Re: Hunspell unmunching question
Andrea, I have already fixed it on build 68. It now displays combined prefixes at the bottom of the derivates panel. I have compiled a build 70 to fix some little bugs, which will be available when I update my site on the 1st of January. I have also written a guide about how to install the dictionaries, also available on the next site update (I will add a link from the English Dictionaries to there). I have also been working on en_GB and it should bring around 700 new words on 1-JAN-2015 (I usually add around 600 to 800 words on each update) making a total of 8000+ new words since I grabbed the project a year ago. My dear friend, Kind regards, Marco A.G.Pinto -- On 24/12/2014 19:56, Andrea Pescetti wrote: On 04/12/2014 Marco A.G.Pinto wrote: What this means is that I probably need to change the code of my tool, maybe create three arrays: 1st - to store the words with suffixes 2nd - to store the codes of the prefixes 3rd - to store 1st plus all its combinations with the prefixes (it would apply prefixes to 1st and store them in 3rd ) Displaying all combinations would be highly unpractical since indeed it would explode. Maybe you could rearrange the GUI so that it displays something like unsubscribe (and derivatives) when it handles prefixes. Regards, Andrea. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org --
Digital signing release for windows.
Hi. It seems (as usual) that the discussion has died out, and nobody does anything (my apologies in advance I am wrong, I would very much like to be wrong). Digital signing was and is a major theme for AOO. In fact AOO and Tomcat was to be the 2 start/test applications for Apache. Infra has invested quite an amount of money into getting this to happen and a big amount of that expires relative soon (Apache has a slot of signings available for 12 month). Tomcat has now for a while signed releases, we (or more correctly the PMC) has received a signing certificateso it is without doubt 100% upto us when we start (as far as I know we have not even done test signing, except for my experiments). I am sure the board of apache will heavely reduce the budget for digitial signing for the year to come, unless we put action behind the pressure we created. My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. What is stopping us from doing something that simple ? If we want a 4.2 so much better, but lets do the simple things first. And please lets not cloud this simple step, by missing buildbots etc. just my opinion. rgds jan i.
Re: building aoo on windows
On 23 December 2014 at 15:29, Ariel Constenla-Haile arie...@apache.org wrote: On Mon, Dec 22, 2014 at 08:29:54PM +0100, Oliver Brinzing wrote: What build settings are neede fpr an release build? These are my (old) configure options for a non-pro build (for a release build, remove the last three): ./configure \ --with-build-version=$(date +%Y-%m-%d %H:%M:%S %z (%a, %d %b %Y)) \ --with-dmake-path=/cygdrive/c/build/dmake/dmake.exe\ --enable-win-x64-shellext \ --with-mozilla-build=/cygdrive/c/mozilla-build \ --with-cl-home=/cygdrive/c/PROGRA~2/MICROS~1.0/VC \ --with-mspdb-path=/cygdrive/c/PROGRA~2/MICROS~1.0/Common7/IDE \ --with-frame-home=/cygdrive/c/PROGRA~1/MICROS~3/Windows/v6.1 \ --with-psdk-home=/cygdrive/c/PROGRA~1/MICROS~3/Windows/v6.1 \ --with-midl-path=/cygdrive/c/PROGRA~1/MICROS~3/Windows/v6.1/Bin \ --with-asm-home=/cygdrive/c/PROGRA~2/MICROS~1.0/VC/bin \ --with-csc-path=/cygdrive/c/Windows/MICROS~1.NET/FRAMEW~1/v3.5 \ --with-directx-home=/cygdrive/c/PROGRA~2/MIBD7F~1 \ --with-jdk-home=/cygdrive/c/PROGRA~2/Java/JDK16~1.0_3 \ --with-ant-home=/cygdrive/c/build/APACHE~1.2 \ --with-lang=en-US \ --enable-wiki-publisher \ --enable-category-b \ --enable-bundled-dictionaries \ --enable-verbose \ --with-package-format=installed msi \ --without-junit \ --with-atl-include-dir=C:/WinDDK/7600.16385.1/inc/atl71 \ --with-atl-lib-dir=C:/WinDDK/7600.16385.1/lib/ATL/i386 \ --with-mfc-include-dir=C:/WinDDK/7600.16385.1/inc/mfc42 \ --with-mfc-lib-dir=C:/WinDDK/7600.16385.1/lib/Mfc/i386 \ --without-stlport \ --disable-strip-solver \ --enable-symbols \ --enable-dbgutil \ They might be old, but they work on my VM (got them from you quite a while ago). I thought we decided to remove wiki-publisher when we released 4.0, for 2 reasons it is a plugin and the licensetext does not seem updated. rgds jan i. And how can i clean a build? cd trunk/main source the build script dmake clean Regards -- Ariel Constenla-Haile La Plata, Argentina
Re: Explaining Java (was RE: Java 32)
On 25 December 2014 at 00:42, Dennis E. Hamilton dennis.hamil...@acm.org wrote: I finished checking on the Java-specific messages and the six messages only have a single place where each is produced. It appears that a single (default en) page could provide the necessary information for reference from any messages in the installed binaries. Andrea suggests The page could be included in the set of standard pages (the xx pages, see http://openoffice.apache.org/website-native.html and then each translation team can decide whether to use the English one or their translated one. A. Is this a potential way to do it? 1. Create an ooo-site/trunk/content/xx/java/ directory. 2. Create leftnav.mdtext and index.mdtext files there. 3. The content/xx/java/index.mdtext would become the English Language version that We adopt for the target. If further breakout is required, it can be handled in that directory at a later time. B. Having done that, and having the message be agreeable, internationalization can commence. C. At an appropriate time, the content/java/ directory is created and it is arranged that this and content/xx/java/ are synchronized. (I have no idea what order this has to be in and which is the master.) D. The current content/download/common/java.html can be redirected to content/java/ Or E. The adjusted default messages that link to the site will link to http://openoffice.org/java and be in the build in time to test (4.1.2?) developer builds with the new messages and the new site pages. How am I doing? Without being an expert, I can only say your suggestion looks pretty much like how I would have done it. Remark, Infra (==me) work on moving translations to a new service. This service will also offer webpage translation (through the same interface) so we can ask all our translators to translate relevant parts. We have to change every page slightly (add a special css and js) and the it just works. I hope to be able to present this at FOSDEM. rgds jan i. -Original Message- From: Andrea Pescetti [mailto:pesce...@apache.org] Sent: Monday, December 22, 2014 00:12 To: dev@openoffice.apache.org Subject: Re: Java 32 On 22/12/2014 Dennis E. Hamilton wrote: I am assuming that we can do the job with a single text. So I see no problem with where it is kept. One consideration might be the maintenance of the different-language versions and how browsers are routed to the correct one. The page could be included in the set of standard pages (the xx pages, see http://openoffice.apache.org/website-native.html and then each translation team can decide whether to use the English one or their translated one. Regards, Andrea. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: building aoo on windows
On Thu, Dec 25, 2014 at 04:57:25PM +0100, jan i wrote: I thought we decided to remove wiki-publisher when we released 4.0, for 2 reasons it is a plugin and the licensetext does not seem updated. It is an extension; as such, it has never been part of a release, not even on Sun/Oracle era. Anyway it's good to keep building it, in order to test it is still buildable; and I guess someday it will be released - people are still downloading this one from 2009 http://extensions.openoffice.org/en/project/sun-wiki-publisher Regards -- Ariel Constenla-Haile La Plata, Argentina signature.asc Description: Digital signature
RE: Digital signing release for windows.
