Snamellit

Install GUIX on Macbook 12

Peter Tillemans — Fri, 20 Mar 2026 11:01:00 +0100

Motivation</h2>
I have an old Intel macbook 12 of begin 2016, one of the so-called "Retina Macbooks". It is an ideal couch device but far too slow to run modern OS-X, provided you wanted to run that to begin with.</p>
I wanted to revive this machine to avoid lugging the BIG laptop, especially for the friday SystemCrafters stream in my comfy chair in the living.</p>
I saw some experience reports with Ubuntu, which worked, but then I never used it because Ubuntu is, well it is Ok, there is nothing wrong with it... Gnome works fine, KDE worked fine, it is just all different from my usual Arch/Guix machines for little added benefit.</p>
Because I was curious about immutable distros and leveraging containers like toolbox/flatpak I installed Fedora Silverblue. Again it is fine, Gnome is really luxurious on this machine. It all works well, but again different. Distributing the software between immutable host (which you have to reboot to make packages appear after install), flatpaks and toolbox containers works fine again, but inevitably causes friction when crossing the domains, e.g. Emacs. Nothing insurmountable. Also I am not impresssed by toolbox, it is simple, but it does nothing that distrobox does not seem to do better, while being less tied to the OS. I am not a fan of the dev container workflow, and Fedora Silverblue didn't sell it to me. Again in large deployments the balance might be different.</p>
AFAICT Guix offers (almost) the same immutability features and drawbacks but less pronounced. i.e. you do not have to reboot to make host software available in most cases. The diffferent profiles allow much more granular control with several half-way points to find the right balance of reproducability and creature comfort. Of course this is also means more opportunity to let it run out of control and create a confusing mess. In any case I can leverage the GUIX configuration of my servers and big laptop and ensure a consistent experience if I can get it on the lil' macbook and liberate it to fight another day.</p>

Installation Process</h2>
Installing Ubuntu and Silverblue learned me that there is nothing specially difficult for the intel mac. It kinda just works with some small caveats.</p>
A quick hardware check shows a BCM4350 wireless network adapter which is not on the open hardware list AFAIK, and since the laptop needs to do laptop duty and has only a single USB-C port WiFi is the only way to get something in and out of it. Intel graphics should not be a problem. An intel soundchip. Some Apple NVMe controller (foreshadowing)</p>
So we probably need the nonguix version to support the firmware blobs.</p>

Creating Installation Media</h3>

Check out on your local friendly Guix enabled device, a foreign install is fine, checkout the SystemCrafters Guix Installer Repo</a>. In the root of the project is a script build.iso</code>. Run it and have a walk outside or something. It takes a while. If you have no Guix enabled machine yet, you can download the last released version, which is over a year old, so the first guix pull</code> on the macbook will be epic... .</p>

You'll end up with a file guix-installer-202603162333.iso</code> with of course a probably newer timestamp is spacetime is behaving consistently in your locati This can be written to a thumb drive. Ensure you check with dmesg -w</code> which device the USB stick uses. On insertion you'll see</p>

$ sudo dmesg -w
</span>... lots of lines skipped
</span>[308042.889695] usb 1-4.3.2: new high-speed USB device number 12 using xhci_hcd
</span>[308043.000238] usb 1-4.3.2: New USB device found, idVendor=0781, idProduct=5572, bcdDevice= 1.00
</span>[308043.000242] usb 1-4.3.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
</span>[308043.000244] usb 1-4.3.2: Product: Cruzer Switch
</span>[308043.000246] usb 1-4.3.2: Manufacturer: SanDisk
</span>[308043.000247] usb 1-4.3.2: SerialNumber: 4C530001061011107340
</span>[308043.038906] usb-storage 1-4.3.2:1.0: USB Mass Storage device detected
</span>[308043.039031] scsi host2: usb-storage 1-4.3.2:1.0
</span>[308043.039112] usbcore: registered new interface driver usb-storage
</span>[308043.042575] usbcore: registered new interface driver uas
</span>[308044.049756] scsi 2:0:0:0: Direct-Access     SanDisk  Cruzer Switch    1.00 PQ: 0 ANSI: 6
</span>[308044.055625] sd 2:0:0:0: [sda] 62521344 512-byte logical blocks: (32.0 GB/29.8 GiB)
</span>[308044.056787] sd 2:0:0:0: [sda] Write Protect is off
</span>[308044.056790] sd 2:0:0:0: [sda] Mode Sense: 43 00 00 00
</span>[308044.057159] sd 2:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
</span>[308044.093399]  sda: sda1 sda2
</span>[308044.093545] sd 2:0:0:0: [sda] Attached SCSI removable disk
</span></code></pre>
The '[sda]' on the last lines shows that the USB is now available as
/dev/sda</code>. Be careful as using your current harddisk by accident will
cause an unscheduled backup/restore excercise. To be safe make sure
you use the data which appeared on screen when inserting the
drive. Pull it out and insert it again to be sure.</p>
Also don't mount/open it if your smart desktop assistent comes asking
helpfully. It only makes things slower and more complicated.</p>
$ sudo dd if=guix-installer-202603162333.iso of=/dev/sda bs=1M
</span>$ sync
</span></code></pre>
The bs=1M</code> is to speed things up otherwise it takes forever. Value is
not critical but this is easy to type and _reasonable_™.</p>
This will probably take a refill coffee</span> amount of time to
complete. The `sync` should ensure the buffers are written before
unplugging the device.</p>
Installation Process</h3>
One of the biggest challenges to start the installation process is to
build a Jenga tower of USB dongles to ensure you can power the macbook
and insert the USB stick. This device only has a single USB-C port, it
dislikes thunderbolt docks or even many USB-C docks. I used a
Steamdeck dock. In practice I assume most of the cheap USB extender
dongles will do it, however I had to experiment before it worked.</p>
You can probably install the OS on whatever capacity is remaining
after all this time, but I would not rely on it and I would not want
to do the crypto setup of the disks with the battery draining like a
James Bond Villain Death Trap</a>.</p>
I installed it a few times. First without disk encryption. Worked
fine. You follow the prompts.</p>
Then with disk encryption. Worked fine.</p>
I choose separate volumes for root</code> and home</code> formatted in ext4. When encrypting the
volumes using LUKS we now get an interesting issue. During boot up we
are asked 4 times to unlock the drives. Also once we selected the
image to boot in Grub the kernel will ask to unlock the disks, but the
internal laptop keyboard does not work. This can be solved by adding a
USB keyboard to your Jenga Tower and unlock the drives. This get tired
really quickly. For installation it is not a blocker so we plod on.</p>
Also at some point the graphical installer decide that black is the
new orange and show nothing else than that. However the manual
installer is well documented.</p>
Also the installation process for GUIXSD is far less important than
for other distros as you can completely control the OS using `guix
system reconfigure`. So if you can boot in a terminal and get on your
network you're golden.</p>
Crypto Setup</h3>
I am going to forget the keyboard issue for now and deal with the
passwords. Because if that is fixed the keyboard does not matter
anymore as once the kernel is fully started it works again.</p>
If you followed along the installer will already have created the
partitioning and LUKS encryption of the volumes. We can use a keyfile
to unlock the partitions but we have to make sure the keyfile is not
exposed on an unencrypted volume. Some people suggest a keyfile on a
USB stick but this is not very practical on this device (think Jenga
tower).</p>
There is no way to pass secrets from Grub to the booting
kernel. However we have access to files in the initial ramdisk. The
GUIX bootloader configuration has the extra-initrd</code> option which was
originally added for this very purpose and adding the keyfile is
explained there.</p>
So the plan is:</p>

add a key from a keyfile to a slot in the LUKS partitions</li>
wrap the keyfile in a cpio image to merge to the initial ramdisk</li>
configure the mapped devices to use this keyfile</li>
</ul>
add keyfile to initrd</h4>
I created a random file</p>
$ dd if=/dev/urandom of=/keyfile.bin bs=1 count=512
</span>$ chmod 0400 /keyfile.bin
</span>$ echo /key-file.bin | cpio -oH newc >/key-file.cpio
</span>$ chmod 0000 /keyfile.cpio
</span></code></pre>
add the keyfile as a key to the LUKS partitions.</p>
Update /etc/config.scm</code> to add the extra-initrd</code> option to make the file
accessible during early boot.</p>
(bootloader (bootloader-configuration
</span>               (bootloader grub-efi-bootloader)
</span>               (targets '("/boot/efi"))
</span>               (keyboard-layout keyboard-layout)
</span>	              (extra-initrd "/key-file.cpio")))
</span></code></pre>
Tell kernel to use the keyfile</h4>
To configure the kernel to use the keyfile instead of asking for a
password, we have to add the #:key-file "/key-file.bin"</code> to the luks mapping</p>
(mapped-devices
</span> (list (mapped-device
</span>        (source (uuid "47642581-ea45-4c53-84c8-d1baf81c70de"))
</span>        (target "my-root")
</span>        (type luks-device-mapping)
</span>	        (arguments '(#:key-file "/key-file.bin")))
</span>       (mapped-device
</span>        (source (uuid "f2d3ee87-7cc7-4a95-8f4c-1f6c0fa750ee"))
</span>        (target "my-home")
</span>        (type luks-device-mapping)
</span>	        (arguments '(#:key-file "/key-file.bin")))))
</span></code></pre>
Apply it</h4>
run a guix system reconfigure</code> and reboot and now you will only have to
enter 2x the password. A 50% improvement  ( or 500%, 600% according to
some world leader).</p>
Now why does grub insist in decrypting the /home</code> partition?</p>
A quick look in /boot/grub/grub.cfg</code> shows:</p>
➜ cat /boot/grub/grub.cfg | head
</span># This file was generated from your Guix configuration.  Any changes
</span># will be lost upon reconfiguration.
</span>insmod luks
</span>insmod luks2
</span>cryptomount -u 47642581ea454c5384c8d1baf81c70de
</span>cryptomount -u f2d3ee877cc74a958f4c1f6c0fa750ee
</span>
</span># Set 'root' to the partition that contains /gnu/store.
</span></code></pre>
Ok, that explains it. But why?</p>
The manual does not give me any hints. Looking in the source code of
the guix bootloader generator shows that it makes a list of all mapped
devices which have a valid UUID and add it to grub. It throws a
warning when a mapped device uses the regular linux devicename instead
of the UUID as grub cannot find the devices with the linux name. This
makes sense and we can abuse it to get rid of the 2nd password prompt:</p>
(mapped-devices
</span> (list (mapped-device
</span>        (source (uuid "47642581-ea45-4c53-84c8-d1baf81c70de"))
</span>        (target "my-root")
</span>        (type luks-device-mapping)
</span>	  (arguments '(#:key-file "/key-file.bin")))
</span>       (mapped-device
</span>        ;;(source (uuid "f2d3ee87-7cc7-4a95-8f4c-1f6c0fa750ee"))
</span>	  (source "/dev/nvme0n1p3")
</span>        (target "my-home")
</span>        (type luks-device-mapping)
</span>	  (arguments '(#:key-file "/key-file.bin")))))
</span>
</span></code></pre>
If we replace the UUID with the regular device name, it will no longer
be exported to grub.cfg</code> and the kernel kan still find the device for
mapping it.</p>
A quick reconfigure and reboot later confirms this. I can now remove
the keyboard from the Jenga tower, but that would be cheating.</p>
Fixing the keyboard</h3>
Some searching in the Guix mailing list showed that "hid_apple" was
removed from the standard initrd somewhere in '24 because of issues
with RISCV.</p>
That is where the initrd-modules</code> option is for:</p>
(operating-system
</span>  ...
</span>  (initrd-modules (cons "hid_apple" %base-initrd-modules))
</span>)
</span></code></pre>
This fixes the issue. I forgot how I tested it, but it does.</p>
Post Installation</h2>
System does not allow to login after sleep</h3>
Actually the problem is that the disk is still sleeping (remember the
foreshadowing when seeing the Apple NVMe device). This is not GUIX
specific as I already had to fix it in Ubuntu and Fedora. There you
add</p>
echo 0 >/sys/bus/pci/devices/0000\:01\:00.0/d3cold_allowed
</span></code></pre>
in the crontab</code> on the @reboot</code> event.</p>
This syntax is not supported by the herd scheduled jobs and I did not
find an alternative and got no suggestions on the #guix IRC
channel. So I decided to make a small shepherd service for this.</p>
(define disk-sleep-shepherd-service
</span>  (shepherd-service
</span>   (provision '(disk-sleep))
</span>   (documentation "Disallow disk to go to d3cold state to prevent crash on wake up.")
</span>   (one-shot? #t)
</span>   (start #~(lambda _
</span>	       (call-with-output-file "/sys/bus/pci/devices/0000:01:00.0/d3cold_allowed"
</span>		 (lambda (port) (display "0" port)))
</span>	       #t))))
</span>
</span>
</span></code></pre>
The only part I struggled with is that the start</code> field takes a
function with a variable number of arguments. The /var/log/messages</code>
registered the error but was not very helpful. Herd did not show the
service at all until it was fixed. Comparing to other implementation
gave the needed clues.</p>
To add this to the system:</p>
(operating-system
</span> ...
</span> (services
</span>  ...
</span>  (simple-service 'disk-sleep-service shepherd-root-service-type
</span>	  (list disk-sleep-shepherd-service))
</span>  ...
</span>  ))
</span></code></pre>
Sound : no sound from speakers.</h3>
There is no sound coming from the speakers.</p>
There is sound coming from the headphone jack. Good enough for use in
the living.</p>
I'll call this a feature, not a bug.</p>
Things I would do differently</h2>
Basically use btrfs to have a single encrypted LUKS volume to deal with and
split the volumes in btrfs. That would also give the other goodness of
btrfs and should be well supported by grub.</p>
But for now I'll enjoy my new couch laptop.</p>


