Re: What's the "right" way to update a port to

[Gabriel Rosenkoetter]

On 28 Aug, 2016, at 13:16EDT, Rainer Müller  wrote:
> No, verification of PGP signatures is not provided by base. gpg is not
> available on an standard OS X install. Adding that as a requirement just
> to verify the distfile would be quite heavy.

Oh, absolutely! I wasn’t suggesting making it a requirement, that’s why I wrote:

> On 2016-08-28 18:46, Gabriel Rosenkoetter wrote:
>> 
>> (... but if there’s some standardized “make sure some sort of PGP exists 
>> locally and just warn, rather than fail, if it doesn't” code, ...

I’m pretty certain I’ve seen exactly this “Hey, I can’t check this signature 
because you don’t have a PGP; you might want that, but I’m going ahead anyway” 
message in several tools similar to MacPorts before… CPAN, maybe? I think it 
was also part of pkgrsrc back when I was using NetBSD regularly.

But I guess what you’re saying is, “no, there isn’t a standard way to do this”.

> I would recommend maintainers to verify the signature locally and then
> generate checksums for inclusion in the Portfile.

Huh. I see how that works, but as a user, I guess I’d prefer to do my own 
signature verification at build time, otherwise I’m only trusting the port 
maintainer.

Thinking about this more, though, unless one forces the retrieval of the 
signature to come from the original distribution site, that’s still true, so 
doing this Right is certainly complicated.

If there’s really no appetite for this, no big deal, I was just asking. :^>

--
Gabriel Rosenkoetter
g...@eclipsed.net



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users

Re: What's the "right" way to update a port to

[Rainer Müller]

On 2016-08-28 18:46, Gabriel Rosenkoetter wrote:
> Apologies if this is a common question (if there’s a way to search PiperMail 
> archives that isn’t “download all of them and use grep locally”, I’ve never 
> known what it was), but I didn’t see an explicit facility to list a 
> cryptographic signature for the distribution files.
> 
> Is that a done thing?
> 
> (I can see how one could do this by adding the signature file to $distfiles 
> and then putting the signature verification in a post-checksum step, but if 
> there’s some standardized “make sure some sort of PGP exists locally and just 
> warn, rather than fail, if it doesn't” code, I figure it’s probably better to 
> adhere to that.)

No, verification of PGP signatures is not provided by base. gpg is not
available on an standard OS X install. Adding that as a requirement just
to verify the distfile would be quite heavy.

I would recommend maintainers to verify the signature locally and then
generate checksums for inclusion in the Portfile.

Rainer
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users

Re: What's the "right" way to update a port to

[Gabriel Rosenkoetter]

Thank you both for your responses! (Sorry it took me a bit to follow through on 
them; my day job intervened.)

> On 21 August 2016 at 13:32, Yongwei Wu wrote:
>> Maybe the following two links?
>> 
>> https://trac.macports.org/wiki/howto/InstallingOlderPort
>> https://guide.macports.org/#development.local-repositories

I'm not sure whether the first of those was what I was looking for, but the 
second was exactly on-point. Thank you, Yongwei!

Mojca, if that lengthy explanation was not a thing that you had stashed to 
copy-paste already, I think that it should be. Or, plausibly more usefully in 
the general case, maybe it should get its own space under guide.macports.org? 
(Clearly, all this information’s in there somewhere, but a “quick start” 
section in chapter 4, ala https://guide.macports.org/#using.common-tasks, is 
what I was looking for, and you wrote up here.)

> On 21 Aug, 2016, at 17:53 EDT, Mojca Miklavec  wrote:
> - you should get an error along with the suggested new checksums that
> should be replaced in the Portfile (make sure that the checksums are
> correct before copy-pasting them and that you fetch the right files)

Apologies if this is a common question (if there’s a way to search PiperMail 
archives that isn’t “download all of them and use grep locally”, I’ve never 
known what it was), but I didn’t see an explicit facility to list a 
cryptographic signature for the distribution files.

Is that a done thing?

(I can see how one could do this by adding the signature file to $distfiles and 
then putting the signature verification in a post-checksum step, but if there’s 
some standardized “make sure some sort of PGP exists locally and just warn, 
rather than fail, if it doesn't” code, I figure it’s probably better to adhere 
to that.)

> Once you get that working, you can open a new ticket to request an
> upgrade. You could run "svn diff" inside abcde and attach the diff to
> the ticket. (Please note that we will soon try to switch to pull
> requests on GitHub.)
> 
> Ideally you would also volunteer to be the maintainer of that port
> that currently has nobody to look after.

All done: https://trac.macports.org/ticket/52122

Thanks for your assistance!

--
Gabriel Rosenkoetter
g...@eclipsed.net



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users

Re: What's the "right" way to update a port to

[Mojca Miklavec]

Dear Gabriel,

On 21 August 2016 at 13:32, Yongwei Wu wrote:
> On Saturday, 20 August 2016, Gabriel Rosenkoetter wrote:
>>
>> I'm very new to this mailing list (as of yesterday), but only relatively
>> new to using MacPorts (for little things over the past few years).
>>
>> Recently, I finally got around to reripping my CD collection, and I
>> figured I'd use the same tool to do that that I did 15 years ago on a
>> now-deceased FreeBSD system: abcde.
>>
>> The port installs just fine, and with the right abcde.conf configuration
>> can work, but as noted in https://trac.macports.org/ticket/49799, the
>> preferred way to retrieve tracks from a CD under Mac OS X (cddafs, or "just
>> copy the AIFFs from the mounted volume") is flat broken under the current
>> port version (2.7).
>>
>> The note in that bug report about the upstream bug is exactly correct, and
>> the fix is available in the relatively recently (April 2016, I think) 2.7.2
>> upstream release.
>>
>> I think this should be relatively simple to fix, and I'd like to learn how
>> to do that and contribute the update. Any pointers where I should start
>> reading?
>
> Maybe the following two links?
>
> https://trac.macports.org/wiki/howto/InstallingOlderPort
> https://guide.macports.org/#development.local-repositories

Like Yongwei Wu suggested, you need to create a local portfile
repository. I would start with a SVN checkout (might be a sparse
checkout with just the relevant port) of
https://svn.macports.org/repository/macports/trunk/dports/
(please note that we'll soon switch to git), even though just copying
the file from $(port dir abcde) or from somewhere else should also
work fine.