-- replying to -- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. [ ... ] My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. orcmid The official key is not needed in order to confirm a successful signing. Demonstrating a successful signing with any verifiable key is good enough to establish that the end-to-end procedure works. Then take the same originals back through the ASF signing process. A shortcut, which I am puzzling about is to not even do a new build but use the artifacts that are already in the Apache 4.1.1 distribution. (It does mean the cab may have to be opened, and I am not certain how that works for signing). This has the advantage of preserving the provenance of the distribution, because apart from signing the artifacts are identical. It might be too difficult to interrupt the process to just use the end-stage that puts together the (now-signed) cab contents and the installer package. In that case, it might be good enough to experiment with on a single language but not for a new binary release. But if we are certain there is a working process but new builds are needed, waiting for 4.1.1 seems like a good idea. One can then verify the process using a developer build before going to rc01. Also, I think it is still necessary to see what the problem was with having a signed installer (actually, a setup self-extractor the way AOO does it) that creates a setup directory of unsigned artifacts. The Windows 8[.1] Problem seems odd. If it doesn't complain when the 4.1.1 extraction is done with an unsigned installer, I can't quite get the problem. It may be that the way I do installs avoids that problem and that might be useful to understand. (I don't let the installer crap on my desktop, and I have it use a share on a file server instead, and setup runs from there just fine on 8.1 and Windows 10 Technical Preview.) /orcmid Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. [ ... ] - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
[OFF-LIST] RE: Digital signing release for windows.
It occurs to me that nagging the list about things is not moving the ball forward. I suggest that is not useful and it would be valuable to stay constructive or even request assistance. Your offer is interesting. Andrea has the key for AOO. Don't forget that all of the languages need to be done. - Dennis -Original Message- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. Hi. It seems (as usual) that the discussion has died out, and nobody does anything (my apologies in advance I am wrong, I would very much like to be wrong). [ ... ] My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. What is stopping us from doing something that simple ? If we want a 4.2 so much better, but lets do the simple things first. And please lets not cloud this simple step, by missing buildbots etc. just my opinion. rgds jan i. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
RE: [OFF-LIST] RE: Digital signing release for windows. - APOLOGY
I screwed up big time. My carelessness in not correcting the To: address is inexcusable. Jan, I am very sorry. In the future, I will not use any Reply buttons to move off-list. That way I'll have to get the address correct. - Dennis -Original Message- From: Dennis E. Hamilton [mailto:dennis.hamil...@acm.org] Sent: Thursday, December 25, 2014 09:35 To: dev@openoffice.apache.org Subject: [OFF-LIST] RE: Digital signing release for windows. It occurs to me that nagging the list about things is not moving the ball forward. I suggest that is not useful and it would be valuable to stay constructive or even request assistance. Your offer is interesting. Andrea has the key for AOO. Don't forget that all of the languages need to be done. - Dennis -Original Message- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. [ ... ] - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: [OFF-LIST] RE: Digital signing release for windows. - APOLOGY
On Thursday, December 25, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: I screwed up big time. My carelessness in not correcting the To: address is inexcusable. not a problem for me, especially because it gives me a chance to write something I have wanted to in a long time. Jan, I am very sorry. no need to be sorry,this just shows you are human like the rest of us :-) In the future, I will not use any Reply buttons to move off-list. That way I'll have to get the address correct. I do that, and end up sending you extra mails. rgds jan i - Dennis -Original Message- From: Dennis E. Hamilton [mailto:dennis.hamil...@acm.org javascript:;] Sent: Thursday, December 25, 2014 09:35 To: dev@openoffice.apache.org javascript:; Subject: [OFF-LIST] RE: Digital signing release for windows. It occurs to me that nagging the list about things is not moving the ball forward. I suggest that is not useful and it would be valuable to stay constructive or even request assistance. Your offer is interesting. Andrea has the key for AOO. Don't forget that all of the languages need to be done. - Dennis -Original Message- From: jan i [mailto:j...@apache.org javascript:;] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. [ ... ] - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org javascript:; For additional commands, e-mail: dev-h...@openoffice.apache.org javascript:; -- Sent from My iPad, sorry for any misspellings.
Re: Digital signing release for windows.