Screenshot in Sway with GUIX
Peter Tillemans — Sat, 25 Oct 2025 14:19:00 +0200
Screenshots in Sway with Guix Home Manager</h2>
A blog post</a> documented an elegant way to configure screenshots in
wayland using grim</strong> and grimshot</strong>. After moving my sway config to use
the GUIX</strong> sway-service</code> to generate the config file Iost my configured
screenshot bindings.</p>
Output Files</h3>
The screenshots will be placed  in the Pictures/screenshots</code> folder
with the timestamp as filename.  To avoid duplication and ensure
consistency we'll add  a variable to generate the filename</p>
(sway-configuration
</span>  (variables (append %sway-default-variables
</span>		     `((menu .  ,#~(string-append
</span>                                    #$fuzzel
</span>                                    "/bin/fuzzel"
</span>                                    " -w 50 -x 8 -y 8 -r 3 -b 232635ff -t A6Accdff -s A6Accdff -S 232635ff -C c792eacc -m c792eacc -f \"JetBrains Mono:weight=light:size=10\" --icon-theme=\"Papirus-Dark\" --no-exit-on-keyboard-focus-loss"))
</span>		       (term . ,(file-append alacritty "/bin/alacritty"))
</span>		       (screenshot_out . "$(xdg-user-dir PICTURES)/screenshots/$(date +\"%Y%m%d-%H%M%S\").png"))
</span>		     ))
</span>  ...)
</span></code></pre>
Key Bindings</h3>
I often use various screenshots pasted in chat windows or Jira tickets
so the clipboard is an important destination.
Alternatively saving them to move them to a target folder for
inclusion whereverr they needed is an important secondary use-case.</p>
We can now use the variable made previously and add the following keybindings:</p>
(sway-configuration
</span>	    ...
</span>	    (keybindings (append
</span>			  `(...
</span>			    ;; Special key to take a screenshot with grim
</span>			    ($mod+Shift+p . "exec grimshot copy anything")
</span>			    ($mod+Shift+s . "exec grimshot save screen $screenshot_out")
</span>			    ($mod+Shift+w . "exec grimshot save window $screenshot_out")
</span>			    ($mod+Shift+a . "exec grimshot save area $screenshot_out")
</span>			    ...
</span>
</span>			    )
</span>
</span>
</span></code></pre>
Deploying the configuration</h2>
To activate the configuration</p>
$ make home
</span>echo Loading modules from ~/.config/dotfiles/guix/src
</span>Loading modules from /home/pti/.config/dotfiles/guix/src
</span>guix home reconfigure -L ~/.config/dotfiles/guix/channel -c 32 ~/.config/dotfiles/guix/home-config-`hostname | cut -d. -f1`.scm
</span>...
</span></code></pre>
which quickly (for some value of quick) updates the home
configuration, writing a new ~/.config/sway/config</strong> file.</p>
When the prompt returns a quick reload of the sway config with
$mod+Shift+c</code> and testing if the modifications are active.</p>
Testing it Out</h2>
I opened libre office writer to paste copied screenshots and made a
mess to show the copy anything</code> works as expected. It does, it
highlights what it understands depending on your mouse location, a
window if hovering over a window, a rectangle if you start selecting
and all the screen if you move the mouse outside all windows (i.e. the
boundary on a tiling wm). It is a bit fiddly so sometimes I select the
wrong thing, but since it only clobbers the clipboard and I can
quickly try again, this seems reasonable.</p>
Similarly using the 3 other bindings to save different type of
screenshots.</p>
  $ ls ~/Pictures/screenshots/
</span>20251025-141106.png  20251025-145006.png  20251025-145019.png
</span></code></pre>
Cool, that made a mess in the folder and displaying</strong> them show that it
are actually screenshots. Cool.</p>


