2016-06-01 17:23:13 <ncopa> huh
2016-06-01 17:23:19 <ncopa> why did the zfs stuff break?
2016-06-01 18:03:50 <barthalion> ncopa: did you do something with 3.4 by any chance?
2016-06-01 18:10:24 <ncopa> no
2016-06-01 18:10:31 <ncopa> i didnt get to it
2016-06-01 18:10:36 <ncopa> but thanks for the reminder
2016-06-01 18:10:39 <ncopa> i'll check it now
2016-06-01 18:20:10 <barthalion> \o/
2016-06-01 18:20:21 <ncopa> worked like a charm here
2016-06-01 18:20:25 <ncopa> d
2016-06-01 18:20:32 <barthalion> weird
2016-06-01 18:20:37 <ncopa> yeah
2016-06-01 18:20:39 <barthalion> I guess the answer is 42
2016-06-01 18:20:46 <ncopa> something like that :)
2016-06-01 18:26:14 <ncopa> i'll have to fix that zfs thing
2016-06-01 18:26:21 <ncopa> i think i know what went wrong
2016-06-01 18:26:25 <ncopa> but a bit later
2016-06-03 07:31:00 <fabled> bah
2016-06-09 12:44:30 <clandmeter> ncopa: seems as claws on 3.4 had issues, not sure why though.
2016-06-09 14:50:07 <ncopa> i disabled the continue on errors
2016-06-09 14:50:30 <ncopa> clandmeter: what isses does claws have?
2016-06-09 14:50:34 <ncopa> i use claws all the time
2016-06-09 14:51:23 <clandmeter> ncopa: it was linked against older lib
2016-06-09 14:51:31 <ncopa> oh
2016-06-09 14:51:54 <ncopa> and older lib did not change so version?
2016-06-09 14:52:15 <clandmeter> ERROR: unsatisfiable constraints:
2016-06-09 14:52:15 <clandmeter>   so:libetpan.so.17 (missing):
2016-06-09 14:52:15 <clandmeter>     required by: claws-mail-3.13.2-r1[so:libetpan.so.17]
2016-06-09 14:52:24 <clandmeter> current is .20
2016-06-10 12:51:51 <fabled> algitbot: retry 3.4-stable
2016-06-12 09:44:11 <barthalion> fun
2016-06-12 09:44:26 <barthalion> do I have build env here?
2016-06-12 09:44:27 <barthalion> no
2016-06-12 09:56:32 <barthalion> all current day smartheads are missing now
2016-06-12 09:56:48 <barthalion> nmeum: any idea why I had to do this? http://dup.pw/aports/92726e78  
2016-06-12 10:13:46 <nmeum> barthalion: builldir is not set in that APKBUILD
2016-06-12 10:14:37 <nmeum> you still need to explicitly assign a value to it, after doing so you can use the default_prepare function
2016-06-12 10:48:00 <barthalion> nmeum: I thought the default value of $builddir is $srcdir/$pkgname-$pkgver
2016-06-12 10:48:23 <barthalion> and it is wrong only in package()
2016-06-12 10:48:42 <barthalion> works fine in prepare() and build()
2016-06-12 10:51:22 <nmeum> oh, I didn't notice that builldir has a default value now, nice
2016-06-12 10:51:26 <nmeum> good to know
2016-06-12 10:51:34 <nmeum> but no idea why it isn't set in package()
2016-06-14 06:37:43 <barthalion> ah, right, no pkgrel change
2016-06-15 06:33:25 <rnalrd> freeswitch sources on buildserver needs to be deleted
2016-06-15 06:36:21 <rnalrd> algitbot; retry 3.2-stable
2016-06-15 06:36:35 <rnalrd> algitbot:retry 3.2-stable
2016-06-15 06:38:14 <rnalrd> algitbot:retry 3.2-stable
2016-06-17 14:26:42 <rnalrd> algitbot:retry edge
2016-06-17 14:34:01 <rnalrd> algitbot:retry edge
2016-06-17 14:34:04 <rnalrd> algitbot:retry master
2016-06-17 20:21:20 <barthalion> nmeum: esptool does not build
2016-06-17 20:21:34 <barthalion> nmeum: you need setuptools in makedeps
2016-06-17 20:21:54 <nmeum> barthalion: I will fix it right away
2016-06-17 20:21:59 <nmeum> thanks for the heads up
2016-06-18 21:36:18 <barthalion> j apo
2016-06-18 21:36:21 <barthalion> oops
2016-06-18 21:36:46 <jirutka> what’s wrong?
2016-06-20 10:56:22 <nmeum> ncopa: ^ is the old xclip tarball from the previous url still cached in /var/cache/distfiles or why does it cause a checksum error?