On Thursday, December 25, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: -- replying to -- From: jan i [mailto:j...@apache.org javascript:;] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. [ ... ] My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. orcmid The official key is not needed in order to confirm a successful signing. Demonstrating a successful signing with any verifiable key is good enough to establish that the end-to-end procedure works. Then take the same originals back through the ASF signing process. which is infra offers test keys, but I was talking about making a release and that requires the official key. I have experimented enough (I started about 6month ago, and was part of the discussions in infra) A shortcut, which I am puzzling about is to not even do a new build but use the artifacts that are already in the Apache 4.1.1 distribution. (It does mean the cab may have to be opened, and I am not certain how that works for signing). This has the advantage of preserving the provenance of the distribution, because apart from signing the artifacts are identical. with my knowledge this would be far more difficult, It might be too difficult to interrupt the process to just use the end-stage that puts together the (now-signed) cab contents and the installer package. you dont interrupt the process, you simply start the build process in the right directory, this is a standard facility of our build system. In that case, it might be good enough to experiment with on a single language but not for a new binary release. But if we are certain there is a working process but new builds are needed, waiting for 4.1.1 seems like a good idea. One can then verify the process using a developer build before going to rc01. The release candidate should only be in a single language, but since we vote on binaries as well The vote should be on all languages we want to release. Also, I think it is still necessary to see what the problem was with having a signed installer (actually, a setup self-extractor the way AOO does it) that creates a setup directory of unsigned artifacts. The Windows 8[.1] Problem seems odd. If it doesn't complain when the 4.1.1 extraction is done with an unsigned installer, I can't quite get the problem. It may be that the way I do installs avoids that problem and that might be useful to understand. (I don't let the installer crap on my desktop, and I have it use a share on a file server instead, and setup runs from there just fine on 8.1 and Windows 10 Technical Preview.) it has been tried both by myself and mark from tomcat, for 8.1 we need the runtime objects signed, for older versions your idea works well. rgds jan i /orcmid Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. [ ... ] - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org javascript:; For additional commands, e-mail: dev-h...@openoffice.apache.org javascript:; -- Sent from My iPad, sorry for any misspellings.
Re: Digital signing release for windows.
On Thursday, December 25, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: It occurs to me that nagging the list about things is not moving the ball forward. I suggest that is not useful and it would be valuable to stay constructive or even request assistance. I agree with you, but sometimes you need to be a bit more direct to get things movingI am not happy about this fact, but look at our list and you will find many good initiatives that simply died. As a side note, I actually was constructive too. This issue is important not only to AOO but also to INFRA as representative for ASF.so it would be unfair just to let it die.but I am all ears (or eyes) for suggestions on how to reactivate good ideas and get them done. Your offer is interesting. Andrea has the key for AOO. I know that, but expected the key had been passed on to some other PMC. Don't forget that all of the languages need to be done I have a script, do when I want to generate I simply tell it which languages..but yes it take calendar and cpu tine. rgds jan i . - Dennis -Original Message- From: jan i [mailto:j...@apache.org javascript:;] Sent: Thursday, December 25, 2014 07:51 To: dev Subject: Digital signing release for windows. Hi. It seems (as usual) that the discussion has died out, and nobody does anything (my apologies in advance I am wrong, I would very much like to be wrong). [ ... ] My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. What is stopping us from doing something that simple ? If we want a 4.2 so much better, but lets do the simple things first. And please lets not cloud this simple step, by missing buildbots etc. just my opinion. rgds jan i. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org javascript:; For additional commands, e-mail: dev-h...@openoffice.apache.org javascript:; -- Sent from My iPad, sorry for any misspellings.
RE: Digital signing release for windows.
-- in reply below -- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 10:13 To: dev@openoffice.apache.org; dennis.hamil...@acm.org Subject: Re: Digital signing release for windows. On Thursday, December 25, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: [ ... ] orcmid The official key is not needed in order to confirm a successful signing. Demonstrating a successful signing with any verifiable key is good enough to establish that the end-to-end procedure works. Then take the same originals back through the ASF signing process. which is infra offers test keys, but I was talking about making a release and that requires the official key. I have experimented enough (I started about 6month ago, and was part of the discussions in infra) orcmid I don't understand what experimentation in Infra has to do with AOO learning, as a project, how to do these things. I apologize for my ignorance in not being around whenever this was discussed before. How can we translate what you have confirmed by experimentation into something the project can do here and that release managers can be equipped to do as we move ahead? If that is available in previous materials that I have missed in my absence, please point to where the information is. /orcmid A shortcut, which I am puzzling about is to not even do a new build but use the artifacts that are already in the Apache 4.1.1 distribution. (It does mean the cab may have to be opened, and I am not certain how that works for signing). This has the advantage of preserving the provenance of the distribution, because apart from signing the artifacts are identical. with my knowledge this would be far more difficult, It might be too difficult to interrupt the process to just use the end-stage that puts together the (now-signed) cab contents and the installer package. you dont interrupt the process, you simply start the build process in the right directory, this is a standard facility of our build system. orcmid Then it is relatively easy to put together a signed distribution using existing artifacts? /orcmid In that case, it might be good enough to experiment with on a single language but not for a new binary release. But if we are certain there is a working process but new builds are needed, waiting for 4.1.1 seems like a good idea. One can then verify the process using a developer build before going to rc01. The release candidate should only be in a single language, but since we vote on binaries as well The vote should be on all languages we want to release. orcmid I don't understand. I thought the idea was to *not* do a new Apache release, but reissue signed convenience binaries. For that, the best provenance is binaries that have already been through the release-process-like approval of the previous binaries. Or are those not done in combination? /orcmid Also, I think it is still necessary to see what the problem was with having a signed installer (actually, a setup self-extractor the way AOO does it) that creates a setup directory of unsigned artifacts. The Windows 8[.1] Problem seems odd. If it doesn't complain when the 4.1.1 extraction is done with an unsigned installer, I can't quite get the problem. It may be that the way I do installs avoids that problem and that might be useful to understand. (I don't let the installer crap on my desktop, and I have it use a share on a file server instead, and setup runs from there just fine on 8.1 and Windows 10 Technical Preview.) it has been tried both by myself and mark from tomcat, for 8.1 we need the runtime objects signed, for older versions your idea works well. orcmid Help me understand what is happening. I understand that the full signing is required for certification, and Rob also commented about some sort of complaint. Yet I have AOO 4.1.1 installed and operating without any complaints on Windows 8.1 and on Window 10 Technology Preview. I am having difficulty comprehending how having the extractor signed and not having the setup files signed screws this up. Is there something else in the install scenario also being changed? PS: I am going to try this myself, but I am not ready to alter my development configuration just yet. I am almost there. /orcmid rgds jan i /orcmid Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. [ ... ] - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
location of libraries/library/module/script DTDs?
Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd These are used in ODF packages for the script-lb.xml, script-lc.xml, and parcel-description.xml files. Besides the DTDs, are there any specs that describe the format of these 3 XML files? I haven't found them in the SDK or the source distribution. I need them to do DTD validation of the script-related metadata in these XML files, in addition to the RelaxNG validation of the other ODF XML content. I'm working on an ODF diagnostic tool, and I need to study these to determine if there can be multiple scripts per XML file, etc. Thanks, Lee - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: building aoo on windows
Hi Ariel, merry xmas to you too, and have fun building :) i worked :-) ./configure \ --with-build-version=$(date +%Y-%m-%d %H:%M:%S %z (%a, %d %b %Y)) \ --with-vendor=My AOO Debug Build \ --with-dmake-url=http://dmake.apache-extras.org.codespot.com/files/dmake-4.12.tar.bz2; \ --with-ant-home=/cygdrive/c/build/ant \ --with-mozilla-build=/cygdrive/c/build/mozilla-build \ --with-frame-home=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0 \ --with-psdk-home=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0 \ --with-midl-path=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0/bin \ --with-cl-home=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/VC \ --with-mspdb-path=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/Common7/IDE \ --with-asm-home=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/VC/bin \ --with-csc-path=/cygdrive/c/Windows/Microsoft.NET/Framework/v3.5 \ --with-jdk-home=/cygdrive/c/Program Files (x86)/Java/jdk1.7.0 \ --with-nsis-path=/cygdrive/c/Program Files (x86)/NSIS/Unicode \ --with-directx-home=/cygdrive/c/Program Files (x86)/Microsoft DirectX SDK (June 2010) \ --with-atl-include-dir=/cygdrive/c/WinDDK/7600.16385.1/inc/atl71 \ --with-atl-lib-dir=/cygdrive/c/WinDDK/7600.16385.1/lib/ATL/i386 \ --with-mfc-include-dir=/cygdrive/c/WinDDK/7600.16385.1/inc/mfc42 \ --with-mfc-lib-dir=/cygdrive/c/WinDDK/7600.16385.1/lib/Mfc/i386 \ --with-package-format=installed msi \ --enable-win-x64-shellext \ --enable-category-b \ --enable-bundled-dictionaries \ --with-lang=de \ --without-fonts \ --without-stlport \ --without-junit \ --disable-online-update \ --disable-strip-solver \ --enable-symbols \ --enable-dbgutil \ --enable-crashdump \ --enable-debug \ --enable-verbose \ next time i will try building with: --enable-pch \ --disable-odk --with-epm-url=http://www.msweet.org/files/project2/epm-3.7-source.tar.gz; \ *) build --all -P2 -- -P2 *) but not sure if epm is needed, it's mentioned in https://wiki.openoffice.org/wiki/Documentation/Building_Guide_AOO maybe this will help to speed up the build process ... Regards Oliver - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
RE: location of libraries/library/module/script DTDs?
The files listed below are not conventional files used in ODF packages. The basic ODF files do not use DTDs and files by those names are not part of the standard ODF document structure. While there might be other files in an ODF package, usually XML files are expected to conform to [xml-names] and need a different schema. What is the file extension on the files you are examining and are there standard ODF components there as well, such as content.xml (the minimum requirement) and a META-INF/manifest.xml conforming to the ODF specification. If it is otherwise an ODF package, the meta.xml file should reveal what software produced it. It may be that these are *OpenOffice-specific and you will find nothing about them in the ODF specification, so your tool may need to differentiate between ODF and implementation-specific content. Note that scripting is implementation-dependent in the ODF specification. - Dennis -Original Message- From: Lee Fisher [mailto:l.office.fis...@gmail.com] Sent: Thursday, December 25, 2014 11:41 To: dev@openoffice.apache.org Subject: location of libraries/library/module/script DTDs? Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd These are used in ODF packages for the script-lb.xml, script-lc.xml, and parcel-description.xml files. Besides the DTDs, are there any specs that describe the format of these 3 XML files? I haven't found them in the SDK or the source distribution. I need them to do DTD validation of the script-related metadata in these XML files, in addition to the RelaxNG validation of the other ODF XML content. I'm working on an ODF diagnostic tool, and I need to study these to determine if there can be multiple scripts per XML file, etc. Thanks, Lee - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: building aoo on windows
Hi Oliver, On Thu, Dec 25, 2014 at 08:51:03PM +0100, Oliver Brinzing wrote: Hi Ariel, merry xmas to you too, and have fun building :) i worked :-) ./configure \ --with-build-version=$(date +%Y-%m-%d %H:%M:%S %z (%a, %d %b %Y)) \ --with-vendor=My AOO Debug Build \ --with-dmake-url=http://dmake.apache-extras.org.codespot.com/files/dmake-4.12.tar.bz2; \ --with-ant-home=/cygdrive/c/build/ant \ --with-mozilla-build=/cygdrive/c/build/mozilla-build \ --with-frame-home=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0 \ --with-psdk-home=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0 \ --with-midl-path=/cygdrive/c/Program Files/Microsoft SDKs/Windows/v7.0/bin \ --with-cl-home=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/VC \ --with-mspdb-path=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/Common7/IDE \ --with-asm-home=/cygdrive/c/Program Files (x86)/Microsoft Visual Studio 9.0/VC/bin \ --with-csc-path=/cygdrive/c/Windows/Microsoft.NET/Framework/v3.5 \ --with-jdk-home=/cygdrive/c/Program Files (x86)/Java/jdk1.7.0 \ --with-nsis-path=/cygdrive/c/Program Files (x86)/NSIS/Unicode \ --with-directx-home=/cygdrive/c/Program Files (x86)/Microsoft DirectX SDK (June 2010) \ --with-atl-include-dir=/cygdrive/c/WinDDK/7600.16385.1/inc/atl71 \ --with-atl-lib-dir=/cygdrive/c/WinDDK/7600.16385.1/lib/ATL/i386 \ --with-mfc-include-dir=/cygdrive/c/WinDDK/7600.16385.1/inc/mfc42 \ --with-mfc-lib-dir=/cygdrive/c/WinDDK/7600.16385.1/lib/Mfc/i386 \ --with-package-format=installed msi \ --enable-win-x64-shellext \ --enable-category-b \ --enable-bundled-dictionaries \ --with-lang=de \ --without-fonts \ --without-stlport \ --without-junit \ --disable-online-update \ --disable-strip-solver \ --enable-symbols \ --enable-dbgutil \ --enable-crashdump \ --enable-debug \ --enable-verbose \ next time i will try building with: --enable-pch \ Yes, this one speeds up building on Windows (it may hide build breakers due to missing header includes, so it should not be added in builds made to test the buildability of the source code). --disable-odk --with-epm-url=http://www.msweet.org/files/project2/epm-3.7-source.tar.gz; \ *) build --all -P2 -- -P2 *) but not sure if epm is needed, it's mentioned in https://wiki.openoffice.org/wiki/Documentation/Building_Guide_AOO Indeed, epm is not needed for Windows. Regards -- Ariel Constenla-Haile La Plata, Argentina signature.asc Description: Digital signature
Re: location of libraries/library/module/script DTDs?
I got a dump of 250MB of ODF files from the AOO bug database, via Rob, the ODF subset used for his recent Peach fuzzing. There are very few examples of scripts. All of the examples I've found to date use these XML files, which refer to these DTD files. I have not see any other script files which do not use these XML files and refer to these DTDs. So, these DTDs *are* referred by one ODF producer which implements scripts. I'll dig up the specific filenames. Since these scripts came from the bug database, the're the 'wild west', could be generated from anywhere. I really wish I had a test suite of AOO QA documents which exercised the script abilities. I realize scripting is outside of the OASIS ODF spec. I would like to find the AOO docs that describe their implementation of scripts. Thanks, Lee On 12/25/2014 11:54 AM, Dennis E. Hamilton wrote: The files listed below are not conventional files used in ODF packages. The basic ODF files do not use DTDs and files by those names are not part of the standard ODF document structure. While there might be other files in an ODF package, usually XML files are expected to conform to [xml-names] and need a different schema. What is the file extension on the files you are examining and are there standard ODF components there as well, such as content.xml (the minimum requirement) and a META-INF/manifest.xml conforming to the ODF specification. If it is otherwise an ODF package, the meta.xml file should reveal what software produced it. It may be that these are *OpenOffice-specific and you will find nothing about them in the ODF specification, so your tool may need to differentiate between ODF and implementation-specific content. Note that scripting is implementation-dependent in the ODF specification. - Dennis -Original Message- From: Lee Fisher [mailto:l.office.fis...@gmail.com] Sent: Thursday, December 25, 2014 11:41 To: dev@openoffice.apache.org Subject: location of libraries/library/module/script DTDs? Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd These are used in ODF packages for the script-lb.xml, script-lc.xml, and parcel-description.xml files. Besides the DTDs, are there any specs that describe the format of these 3 XML files? I haven't found them in the SDK or the source distribution. I need them to do DTD validation of the script-related metadata in these XML files, in addition to the RelaxNG validation of the other ODF XML content. I'm working on an ODF diagnostic tool, and I need to study these to determine if there can be multiple scripts per XML file, etc. Thanks, Lee - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: location of libraries/library/module/script DTDs?
Hello Lee, On Thu, Dec 25, 2014 at 11:40:59AM -0800, Lee Fisher wrote: Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd You can use http://opengrok.adfinis-sygroup.org/ Select aoo-trunk In Projec(s) and put the filename in File Path, this will tell you they are in main/xmlscript/dtd/ https://svn.apache.org/viewvc/openoffice/trunk/main/xmlscript/dtd/ (though I can't find scripting.dtd). If you use OpenOffice, open a document, go to the menu Tools - Customize, modify a toolbar or the menu, and store the changes inside the document, you'll get extra xml files, their DTDs are in https://svn.apache.org/viewvc/openoffice/trunk/main/framework/dtd/ Regards -- Ariel Constenla-Haile La Plata, Argentina signature.asc Description: Digital signature
Re: location of libraries/library/module/script DTDs?
Hi Lee, Lee Fisher schrieb: Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd You can search the code with http://opengrok.adfinis-sygroup.org/ and look into the files. In this case you will find, that the first three are in main/xmlscript/dtd/. For scripting.dtd I cannot help you. It seems to be a namespace URI. These are used in ODF packages for the script-lb.xml, script-lc.xml, and parcel-description.xml files. Besides the DTDs, are there any specs that describe the format of these 3 XML files? The format is in the libraries.dtd. Kind regards Regina - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: location of libraries/library/module/script DTDs?