Consolidating Secrets in Pass
Peter Tillemans — Sat, 28 Jun 2025 13:15:00 +0200
Background</h2>
Like a lot of people I've had  a long history managing passwords and
secrets over the years.  From a little black book, over an Excel sheet,
using a GPG encoded secrets file (works really well with Emacs gpg
support), 1password (till they racked up their prices), lastpass (till
they got bought by the Evil LogMeIn Corp), KeepassXC and lately pass</a>.</p>
I was perfectly happy with KeepassXC for a very long time, except for
the command line integration.  So I kept ending up with passwords in
.envrc</strong> files in folders and excluded in the global .gitignore</strong> to avoid
too many red cheeks.  While this does keep secrets out of harms way
mostly, it kept nagging that I had them in plain text in those
files.  In theory there is keepassxc-cli</strong> to query the passwords from
the command line, but let's say the experience does not spark joy.  It
has no easy way to cache the password between calls and it is
optimized for interactive use.  (AFAICT, just the giant size of the
command to type gives me dread).</p>
Some day I stumbled over pass</strong> and found that after setup I could just
pass snamellit/website</code> to get the password on stdout.  I wrote about
the setup and emacs integration in a previous post</a>. Since it
leverage gpg, password caching is handled by the gpg-agent and my
.envrc</strong> files quickly were purged of blasphemous secrets, replace by
pure bliss:</p>
export </span>MY_SECRET</span>=$</span>(</span>pass</span> my/secret)
</span>export </span>OTHER_SECRET</span>=$</span>(</span>pass</span> other/secret)
</span></code></pre>
similarly in emacs I can consistently get my passwords and related
info with:</p>
(org</span>-</span>gcal</span>-</span>client</span>-</span>id (auth</span>-</span>source</span>-</span>pass</span>-</span>get</span> 'secret </span>"snamellit/org-gcal-client"</span>))
</span>(org</span>-</span>gcal</span>-</span>client</span>-</span>secret (auth</span>-</span>source</span>-</span>pass</span>-</span>get </span>"id"
</span>"snamellit/org-gcal-client"</span>))
</span></code></pre>
When needed the gpg-agent</strong> will launch the appropriate pin-entry
program whether in terminal or in the GUI and the caching will not
force me to login several times when entering the folder.</p>
So I ended up with my interactive use covered by KeepassXC</strong> and
automated use by pass</strong>.</p>
However, after some time I ended up with hundreds of secrets in
KeepassXC</strong>, hundreds in pass</strong>, it is not always clear whether use is
interactive or automated so confusion and duplication starts and
things become harder to manage.  In addition KeepassXC</strong> was using
historically Dropbox to make it available on all my devices, recently
migrated to Nextcloud, which has issues with dealing with conflicts
which occasionally bite me in the behind.  On the other hand pass</strong>
secrets are stored encrypted in git where conflict punch you in the
face.  I prefer the latter.  And started contemplating whether to move
everything to pass.</p>
Thanks to the encouragement of SummerEmacs, one of the more
enthusiastic SystemCrafters, ensuring the great experience in browsers
and iOS mobile devices I had no more excuses to keep postponing it.</p>
Preparation</h2>
I started out with keeping my pass passwords as part of my
dotfiles.   This was convenient when they were few.  However this is
weird</span> so this will attract weirdness</span> when configuring all integrations
I'll need.</p>
Also pass</strong> supports a git</strong> command to manage the password-store with git
which is not really useful when it is part of something else.   So the
first order of the day is to move all secrets to a separate repository
and update the dotfiles</strong> to check for presence and clone the repo if
missing (and do a gently pull when it is).
A quick visit to each of the machines in my machine park to apply this
change.
Everything still seems to be working.</p>
Migration of the KeepassXC data</h2>
I used the pass-import</a> tool which adds in import</strong> command to pass which
supports a crazy amount of password managers, including keepassxc.  For
keepassxc it need the pykeepass</strong>.  If you're running on Arch, everything
is a yay -S</code> away.  However on Ubuntu and its derivatives it is the
usual slog we start to get accustomed to.  It's all in the pass-import
README</a> , note that on Ubunty the pykeepass</strong> library is available with
apt install python3-pykeepass</code>.</p>
Once it is installed I tried  a dry run (with the -d</code> flag) to see if
basic functionality is working</p>
pass</span> import -a -d keepassxc </span>~</span>/Nextcloud/Apps/Keepassxc/Passwords.kdbx
</span>Password</span> for /home/pti/Nextcloud/Apps/Keepassxc/Passwords.kdbx:
</span>  </span>w</span>  Data would be imported from keepassxc to pass
</span>  </span>.</span>   Passwords imported from: /home/pti/Nextcloud/Apps/Keepassxc/Passwords.kdbx
</span>  </span>.</span>   Passwords exported to: /home/pti/.password-store
</span>  </span>.</span>   Number of password imported: 2035
</span>  </span>.</span>   All data imported
</span>  </span>w</span>  Weak password detected: eDGQqipE might be weak.  Score 2 (100000001 guesses)</span>.</span>  This estimate is based on the sequence eDGQqipE(bruteforce)
</span>  </span>w</span>  Weak password detected: eDGQqipE might be weak.  Score 2 (100000001 guesses)</span>.</span>  This estimate is based on the sequence eDGQqipE(bruteforce)
</span>  </span>w</span>  Weak password detected: eDGQqipE might be weak.  Score 2 (100000001 guesses)</span>.</span>  This estimate is based on the sequence eDGQqipE(bruteforce)
</span>...</span>  large list of names of secrets
</span>
</span></code></pre>
This asks for the password of the Keepass file and some remarks it
has.</p>
This all looks reasonable.  So we can try the import.  Since the
password-store is a git repo no real damage can be done to it (as it
is safely pushed somewhere else where the import tool cannot touch it)
and any damage done can be reverted....</p>
Now is a good time to check if the mooring lines of your laptop are
properly secured as encrypting all the secrets will spin up the
propellors if the number is large enough.</p>
I run it again without the -d</code> flag and after several minutes the
noise dies down and I am left with a lot of additional folders in my
~/.password-store</code> which match the grouping in KeepassXC.  The files
contain the secrets and the expected metadata.  This looks good so I
add/commit the things to complete the level.</p>
Integration with iOS for my iPhone</h2>
Let's start with the most scary one : the iPhone.</p>
Upon recommendation I had installed passforios</strong> which needs to be
configured.</p>
Configuring the host, repo and username to use for the git repository
is straightforward enough.</p>
I always use ssh to access my repos so we need to add an ssh keypair
for this purpose.  There is no support to generate key-pairs in
passforios for reasons, so I have to do it externally and upload the
key. A quick ssh-keygen</code> , uploading the public key to the forge,
allowing access to the repo and if I can get the private key on my
phone we can access the repo.</p>
passforios</strong> has a nice feature to load ascii armored keys via a QR
code. A bit digging surfaced the asc-key-to-qr-code-gif tool</a> which
was made for this specific purpose. The ssh key is already in the
appropriate format so this can be directly converted</p>
./asc-to-gif.sh </span>~</span>/.ssh/id-passforios ssh-pub.gif
</span>display</span> ssh-pub.gif
</span></code></pre>
Then go to the repository settings, press the circled i  on the SSH
Key</strong> button, select the ASCII-Armor Key and click to scan the QR
code. Point the camera to the QR code on the screen and it should
appear in the key field in the app.</p>
We have to repeat this 2 more times to get the private and public key
for the password-store into the app. First exporting the keys</p>
gpg</span> --export -a 1234ABCD </span>></span>gpg.pub
</span>gpg</span> --export-secret-key -a 1234ABCD </span>></span>gpg.key
</span></code></pre>
converting to a gif, displaying them and scanning them in *Settings ->
PGP Key -> ASCII-Armor Key in the respective fields.</p>
If, after synching, you go now to the Passwords you should be greeted
with a listing of all folders and keys and the secrets should be
visible if made visible by tapping the eye icon.</p>
I needed to enable passforios</strong> as a source for autofill : Settings ->
Passwords -> Autofill Passwords and slide the toggle for Pass</strong>. I also
disabled the toggle for Strongbox</strong> which I was using for integration
with the Keepass database.</p>
Now I see the option to select the secrets from the passforios</strong> app. It
does not narrow down to the right key, but that is a problem for
future me.</p>
Ok, the hard part is done. Or at least the most risky part, ... in my
eyes... whatever. Moving on...</p>
Integration with FireFox</h2>
Checking at the bottom of the pass website</a> we find that passff</strong> is the
good stuff for integration with FireFox.  From previous adventures with
KeepassXC and NativeMessaging I assumed there had to be a host part to
be installed too.</p>
Indeed we are directed to the passff-host github repo</a> to get an
install-script which generates the native messaging json for the
different browsers and a small executable python script which contains
remarkable clean and no-dependency code.  Similarly the install script
is straightforward. I do not understand why it support half a dozen
browser, mostly chrome based as for the life of me I cannot find an
extension which uses this host program.  So either I need bigger
glasses or there is some knowledge beyond my grasp.</p>
Running the installer, installing the extension, restarting firefox
for good luck and the extension appears and offers passwords on the
sites I try.</p>
Out of curiosity I check the configuration in
~.mozilla/native-messaging :</p>
pti@tuxedo </span>~></span> ls .mozilla/native-messaging-hosts/
</span>org.keepassxc.keepassxc_browser.json</span>  passff.json  passff.py</span>*
</span>pti@tuxedo </span>~></span> cat .mozilla/native-messaging-hosts/passff.json
</span>{
</span>  </span>"name"</span>: </span>"passff"</span>,
</span>  </span>"description"</span>: </span>"Host for communicating with zx2c4 pass"</span>,
</span>  </span>"path"</span>: </span>"/home/pti/.mozilla/native-messaging-hosts/passff.py"</span>,
</span>  </span>"type"</span>: </span>"stdio"</span>,
</span>  </span>"allowed_extensions"</span>: </span>[ </span>"passff@invicem.pro" </span>]
</span>}
</span>pti@tuxedo </span>~></span> cat .mozilla/native-messaging-hosts/passff.py
</span>#!/usr/bin/python3
</span>"""
</span>    Host application of the browser extension PassFF
</span>    that wraps around the zx2c4 pass script.
</span>"""
</span>
</span>import</span> json
</span>...
</span>
</span></code></pre>
Nothing out of the ordinary, the passff.py python is the same as in
the repo.  My old keepassxc extension support is still there.</p>
Firefox is installed natively on this machine, not with a flatpak
which I assume will come with its own challenges.</p>
Chromium Support</h2>
Time to tackle the Chrome family. Chrome is required to put food on
the table so we have to get that going eventually. But Chrome is
distributed as a flatpak (or a snap but I am NOT</strong> going to deal with
that), and I can install Chromium natively, and apparently native
installs are MUCH</strong> better supported than the versions in wrappers so
let's start with that one first.</p>
From the pass website</a> we find that browserpass</a></strong> is the way to go for
the chrome family. The browser extension installs from the usual
places without drama and starts promptly complaining it cannot find
the native host to talk to.</p>
The native host in question is from the browsaerpass-native sister
repo</a> . As usual for all distro's there are packages ready to install
but because Ubuntu-derivative I can compile from source. Downloading
the source for version 3.1.0 from the releases page</a>. Again this repo
refers to all browsers including firefox although I cannot for the
life of me find a Firefox Extension supporting this host app.</p>
Then building and installing timelapse :</p>
tar</span> -xzvf </span>~</span>/Downloads/browserpass-native-3.1.0.tar.gz
</span>cd</span> browserpass-native-3.1.0
</span>ls
</span>less</span> README.md
</span>PREFIX</span>=</span>/usr/local </span>make</span> configure
</span>sudo</span> make PREFIX=/usr/local install
</span>which</span> browserpass
</span></code></pre>
which shows the executable lives at /usr/local/bin/browserpass</code> and
this totally went fine the first time (NOT!!!!).</p>
The Makefile</code> has support to install the magic json to enable native
messaging for the different browsers.</p>
PREFIX</span>=</span>/usr/local </span>make</span> hosts-chromium-user
</span>PREFIX</span>=</span>/usr/local </span>make</span> hosts-chrome-user
</span></code></pre>
The second invocation is a hail-mary because I already know the Chrome
flatpak does not look in the same places and will require some
additional finnagling</p>
For now focus on Chromium and check if the configuration looks
reasonable:</p>
pti@tuxedo </span>~></span> cd .config/chromium/NativeMessagingHosts/
</span>pti@tuxedo </span>~</span>/.c/c/NativeMessagingHosts</span>></span> ls
</span>com.github.browserpass.native.json@
</span>pti@tuxedo </span>~</span>/.c/c/NativeMessagingHosts</span>></span> cat com.github.browserpass.native.json
</span>{
</span>    </span>"name"</span>: </span>"com.github.browserpass.native"</span>,
</span>    </span>"description"</span>: </span>"Browserpass native component for the Chromium extension"</span>,
</span>    </span>"path"</span>: </span>"/usr/local/bin/browserpass"</span>,
</span>    </span>"type"</span>: </span>"stdio"</span>,
</span>    </span>"allowed_origins"</span>:</span> [
</span>        </span>"chrome-extension://naepdomgkenhinolocfifgehidddafch/"</span>,
</span>        </span>"chrome-extension://pjmbgaakjkbhpopmakjoedenlfdmcdgm/"</span>,
</span>        </span>"chrome-extension://klfoddkbhleoaabpmiigbmpbjfljimgb/"
</span>    </span>]
</span>}
</span></code></pre>
Cool, the executable is looked at where it is installed (this is not
obvious, don't ask how I know). The rest looks also like how these
things should look. Let's try...</p>
The extension settings page is no longer complaining the native host
is missing and there are password entries visible. Checking with some
website shows the password is injected. yay!.</p>
Level complete, ready for the final boss.</p>
Enabling Chrome Support, now with more Flatpak!</h2>
Ok, we have a working chromium support so repo access, host app,
native host configuration et al are proven working. We can only focus
on jumping over the Flatpak Firewall...</p>
As a good cargo cultist I do a literature study and find that I should</p>


find the config location of the flatpak app</p>
</li>

use flatpak-spawn</code> to spawn the native messaging host app</p>
</li>

enable D-Bus Session socket access for chrome</p>
</li>

Package up the calling of the host app in a single script to
configure in the json.</p>
Not necessarily in that order....</p>
</li>
</ul>
For the permission to access D-Bus Session start up flatseal</strong> from
flathub, navigate to com.google.Chrome</strong> and enable the D-Bus Session
socket. This should be possible with some additional cursing in the
manifest file of Chrome. I cannot find decent reference documentation
in a reasonable time, so flatseal</strong> it is.</p>
The configuration of the flatpak app is easy too, painful experience
seared in my brain that flatpaks look in  ~/.var/app/</strong> folder so for
Chrome this will be ~/.var/app/com.google.Chrome</strong> . From the hail-mary
install for chrome done above I know that it just creates a symbolic
link to
/usr/local/lib/browserpass/hosts/chromium/com.github.browserpass.native</strong>
so we can start from there. We will have to edit that so copy it. We
also need a wrapper to call the native host app</p>
cd </span>~</span>/.var/app/com.google.Chrome/config/google-chrome/NativeMessagingHosts
</span>cp</span> /usr/local/lib/browserpass/hosts/chromium/com.github.browserpass.native
</span>ec</span> browserpass.sh
</span></code></pre>
Add the content of the wrapper</p>
#!/bin/sh
</span>cd </span>~
</span>/usr/bin/flatpak-spawn</span> --host /usr/local/bin/browserpass </span>2</span>></span>/tmp/browserpass-error.log
</span></code></pre>
I added the optional redirect of stderr</strong> to an error logfile because
from experience I know nothing ever goes wrong if you enable error
reporting beforehand.</p>
chmod</span> +x browserpass.sh
</span>pwd
</span>pwd </span>| </span>wl-copy
</span>ec</span> com.github.browserpass.native.json
</span></code></pre>
Installing the browserpass extension in Chrome after restarting it (I
am not superstitious, just careful) and I can bask in the glory of
seeing proposals for passwords when trying to log in. Most of the
proposals are pretty garbage, but that is a problem for future me.</p>
Conclusion</h2>
I have access to my password-store secrets on my phone, my browsers on laptop and
desktop, and most importantly Emacs</strong>. Narrowing of the proposed secrets
is, euhmmm, sub-optimal, but since it is sub-optimal in the same way
on all platforms I assume that some TLC in the password-store and
cleaning of the migrated secrets will fix that in time.</p>
In the process I gained much more confidence in configuring flatpak
apps. I can decommission the keepassxc system including dealing with
the sync conflicts (which was admittedly super easy with the merge
database feature in KeepassXC). I no longer have to deal with giving
the KeepassXC window a place on the desktop and autostarting it.</p>
I am a bit puzzled about the host-apps referring to supporting
browsers for which no extensions are available. This probably might
warrant some additional investigation.</p>
Big step forward</p>


