Re: [Mldonkey-users] MLDonkey & Debian ( Trying to do an Official Package )

[Sylvain LE GALL]

On Thu, May 29, 2003 at 09:16:47AM +0200, b8_bavard wrote:
> 
> >  Currently what i do :
> >  * trying to build a real chroot for mldonkey ( maybe using
> >   MLDONKEY_CHROOT, but it seems a little broken )
> 
> As I have repeated a lot, this is really the most useless part. You
> have access to the code, so no troyan. It's written in Ocaml, so no
> buffer overflows. What are you afraid of ?
> 

Even, if it was the best program i ever see or the most secured and
reviewed code, i would also try to make it run in a chroot. Why ?

Because, it is just an extra guaranty. It is not about code or quality,
it is just about guaranty ( in fact with mldonlkey you have write access
to certain part of the fs. It is unsafe to let this fs be as wide as
anyone want ).

Anyway, it will be an option. People can desactivate it ( i will not try
to dictate people way of using mldonkey, even the system wide daemon is
an option ).

> >  * fixing ocaml policy bug
> >  * trying to get rid of the builtin zoggy ( because zoggy already exist
> >   in debian and it should be use to build the .zog )
> 
> Zoggy is not used, just a Camlp4 file to translate zoggy files to
> Ocaml code. Unless you want to modify the interface, it's really not
> useful to ask the user to install the zoggy package just for the
> camlp4 file.
> 

Ok, so i have a bug report for you : if i don't install zoggy and try to
make depend, it fails because of trying to make depend on .ml which are
at the beginning .zog. So they try to translate .zog to .ml in order to
build target depends. It fails if zoggy is not present.


> >  * trying to find a stable version of mldonkey.
> 
> 2.5 looks really stable.
> 

Ok, i am working on it.

> >  What has been done :
> >  * debconf script for a server wide mldonkey
> >  * manpage ( don't think it is new things, it is just a transcript of
> >   mlnet -help )
> >  * mldonkey_option a program to parse *.ini
> 
> A good thing to do would be to include all this stuff in the official
> version, and modify the configure.in script to modify the debian files
> (often just to update the version number).
> 
> Note that there is a program src/gtk/gui/gui_installer.ml that is
> supposed to generate a basic downloads.ini file in the future. If you
> program in ocaml, it can be used to show you how to easily generate
> option files.
> 

debconf and manpage are to my mind very unuseful for upstream. It is
just a translation of option given by mlnet -h. I don't add anything
more ( just a comment on P2P network ).

mldonkey_option is written in ocaml ( off course, i am an ocaml
programmer, i have read some parts of your source code, i have patched
some path in src/daemon/common/commonOptions.ml for example )

If you want to have it, i will send it to you in private. ( just
ask me to send it to you ).


Thanks for the information you provided me, and thanks for mldonkey.
Don't take chrooting for an untrustment but for an extra security
option.

Kind regard
Sylvain LE GALL