On 25 December 2014 at 21:18, Lee Fisher l.office.fis...@gmail.com wrote: I got a dump of 250MB of ODF files from the AOO bug database, via Rob, the ODF subset used for his recent Peach fuzzing. There are very few examples of scripts. All of the examples I've found to date use these XML files, which refer to these DTD files. I have not see any other script files which do not use these XML files and refer to these DTDs. So, these DTDs *are* referred by one ODF producer which implements scripts. It is correct that you will find many XML based documents that refer to DTD documents, actually it is a part of XML standard to do so. But that does not mean that scripts or programs use these files. They are often (and in case of AOO it is so) included just as a reference for defining which XML constructs are legal. If you google DTD there are a handfull of sites that offer them for both ODF and OOXML. rgds jan i. I'll dig up the specific filenames. Since these scripts came from the bug database, the're the 'wild west', could be generated from anywhere. I really wish I had a test suite of AOO QA documents which exercised the script abilities. I realize scripting is outside of the OASIS ODF spec. I would like to find the AOO docs that describe their implementation of scripts. Thanks, Lee On 12/25/2014 11:54 AM, Dennis E. Hamilton wrote: The files listed below are not conventional files used in ODF packages. The basic ODF files do not use DTDs and files by those names are not part of the standard ODF document structure. While there might be other files in an ODF package, usually XML files are expected to conform to [xml-names] and need a different schema. What is the file extension on the files you are examining and are there standard ODF components there as well, such as content.xml (the minimum requirement) and a META-INF/manifest.xml conforming to the ODF specification. If it is otherwise an ODF package, the meta.xml file should reveal what software produced it. It may be that these are *OpenOffice-specific and you will find nothing about them in the ODF specification, so your tool may need to differentiate between ODF and implementation-specific content. Note that scripting is implementation-dependent in the ODF specification. - Dennis -Original Message- From: Lee Fisher [mailto:l.office.fis...@gmail.com] Sent: Thursday, December 25, 2014 11:41 To: dev@openoffice.apache.org Subject: location of libraries/library/module/script DTDs? Hi, Where can I find these DTDs: libraries.dtd library.dtd module.dtd scripting.dtd These are used in ODF packages for the script-lb.xml, script-lc.xml, and parcel-description.xml files. Besides the DTDs, are there any specs that describe the format of these 3 XML files? I haven't found them in the SDK or the source distribution. I need them to do DTD validation of the script-related metadata in these XML files, in addition to the RelaxNG validation of the other ODF XML content. I'm working on an ODF diagnostic tool, and I need to study these to determine if there can be multiple scripts per XML file, etc. Thanks, Lee - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: location of libraries/library/module/script DTDs?
It is correct that you will find many XML based documents that refer to DTD documents, actually it is a part of XML standard to do so. But that does not mean that scripts or programs use these files. They are often (and in case of AOO it is so) included just as a reference for defining which XML constructs are legal. If you google DTD there are a handfull of sites that offer them for both ODF and OOXML. Thanks to multiple responders, for the pointers to more easily search the code. The box with the data in question is down for backup, I'll get you specific file names and creator versions by morning. And, again I realize scripting is outside realm of OASIS spec, yet AOO and other clients need to read these documents which contain these scripts. If AOO reads these and doesn't have the DTDs to validate the metdata before running scripts, that sounds kindof scary. That's why I was presuming I'd find the DTDs in the current AOO code, regardless of which codebase generated the original documents. I mainly need to know if the XML files can contain multiple scripts per file, or there must be a separate file for each script (which I think is the case). All scripts I've found to date are StarBasic, Java JARs, Java BeanShell, and JavaScript. (I haven't started parsing the MS-centric VBA OLE2 blobs yet.) I've not found any Python-based scripts yet. I'm not sure what other language-based scripts to be expecting, from the various ODF implementors... :-) I heard someone asking the LibreOffice team to support Guide-based scripting at a recent conference. :-| I've been doing this code by reading the ODF spec, and studying data from code output. I've not yet studied how AOO's current code handles scripts. That's my next step. :-) I don' t yet know which clients run the various scripts. If there is any AOO or other org ODF script interop matrix data, I would very much appreciate a pointer. Thanks, Lee - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: Deflecting the Attack of the Clones
On Tue, Dec 23, 2014 at 3:00 PM, Dennis E. Hamilton dennis.hamil...@acm.org wrote: [Not cross-posting to private@.] -- replying to -- From: Kay Schenk [mailto:kay.sch...@gmail.com] Sent: Tuesday, December 23, 2014 10:20 To: OOo Apache Cc: dennis.hamil...@acm.org; privateAOO Subject: Re: Deflecting the Attack of the Clones On Sun, Dec 21, 2014 at 10:17 AM, jan i j...@apache.org wrote: On Sunday, December 21, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: -- in reply to -- From: Andrea Pescetti [mailto:pesce...@apache.org javascript:;] Sent: Monday, December 15, 2014 13:37 To: dev@openoffice.apache.org javascript:; Subject: Re: Deflecting the Attack of the Clones [ ... ] We are in good relationship with the author. The current branding and wording of AndrOpen Office were approved by the OpenOffice PMC. If any changes are needed, feel free to suggest them. It is an unofficial port, but it is also as close as possible to OpenOffice. orcnote My correspondent notices that there are appropriate disclaimers on the AndrOpen Office AOO web page. In a follow-up sent to me, I am told that the installed software identifies itself as Apache OpenOffice and all of the branding of Apache OpenOffice is present. I think it is important that a fork *not* do that, and that such identifications, including any links to support addresses and for pinging updates be corrected. (I don't have an answer for the on-line help or identification of AndrOpen-specific topics on the OpenOffice Forums.) /orcnote Currently we have AndrOffice listed as a port -- http://www.openoffice.org/porting/ What this means to me is the 3rd party MUST identify itself as Apache OpenOffice. This is different than a fork. So, they SHOULD NOT re-brand. This goes against our trademark policy. See our distribution page -- http://www.openoffice.org/distribution/ But...they should identify that their product is Apache OpenOffice. [ ... ] orcmid This page, https://play.google.com/store/apps/details?id=com.andropenoffice specifically identifies the product as a *fork* of *Apache OpenOffice* and it disavows any association with Apache OpenOffice or LibreOffice projects. It claims to be the world's first *port* of *OpenOffice*. The same confusion arises here: https://sites.google.com/site/andropenoffice/home. There is a separate source code for a few parts, not under ALv2 (MPL or LGPL), apparently for some externals. There is a link for a blog. Although Google Play lists andreopenoffice.com in all of its material, http://andropenoffice.com doesn't serve up anything at the moment. Right on all counts! This last item was particularly confusing to me, as it seems that what's in google play is very different from andropenoffice.com. Here is a typical example of confusion about this product, https://www.marshut.net/pyzxp/aoo-for-android-not-worth-the-download.html . Notice Apache's Open Office for Android. And folks speak of AOO for Android as if it is the AOO known to us. I think the distinction between a port and a fork is lost here and too fine hair-splitting to be useful. If the Apache OpenOffice project is willing to handle support requests for such a product, so be it. Enjoy the reputation. /orcmid Yes, the words fork and port were used and they are not really the same. . I think contacting the vendor re the distinction between these two terms might solve this problem. We will investigate the support item as well. -- - MzK There's a bit of magic in everything, and some loss to even things out. -- Lou Reed
Re: Digital signing release for windows.