Samba Adventures with Guix
Peter Tillemans — Sat, 17 Aug 2024 00:00:00 +0200
Samba or CIFS file sharing is a finicky area at best, but widely used,
especially since it was heavily pushed by Microsoft in the Windows
ecosystem, This makes it widely used in corporate and NAS environments
and even for Linux file sharing.</p>
In this post I will look at some ways to use CIFS file sharing as a
client. Personally I find hardly any uses for Samba file serving
nowadays from my compute environments, with git</strong>, ssh</strong>, http(s)</strong>,
databases, MQTT, file synchronization services ... it hardly ever happens that
I face a situation where I think : "Hey, I wish I could serve my files
from my PC/VPS/VM/... with Samba". It is such a generic non-specific
service I usually find a more opinionated data sharing
service. Actually I find the same for NFS.</p>
That being said, it is still ubiquitous to get enterprise data and to
connect to NAS or remote hard disks.</p>
CIFS Server Simulator</h2>
In practice setting up and connecting to a CIFS server is a
frustrating experience due to a bewildering array of different
protocols, security systems, credentials, ... .</p>
To test out accessing a Samba server without having to deal with too
many moving pieces at the same time I like to use a known fixed local
basic samba server. This enables me to get working client - server
configurations which I find easier to tweak to real life servers than
starting from scratch.</p>
Docker hub provides preconfigured images for Samba servers which are
easy to use :</p>
$</span> docker run --name test-smb -p 4139:139 --rm -p 4445:445 -v `</span>pwd</span>`/samples/:/mnt/export --rm -d dperson/samba -p -u </span>"joe;schmoe"</span> -s </span>"export;/mnt/export/;yes;no;no;joe;;;Test Share"
</span></code></pre>
This will start a samba server and listen on ports 4139 and 4445 so it
does not clash if a server is running on the machine we're using and
we do not need special privileges other than being in the docker</code> group
to run docker</strong> as a regular user. The -s ...</code> option configures a share
name export</strong> which is browsable, not readonly, not accessible by guest
users and  can only be accessed with the joe</strong> user account. This is to
make the experience a bit more in line with usual real world
configuration which are seldom as open as the default settings for
shares. For more details, see the github repo for the image</a>.</p>
Because this is not a fun command line to type I like to put them in a
Makefile</strong> in a folder with some support files</p>
$</span> cd ...
</span>$</span> mkdir test-smb
</span>$</span> cd test-smb
</span>$</span> mkdir samples
</span>$</span> echo </span>"Hello, Samba" </span>></span>samples/hello.txt
</span></code></pre>
and then add the Makefile</p>
servers-start</span>:
</span>        </span>docker</span> run --name test-smb -p 4139:139 --rm -p 4445:445 -v `</span>pwd</span>`/samples/:/mnt/export --rm -d dperson/samba -p -u </span>"joe;schmoe"</span> -s </span>"export;/mnt/export/;yes;no;no;joe;;;Test Share"
</span>
</span>servers-stop</span>:
</span>        </span>docker</span> stop test-smb
</span></code></pre>
Guix Notes for Docker</h3>
Docker  (and podman too) need some OS support to talk to the kernel to
create the namespaces to make the containers work. Even though podman
does not need a daemon to run, it still needs some setuid</strong> helpers. I
tend to mostly use docker</strong> because of habit and everyone else uses it
and tends to be better supported and documented for my use cases. In
any case I did not have any luck getting either to work in a local
guix shell</code>.</p>
To enable docker</strong> on Guix-SD I have the following in my system configuration.</p>
  ...
</span>  (use</span>-</span>service</span>-</span>modules cups desktop docker networking ssh xorg)
</span>  ...
</span>
</span>(operating</span>-</span>system
</span>  ...
</span>  (users
</span>   (</span>cons</span>*
</span>    (user</span>-</span>account
</span>     ...
</span>     (supplementary</span>-</span>groups
</span>      '( ... </span>"docker"</span>)))  </span>;; enable access to docker daemon
</span>    %base</span>-</span>user</span>-</span>accounts))
</span>...
</span>(packages
</span> (</span>append
</span>  (</span>list
</span>   ...
</span>   </span>;; add docker command line tools
</span>   docker
</span>   ...
</span>   ))))
</span>...
</span>(services
</span> (</span>append
</span>  (</span>list
</span>   ...
</span>   </span>;; enable docker
</span>   (service docker</span>-</span>service</span>-</span>type)
</span></code></pre>
When using Guix on a host os, the native docker</strong> package should work
fine.</p>
Connecting using smbclient</h2>
Before mounting drives we need to ascertain our credentials are
accepted by the Samba server. It makes no sense proceeding trying to
mount shares if we cannot get past authentication and the overhead of
configuring those shares and the Guix configuration rebuilding really
impacts iteration speed when trying things out.</p>
The most straightforward way to connect to a CIFS server is with the
smbclient</strong> tool which is part of the samba</strong> package:</p>
➜</span> guix shell samba
</span>
</span>test-smb</span> on  main via 🐃
</span>➜</span> smbclient -L //localhost -p 4445 -U joe
</span>Password</span> for </span>[</span>WORKGROUP</span>\j</span>oe</span>]</span>:
</span>
</span>    </span>Sharename</span>       Type      Comment
</span>    </span>---------</span>       ----      -------
</span>    </span>export          </span>Disk      Test Share
</span>    </span>IPC$</span>            IPC       IPC Service (Samba Server)
</span>SMB1</span> disabled</span> --</span> no workgroup available
</span>
</span>test-smb</span> on  main </span>[!]</span> via 🐃  took 4s
</span>➜</span> smbclient //localhost/export -p 4445 -U joe
</span>Password</span> for </span>[</span>WORKGROUP</span>\j</span>oe</span>]</span>:
</span>Try </span>"help"</span> to get a list of possible commands.
</span>smb: </span>\></span> ls
</span>  </span>.</span>                                   D        0  Sat Aug 17 03:49:32 2024
</span>  </span>..</span>                                  D        0  Sat Aug 17 05:22:38 2024
</span>  </span>hello.txt</span>                           N       13  Sat Aug 17 03:50:27 2024
</span>
</span>                </span>1912951596</span> blocks of size 1024. 998957000 blocks available
</span>smb: </span>\>
</span></code></pre>
The guix shell samba</code> creates a profile with the samba</strong> package
installed which places `smbclient` on the path.</p>
smbclient -L //servername</code> lists the services offered by the server, in
our case localhost</strong> to connect to our docker instance. The -p 4445</code>
option selects the custom port we specified on our docker
container. By default smbclient</strong> will use your login as uid, so we need
to override it to the user we created when starting the docker
container with -U joe</code> .</p>
The password is configured as schmoe</code>.</p>
We see the export</code> folder is shared so we connect to it using
`smbclient //localhost/export -p 4445 -U joe` and can list the
contents. And of course we can upload, download and all the other
terminal goodness offered by smbclient</strong>.</p>
In practice it can be very fiddly to get the right username, password,
Workgroup or Domain, port number, SMB protocol, etc dialed in. The
obtuse messages often do not really help. The other methods make
interpreting errors even harder, with the exception of programmatic
access which is sometime surprisingly helpful in getting a connection
going.</p>
Save the credentials</h3>
The samba tools have a convention to save the credentials in a
authentication file</strong> which is supported by most tools AFAICT.</p>
To use this create a file .smbcredentials</code> in your home folder. Well,
it can be anything but I like that place as I typically only have my
NAS to connect to using samba and it is for my home folder, backup
folder, my Music and Movies folder and the like, i.e. stuff related to
my user account, so I find it in its place in my home folder.</p>
In it place the username</code>, password</code> and domain</code> which worked with
smbclient so they no longer need to be provided :</p>
username=joe
</span>password=schmoe
</span>domain=WORKGROUP
</span></code></pre>
Then we can use it:</p>
$</span> smbclient //localhost/export -p 4445 -A </span>~</span>/.smbcredentials
</span>
</span>Try </span>"help"</span> to get a list of possible commands.
</span>smb: </span>\></span> ls
</span>  </span>.</span>                                   D        0  Sat Aug 17 03:49:32 2024
</span>  </span>..</span>                                  D        0  Sat Aug 17 12:02:13 2024
</span>  </span>hello.txt</span>                           N       13  Sat Aug 17 03:50:27 2024
</span>
</span>                </span>1912951596</span> blocks of size 1024. 998918312 blocks available
</span>smb: </span>\>
</span></code></pre>
This save a lot of typing and we can use this file in the next stages
and avoid spreading the credentials all over the disk. I am going to
gloss over encrypting this info any further because I do not keep
nuclear (or any other for that matter) secrets on my nas.</p>
Mounting Shares with mount.cifs</code></h2>
Let's create a mount point in our test folder</p>
$</span> mkdir mnt
</span></code></pre>
and then mount the share with mount.cifs</code>.  This is part of the cifs-utils</code> package.</p>
ttest-smb</span> on  main </span>[?]</span> via 🐃
</span>➜</span> guix shell cifs-utils
</span>The</span> following derivation will be built:
</span>  </span>/gnu/store/2x7mmyrsnsf21aing02ass82899gm2yh-profile.drv
</span>
</span>building</span> CA certificate bundle...
</span>listing</span> Emacs sub-directories...
</span>building</span> fonts directory...
</span>building</span> directory of Info manuals...
</span>building</span> profile with 1 package...
</span>est-smb</span> on  main via 🐃
</span>❮</span> sudo mount.cifs //localhost/export mnt -o credentials=/home/pti/.smbcredentials,port=4445
</span>
</span>test-smb</span> on  main </span>[?]</span> via 🐃
</span>➜</span> ls mnt
</span>hello.txt
</span>
</span>test-smb</span> on  main </span>[?]</span> via 🐃
</span>➜
</span></code></pre>
This mounts the share to the folder mnt</code>. The -o</code> option is used to
point to the credentials file and the port number of our docker NAS
simulator.</p>
Checking with the regular mount</code> command to see if it agrees we mounted
the share:</p>

</span>❯</span> sudo mount -t cifs
</span>//localhost/export</span> on /home/pti/src/test-smb/mnt type cifs (rw,relatime,vers=3.1.1,cache=strict,username=joe,domain=WORKGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=0000:0000:0000:0000:0000:0000:0000:0001,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)
</span>
</span>test-smb</span> on  main </span>[?]</span> via 🐃
</span>➜</span> sudo mount </span>| </span>grep</span> cifs
</span>/etc/auto.cifs</span> on /nas type autofs (rw,relatime,fd=6,pgrp=1732,timeout=600,minproto=5,maxproto=5,indirect,pipe_ino=27049)
</span>//localhost/export</span> on /home/pti/src/test-smb/mnt type cifs (rw,relatime,vers=3.1.1,cache=strict,username=joe,domain=WORKGROUP,uid=0,noforceuid,gid=0,noforcegid,addr=0000:0000:0000:0000:0000:0000:0000:0001,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)
</span></code></pre>
Calling mount</code> without arguments lists all mounted filesystems, however
nowadays the output is so overwhelming that I prefer to use grep</code> to
narrow down the output to the filesystem type I am interested in. The
same thing can be achieved by specifying the filesystem type with the
-t</code> option.</p>
Configuring the mounts in the operating system.</h2>
The mount.cifs</code> command is fine for testing and ad-hoc use but in
practice I mostly (read 99+% of the time) want the same shares of the
NAS mounted in the same place on my system. This is where the fstab</code>
file comes in. This file is read by the mount command at boot time and
mounts the configured filesystems.</p>
I do not recommend mounting CIFS shares at boot time, but configuring
the shares in fstab</code> is a good way to be able to mount them when needed
with a quick mount -a</code> command.</p>
On my Tuxedo system I have in the /etc/fstab</code> file</p>
...
</span>//nas.snamellit.com/home /home/pti/nas   cifs   rw,uid=1000,gid=100,credentials=/home/pti/.smbcredentials   0   0
</span>//nas.snamellit.com/public /mnt/public   cifs   rw,uid=1000,gid=100,credentials=/home/pti/.smbcredentials   0   0
</span>//nas.snamellit.com/multimedia /mnt/multimedia   cifs   rw,uid=1000,gid=100,credentials=/home/pti/.smbcredentials   0   0
</span>...
</span></code></pre>
The first column is the reference to the share as we've seen
above. Then the mount point. The 3rd column indicates it is a cifs</code>
share, Then the options we've seen with smbmount. Here I have to play
with the uid</code> and gid</code> to align my local user and group with the
configuration on the nas. The last 2 columns are whether to include
the mounts when dumping the filesystem and doing a filesystem check
which will probably always be 0 as the CIFS server is responsible for
that.</p>
In theory this will mount the shares at boot time, and it probably
does, however in my experience it seems they are unmounted on suspend
and not remounted after resume. Or there is some timeout. I never
investigated I must admit. I just do a quick mount -a</code> before I need
them and this works wonders.</p>
On Guix-SD the file-systems</code> are specified in the operating-system</code>
section of the system configuration :</p>
(operating</span>-</span>system
</span> ...
</span>
</span>(file</span>-</span>systems
</span> (</span>cons</span>*
</span>  ...
</span>  (file</span>-</span>system
</span>    (device </span>"//nas.snamellit.com/public"</span>)
</span>    (options </span>"uid=1000,gid=1000,credentials=/home/pti/.smbcredentials"</span>)
</span>    (mount</span>-</span>point </span>"/mnt/public"</span>)
</span>    (type </span>"cifs"</span>)
</span>    (mount? #f)
</span>    (create</span>-</span>mount</span>-</span>point? #t))
</span>  (file</span>-</span>system
</span>    (device </span>"//nas.snamellit.com/multimedia"</span>)
</span>    (options </span>"uid=1000,gid=1000,credentials=/home/pti/.smbcredentials"</span>)
</span>    (mount</span>-</span>point </span>"/mnt/multimedia"</span>)
</span>    (type </span>"cifs"</span>)
</span>    (mount? #f)
</span>    (create</span>-</span>mount</span>-</span>point? #t))
</span>  (file</span>-</span>system
</span>    (device </span>"//nas.snamellit.com/home"</span>)
</span>    (options </span>"uid=1000,gid=1000,credentials=/home/pti/.smbcredentials"</span>)
</span>    (mount</span>-</span>point </span>"/home/pti/nas"</span>)
</span>    (type </span>"cifs"</span>)
</span>    (mount? #f)
</span>    (create</span>-</span>mount</span>-</span>point? #t))
</span>  %base</span>-</span>file</span>-</span>systems)))
</span> </span>)</span>
</span></code></pre>
Which is just a straightforward translation of the fstab</strong> columns in
Guix-ese.</a></p>
Automatic Mounting with AutoFs</h2>
Of course the inefficiency of having to type mount -a</code> almost on a
weekly basis is unbearable and this inefficiency has to be addressed
even if this means we cannot expect net positive effect in the coming
millenia.</p>
Enter autofs</code> which is an awesome system to dynamically mount and
unmount filesystems on an as needed basis. The kernel will notice when
a mounted folder is accessed and ask the autofs daemon</strong> to mount the
configured mount and unmount it after some timeout occurs without any
activity.</p>
This is transparant for the user other than a slight delay when
accessing the folder the first time when it is unmounted.</p>
This system is very flexible at it was clearly intended for far more
ambitious use-cases than accessing your personal music library from
your nas, but that does not mean we cannot strip it down and use it
for our purposes.</p>
What is a bit confusing is the configuration. It uses 3 different
file types to configure the system.</p>

