Hipster 2014.10 is finally out

We are finally ready to present you new OpenIndiana Hipster snapshot and ISO images. We had some difficulties with generating installable "entire", so we had to delay snapshot for a week. But now you can just pkg fix entire to be more stable in constantly-changing Hipster world :) Since last snapshot a lot of work was done. I tried to summarize the changes in this informal "release notes". Please, be sure to read at least Perl-related notices before updating from previous snapshot.

General system changes

We performed migration from GCC 4.7.4 to GCC 4.8.3. New packages are compiled with GCC 4.8.4.
Perl 5.10 is not compulsory now. All perl dependencies were updated to use Perl 5.16 or don't care about perl version. This includes changes to illumos-gate. /usr/perl5/bin/perl now is mediated symlink, pointing to perl 5.16 by default. However, if you would like to compile unmodified illumos gate, you should switch it back to perl 5.10:

pkg set-mediator system-perl=5.10

Perl 5.10 modules which are required to compile illumos-gate are preserved. Other perl 5.10 modules are removed. If you have perl-510 installed on your system and don't need it, you can just remove runtime/perl-510, runtime/perl-510/extra and runtime/perl-510/module/sun-solaris.
During perl update version of perl-516/module/sun-solaris was DECREASED from 5.11 to 0.5.11 for consistency with other illumos-gate provided software. So if you have installed it, please, remove it BEFORE updating to new Hipster snapshot.
Perl 5.16 was recompiled without -Dperl_static_inline="static" flag to avoid creating one more patch for illumos-gate (this can affect perl ABI). So, if you had self-compiled perl modules, possibly, you have to recompile them.
Also, for consistency we renamed library/perl-5/xml-parser@5.12.1-0.151.1.8.1 to library/perl-5/xml-parser@2.41. So, if you have it installed (and every desktop system has it), please update it to library/perl-5/xml-parser@2.41,5.11-2014.1.2.0 (pkg update library/perl-5/xml-parser@2.41,5.11-2014.1.2.0). Also you'll have to update desktop/system-monitor/gnome-system-monitor if you have it installed.

Development tools and compilers

• OpenJDK was updated to 1.7.60. GCC 4.7 was updated to 4.7.4. GCC 4.8.3 and Clang 3.4 were added.
• GDB was updated to 7.6.2
• Mercurial was updated to 3.0.2
• MPICH was updated to 3.1.2
• ant was updated to 1.9.3
• python 2.7 was updated to 2.7.8

Common software

• bash was updated to fix latest bash CVEs, GNU coreutils were updated to 8.22, CUPS updated to 1.4.8, doxygen updated to 1.8.7, GNU grep was updated to 2.20, gnupg to 2.0.25
• Several packages to work with numerical data were added (datamash, hdf5)

Server software

• A lot of packages were updated, including apache 2.4, apache 2.2, nginx, php 5.4, php 5.5, squid 3.1, tomcat 6.0, postgresql 8.4/9.3
• Ldap backend was enabled for OpenLDAP server.
• Illumos-gate provided wu-ftpd was replaced with proftpd 1.3.5
• Barman was updated to 1.3.3
• NTP was updated to 4.2.7p453
• Bind was updated to 9.9.6

Desktop software

• Firefox and Thunderbird were updated to 24.8.1
• Packages from sic-team incorporation (notably, Mozilla nss and nspr) were updated.
• glib-networking, webkit were added
• Experimental package for Apache OpenOffice 4.1.1 was added. There is known issue with it - it can't create ODF documents. We are working on it.
• ntfsprogs were updated to 2014.2.15 version
• DJVU support was added to evince
• Gnome-pilot and Gnome-pilot-link packages are obsolete now as upstream is dead.

Also there were lot of other small fixes.

As always we ship the newest illumos-gate version, so you can leverage the great work of illumos developers.

Last time I blogged about Hipster I shared some plans. From things which were planned but not made I have to point to integration of new Perl version and 64-bit Perl version. Also we didn't add vlc and other multimedia software to oi-userland because of legal issues. We still miss fsvs. However, I hope we'll find decision for this problem soon.

Now I'd like to share my current plans, the things I'm interested in and the things I'm working on.

First of all, I'd like to look at OpenOffice issue with ODF files. It seriously bugs me, but I don't know if and when I'll be able to solve it.

One thing which annoys me in OpenIndiana desktop is lack of text search in gnome terminal. I have prepared update to gnome-terminal 2.32. It's coming soon.

Also I'd like to look at migration of some XNV components to oi-userland. This should allow us to enhance their packaging (so that it better correlates with oi-userland build system) and later I hope to update it.

I'm seriously annoyed by our out-of-date sendmail, coming from illumos-gate. I'd like to see postfix as a first-class OI MTA. Of course, we'll also need dovecot and perhaps some other mail server software.

Finding security patches for our squid 3.1 is becoming harder. Perhaps we have to update it to recent 3.4 version and also receive SMP support as a pleasant triffle.