On 25 December 2014 at 20:17, Dennis E. Hamilton dennis.hamil...@acm.org wrote: -- in reply below -- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 10:13 To: dev@openoffice.apache.org; dennis.hamil...@acm.org Subject: Re: Digital signing release for windows. On Thursday, December 25, 2014, Dennis E. Hamilton dennis.hamil...@acm.org wrote: [ ... ] orcmid The official key is not needed in order to confirm a successful signing. Demonstrating a successful signing with any verifiable key is good enough to establish that the end-to-end procedure works. Then take the same originals back through the ASF signing process. which is infra offers test keys, but I was talking about making a release and that requires the official key. I have experimented enough (I started about 6month ago, and was part of the discussions in infra) orcmid I don't understand what experimentation in Infra has to do with AOO learning, as a project, how to do these things. OK let me be very precise about the use of my hats. As AOO Committer I tested how AOO could implement digital signing, As INFRA committer I helped ASF find a solution that would work for all projects. I cannot tell you what it has to do with AOO learning, because I am not sure what you mean. I documented my findings on this list. I apologize for my ignorance in not being around whenever this was discussed before. How can we translate what you have confirmed by experimentation into something the project can do here and that release managers can be equipped to do as we move ahead? Simply read the cook receipt I wrote on this thread (and other threads). There are no magic to it, no change to the build system is needed unless we want to automate it. If that is available in previous materials that I have missed in my absence, please point to where the information is. See earlier mails on this list, with subject digital signing (ps. some of the mails might also be on private). If you want to know how ASF have implemented digital signing, you need to search in Infra ML. Basically we can sign artifacts using a tomcat script/program which we could call from inside our build system or use the Web UI to manually sign the artifacts. The build system is not easy to expand (I think everybody who have tried will agree to that), I tried to change it based on the capstone output, but failed. Then I realised that manually uploading the artifacts to the webUI, signing them and then downloading them again was a lot faster. /orcmid A shortcut, which I am puzzling about is to not even do a new build but use the artifacts that are already in the Apache 4.1.1 distribution. (It does mean the cab may have to be opened, and I am not certain how that works for signing). This has the advantage of preserving the provenance of the distribution, because apart from signing the artifacts are identical. with my knowledge this would be far more difficult, It might be too difficult to interrupt the process to just use the end-stage that puts together the (now-signed) cab contents and the installer package. you dont interrupt the process, you simply start the build process in the right directory, this is a standard facility of our build system. orcmid Then it is relatively easy to put together a signed distribution using existing artifacts? Yes very. The time/CPU killer is getting the artifacts build, not the signing afterwards. /orcmid In that case, it might be good enough to experiment with on a single language but not for a new binary release. But if we are certain there is a working process but new builds are needed, waiting for 4.1.1 seems like a good idea. One can then verify the process using a developer build before going to rc01. The release candidate should only be in a single language, but since we vote on binaries as well The vote should be on all languages we want to release. orcmid I don't understand. I thought the idea was to *not* do a new Apache release, but reissue signed convenience binaries. A patch is also a apache release, and since the checksums change it is formally not the same. real apache releases only have source code, so they would never use digital signing. We do however provide binaries as the primary target for end-users with checksums. For that, the best provenance is binaries that have already been through the release-process-like approval of the previous binaries. Or are those not done in combination? We cannot use the binaries for 4.1 unless someone can show how we easily can split the installer and then combine it again. We need a build tree so that our builder can run and generate a new installer. The checksum for the new installer is different from the old installer, so we cannot just overwrite version
RE: Digital signing release for windows.