the /etc/autofs.conf</code> file which configures the daemon operating
options, like the timeouts and the location of the main master file</strong>.</li>
the master file(s), there is always a main file, but this can
delegate to directory with additional parts of the file which can be
assumed to be imported in the main file. Its main purpose is to map
a parent folder of mount points to a map file</strong>.</li>
the map files which map a subfolder in the folder from the line in
the master file</strong> to a mount specification which will be used when
that folder is accessed.</li>
</ul>
Example on the Tuxedo:</h3>
On my Tuxedo (running Tuxedo OS which is an Ubuntu 22.04 derivate) I have the following configuration:</p>


/etc/autofs.conf</code>:</p>
...
</span>[ autofs ]
</span>#
</span># master_map_name - default map name for the master map.
</span>#
</span>master_map_name = /etc/auto.master
</span>...
</span></code></pre>
so the master map</strong> is in the file /etc/auto.master</code>.</p>
</li>

/etc/auto.master</code>:</p>
...
</span>/-  /etc/autofs.direct  -ro
</span></code></pre>
</li>
</ul>
The "/-" is a special case which means "any" directory. In this case
the folder name in the map file</strong> is assumed to be a fully qualified
directory name instead of a subfolder in the folder mentioned in the
first column.  In this case the map file</strong> is /etc/autofs.direct</code> and the
default options are -ro</code> .</p>

/etc/autofs.direct</code>:/home/pti/nas -fstype=cifs,rw,noperm,vers=3.0,credentials=/home/pti/.smbcredentials    ://nas.snamellit.com/home
</span></code></pre>
This shows that the mount point /home/pti/nas</code> will mount the share
//nas.snamellit.com/home</code> of file system type cifs with the options
(the rest of the 2nd column) as mount options.</li>
</ul>
Example on the Guix-SD desktop</h3>
Unfortunately there is not (yet) packaged support for an autofs</strong>
service-type, so we have to make it ourselves.</p>
First we define a configuration record type for our new service:</p>
(define</span>-</span>record</span>-</span>type</span>* <</span>autofs</span>-</span>configuration</span>>
</span>  autofs</span>-</span>configuration make</span>-</span>autofs</span>-</span>configuration
</span>  autofs</span>-</span>configuration?
</span>  (pid</span>-</span>file autofs</span>-</span>configuration</span>-</span>pid</span>-</span>file
</span>            (default </span>"/var/run/autofs.pid"</span>))
</span>  (autofs</span>-</span>direct autofs</span>-</span>configuration</span>-</span>autofs</span>-</span>direct
</span>                 (default (plain</span>-</span>file </span>"autofs.direct" "/home/pti/autonas -fstype=cifs,rw,noperm,vers=3.0,credentials=/home/pti/.smbcredentials  ://nas.snamellit.com/home"</span>))))
</span></code></pre>
I should probably not put my actual configuration in the default, but
it makes my life easier at the moment and I'll refactor it
later. (Yeah, sure...)</p>
Since the autofs service needs some boilerplate configuration files I
generate them with an activation function:</p>
(define (autofs</span>-</span>activation config)
</span>  </span>"Return the activation GEXP to create the config files for autofs"
</span>  (</span>with-</span>imported</span>-</span>modules '((guix build utils))
</span>                         #~(begin
</span>                             (use</span>-</span>modules (guix build utils)
</span>                                          (ice</span>-</span>9</span> textual</span>-</span>ports))
</span>
</span>                             (define (touch file</span>-</span>name)
</span>                               (call</span>-with-</span>output</span>-</span>file file</span>-</span>name (const #t)))
</span>
</span>                             </span>;; 'sshd' complains if the authorized-key directory and its parents
</span>                             </span>;; are group-writable, which rules out /gnu/store.  Thus we copy the
</span>                             </span>;; authorized-key directory to /etc.
</span>                             (call</span>-with-</span>output</span>-</span>file </span>"/etc/autofs.conf"
</span>                               (</span>lambda </span>(</span>f</span>) (put</span>-</span>string f </span>"
</span>[ autofs ]
</span>master_map_name = /etc/auto.master
</span>timeout = 300
</span>"</span>)))
</span>                             (call</span>-with-</span>output</span>-</span>file </span>"/etc/auto.master"
</span>                               (</span>lambda </span>(</span>f</span>) (put</span>-</span>string f </span>(</span>format </span>#f </span>"/-  ~a -ro</span>\n</span>"</span> #$(autofs</span>-</span>configuration</span>-</span>autofs</span>-</span>direct config)))))
</span>
</span>                             )))
</span></code></pre>
You'll recognize the absolutely stripped down versions of the files
mentioned above being generated. The /etc/auto.master</code> file maps the
directfs</strong> map file to the file generated in the configuration record.</p>
This should tie up nicely the links between the 3 files.</p>
Then I need a shepherd service</strong> to start the autofs</strong> daemon:</p>
(define (autofs</span>-</span>shepherd</span>-</span>service config)
</span>  (define pid</span>-</span>file (autofs</span>-</span>configuration</span>-</span>pid</span>-</span>file config))
</span>
</span>  (</span>list
</span>   (shepherd</span>-</span>service
</span>    (provision '(autofs))
</span>    (</span>documentation </span>"AutoFS Service."</span>)
</span>    (requirement '(networking))
</span>    (start #~(make</span>-</span>forkexec</span>-</span>constructor
</span>              (</span>list
</span>               #$(file</span>-</span>append</span> autofs </span>"/sbin/automount"</span>)
</span>               </span>"-f" </span>;; run in foreground to give shepherd more control
</span>               </span>"-p"</span> #$(autofs</span>-</span>configuration</span>-</span>pid</span>-</span>file config)
</span>               </span>"/etc/auto.master"</span>)
</span>              #:pid-file #$(autofs</span>-</span>configuration</span>-</span>pid</span>-</span>file config)))
</span>    (stop #~(make</span>-</span>kill</span>-</span>destructor))
</span>    )))
</span></code></pre>
We point it to the generated auto.master</strong> file from the activation
function. (I could probably refactor this to use guix instantiated
files but at this stage that extra level of indirection would only
confuse me and make debugging harder. I find jumping through 3 files
already hard enough to follow).</p>
Then we need to put a bow around it and define an autofs-service-type</code>.</p>
(define autofs</span>-</span>service</span>-</span>type
</span>  (service</span>-</span>type (name 'autofs)
</span>                (description </span>"Run the autofs daemon to automount folders on access."</span>)
</span>                (extensions
</span>                 (</span>list
</span>                  (service</span>-</span>extension activation</span>-</span>service</span>-</span>type autofs</span>-</span>activation)
</span>                  (service</span>-</span>extension shepherd</span>-</span>root</span>-</span>service</span>-</span>type autofs</span>-</span>shepherd</span>-</span>service)))
</span>                (compose </span>concatenate</span>)
</span>                (default</span>-</span>value (autofs</span>-</span>configuration)))
</span>  )
</span></code></pre>
This just extends the activation-service-type</code> and the
shepherd-root-service-type</code> to run our initialisation code and ensure
the autofs</strong> daemon gets started.</p>
Then we can add this to our system configuration:</p>
(operating</span>-</span>system
</span> ...
</span> (packages
</span>  (</span>append
</span>   (</span>list
</span>    ...
</span>    autofs)))
</span> (services
</span>  (</span>append
</span>   (</span>list
</span>    ...
</span>    (service autofs</span>-</span>service</span>-</span>type))
</span>   ...)))
</span></code></pre>
i.e. add the autofs</code> package to install the daemon and support stuff
and enable the service of type autofs-service-type</code>.</p>
Conclusion</h2>
I can now use files on my nas transparantly. I was a bit flippant on
my reasons to enable autofs</strong>. The real reason was that I want to keep
automatic backup copies of my forge running on an VPS somewhere on my
NAS with a cron job, which means I would not be there to run a mount -a</code> at the time. (I now realize I could do that as part of the cron
job : 20/20 hindsight). In any case this is a major quality of life
improvement. As a side effect, my music library now gets properly
indexed and is made available on the default music player. Apparently
I still use CIFS more than I care to admit.</p>
The big problem with SMB/CIFS is getting the initial connection
going. Once that is achieved and the credentials are safely stored
away in credentials</strong> file, they can be easily reused with a lot less
surprising things along the way.</p>
It also pays to test things out in the smallest possible meaningful
scope, in this case smbclient</strong> before adding more obfuscation layers on
top of it, as that just adds more complexity, pitfalls and rabbit
holes to get lost in. By going step by step, building on previous
result I often get results faster (or at all) even if I have to do
additional steps which turn out to no longer be needed in the final
solution.</p>


Refactoring Emacs Config using Org
Peter Tillemans — Sun, 28 Jul 2024 00:00:00 +0000
Refactoring my Emacs Config</h1>
It is time to work on my Emacs config. Not because it is hopelessly broken, but to prevent that from happening. A long time ago I had a literate config I had to declare Emacs bankrupcy on because of the amount of cruft and lack of TLC. It had grown to a 4000 line 100kB+ inconsistent mess. It was nice to have evrything in a single file with documentation in place.</p>
To reduce my config and leverage newer packages I then tried some of the big distros, Spacemacs and Doomemacs. This reduced the size I had to maintain to about 30k allowing me to keep on top of it. My personal modifications were then in a config.org file.</p>
A few years ago I wanted to get better on using Windows and switched my main machine to a Windows desktop. I immediately noticed Doom Emacs being slow. Then a search started to find the right version of Emacs on Windows : msvc version, cygwin, msys2, wsl, ..., which all had different integration issues. I finally figured out that there is something in Doom which caused the sluggishness, and it is far less present in much more minimal config.
*
Hence I started relatively fresh using Rational Emacs, later Crafted Emacs as a base and organizing core. This is a regular elisp modular configuration. I split my personal configuration settings in different custom modules: pti-ui-XXX, pti-ide-XXX, pti-org-XXX, pti-evil-XXX.</p>
Goals to achieve</h1>
I like to jot down some things I want to achieve to help me decide when is done and guide some decision along the way to avoid me getting stuck in the middle of a bramble forrest.</p>
I came up with:</p>