2016-06-20 11:33:06 <ncopa> nmeum: i dont know
2016-06-20 11:35:05 <ncopa> php pear downloads are broken
2016-06-20 11:35:07 <ncopa> i mean
2016-06-20 11:35:18 <ncopa> i the content change every download
2016-06-20 11:36:24 <barthalion> that explains why I didn't fix it with my commit
2016-06-20 11:36:36 <jirutka> it’s PHP, of course it’s broken :P  //trolling
2016-06-20 11:36:44 <ncopa> i think its the gzip'ing that does it
2016-06-20 11:36:59 <ncopa> gzip has a field for timestamp
2016-06-20 11:37:06 <ncopa> which changes every rebuild
2016-06-20 11:37:14 <ncopa> so checksum does not match
2016-06-20 11:37:53 <barthalion> can we remove that field after abuild downloaded the file?
2016-06-20 11:39:32 <ncopa> thats a good question
2016-06-20 11:39:36 <ncopa> i think we can
2016-06-20 11:39:39 <ncopa> but do we want
2016-06-20 11:39:51 <ncopa> it will make the the checksum fail for everythin else
2016-06-20 11:39:56 <ncopa> unless we have an option=... for it
2016-06-20 11:40:20 <ncopa> option="reset-gzip-timestamp"
2016-06-20 11:40:54 <ncopa> ideally, the php site should cache the generated tarballs
2016-06-20 11:41:06 <ncopa> so we get a cached variant
2016-06-20 11:41:09 <barthalion> we have no power there
2016-06-20 11:41:11 <ncopa> i think thats what github does
2016-06-20 11:41:17 <fcolista> this would solve the github download as sell..but i think this would make download less secure
2016-06-20 11:41:17 <barthalion> I doubt we are the first distribution to hit that
2016-06-20 11:41:17 <ncopa> we can report it
2016-06-20 11:41:30 <barthalion> fcolista: it doesn't affect security at all
2016-06-20 11:41:39 <ncopa> debian make a copy of the sources
2016-06-20 11:41:54 <ncopa> maybe we should as wall
2016-06-20 11:41:58 <ncopa> have sourcepackages
2016-06-20 11:42:01 <fcolista> barthalion, yes. If you generate timestamp each download, how can you be sure that the upstream is not modified?
2016-06-20 11:42:31 <barthalion> fcolista: no. timestamp is just a timestamp
2016-06-20 11:42:38 <barthalion> it does not tell me if upstream modified anything
2016-06-20 11:42:54 <ncopa> fcolista: i'd say the oposite
2016-06-20 11:42:55 <barthalion> and if someone did something nasty, it doesn't save me either, this is what signatures are for
2016-06-20 11:42:56 <fcolista> So we jsut reset the timestamp part of the zip, and not the entire checksum of the file?
2016-06-20 11:43:00 <barthalion> exactly
2016-06-20 11:43:05 <fcolista> Ah, ok.
2016-06-20 11:43:18 <fcolista> I thought it would affect the entire checksum.
2016-06-20 11:43:34 <ncopa> since upstream modifies the timestamp, we cannot verify using checksum
2016-06-20 11:43:38 <barthalion> it will, but there is no golden bullet
2016-06-20 11:43:41 <fcolista> then yes, as ncopa said, is the opposite.
2016-06-20 11:43:52 <ncopa> what we are talking about is to reset it to 0
2016-06-20 11:44:07 <barthalion> by removal/reset of timestamp, checksum will stop changing for no reason
2016-06-20 11:44:09 <ncopa> then we cannot verify with against an upstream checksum
2016-06-20 11:44:23 <ncopa> unles something changes ofc
2016-06-20 11:44:23 <barthalion> however, it will differ if the content of tarball has changed
2016-06-20 11:44:27 <ncopa> yes
2016-06-20 11:44:57 <ncopa> there are a few projects that silently change contents of the tarball
2016-06-20 11:45:20 <ncopa> i have seen minor typo fixes in releases notes/docs
2016-06-20 11:45:59 <ncopa> but i think we should report it upstream
2016-06-20 11:46:09 <ncopa> not beeing able to verify checksum is an upstream problem
2016-06-20 11:51:41 <ncopa> <delboy1978uk> ncopa: use composer, stop using pear
2016-06-20 11:51:45 <ncopa> oh well
2016-06-20 11:52:15 <ncopa> i think I'll send an email to security@php.net
2016-06-20 11:52:48 <barthalion> lol, 'use composer'
2016-06-20 11:53:32 <barthalion> it's very reassuring that neither pear or composer verifies checksums
2016-06-20 11:56:58 <jirutka> or we can just remove all Pear packages from repository :P these can be installed using some php tool, same as ruby packages, right?