PostgreSQL 9.4 release is coming. I want to have it in the gate. On other hand, I think we should remove PostgreSQL 8.4 once 9.4 is landed. PostgreSQL 8.4 has already reached its EOL.

PHP 5.6 is already out. I think, we'll get it soon. As always I hope to use EveryCity's work :)

Our Ruby is amazingly old. We have to migrate to at least ruby 1.9. Ruby 1.9 package is ready and just waiting for official snapshot announcement

I'd like to see some binary blobs disappearing from OI Hipster - like cpp (we can use Joyent version), also I hope once we'll have open source gcc-compiled dmake alternative.

Adding dpkg/apt tools and support for DilOS zones in OI seems attractive and perhaps even necessary thing if we want to better collaborate with DilOS on userland packages.

I hate Roskomnadzor

I don't have good words for them. This organization of bureaucrats and idiots are a real pain in the ass. Yesterday we (South Federal University) had to block all Youtube IP addresses, because our chiefs are afraid of possible fines. We have Internet Provider license and so have to filter "unacceptable" content. After last Roskomnadzor representatives found that several links on youtube, providing extrimist materials, are accessible from our network. We don't have any filtering services, so we were told just to ban all Youtube IP addresses to avoid penalties. What a hell! I've already received a lot of pleasant comments from our users. Really, ignorance is strength!

rude hack to proceed on zoneadm attach error

I have two zones on my build host. One is build zone, serving IPS repository for the whole host,  so I have to be very careful with its updates and another - test one. I wished to update test zone, so issued

# zoneadm -z zonename detach
# zoneadm -z zonename attach -u

and noticed that I detached build zone with repository. zoneadm launched pkg, pkg worked for a while, and then it said:

Evaluation: Packages in zone zonename are out of sync with the global zone. To proceed, retry with the -u flag. 
Result: Attach Failed.

What a hell! NGZ and GZ were in sync... At least both of them were latest /hipster. So I removed all publishers served by this zone from host and zone config.  The same reaction.
After grepping for this message in  /usr/lib/brand/ipkg/attach I found that this message is produced in  the following part of the script ($m_need_update message).

#
# Bring the ngz entire incorporation into sync with the gz as follows:
# - First compare the existence of entire in both global and non-global
#   zone and update the non-global zone accordingly.
# - Then, if updates aren't allowed check if we can attach because no
#   updates are required. If we can, then we are finished.
# - Finally, we know we can do updates and they are required, so update
#   all the non-global zone incorporations using the list we gathered
#   from the global zone earlier.
#

if [[ -z $gz_entire_fmri && -n $ngz_entire_fmri ]]; then
        if [[ $allow_update == 1 ]]; then
                LC_ALL=C $PKG uninstall entire || pkg_err_check "$f_update"
        else
                log "\n$m_need_update" "$ZONENAME"
                EXIT_CODE=$ZONE_SUBPROC_NOTCOMPLETE
                exit $EXIT_CODE
    fi
fi


if [[ $allow_update == 0 ]]; then
        LC_ALL=C $PKG install --accept --no-refresh -n $incorp_list
        if [[ $? == 0 ]]; then
                log "\n$m_complete"
                EXIT_CODE=$ZONE_SUBPROC_OK
                exit $EXIT_CODE
        else
                log "\n$m_need_update" "$ZONENAME"
                EXIT_CODE=$ZONE_SUBPROC_NOTCOMPLETE
                exit $EXIT_CODE
        fi
fi

I've just commented all these checks out and after this zone attach succeed. Zone is working now and I'm glad I don't have to reinstall my build zone....

Experience: dialog with prosecutor

Wow! Today we had a guest from prosecutor's office.
They checked if we (South Federal University) ban sites from prosecutor's list. Luckily, our upstream provider does it for us.
But a check was ridiculous.
Yes, we receive daily lists of sites to ban. I though they would check some sites from this list and go in peace. But prosecutor just searched for prohibited works with Google and tried if she can download the materials. Of course, Google found working links :)
What a hell? Why should we imitate some work if everyone knows how to avoid these regulation rules? Why should anyone spend resources for content filtering? I think our government are a herd of archaic dinosaurs who just don't know how to lick chief's arse better

OpenIndiana /hipster progress and my long TODO list...

There is always a lot of things to do. Of course I'd like to see OpenIndiana a modern universal OS, but it's still a long way to go. We've made a lot of work in the last two monthes.
1) Thanks to Adam Stevko and  Andrzej Szeszo we have a modern IPS version. Unfortunately, IPS GUI has gone, but as it was dropped even by upstream , it's not a big loss. We got ability to generate dependencies on mediated links, improved speed of operations and I hope fixed a number of bugs.
2) Andrzej Szeszo has updated NVidia drivers to version 331.20
3) Andrzej Szeszo has finally proposed a reasonable package versioning scheme, which allows to do /hipster more stable and predictable. I hope we'll adopt it soon.
4) I continued my work on JDS conversion and updates: we received Python 2.7, a lot of Python modules and several GUI applications (totem, rhythmbox, fbreader) were moved from JDS or added to oi-userland. The most noticable additions are OpenJDK 1.7.45, Firefox 17esr and Bacula 5.2.13.
I know, there should be some bugs there, but I hope we'll deal with them soon.