Manage init.el</em> as an org-file</li>
Use a simple robust tangling solution which works together with
Crafted Emacs</li>
Leverage inclusion of use-package</del> in Emacs29 for configuration and
loading</li>
Reduce dependencies : read evaluate the value a package brings
before including it</li>
Refactor existing configuration</li>
</ul>
In typical fashion the first goal is not a goal but what I will be doing, but judging from other Business Analysis</em> efforts, this is part for the course. What is the goal of the project? Do the project on time and in budget!</em> (real helpful...)</p>
I actually added this when I notice the path getting all tangly and thorny and I remembered I forgot to list what I wanted to do. Well better late than never.</p>
Approach</h1>
There are couple of constraints and probable consequences.</p>

likely editing the generated file instead of the source file</li>
</ul>
Navigation Between Functions</h2>
Normally in Emacs Lisp buffers navigation between functions is magic. Who knows how this will pan out in org-babel.</p>
That being said I found that in configuring emacs previously I use little homebrew functions which are usually close to where I use them and for the other functions C-h f</code> is a good friend.</p>
Editing the Generated File iso the Org Sources</h2>
That is a me</em> problem. I am going</em> to be editing the generated file. So I need early feedback for this.</p>
Tangling and Git</h2>
Adding generated files in git is a no-no. I will have to add the generated file to the gitignore.</p>
Then there is the issue that the config source file ideally is close to the generated file (see above). If I tangle the file from the git location into ~/.config/emacs</em> then I'll have to navigate between the two locations. Probably there is an easy solution for this, but I don't have it now.</p>
If I symbolic link the file from the git location to ~/.config/emacs</em> then it is unclear if emacs will compare the creation date of the symbolic link or the file it points to. Probably this is well defined but I remember being bitten by this in the past.</p>
But of course no-one is mandating that the emacs configuration has to be part of the dotfiles</em> repo. I want to refactor that shortly and if I remove all the emacs stuff from the dotfiles repo then I can just clone the emacs config repo to ~/.config/emacs</em> and be done with it. And I have less to migrate in the dotfiles. So that is a win in my book.</p>
Do I want to factor out Crafted Emacs?</h2>
I am not sure. I like the idea of having a base configuration which is well maintained and I can just add my personal configuration to. The upstream moves forward with the times, I can pull in the changes and the (mild) breakage over time will push me to keep my configuration up to date.</p>
But I also like the idea of having a configuration which is mine and mine alone. I can do whatever I want with it. I can add a package, remove a package, change a package. I can do whatever I want.</p>
However it is not on the goals list. I will keep it in mind and see how it goes.</p>
Do I want to factor out the custom modules?</h2>
Yes. In the past I was pretty happy with a single org file. Before I declared emacs bankruptcy and moved to Spacemacs and Doom Emacs I had a single org file. I liked it. I could search for things easily. I could see the context of the configuration I could add documentation in context. I liked it.</p>
What I did not like was technical debt and conflicting modules which were integrated at different times and not necessarily work well together. The experience was inconsistent and I felt I was running behind the current state of the art. Hence the need to explore the big distros.</p>
After the big distros I moved to a modular configuration based on Rational Emacs</em>, later renamed to Crafted Emacs</em>. This was a good move. I could keep up with the changes in the emacs world and I could keep my configuration in check. It was all emacs lisp and this worked well for me.</p>
I added a number of custom modules to the configuration. This works well bt I think the tools in org-mode can do better for this use-case. An Emacs config is not just code to do features. Emacs is also an integration platform where workflows are at least as important as the code. Having a place to document the workflows and the code in context is a big win. Also the code blocks can generate other files which integrate with the Emacs modules. And being able to run code blocks in the org file is a big win to show running examples or have ad-hoc tools available. Now this is also possible with comments in the source code, but I was brainwashed that comments are bad and code is good so I not comfortable with large comments in the source code. (Although that is changing slowly).</p>
Approach</h1>
Recover the Infrastructure from the Old Configuration</h2>
The tangling code proved to be very robust and will work fine with Crafted Emacs.</p>
Use Elpaca as Package Manager</h2>
I used straight</em> as package manager with Crafted Emacs. I will switch to elpaca</em> as one of the co-maintainers of straight</em> started elpaca</em> as a more user-friendly package manager.</p>
The integration with use-package</em> is more seamless and the configuration is more concise compared to straight</em>.</p>
I had to add quelpa</em> in the mix for some reason. Part of the refactor is to remove both straight</em> and quelpa</em> and use elpaca</em>.</p>
It also seems to be more in line with the modern package managers in neovim</em>.</p>
Use Org-Babel for Configuration</h2>
Yeah, Duh. This is the whole point of the exercise.</p>
But it also for maintenance support, running examples and (if needed) generating support scripts.</p>
Use use-package</em> for Configuration</h2>
Crafted Emacs leverages the customize infrastructure, including package-install-selected-packages</em> to install packages. This means that adding the packages and configuring them is a two-step process and they end up in different modules.</p>
Also there are subtle issues with state being persisted in the saved custom.el</em> file. I maintain half a dozen systems which I want to be consistent. I have the feeling that use-package</em> is better supported by the upstream package and I can steal more configs from the respective README's. Time will tell.</p>
However it is a new tool to learn and I never used it at this scale.</p>
No new features</h2>
My config suits me so I need no new features. I just want the same behavior after as before. I can quickly compare behavior on different machines. I will wait to update my VPS until I have a baseline on the desktop of the migration.</p>
Do incremental changes</h2>
I kept my init.el</em> relatively small and moved big chunks to separate modules. I can repeatedly copy a file in an org babel block and tangle it to the init.el</em> file. Then the resulting config has to be the same</p>

I will start with the init.el</em> as an org file</li>
Verify it works and behaves the same</li>
Split the block in logical pieces give them an Org Header.</li>
Evaluate if they are in the right place and move if needed.</li>
Migrate the config to use use-package</em></li>
Verify it works and behaves the same</li>
Repeat until done</li>
</ul>
When a file is migrated, I baseline to the master branch and push it to the remote.</p>
Then the next file.</p>
Doing it.</h1>
I will spare the grind of the actual migration. Actually migrating was no problem. Dealing with the long tail of issues was.</p>
Issues</h2>
Use-Package defer and loading behavior.</h3>
I faced quite some issues with the loading behavior of the packages. I started with :defer nil</code> to get things working. If Emacs took 15s to load then that was not a priority to fix. This bit me in the backend afterwards.</p>
I misundertood the documentation and made the classic mistake of attributing *magic* properties to things as `:commands`, `:hook` and `:bind`. Although it is documented that these can only define to functions in the package, I made the mistake that other functions would trigger loading the package. Since this auto loading is a thin veneer over the standard Emacs loading mechanism, this is not the case. I formulated the rule that you can only refer to a thing in the package from a thing which is already loaded. That helped debugging and avoiding this issue.
</span>
</span>I put a delay between 3 and 10s for modules I would classify as *creature comforts*. This is a good compromise between loading time and usability. I can always lower the delay if I feel the need for speed.
</span>
</span>It took some time to get this directed acyclic graph sorted out. 
</span></code></pre>
Use-Package and :custom</h3>
Since Crafted Emacs uses the customize infrastructure, and I adopted that it would make sense to use the :custom</code> keyword in use-package</code>. Of course the penny dropped after I moved ton to setq</code> forms in the :init</code> blocks. This in turn caused issues with getting passwords with the pass</em> command which is slow and requires sometimes a pin-entry.</p>
Using :custom</code> ensures the variables are still defined on loading the package so it can bootstrap and and the password will be unlocked at that time, which is probably when I do something that actually needs it.</p>
Pinentry in Emacs</h3>
I did not have this issue before but Emacs seemed to hang when started from the i3 launcher. From comparing to starting on the terminal this is likely because it was waiting for the pinentry to be entered when the emacs --daemon</em> was started which has no GUI frame. This resulted in multiple emacs --daemon</code> processes in the process list, which surprised me as I never experienced this before.</p>
I disabled the emacs pinentry support and then it pops up a GUI window so I could enter the password. This is not ideal but it works. In the mean time this is fixed as no more passwords are asked before Emacs is fully started. But it is likely this issue will return.</p>
Elpaca and Dev Releases from Emacs</h3>
Elpaca needs the build date of emacs to compare to package versions or
something. However it does not support all dev versions. It has a
table to map released versions to date codes to compare to the build
date of emacs with the date of potential packages. (or something
similar).</p>
This caused some headscratching how to get this and I finally settled on the
birthdate of the .drv package installed by guix</em>.</p>
For guix emacs-next packages you can find the date with: ( 
in the source block below:</p>
#+BEGIN_SRC shell
</span>stat /gnu/store/*emacs-next-[23]*.drv | rg Birth | cut -d' ' -f3 | tr -d '-'
</span>#+END_SRC
</span>
</span>#+RESULTS:
</span>| 20240727 |
</span>| 20240727 |
</span></code></pre>
It is possible there are more so probably the most recent one is the
one to use.</p>
I override the elpaca generated one with the one I found in early-init.el</em>.</p>
(setq elpaca-core-date "20240727")
</span></code></pre>
This is manual for now. Maybe I should trigger this on guix home reconfigure</code>.</p>
Results</h1>
I now like visiting my config more</p>
</p>
I separated the config from my main dotfiles and published separately in a public repo on my forge</a>.</p>
Here is an example with workflow notes and executable sample code :</p>
</p>
Looking at the git log:</p>
commit 008f173ef49e2dfe175c4d84e6c87425442d1468
</span>Date:   Tue Jul 30 16:51:18 2024 +0200
</span>
</span>switch to new emacs config, burn old bridges
</span>
</span>commit 2b44a918653890950b0985a4a5e8d65be22507c7
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Tue Jul 30 16:47:28 2024 +0200
</span>
</span>save crafted emacs before deleting;
</span>
</span>commit f79ab7ec6d8cd7af35253db997b291029174c38e
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Tue Jul 30 00:49:19 2024 +0200
</span>
</span>rework and testing of the new config
</span>
</span>commit acf915e24b43d4eb3950931b13121a037b77a659
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Mon Jul 29 17:51:19 2024 +0200
</span>
</span>finished porting emacs init to org-mode
</span>
</span>commit a1cd08f6e157e918f5979e57f0ee50b01688b98f
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Mon Jul 29 11:25:56 2024 +0200
</span>
</span>remove dependency on general to define evil keybindings
</span>
</span>commit 739c067427c6944c96ba5cf1990788a99beb9386
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Mon Jul 29 10:04:56 2024 +0200
</span>
</span>remove migrated config
</span>
</span>commit 4010de3d8eb8a7621d9e20bb7bc8af663059a527
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Mon Jul 29 10:01:17 2024 +0200
</span>
</span>fix issues with starting emacs.
</span>
</span>- migrated pti-org-packages and pti-org-config
</span>- migrated last requires
</span>- resolved some existing conflicts
</span>
</span>commit 99c83bb248a896c99700cca6025777a938d36701
</span>Author: Peter Tillemans <pti@snamellit.com>
</span>Date:   Mon Jul 29 01:26:08 2024 +0200
</span>
</span>Start refactor emacs config to org-mode again.
</span></code></pre>
I started on July 27th at 01:30 and the initial migration was done on July 19th 18:00 about. At that point the emacs config moved to a new repo.</p>
</p>
comparing the results we see that the files reduced from 12 to 3, total lines is the same (1851 vs 1871). However total size increased  from 67kB to about 85kB.</p>
I am pretty happy with the change. I removed some duplication, removed some packages I hardly used, found some configs in the wrong place and I have held everything in my hands for a late spring cleaning.</p>
Is it better than my before emacs lisp configuration? I don't know. It is just a tradeoff, exchanging some consequences for other consequences. I learned a ton which will help maintain it in the future. Maybe I change my mind in a few years and migrate back, which will be another great opportunity for a spring cleaning.</p>


Workflows for Unix Password Store with Emacs and Shell
Peter Tillemans — Tue, 25 Jun 2024 00:00:00 +0000
Table of Contents</h1>

Managing Secrets using Pass</a></li>
Installation</a>

GUIX</a></li>
Debian, Ubuntu et al</a></li>
</ol>
</li>
Emacs Integration</a>

Enable the Unix Password Store.</a></li>
Helper Function</a></li>
Using in Emacs Configuration</a></li>
</ol>
</li>
Shell integration</a>