You then need to add path to that new dports to
${prefix}/etc/macports/sources.conf as instructed by the links, run
poinindex inside dports and make sure that "port dir abcde" points to
your local checkout. Then:

- replace the version 2.7 with 2.7.2 in the Portfile

- (optional) run "portindex" in your local "dports" again

- run "sudo port -v extract abcde"

- you should get an error along with the suggested new checksums that
should be replaced in the Portfile (make sure that the checksums are
correct before copy-pasting them and that you fetch the right files)

- "sudo port -v install abcde" should then install the latest version;
you might need minor modifications in the Portfile in case that the
port changed in any significant way

Once you get that working, you can open a new ticket to request an
upgrade. You could run "svn diff" inside abcde and attach the diff to
the ticket. (Please note that we will soon try to switch to pull
requests on GitHub.)

Ideally you would also volunteer to be the maintainer of that port
that currently has nobody to look after. In that case you would add
eclipsed.net:gr openmaintainer
to the maintainers field (openmaintainer is optional and allows others
to make minor modifications to the port).

Then just reply to this thread again or ask on IRC. IRC might also be
useful to resolve your problems quickly in case you are stuck.

(I need to add that you could also just request an update of the port
and someone else could do the required steps. But if you are willing
to look after it yourself, being able to add or update other software
in the future without having to wait for others to do it for you is
often a valuable asset. And in particular ports without the maintainer
would more than welcome any new caring hands to look after them.)

Mojca
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users

Re: What's the "right" way to update a port to

[Yongwei Wu]

May the following two links?

https://trac.macports.org/wiki/howto/InstallingOlderPort
https://guide.macports.org/#development.local-repositories

On Saturday, 20 August 2016, Gabriel Rosenkoetter  wrote:

> I'm very new to this mailing list (as of yesterday), but only relatively
> new to using MacPorts (for little things over the past few years).
>
> Recently, I finally got around to reripping my CD collection, and I
> figured I'd use the same tool to do that that I did 15 years ago on a
> now-deceased FreeBSD system: abcde.
>
> The port installs just fine, and with the right abcde.conf configuration
> can work, but as noted in https://trac.macports.org/ticket/49799, the
> preferred way to retrieve tracks from a CD under Mac OS X (cddafs, or "just
> copy the AIFFs from the mounted volume") is flat broken under the current
> port version (2.7).
>
> The note in that bug report about the upstream bug is exactly correct, and
> the fix is available in the relatively recently (April 2016, I think) 2.7.2
> upstream release.
>
> I think this should be relatively simple to fix, and I'd like to learn how
> to do that and contribute the update. Any pointers where I should start
> reading? (Yes, I could go slog through the whole of the relevant
> documentation, but I do, as I'm sure you all do, have a day job, so a shove
> in the right direction may help.)
>
> (I do also have some other suggestions about packages that it'd be neat if
> abcde also depended upon and used — like py-eyeD3 — and some other software
> that'd be neat to also have packaged and then depend abcde upon — like glyr
> — and I'm happy to do the leg work on those things too, but I figured I'd
> start small and work up from there.)
>
> --
> Gabriel Rosenkoetter
> g...@eclipsed.net 
>
>

-- 
Yongwei Wu
URL: http://wyw.dcweb.cn/
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users

What's the "right" way to update a port to

[Gabriel Rosenkoetter]

I'm very new to this mailing list (as of yesterday), but only relatively new to 
using MacPorts (for little things over the past few years).

Recently, I finally got around to reripping my CD collection, and I figured I'd 
use the same tool to do that that I did 15 years ago on a now-deceased FreeBSD 
system: abcde.

The port installs just fine, and with the right abcde.conf configuration can 
work, but as noted in https://trac.macports.org/ticket/49799, the preferred way 
to retrieve tracks from a CD under Mac OS X (cddafs, or "just copy the AIFFs 
from the mounted volume") is flat broken under the current port version (2.7).

The note in that bug report about the upstream bug is exactly correct, and the 
fix is available in the relatively recently (April 2016, I think) 2.7.2 
upstream release.

I think this should be relatively simple to fix, and I'd like to learn how to 
do that and contribute the update. Any pointers where I should start reading? 
(Yes, I could go slog through the whole of the relevant documentation, but I 
do, as I'm sure you all do, have a day job, so a shove in the right direction 
may help.)

(I do also have some other suggestions about packages that it'd be neat if 
abcde also depended upon and used — like py-eyeD3 — and some other software 
that'd be neat to also have packaged and then depend abcde upon — like glyr — 
and I'm happy to do the leg work on those things too, but I figured I'd start 
small and work up from there.)

--
Gabriel Rosenkoetter
g...@eclipsed.net



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
macports-users mailing list
macports-users@lists.macosforge.org
https://lists.macosforge.org/mailman/listinfo/macports-users