-02-28 Thread Scott Kostyshak
On Wed, Feb 28, 2018 at 07:20:38PM +, racoon wrote:

> > Uwe and racoon, do you recommend going forward with the release? Why was
> > the above not a problem for rc2?
> 
> My guess is that I did not have the virus scanner activated when installing
> rc2 but can't say for sure.

We've decided to delay the release.

racoon, I'm sorry to ask you to spend more time on this (especially now
that you have things working and probably do not want to change
anything), but would you be willing to uninstall 2.3.0 and see if you
can reproduce the issue with the 2.3.0rc2 installer (e.g. having the
virus scanner activated)? I'm curious in whether there is a difference
between 2.3.0rc2 and 2.3.0. I do not blame you if you do not want to
touch your working installation. You've already been so helpful in
testing.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon



On 2018-02-28 17:50, Scott Kostyshak wrote:

On Wed, Feb 28, 2018 at 11:36:33AM +, racoon wrote:

On 28.02.2018 12:04, Uwe Stöhr wrote:



Strange. I just ran the installer again and now it works.


The installer checks the Windows registry to locate LaTeX program. If you have 
MiKTeX or TeXLive  installed but the installer cannot find it, your virus 
scanner blocks that the installer have read access to the registry. This should 
not happen but virus scanners ate often over eager. Blocking read permission 
makes no sense in my opinion.

In general I cannot recommend using virus scanners because the make make 
problems than they solve. I am not using such scanners for years now and I am 
virus-free nevertheless. The best way to stay safe us to use consequently only 
non-admin accounts. If you need to install things that should be available for 
all users of the PC, allow elevated rights only for the installer. Thus way 
virus programs cannot modify e.g. the registry. Only if there are bugs in 
Windows itself, this method can be unsafe but in this case also virus scanners 
don't help.

Just my opinion.


Thanks. I guess a blind spot is when an installer is actually infected with
a virus and one gives the installer elevated right. That's where a virus
scanner might be handy. Though most of the time I do not use one either.


Uwe and racoon, do you recommend going forward with the release? Why was
the above not a problem for rc2?


My guess is that I did not have the virus scanner activated when 
installing rc2 but can't say for sure.


Daniel


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon

On 2018-02-28 17:58, Scott Kostyshak wrote:

On Wed, Feb 28, 2018 at 09:25:47AM +, racoon wrote:


Strange. I just ran the installer again and now it works.


To be clear, the installer works and after the installation you can
successfully compile e.g. the user guide?


That is correct.

Daniel


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread Scott Kostyshak
On Wed, Feb 28, 2018 at 09:25:47AM +, racoon wrote:

> Strange. I just ran the installer again and now it works.

To be clear, the installer works and after the installation you can
successfully compile e.g. the user guide?

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread Scott Kostyshak
On Wed, Feb 28, 2018 at 11:36:33AM +, racoon wrote:
> On 28.02.2018 12:04, Uwe Stöhr wrote:
> > 
> > > Strange. I just ran the installer again and now it works.
> > 
> > The installer checks the Windows registry to locate LaTeX program. If you 
> > have MiKTeX or TeXLive  installed but the installer cannot find it, your 
> > virus scanner blocks that the installer have read access to the registry. 
> > This should not happen but virus scanners ate often over eager. Blocking 
> > read permission makes no sense in my opinion.
> > 
> > In general I cannot recommend using virus scanners because the make make 
> > problems than they solve. I am not using such scanners for years now and I 
> > am virus-free nevertheless. The best way to stay safe us to use 
> > consequently only non-admin accounts. If you need to install things that 
> > should be available for all users of the PC, allow elevated rights only for 
> > the installer. Thus way virus programs cannot modify e.g. the registry. 
> > Only if there are bugs in Windows itself, this method can be unsafe but in 
> > this case also virus scanners don't help.
> > 
> > Just my opinion.
> 
> Thanks. I guess a blind spot is when an installer is actually infected with
> a virus and one gives the installer elevated right. That's where a virus
> scanner might be handy. Though most of the time I do not use one either.

Uwe and racoon, do you recommend going forward with the release? Why was
the above not a problem for rc2?

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon

On 28.02.2018 12:04, Uwe Stöhr wrote:



Strange. I just ran the installer again and now it works.


