Re: Statically linked build of 0install

FYI I have a couple FTP archives that I set up this year

https://pmiess.gitlab.io/0install-feeds/netcdf.xml
FTP site is the first of three alternatives
Used by gnuwin32 gri

And 
https://pmiess.gitlab.io/0install-feeds/pthreads-win32.xml
Only ftp archive so the change will break this feed.
There are some linked http mirrors on the homepage I could set up to fix it.
Used by gnuwin32 chess

So I would need to modify 1 feed to handle this change, and should modify one more to remove the ftp archive if it's not allowed.

Personally I'd prefer to keep ftp, that way if an archive is only available via ftp I don't have to mirror the archive (and source to comply with GPL), but if it becomes necessary I think I can do so on GitLab, since I only publish open source packages.

Phil




-----Original Message-----
From: Thomas Leonard [mailto:[email protected]] 
Sent: Saturday, November 17, 2018 10:40 AM
To: The Zero Install system <[email protected]>
Subject: Re: [Zero-install-devel] Statically linked build of 0install

In Tue, 30 Oct 2018 at 21:14, Thomas Leonard <[email protected]> wrote:
>
> On Sun, 28 Oct 2018 at 13:28, Bastian Eicher <[email protected]> wrote:
> >
> > Hi all,
> >
> > I've recently been experimenting with running 0install in Docker 
> > containers based on various Linux distributions. Since I wanted to 
> > use the latest version I downloaded the pre-built binaries listed here:
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__0install.net_too
> > ls_0install.xml&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwK
> > gY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83
> > jNJ6t2g1k7svk3tgyXo62kSh8U&s=DZZhOiCUEkSuprtBC2kaPUMEr7cx5wW0inM3Wum
> > 4NE4&e=
> >
> > On Debian Stable and Ubuntu 18.04 I simply had to run "apt-get 
> > install libcurl3", download and extract the 0install archive and was good to go.
> > However, on Debian Testing and Ubuntu 18.10 libcurl3 has been 
> > replaced with libcurl4. After installing this 0install fails to launch with:
> > "/lib/x86_64-linux-gnu/libcurl.so.4: version `CURL_OPENSSL_3' not found"
> > Installing a libcurl3 package intended for an older distro also 
> > isn't a good option, since libcurl3 and libcurl4 both attempt to 
> > install the same file and therefore cannot co-exist on the same 
> > system. Forcibly downgrading libcurl also breaks the curl command on the system.
> > Running the binaries on Alpine is of course even trickier, since 
> > that distro does not use glibc.
> >
> > This got me thinking: Would it be practical to create completely 
> > statically linked builds of 0install? A quick Google search turned 
> > up a blog article titled "Creating Static Linux Binaries in OCaml"
> > (https://urldefense.proofpoint.com/v2/url?u=http-3A__rgrinberg.com_p
> > osts_static-2Dbinaries-2Dtutorial_&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=fqc0y-j4tovnPxKpKyw3wqQcdh8XIczb6SlDw800gLA&e= ). Since I have no experience with OCaml yet, I'm not sure if this is applicable to 0install.
> > @Thomas: Could you perhaps take a quick look?
>
> Static linking libcurl itself probably isn't difficult (or we could 
> replace it with cohttp if we dropped FTP support; I guess no-one is 
> using FTP now anyway).

I checked the mirror for public feeds referencing FTP sites.
These FTP sites are still running and being used as the main download URL by their projects:

https://urldefense.proofpoint.com/v2/url?u=ftp-3A__xmlsoft.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=u3POzq-pj8Mtg_vyUiG635PXfT9JuDkz5CZkGilSnfg&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.alsa-2Dproject.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=IWcGdTU2mfzrKxS9txHapnwxYWgiz6hgy08B1lWOzGg&e= 

These FTP sites are used in some feeds, but there is an HTTP alternative:

https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.gnu.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=h97a_kbvNhv8ebhS5LlDbhSLue5eSK3KoG0hbo0dv1M&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.gmplib.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=uSbyxttOgklmRL8DtxJLJbod1erlEQM9LU31wXs-uWo&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.lyx.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=ZcOZlBudPxnHGRmvUiib8czTirar2Ud9sfSMeDDveUQ&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.gnome.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=VVEiTDzMsfWEVAyjrlcgBApXltIQIiqcefQuj8R4Z3I&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.vim.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=l1cUUtzj9qpfkugtudg-8pGY-Q-CMPtLF_Ldt8BVx68&e=
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.osuosl.org&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=kKibKMzzvLo-InqId-dUtPjvSdLNE2AWt_N-LTM4W44&e= 

We should probably start logging warnings about FTP sites. We could also drop support in the 0install client, and just copy the archives to the mirror service to avoid breaking anything.
Or just drop it anyway - no feed using FTP has been updated since Jan 2017.


-- 
talex5 (GitHub/Twitter)        https://urldefense.proofpoint.com/v2/url?u=http-3A__roscidus.com_blog_&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=BYnlU56oJNQ-MG_0emZjSZ-pgLygfHNWefRftp5poRs&e= 
GPG: 5DD5 8D70 899C 454A 966D  6A51 7513 3C8F 94F6 E0CC


_______________________________________________
Zero-install-devel mailing list
[email protected]
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.sourceforge.net_lists_listinfo_zero-2Dinstall-2Ddevel&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=7wEk3sGEPw1AT4P83jNJ6t2g1k7svk3tgyXo62kSh8U&s=Pc08KZhhc_H8bApp4InS-WBDV9RJVwfOl29-Mohm-Rs&e=