DirEnv integration</a></li>
</ol>
</li>
Tips</a>

Entering passwords on the terminal</a></li>
Getting fields from multi field secrets</a></li>
</ol>
</li>
</ol>
</a></p>
Managing Secrets using Pass</h1>
On UNIX there is a well known tool to manage secrets called
password-store</strong> or pass</strong> for short.</p>
It is a very minimal tool, more to facilitate workflows that to do
real work, very much in the UNIX philosophy. It stores all secrets in
plain files in a folder structure. It does not care about what is in
the files and encrypts them using a GPG public key so only the owner
of the private key can decrypt them. It does offer special access to
the first line so a password can be quickly fetched and copied to the
clipboard or stdout or wherever some pass</strong> aware integration needs it.</p>
Certain folders can be configured to use a different public keys to
allow pragmatic secret delegation to different systems without
exposing all secrets.</p>
It leverages the gpg</strong> infrastructure for key management, distribution,
unlocking with pinentry</strong>, caching with gpg-agent</strong>.</p>
</a></p>
Installation</h1>
</a></p>
GUIX</h2>
Add password-store</strong>, gpg</strong> and pinentry</strong> to your package list.</p>
The pinentry</strong> program provides a client to securely unlock your keys in
a GUI and terminal environment. There are other options to make it
better fit your environment, but this is fine for me.</p>
</a></p>
Debian, Ubuntu et al</h2>
Add pass</strong>, gpg</strong>, gpg-agent</strong> and pinentry-gnome</strong> of pinentry-qt</strong> using</p>
$ apt-get install pass gpg gpg-agent pinentry-qt
</span></code></pre>
Both the gnome and qt versions at least fall back gracefully if no
graphical environment are available.</p>
The current selected pinentry program is provided as
/usr/bin/pinentry</strong> and this link is managed by the usual alternatives
machinery in debian based distros.</p>
</a></p>
Emacs Integration</h1>
Emacs auth-source</strong> infrastructure supports pass</strong> out of the box.</p>
</a></p>
Enable the Unix Password Store.</h2>
We have to make sure the password-store is added to the
auth-sources. There is a handy function for that:</p>
;; enable unix password-store
</span>(auth-source-pass-enable)
</span></code></pre>
We add that somewhere in the init.el before any secrets are needed.</p>
</a></p>
Helper Function</h2>
Auth-sources is a flexible system and works like a database, i.e. you
can query, browse through results and have multiple fields per secret.</p>
Example:</p>
(defun snam-password (host user)
</span>  "Get password from the unix password store.
</span>
</span>Searches the password file for a secret in the folder corresponding to
</span>the HOST name given, which is the folder with the '/' replaced by a '.'.
</span>The filename in the folder corresponds to the USER argument with a
</span>'.pgp' extension."
</span>  (auth-info-password
</span>   (car (auth-source-search
</span>         :max 1
</span>         :host host
</span>         :user user))))
</span></code></pre>
`auth-source-search` returns a list of results, so we have to get the
first entry with `car`. The secret is lightly obfuscated, hence the
need to decode it with the `auth-info-password` function.</p>
Luckily there is a function auth-source-pass-get</a> to get a password
from the password store which also follows the recommended conventions
for multiple fields in a pass file.</p>
(auth-source-pass-get 'secret "snamellit/znc")
</span></code></pre>
The pseudo key `'secret` returns the first line of the password store
entry which contains the password, per pass</strong> conventions.</p>
</a></p>
Using in Emacs Configuration</h2>
For single secrets, like connecting to my znc</strong> IRC bouncer:</p>
(erc-tls :id 'znc :server "********"
</span>         :port "****" :user "xyz" :nick
</span>         "foobar" :password (auth-source-pass-get 'secret "foobar/znc")))
</span></code></pre>
For multifield secrets, like for google authentication, we can
leverage the multiple fields in the password store. Here is my
org-gcal</strong> configuration:</p>
(setq org-gcal-client-id (auth-source-pass-get 'secret "snamellit/org-gcal-client")
</span>      org-gcal-client-secret (auth-source-pass-get "id" "snamellit/org-gcal-client")
</span>      org-gcal-fetch-file-alist '(("xyz@foobar.com" .  "~/org/schedule.org")))
</span></code></pre>
</a></p>
Shell integration</h1>
</a></p>
DirEnv integration</h2>
When developping 12-factor or similar inspired apps, the configuration
is passed using environment variables. Using .envrc</strong> files with
direnv</strong> integration in the shell is a very smooth way to work in
multiple projects.</p>
It is of course less than ideal to have the secrets exposed in the
.envrc</strong> files in your project tree even if it is in the .gitignore</strong>
file, although that is infinitely better than having secrets end up in
the git repository.</p>
Secrets in the .envrc</strong> files can be easily moved to the password store
by entering the folder. The following snippet prints the current value
to the screen and then inserts it in the password store, and verifies
it actually is entered correctly.</p>
$ echo $FOO_BAR_PASSWORD
</span>$ echo $FOO_BAR_PASSWORD | pass add -e foo/bar
</span>$ pass foo/bar
</span></code></pre>
and then editing the .envrc</strong> file from</p>
...
</span>FOO_BAR_PASSWORD=<some secret>
</span>...
</span></code></pre>
to</p>
...
</span>FOO_BAR_PASSWORD=$(pass foo/bar)
</span>...
</span></code></pre>
After modification you'll be asked to allow to read the new .envrc</strong>
file content and you can check if it still works by comparing the
password with the one printed previously.</p>
Printing the passwords allows to fix any typos. If this are the only
copies you have of them you might rug-pull yourself. Ideally it should
be possible to quickly recreate secrets if you lose any, but reality
is often far from ideal. Echoing all these passwords is also not
ideal, but preferable over keeping a little black book of secrets. If
these passwords are coming from another password manager it is not
needed of course.</p>
Do not forget to clear your terminal scroll back history with</p>
$ clear
</span></code></pre>
To help migration of .envrc</strong> files I created a bash script I stored in
~/.local/bin/envrc-to-pass</strong>:</p>
#!/bin/bash
</span>
</span>if [ "$#" -ne 2 ]; then
</span>    echo "Usage: $0 <variable_name> <namespace>" >&2
</span>    exit 1
</span>fi
</span>
</span>VAR_NAME=$1
</span>SLUG=$(echo $VAR_NAME | sed 's/_/-/g' | tr '[:upper:]' '[:lower:]')
</span>NAMESPACE=$2
</span>
</span>
</span>echo "Moving variable $VAR_NAME to $NAMESPACE/$SLUG in password store"
</span>
</span>SECRET=$(grep "$VAR_NAME=" .envrc | cut -d'=' -f2)
</span>if (echo $SECRET | grep '^\$(pass.*)'); then
</span>    echo "secret already migrated"
</span>else
</span>    echo $SECRET | pass insert -e $NAMESPACE/$SLUG
</span>fi
</span>
</span>sed -i "s#$VAR_NAME=.*#$VAR_NAME=\\\$(pass $NAMESPACE\/$SLUG)#" .envrc
</span></code></pre>
This makes short work of migrating projects to use the password-store.</p>
</a></p>
Tips</h1>
</a></p>
Entering passwords on the terminal</h2>
Usually invoking `pass add foobar/baz` will ask to enter the password
and confirm it in the shell.</p>
However when piping a secret into the password-store
with</p>
echo FOO_BAR_PASSWORD | pass add foo/bar
</span></code></pre>
will silently fail although the man pages tell that `pass add` will
read from stdin</strong>. It is not clear IMO that you have to specify the -e</strong>
flag like :</p>
echo FOO_BAR_PASSWORD | pass -e add foo/bar
</span></code></pre>
to suppress the confirmation and make it work as expected.</p>
</a></p>
Getting fields from multi field secrets</h2>
Often secrets come in multiple parts which are nice to be stored in a
single entry in order not to complicate the tree. The pass</strong>
documentation suggests:</p>
<password or main secret>
</span>field1: <some data>
</span>field2: <more data>
</span></code></pre>
the main secret is just the first line, and can have the same
structure as the other lines, if that makes more sense.</p>
e.g. for a google integration:</p>
service-account: 1234567-abcdefghijklm@developer.gserviceadmin.com(some-project)
</span>email: xyz@foobar.com
</span>private-key: ...
</span></code></pre>
In this case it is useful to document</span> which kind of secret it is as it
could also be an api-key, or a refresh-token, or whatever part of the
authentication menagerie that Google offers.</p>
To get these fields individually I use:</p>
GOOGLE_EMAIL=$(pass foo/bar | awk '/^email:/ {print $2}) 
</span></code></pre>
in emacs this syntax is supported directly and the same info can be
fetched with</p>
(let
</span>    ((google-email (auth-source-pass-get "email" "foo/bar")))
</span>  ... )
</span></code></pre>


Deploying Cuirass on GuixSD
Peter Tillemans — Tue, 11 Jun 2024 00:00:00 +0000
Table of Contents</h1>

Install Cuirass in Guix</a></li>
Create a postgresql server</a></li>
Enable the cuirass service</a></li>
Enabling the Web Frontend</a></li>
Submitting jobs</a>