2016-06-20 12:02:25 <ncopa> we should probably have some sort of sourcepackage archive
2016-06-20 12:02:32 <ncopa> but i dont know how to properly do that
2016-06-20 12:02:51 <jirutka> sourcepage archive?
2016-06-20 12:02:57 <ncopa> we do have distfiles.alpinelinux.org
2016-06-20 12:03:01 <ncopa> eg source tarballs
2016-06-20 12:03:12 <jirutka> cache?
2016-06-20 12:03:14 <ncopa> that we have a common cache for all buildservers
2016-06-20 12:03:17 <ncopa> yes
2016-06-20 12:03:48 <ncopa> maybe we should set up a caching squid proxy for all build servers
2016-06-20 12:03:51 <ncopa> i dunno
2016-06-20 12:04:08 <jirutka> imho upstream tarballs should be always verifiable, without caching them etc. if they are not, remove them as broken
2016-06-20 12:04:23 <ncopa> i wrote to security@php.net
2016-06-20 12:04:55 <ncopa> i dont have high hopes though. i assume they are always busy...
2016-06-20 12:05:02 <jirutka> since php is not compiled, what about downloading tarballs directly from the source repository instead of that pear crap? most of them are on GitHub, aren’t they?
2016-06-20 12:05:56 <ncopa> dunno
2016-06-20 12:06:24 <jirutka> i have to go, see ya
2016-06-20 12:07:25 <ncopa> algitbot: retry master
2016-06-20 12:10:09 <nmeum> it would also be nice if a future abuild version could write the checksum it computed to stdout if it didn't match the expected checksum
2016-06-20 12:10:27 <ncopa> good idea
2016-06-20 12:10:50 <ncopa> we should probaly also stop generate all different
2016-06-20 12:11:08 <ncopa> and only do 1 checksum
2016-06-20 12:11:14 <ncopa> sha512 or sha256
2016-06-20 12:14:00 <nmeum> ncopa: why should we do that? Generating multiple checksum doesn't have a disadvantage imho
2016-06-20 12:14:13 <ncopa> makes git log messy
2016-06-20 12:14:23 <nmeum> and if a flaw is discovered in one of the used checksum algorithms we still have 2 different checksum to rely on
2016-06-20 12:14:42 <ncopa> makes it harder to see the diffs
2016-06-20 12:15:02 <ncopa> yes, thats why i added various
2016-06-20 12:15:13 <nmeum> well…if that's the only problem we could move the checksum to an extra file? APKBUILD.checksum or something like that?
2016-06-20 12:15:29 <nmeum> OpenBSD also does it that way iirc
2016-06-20 12:15:37 <ncopa> would still show up in git log
2016-06-20 12:15:44 <ncopa> unless you log a sepcific file
2016-06-20 12:15:58 <ncopa> also, it would double the number of files in the aports tree
2016-06-20 12:16:09 <nmeum> right
2016-06-20 12:17:25 <ncopa> nmeum: re xclip
2016-06-20 12:17:30 <ncopa> we had a tarball from sourceforge
2016-06-20 12:17:36 <ncopa> i have removed it now
2016-06-20 12:17:44 <nmeum> yeah, upstream seems to have moved to github
2016-06-20 12:17:54 <nmeum> so I thought it would be a good idea to use the tagged release from github
2016-06-20 12:18:01 <ncopa> it is
2016-06-20 12:18:12 <ncopa> the change is good
2016-06-20 12:18:18 <nmeum> but the old tarball is still cached in /var/cache/distfiles?
2016-06-20 12:18:22 <ncopa> yes
2016-06-20 12:18:49 <ncopa> algitbot: retry master
2016-06-20 12:19:03 <ncopa> or it was
2016-06-20 12:19:26 <nmeum> ncopa: thanks
2016-06-20 12:19:53 <ncopa> nmeum: thanks to you too :)
2016-06-20 14:50:00 <nmeum> ncopa: the docker build still seems to fail on arm even though the binary should now be paxmarked
2016-06-20 14:56:06 <ncopa> ugh
2016-06-20 15:31:07 <ncopa> seems like go segfaults directly
2016-06-20 15:31:10 <ncopa> sigh
2016-06-21 09:02:47 <rnalrd> umpf
2016-06-21 13:48:04 <ncopa> algitbot: retry master
2016-06-22 19:16:09 <barthalion> algitbot: retry 3.3-stable
2016-06-22 19:16:12 <barthalion> or something
2016-06-22 19:16:14 <barthalion> pretty please
2016-06-24 12:21:40 <ncopa> algitbot: retry master
2016-06-24 12:29:29 <ncopa> algitbot: retry master
2016-06-24 14:15:53 <ncopa> algitbot: retry 3.4-stable
2016-06-28 17:26:16 <ncopa> algitbot: retry 3.4-stable