Thanks Jan, It would be a great help to have links to the posts that document your findings so that someone else could follow in your footsteps and especially figure out what the problem is with Windows 8.1 rejecting unsigned files. May I impose on you for that, please? I see your 2014-12-09 post on Re: Signing AOO 4.1.1 and it is too complicated for me, since I don't understand how to build AOO for Windows in the first place [;). I don't see anything else since I subscribed on 2014-06-22. I may have deleted something that I thought was not of interest to me, but I hope not. Perhaps I am simply not competent enough with the build process to participate in this area. - Dennis PS: I have no access to private @ oo.a.o -Original Message- From: jan i [mailto:j...@apache.org] Sent: Thursday, December 25, 2014 13:25 To: dev; Dennis Hamilton Subject: Re: Digital signing release for windows. [ ... ] OK let me be very precise about the use of my hats. As AOO Committer I tested how AOO could implement digital signing, As INFRA committer I helped ASF find a solution that would work for all projects. I cannot tell you what it has to do with AOO learning, because I am not sure what you mean. I documented my findings on this list. [ ... ] Simply read the cook receipt I wrote on this thread (and other threads). There are no magic to it, no change to the build system is needed unless we want to automate it. [ ... ] See earlier mails on this list, with subject digital signing (ps. some of the mails might also be on private). If you want to know how ASF have implemented digital signing, you need to search in Infra ML. Basically we can sign artifacts using a tomcat script/program which we could call from inside our build system or use the Web UI to manually sign the artifacts. The build system is not easy to expand (I think everybody who have tried will agree to that), I tried to change it based on the capstone output, but failed. Then I realised that manually uploading the artifacts to the webUI, signing them and then downloading them again was a lot faster. /orcmid A shortcut, which I am puzzling about is to not even do a new build but use the artifacts that are already in the Apache 4.1.1 distribution. (It does mean the cab may have to be opened, and I am not certain how that works for signing). This has the advantage of preserving the provenance of the distribution, because apart from signing the artifacts are identical. with my knowledge this would be far more difficult, It might be too difficult to interrupt the process to just use the end-stage that puts together the (now-signed) cab contents and the installer package. you dont interrupt the process, you simply start the build process in the right directory, this is a standard facility of our build system. orcmid Then it is relatively easy to put together a signed distribution using existing artifacts? Yes very. The time/CPU killer is getting the artifacts build, not the signing afterwards. /orcmid In that case, it might be good enough to experiment with on a single language but not for a new binary release. But if we are certain there is a working process but new builds are needed, waiting for 4.1.1 seems like a good idea. One can then verify the process using a developer build before going to rc01. The release candidate should only be in a single language, but since we vote on binaries as well The vote should be on all languages we want to release. orcmid I don't understand. I thought the idea was to *not* do a new Apache release, but reissue signed convenience binaries. A patch is also a apache release, and since the checksums change it is formally not the same. real apache releases only have source code, so they would never use digital signing. We do however provide binaries as the primary target for end-users with checksums. For that, the best provenance is binaries that have already been through the release-process-like approval of the previous binaries. Or are those not done in combination? We cannot use the binaries for 4.1 unless someone can show how we easily can split the installer and then combine it again. We need a build tree so that our builder can run and generate a new installer. The checksum for the new installer is different from the old installer, so we cannot just overwrite version 4.1 we need a patch number. rgds jan i. /orcmid Also, I think it is still necessary to see what the problem was with having a signed installer (actually, a setup self-extractor the way AOO does it) that creates a setup directory of unsigned artifacts. The Windows 8[.1] Problem seems odd. If it doesn't complain when the 4.1.1 extraction is done with an unsigned installer, I can't quite get the problem. It may be that the way I do installs
Re: Signing AOO 4.1.1 (was RE: Budapest and thereafter)
On 13/12/2014 jan i wrote: 8.1 and above, it complains when you start the exe after installation. To people who were waiting for developments in this discussion: a new one (Digital signing release for windows) has been started, so please follow it and I'll post my replies there too. See also the OpenOffice and Infrastructure: ApacheCon meeting discussion. Contrary to popular belief, nothing useful to our purpose was discussed on private lists. Regards, Andrea. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
Re: Digital signing release for windows.
jan i wrote: It seems (as usual) that the discussion has died out, and nobody does anything (my apologies in advance I am wrong, I would very much like to be wrong). You are wrong (so it's good news!), but not so much. I started looking at it only 2 days ago and I didn't get far enough yet. I'm stuck in activating access due to a procedural issue being addressed by Infra; so I don't have the key, but only a preliminary password; and I haven't shared credentials with anyone else at the moment. Anyway, I concur this is a priority. My suggestion is simple, lets rerun AOO 4.1 for windows, sign it digitally, and then release it as a patch version. As 4.1.1? As 4.1.2? From what machines? This is where the discussion is (not where it stopped). And it is a very concrete issue, not some theoretical stupidity. I'll state what I deem unacceptable (we can discuss it if you have different opinions, maybe your views on item C are different?): A) It is unacceptable that the next OpenOffice release is not signed B) It is unacceptable to call something 4.1.2 and release it on Windows only C) It is unacceptable to call something 4.1.2 if it is 100% identical to 4.1.1 on Linux and Mac D) It is unacceptable that the build is not the same quality as 4.1.1 (in terms of compatibility with Windows versions and so on); this risk is quite remote on Windows from what I see. So I already wrote the two options, that can even coexist: 1) Put online new 4.1.1 Windows binaries 2) Create a 4.1.2 with minor updates and bugfixes, cherry-picking some trunk updates. If we choose that 4.1.2 will be a quick release, we may leave all translation updates out of it (Pootle is aligned to trunk at the moment). I would favor option 2, provided we agree quickly (say, in one week) on what we get in it. You'll be happy to know that I have already shortlisted a few bugs that I see relevant for 4.1.2 (list available on request or in separate discussion). I am happy to help, especially with the signing, but to help I need access to the certificate given to the PMC, and somebody who can make a release windows build. I can take care of the certificate part, which as I wrote move forward in the last couple of days. For sure, I can't help you with Windows builds. So you are saying you will need someone else, like Juergen? Steps are simple: 1) make a full build, pick all DLL, JAR and EXE from the object tree 2) Sign them, or let me help with that 3) Overwrite the object tree with the signed artifacts 4) run build but on postprocess (generate new setup package) 5) Sign the installer or let me help with that 6) Upload and start vote 7) Upload to dist and be happy. What is stopping us from doing something that simple ? This is OK for option 1 (the 4.1.1 replacement). Not quite for option 2, meaning that in that case you need the builds in all platforms. But Juergen wrote recently that he still volunteers to provide them, so indeed this is quite feasible. And please lets not cloud this simple step, by missing buildbots etc. In option 1, you only need a Windows machine. In option 2, you need all release build machines. Assuming we have them, I see no other obstacles; we will eventually need buildbots, but these are no longer a prerequisite as I recently wrote. So let's indeed clarify if we want to go for 1 or 2 (or for something else) and then just do it. Regards, Andrea. - To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org For additional commands, e-mail: dev-h...@openoffice.apache.org