The installer checks the Windows registry to locate LaTeX program. If you have 
MiKTeX or TeXLive  installed but the installer cannot find it, your virus 
scanner blocks that the installer have read access to the registry. This should 
not happen but virus scanners ate often over eager. Blocking read permission 
makes no sense in my opinion.

In general I cannot recommend using virus scanners because the make make 
problems than they solve. I am not using such scanners for years now and I am 
virus-free nevertheless. The best way to stay safe us to use consequently only 
non-admin accounts. If you need to install things that should be available for 
all users of the PC, allow elevated rights only for the installer. Thus way 
virus programs cannot modify e.g. the registry. Only if there are bugs in 
Windows itself, this method can be unsafe but in this case also virus scanners 
don't help.

Just my opinion.


Thanks. I guess a blind spot is when an installer is actually infected 
with a virus and one gives the installer elevated right. That's where a 
virus scanner might be handy. Though most of the time I do not use one 
either.


Daniel


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread Uwe Stöhr

> Strange. I just ran the installer again and now it works.

The installer checks the Windows registry to locate LaTeX program. If you have 
MiKTeX or TeXLive  installed but the installer cannot find it, your virus 
scanner blocks that the installer have read access to the registry. This should 
not happen but virus scanners ate often over eager. Blocking read permission 
makes no sense in my opinion.

In general I cannot recommend using virus scanners because the make make 
problems than they solve. I am not using such scanners for years now and I am 
virus-free nevertheless. The best way to stay safe us to use consequently only 
non-admin accounts. If you need to install things that should be available for 
all users of the PC, allow elevated rights only for the installer. Thus way 
virus programs cannot modify e.g. the registry. Only if there are bugs in 
Windows itself, this method can be unsafe but in this case also virus scanners 
don't help. 

Just my opinion. 

Many thanks fir testing and best regards
 Uwe 


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon

On 28.02.2018 07:03, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 09:38:47PM +, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 08:24:43PM +, racoon wrote:

Yes.


What is the exact error message that is given and when is it given? Can
you provide a screenshot?


Also, have you uninstalled all previous 2.3.0 pre-release versions
before trying to install 2.3.0 final?


Strange. I just ran the installer again and now it works.

I noticed that the virus scanner scanned the installer at the first run. 
Maybe that somehow interfered with the installer?!?


Daniel


Re: Tar balls and binaries have been uploaded

2018-02-28 Thread racoon

On 28.02.2018 07:03, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 09:38:47PM +, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 08:24:43PM +, racoon wrote:

Yes.


What is the exact error message that is given and when is it given? Can
you provide a screenshot?


Screenshot attached. The installer cannot find my LaTeX distribution.

Daniel


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread racoon
Yes, uninstalled all 2.3.0 pre-release version before trying to install 
LyX.


I think the dialog asks whether I want to use LaTeX and asks me to 
provide the location of latex.exe manually. I think I never saw that 
before. I'll look more closely at it and provide a screenshot in an hour 
or so when I am at my windows 7 computer.


Daniel

On 2018-02-28 07:03, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 09:38:47PM +, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 08:24:43PM +, racoon wrote:

Yes.


What is the exact error message that is given and when is it given? Can
you provide a screenshot?


Also, have you uninstalled all previous 2.3.0 pre-release versions
before trying to install 2.3.0 final?

Scott



Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Scott Kostyshak
On Tue, Feb 27, 2018 at 09:38:47PM +, Scott Kostyshak wrote:
> On Tue, Feb 27, 2018 at 08:24:43PM +, racoon wrote:
> > Yes.
> 
> What is the exact error message that is given and when is it given? Can
> you provide a screenshot?

Also, have you uninstalled all previous 2.3.0 pre-release versions
before trying to install 2.3.0 final?

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Scott Kostyshak
On Tue, Feb 27, 2018 at 08:24:43PM +, racoon wrote:
> Yes.

What is the exact error message that is given and when is it given? Can
you provide a screenshot?

Thanks,

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread racoon

Yes.

Daniel

On 2018-02-27 18:07, Scott Kostyshak wrote:

On Tue, Feb 27, 2018 at 05:08:23PM +, racoon wrote:

I tried to install the windows binary but the installer does not find the
latex.exe.


So 2.3.0rc2 worked for you, but 2.3.0 does not?