Now I'm interested in several issues:
1) I'm currently working on Thunderbird update to 24.2.0. I hope to finish in about 10 days if there are no any surprises.
2) The second thing I'd like to do is to work a bit on Python 2.7 modules so we'll be able to turn on compilation of Python 2.7 components (I mean setuptools, cherrypy,  mysql, psycopg and so on) by default. As I'm on Python I would deprecate Python 2.4, 2.5. It also worth investigating if IPS could use Python 2.7.
3) I'd like to look on PHP 5.5. Jon Tibble has recently added PHP 5.5 to ec-userland. We could base oi-userland component on this version.
4) I think I should finally build, test and integrate brasero to userland (Ken Mays has prepared patches and Makefile long ago)
4) I would really like to move to userland some more things from oi-build, first of all, kvm and qemu, but I don't think I have a hardware necessary to test it.
5) Also I'd like to look at perl - what do we need to allow Perl 5.10 go away? We definately need 64-bit Perl version. It worth to look at Perl update. One interesting part is current work of Andrew Stormont on https://www.illumos.org/issues/3900 which can allow us to use Perl 5.16 for building illumos-gate.
6) I also want to see apache 2.4 in the gate ( https://www.illumos.org/issues/4405 ). However, I currently don't have a clear view if it can coexist with apache 2.2. The main issue I see now is php module - php 5.4 component currently doesn't allow to build apache php module for several apache versions.
7) And every operating system would like to be a decent desktop. I'd like to see fusefs and vlc out of the box....

It's a long list, I don't know how long it will take to implement everything, but I'm going to do at least something :)

beadm destroy error

Today when I was trying to destroy old boot environment, I got strange error:

# beadm destroy oi-hipster-2013-08-06
Are you sure you want to destroy oi-hipster-2013-08-06?
This action cannot be undone (y/[n]): y
be_destroy_callback: failed to destroy data/zones/build/ROOT/zbe: dataset is busy
be_destroy: failed to destroy BE data/zones/build/ROOT/zbe
be_destroy_zone_root_callback: failed to destroy zone root data/zones/build/ROOT/zbe
be_destroy_zone_roots: failed to destroy zone roots under zonepath dataset data/zones/build: dataset is busy
be_destroy_zones: failed to find and destroy zone roots for zone build
be_destroy: failed to destroy one or more zones for BE oi-hipster-2013-08-06

I didn't want to destroy zone root FS accidentally, so was a bit scared. However, after looking at it a bit longer, I found out, that zone root FS has several manual ZFS snapshots. After destroying snapshots I was able to destroy BE.

Don't trust your mount

Today I was afraid for my sanity. We have 4 servers, one of them serves as nfs server, 3 other mounts two filesystems from the first. Today developer said that the content on servers is asynchronous. I said that it wasn't possible, but took a look. I was wrong. It was possible. Two of 4 servers were out of sync. Two first servers has common content. And two others... We have approximately the following structure. All servers run Ubuntu Linux 12.04. server1:

• /home/user bind-mounted to /export/user
• /home/user/www/shared - bind-mounted to /export/shared
• /export/user - shared by nfs, mounted on /home/user on 2nd,3rd,4th servers
• /export/shared - mounted on /home/user/www/shared on 2nd,3rd,4th server.

mount on 2,3,4 servers showed

...
/dev/mapper/volume on /home type ext4 (rw,noatime,nodiratime)
server1:/export/user on /home/user type nfs (rw,nfsvers=3,addr=x.x.x.x)
server1:/export/shared on /home/user/www/shared type nfs (rw,nfsvers=3,addr=x.x.x.x)

But contents on the first and second server was the same. And on the 3rd and 4th server I saw the difference in file sizes... When I did on the 4th server

cd /home/user/www/shared
touch 1

I saw the file only on the 4th and 3rd servers, but not on the first and second.... I thought about file caches, kernel bugs, my insanity and so on. Finally I did on the 3rd server

cat /proc/mounts

...
rpc_pipefs /run/rpc_pipefs rpc_pipefs rw,relatime 0 0
server1:/export/user/ /home/user nfs rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,.....
server1:/export/shared /home/user/www_old/shared nfs rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,.....

Wait... What? Yes, nfs filesystem was mounted not in www/shared, but in www_old/shared... Evidently, some developer has moved www to www_old and filled www with new stuff... It explained everything. The only thing I don't understand - why mount can't tell truth. I understand, it reads mtab. But why should it lie in such cases?