Scott



Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Scott Kostyshak
On Tue, Feb 27, 2018 at 06:35:19PM +, Jürgen Lange wrote:
> My antivirus program is Windows 10 Defender.
> I tried to download the lyx exe file once again with the newest
> detection rules of Windows Defender. No trojan detected, no abort,
> installation without problems. Seems to be a false positiv result before
> and Microsoft investigated the file in the meantime.

That is good news. Thanks for getting back to us so quickly, Jürgen, and
for your report.

Best,

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Jürgen Lange
My antivirus program is Windows 10 Defender.
I tried to download the lyx exe file once again with the newest
detection rules of Windows Defender. No trojan detected, no abort,
installation without problems. Seems to be a false positiv result before
and Microsoft investigated the file in the meantime.

Jürgen



signature.asc
Description: OpenPGP digital signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Richard Heck
On 02/27/2018 12:12 PM, Scott Kostyshak wrote:
> On Tue, Feb 27, 2018 at 06:19:06AM +, Scott Kostyshak wrote:
>> On Mon, Feb 26, 2018 at 10:02:58PM +, Jürgen Lange wrote:
>>> Hello,
>>>
>>> the binary LyX-230-Installer-1.exe (Windows 10) downloaded from
>>>
>>> ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
>>>
>>> seems to contain Trojan:Win32/Azdem.A!cl
>> Thanks for this report, Jürgen.
>>
>> Note related reports:
>>
>> https://www.mail-archive.com/search?l=mid=20171227013449.i43xa5exdrgoc643%40steph
>>
>> I'm CC'ing our Windows packager.
> Note also that Qt seems to have this issue pop up as well:
>
> https://www.mail-archive.com/search?l=mid=CALckqK2FSPSU3SkAudKkOBLgeTs%2BuKm5XgcJPAMh3O3cf6wgjg%40mail.gmail.com
> https://www.mail-archive.com/search?l=mid=CAKN5Pd%3Df1TaAA-kAiqTqd5vmQjAgbyazS2isUu3cqgD6Vkwurg%40mail.gmail.com

Note that both of those emails say it is the Qt libraries that are being
flagged.

R



Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Scott Kostyshak
On Tue, Feb 27, 2018 at 06:19:06AM +, Scott Kostyshak wrote:
> On Mon, Feb 26, 2018 at 10:02:58PM +, Jürgen Lange wrote:
> > Hello,
> > 
> > the binary LyX-230-Installer-1.exe (Windows 10) downloaded from
> > 
> > ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
> > 
> > seems to contain Trojan:Win32/Azdem.A!cl
> 
> Thanks for this report, Jürgen.
> 
> Note related reports:
> 
> https://www.mail-archive.com/search?l=mid=20171227013449.i43xa5exdrgoc643%40steph
> 
> I'm CC'ing our Windows packager.

Jürgen, what scanner detected the trojan? Is your virus/trojan detector
up to date?

I've looked more into this topic. Here are some related topics:

https://www.mail-archive.com/search?l=mid=CA%2B7gJ%3DZn_%2BQFXb4MKj1NeLNECNgguhF-JSd0vJrSsF%2BTEupvmQ%40mail.gmail.com
https://www.mail-archive.com/search?l=mid=CAC5Snw8bdA7SRMiJBmsJt_bjfRg1JnjGAzOM4izuigzdSfpBiw%40mail.gmail.com
https://www.mail-archive.com/search?l=mid=7894598c-1e1c-3ba3-0fe7-c92e62abd17f%40unitybox.de
https://marc.info/?l=lyx-devel=148095349313844=2

Note also that Qt seems to have this issue pop up as well:

https://www.mail-archive.com/search?l=mid=CALckqK2FSPSU3SkAudKkOBLgeTs%2BuKm5XgcJPAMh3O3cf6wgjg%40mail.gmail.com
https://www.mail-archive.com/search?l=mid=CAKN5Pd%3Df1TaAA-kAiqTqd5vmQjAgbyazS2isUu3cqgD6Vkwurg%40mail.gmail.com

Richard, do you still have Comodo AV available to scan with as you did
here?

https://www.mail-archive.com/search?l=mid=57719E66.5000109%40lyx.org

Has anyone else scanned it for trojans? I'm not sure what else to do.

Note that our packager on Windows sends binaries signed with a GPG key,
so it is highly unlikely that if the signature on the binary you
download verifies (let me know if you want more information on this),
that the trojan was added after the binary was prepared.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Scott Kostyshak
On Tue, Feb 27, 2018 at 05:08:23PM +, racoon wrote:
> I tried to install the windows binary but the installer does not find the
> latex.exe.

So 2.3.0rc2 worked for you, but 2.3.0 does not?

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-27 Thread racoon
I tried to install the windows binary but the installer does not find 
the latex.exe.


Best,
Daniel



Re: Tar balls and binaries have been uploaded

2018-02-27 Thread Pavel Sanda
Scott Kostyshak wrote:
> > > Gentoo ebuildfails and the reason is that tarballs are expected
> > > to be found on /pub/lyx/stable/2.3.x not in bin...
> > 
> > Dang it. I'm sorry for that mistake. I can fix it tonight, or if someone
> > else can fix it before, please go ahead.
> 
> Should be fixed. Can you try again?

Compiles and runs fine now. Pavel


Re: Tar balls and binaries have been uploaded

2018-02-26 Thread Scott Kostyshak
On Mon, Feb 26, 2018 at 10:02:58PM +, Jürgen Lange wrote:
> Hello,
> 
> the binary LyX-230-Installer-1.exe (Windows 10) downloaded from
> 
> ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
> 
> seems to contain Trojan:Win32/Azdem.A!cl

Thanks for this report, Jürgen.

Note related reports:

https://www.mail-archive.com/search?l=mid=20171227013449.i43xa5exdrgoc643%40steph

I'm CC'ing our Windows packager.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-26 Thread Scott Kostyshak
On Mon, Feb 26, 2018 at 05:50:12PM +, Scott Kostyshak wrote:
> On Mon, Feb 26, 2018 at 05:06:47PM +, Pavel Sanda wrote:
> > Scott Kostyshak wrote:
> > > Dear all,
> > > 
> > > The tar balls and binaries for the upcoming 2.3.0 release have been
> > > uploaded. You can get them here:
> > > 
> > >   ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
> > > 
> > > Can you please compile from the tar ball, and do a basic test of
> > > functionality? Let us know how it goes.
> > 
> > Gentoo ebuildfails and the reason is that tarballs are expected
> > to be found on /pub/lyx/stable/2.3.x not in bin...
> 
> Dang it. I'm sorry for that mistake. I can fix it tonight, or if someone
> else can fix it before, please go ahead.

Should be fixed. Can you try again?

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-26 Thread Jürgen Lange
Hello,

the binary LyX-230-Installer-1.exe (Windows 10) downloaded from

ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/

seems to contain Trojan:Win32/Azdem.A!cl

Jürgen



Re: Tar balls and binaries have been uploaded

2018-02-26 Thread Scott Kostyshak
On Mon, Feb 26, 2018 at 05:06:47PM +, Pavel Sanda wrote:
> Scott Kostyshak wrote:
> > Dear all,
> > 
> > The tar balls and binaries for the upcoming 2.3.0 release have been
> > uploaded. You can get them here:
> > 
> >   ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
> > 
> > Can you please compile from the tar ball, and do a basic test of
> > functionality? Let us know how it goes.
> 
> Gentoo ebuildfails and the reason is that tarballs are expected
> to be found on /pub/lyx/stable/2.3.x not in bin...

Dang it. I'm sorry for that mistake. I can fix it tonight, or if someone
else can fix it before, please go ahead.

Scott


signature.asc
Description: PGP signature


Re: Tar balls and binaries have been uploaded

2018-02-26 Thread Pavel Sanda
Scott Kostyshak wrote:
> Dear all,
> 
> The tar balls and binaries for the upcoming 2.3.0 release have been
> uploaded. You can get them here:
> 
>   ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/
> 
> Can you please compile from the tar ball, and do a basic test of
> functionality? Let us know how it goes.

Gentoo ebuildfails and the reason is that tarballs are expected
to be found on /pub/lyx/stable/2.3.x not in bin...
Pavel


Tar balls and binaries have been uploaded

2018-02-26 Thread Scott Kostyshak
Dear all,

The tar balls and binaries for the upcoming 2.3.0 release have been
uploaded. You can get them here:

  ftp://ftp.lyx.org/pub/lyx/bin/2.3.0/

Can you please compile from the tar ball, and do a basic test of
functionality? Let us know how it goes.

We will wait some time for the mirrors to update and then announce the
release.

Thanks,

Scott


signature.asc
Description: PGP signature