Figure out a more elegant way to submit jobs</a></li>
</ol>
</li>
</ol>
</a></p>
Install Cuirass in Guix</h1>
I had a hard time installing cuirass</strong> on my system. I tried to collect
some notes to move step by step to a working solution.</p>
GUIX is great that it is really easy to revert your step to get out or
a dead end and start over from a previous point. Something I made
liberally use off to get something working. However it also means my
deployment process was not really linear but much more error driven.</p>
</a></p>
Create a postgresql server</h1>
Starting the cuirass service will pull in a postgres server, however
it will use by default a version 10. Let's update that to 15 for some
future proofing:</p>
(service postgresql-role-service-type
</span>         (postgresql-role-configuration
</span>          (roles
</span>           (list (postgresql-role
</span>                  (name "cuirass")
</span>                  (create-database? #t))
</span>                 (postgresql-role
</span>                  (name "xyz")
</span>                  (create-database? #t))))))
</span></code></pre>
I also added a database user for me (xyz</strong> here stands for my user
account).</p>
This will also create a database with the same name to allow the
cuirass user (and me) to login to the postgres database and do
database things.</p>
Run a `guix system reconfigure` and check if the postgres is running
with `sudo herd status postgres`.</p>
</a></p>
Enable the cuirass service</h1>
With the database in place there is a fighting chance to get the
service running :</p>
(service cuirass-service-type
</span>         (cuirass-configuration
</span>          (specifications #~(list))))
</span></code></pre>
The example in the reference documentation offers something more
interesting than an empty list but whatever I tried ended up with
'invalid field specifier' errors. But I get that too for nginx
configuration parts so that is probably a skill issue on my part.</p>
Edit: definitely skill issue. I did not see that I defined them in the operating-system</code> expression instead of on toplevel because it starts several screens up and down. Duh. Moving the define of the specifications to toplevel and using them here works just fine.</p>
With a bit of luck we'll see:</p>
xyz@foo ~/.config/dotfiles/guix [env]$ sudo herd status cuirass
</span>Status of cuirass:
</span>  It is running since 05:19:42 PM (4 hours ago).
</span>  Running value is 6513.
</span>  It is enabled.
</span>  Provides (cuirass).
</span>  Requires (user-processes guix-daemon postgres postgres-roles networking).
</span>  Will be respawned.
</span>xyz@foo ~/.config/dotfiles/guix [env]$ sudo herd status cuirass-web
</span>Status of cuirass-web:
</span>  It is running since 05:22:41 PM (4 hours ago).
</span>  Running value is 6679.
</span>  It is enabled.
</span>  Provides (cuirass-web).
</span>  Requires (user-processes cuirass).
</span>  Will be respawned.
</span></code></pre>
If not there may be some info in `/var/log/cuirass.log` or `/var/log/cuirass-web.log`</p>
Alternatively for debugging we can run the application from the git
repository.</p>
First of all we have to give our user access to the database:</p>
xyz@foo ~/.config/dotfiles/guix [env]$ sudo -u cuirass psql
</span>Password:
</span>psql (15.4)
</span>Type "help" for help.
</span>
</span>cuirass=> grant all on database cuirass to xyz;
</span>GRANT
</span></code></pre>
if the cuirass service has initialised the database already you can
add:</p>
cuirass=> grant all on all tables in schema public to xyz;
</span>GRANT
</span>cuirass=> grant all on all sequences  in schema public to xyz;
</span>GRANT
</span></code></pre>
This allows access without jumping through the sudo hoop.</p>
The code in the guix-cuirass</strong> project folder will now just work. Except
the postgresql socket should be exposed too in the proposed command of
the reference manual:</p>
guix shell -CPNW --expose=/var/log/guix/drvs \
</span>--expose=/var/run/dbus --expose=/run/avahi-daemon \
</span>--expose=/etc/ssl/certs --expose=/var/run/postgresql
</span></code></pre>
Note that if the tables and sequences are created when running in your
account it is quite possible that the cuirass</strong> user will not be able to
access them and complain with access denied errors. In that case we
have to do the grants for the cuirass</strong> user:</p>
xyz@foo ~/.config/dotfiles/guix [env]$ psql cuirass
</span>Password:
</span>psql (15.4)
</span>Type "help" for help.
</span>
</span>xyz=> grant all on all tables in schema public to cuirass;
</span>GRANT
</span>xyz=> grant all on all sequences  in schema public to cuirass;
</span>GRANT
</span></code></pre>
Then restarting the service with `sudo herd restart cuirass` should
make it start, or at least give a different error.</p>
Once cuirass</strong> service is running, it will be possible to run the
cuirass-web</strong> service. It relies on the existence of the
/var/run/cuirass/bridge</strong> file which is created by the cuirass service.</p>
Just to be sure that the web server is running :</p>
xyz@foo ~/src/guix-cuirass [env]$ wget http://localhost:8081
</span>--2024-06-11 21:59:09--  http://localhost:8081/
</span>Resolving localhost (localhost)... 127.0.0.1
</span>Connecting to localhost (localhost)|127.0.0.1|:8081... connected.
</span>HTTP request sent, awaiting response... 200 OK
</span>Length: 6142 (6.0K) [text/html]
</span>Saving to: ‘index.html’
</span>
</span>index.html                    100%[================================================>]   6.00K  --.-KB/s    in 0s
</span>
</span>2024-06-11 21:59:09 (378 MB/s) - ‘index.html’ saved [6142/6142]
</span></code></pre>
Cool, we have a 200 Ok status code and some index.html file so the web
UI is running. Now exposing it to the 'net.</p>
</a></p>
Enabling the Web Frontend</h1>
In the reference manual there is a nice configuration to start from to
configure nginx as a frontend for cuirass-web</strong></p>
However you cannot start nginx https without having the certificates
and you cannot get the certificates without the server running. (Well
you can but that is outside the scope of this post)</p>
So we have to cut back the configuration to only start the http nginx
server to do the first handschake with letsencrypt to get the initial
certificates</p>
Let's start with the certbot-service</strong> :</p>
(service certbot-service-type
</span>         (certbot-configuration
</span>          (email "xyz@bar.com")
</span>          (certificates
</span>           (list
</span>            (certificate-configuration
</span>             (domains '("foo.bar.com")))
</span>            ))))
</span></code></pre>
Then add the minimal part for a nginx http server to do the
letsencrypt dance.</p>
(service nginx-service-type
</span>         (nginx-configuration
</span>          (server-blocks
</span>           (list
</span>            ;; TLS is required for authentication; serve the site via
</span>            ;; HTTPS only.
</span>            (nginx-server-configuration
</span>             (listen '("80"))
</span>             (raw-content
</span>              (list "return 308 https://$host$request_uri;")))
</span>
</span>            ))))
</span></code></pre>
Doing a `guix system reconfigure` now will start the nginx server and
download fresh certificates.</p>
We can now add the https server proxy-ing the cuirass-web</strong> server:</p>
(service nginx-service-type
</span>         (nginx-configuration
</span>          (server-blocks
</span>           (list
</span>            ;; TLS is required for authentication; serve the site via
</span>            ;; HTTPS only.
</span>            (nginx-server-configuration
</span>             (listen '("80"))
</span>             (raw-content
</span>              (list "return 308 https://$host$request_uri;")))
</span>
</span>            (nginx-server-configuration
</span>             (listen '("443 ssl"))
</span>             (server-name '("foo.bar.com"))
</span>             (ssl-certificate "/etc/letsencrypt/live/foo.bar.com/fullchain.pem")
</span>             (ssl-certificate-key "/etc/letsencrypt/live/foo.bar.com/privkey.pem")
</span>             (locations
</span>              (list
</span>               ;; Proxy the whole Cuirass web site...
</span>               (nginx-location-configuration
</span>                (uri "/")
</span>                (body (list "proxy_pass http://localhost:8081;")))
</span>               ;; ... but require authentication for the admin pages.
</span>               (nginx-location-configuration
</span>                (uri "~ ^/admin")
</span>                (body
</span>                 (list "if ($ssl_client_verify != SUCCESS) \
</span>            { return 403; } proxy_pass http://localhost:8081;")))))
</span>             ;; (raw-content
</span>             ;;  ;; Register your self-generated certificate authority.
</span>             ;;  (list "ssl_client_certificate /etc/ssl/certs/Snamellit_CA.pem;"
</span>             ;;        "ssl_verify_client optional;"))
</span>             )
</span>            ))))
</span></code></pre>
Creating and installing the root CA is a bit out of scope. For this
post we'll just wave our hands and assume the certificate magically
appeared in the `/etc/ssl/certs/Snamellit_{CA.pem</sub>` location. Creating a
client certificate for firefox and importing it allows to access the
admin section and retrigger jobs etc.</p>}
Once that is setup the commented out section can be activated.</p>
</a></p>
Interactivele Submitting jobs</h1>
For some reason I do not understand yet, the specification file must
be in the loadpath of the cuirass program.</p>
For testing I add them to the examples</strong> folder in the guix-cuirass</strong>
folder in the home folder of the cuirass</strong> user</p>
$ sudo -u cuirass -- bash              # start a shell in the cuirass user
</span>$ cd guix-cuirass                      # enter the project folder
</span>$ cp /foo/bar/snamguix.scm examples    # put spec somewhere on loadpath
</span>$ # start dev environment in container
</span>$ guix shell -CPNW --expose=/var/log/guix/drvs \
</span>    --expose=/var/run/dbus --expose=/run/avahi-daemon \
</span>    --expose=/etc/ssl/certs --expose=/var/run/postgresql
</span>guix shell: loading environment from '/home/pti/src/guix-cuirass/guix.scm'...
</span>$ ~/src/guix-cuirass [env]$ # register new recipe
</span>$ ~/src/guix-cuirass [env]$ ./pre-inst-env cuirass register -S examples/snamguix.scm
</span>2024-06-11T20:18:08 running Fibers on 8 kernel threads
</span>2024-06-11T20:18:08 marking stale builds as "scheduled"...
</span>2024-06-11T20:18:08 builds will be made via the local build daemon
</span>2024-06-11T20:18:08 will perform up to 8 evaluations concurrently
</span>2024-06-11T20:18:08 opening bridge socket at '/tmp/cuirass-tests/var/run/cuirass/bridge'
</span>2024-06-11T20:18:08 retrieving list of pending builds...
</span>2024-06-11T20:18:08 unused GC roots older than 2592000s will be deleted every 86400s
</span>2024-06-11T20:18:08 deleting old GC roots from '/var/guix/gcroots/profiles/per-user/pti/cuirass'...
</span>2024-06-11T20:18:08 selected 0 GC roots to remove
</span>WARNING: (cuirass base): imported module (fibers) overrides core binding `sleep'
</span>2024-06-11T20:18:08 heap: 12.18 MiB; threads: 17; file descriptors: 76
</span>WARNING: (cuirass scripts register): imported module (fibers) overrides core binding `sleep'
</span>2024-06-11T20:18:08 canceling 0 stale builds
</span>2024-06-11T20:18:08 restarting 0 pending builds
</span>2024-06-11T20:18:08 building 0 derivations in batches of 200
</span>2024-06-11T20:18:08 done with 0 derivations
</span>2024-06-11T20:18:08 outputs:
</span><C-C> 
</span>$
</span></code></pre>
This actually starts the scheduler and it just keeps running (unless
we also give the –one-shot flag) but the side effect is to add the
specification to the database. It also allows to see immediately if there are syntax
errors or similar. When satisfied Ctrl-C out of it.</p>
From now on the channel will be checked and build any updated
packages.</p>
</a></p>
Permanently add the job</h2>
Once vetted the specification can be added to the system configuration.</p>
Define the specifications on the toplevel of the system config file. (Be careful, I lost a lot of time because I did not see it was actually in the operating-system</em> expression)</p>
;; cuirass specifications
</span>(define %cuirass-specifications
</span>#~(list
</span>    (specification
</span>    (name "hello")
</span>    (build 'hello))
</span>    (specification
</span>    (name 'snamguix)
</span>    (build '(channels . (snamguix)))
</span>    (channels
</span>    (cons (channel
</span>            (name 'snamguix)
</span>            (url "https://forge.snamellit.com/pti/snamguix.git")
</span>            (branch "main"))
</span>            %default-channels)))))
</span></code></pre>
then replace the empty list in the cuirass-service</em> :</p>
       (service cuirass-service-type
</span>                (cuirass-configuration
</span>                 (specifications %cuirass-specifications)))
</span></code></pre>
reconfigure your system and restart cuirass</em> with sudo herd restart cuirass</code>.</p>
It is not really</em> needed as it was already added to the database, but this will be useful when the CI server need to be repaved.</p>


Terraform workflow using Guix and Emacs
Peter Tillemans — Wed, 05 Jun 2024 00:00:00 +0000
Terraform Deployments</h1>
Terraform allows infrastructure to be defined to deploy applications
and other solutions as code and supports a plethora of on-premise and
cloud deployment targets.</p>
It is essentially based on building a graph of dependencies between
resources, data and modules using the terraform language.</p>
Due to the nature of the beast these things tend to run in the CI
pipelines which makes editing these files frustrating as the edits
have to be committed, pushed, runners have to be scheduled and usually
the deploy pipeline is not the first job.</p>
So good local tooling is needed to get fast feedback.</p>
Terraform tooling on GUIX</h1>
In order to run terraform I need to first package it as it is not
available in the GUIX repositories.</p>
(define</span>-</span>public terraform
</span>  (package
</span>   (name </span>"snam-terraform"</span>)
</span>   (version </span>"1.8.4"</span>)
</span>   (source (origin
</span>            (method url</span>-</span>fetch)
</span>            (uri (</span>string</span>-</span>append </span>"https://releases.hashicorp.com/terraform/"</span> version </span>"/terraform_"</span> version </span>"_linux_amd64.zip"</span>))
</span>            (sha256
</span>             (base32
</span>	       </span>"1i181cmzwlrx8d40z1spilcwgnhkzwalrg8822d23sqdmrs7a5hj"</span>))))
</span>   (build</span>-</span>system binary</span>-</span>build</span>-</span>system)
</span>   (supported</span>-</span>systems '(</span>"x86_64-linux"</span>))
</span>   (arguments '(
</span>      #:install-plan
</span>      `((</span>"." </span>(</span>"terraform"</span>) </span>"bin/"</span>))
</span>      #:phases
</span>      (modify</span>-</span>phases %standard</span>-</span>phases
</span>		     </span>;; this is required because standard unpack expects
</span>		     </span>;; the archive to contain a directory with everything inside it,
</span>		     </span>;; while babashka's release .tar.gz only contains the `bb` binary.
</span>		     (</span>replace</span> 'unpack
</span>			      (</span>lambda</span>* </span>(#:key inputs #:allow-other-keys)
</span>				(system</span>* </span>(which </span>"unzip"</span>)
</span>					 (</span>assoc</span>-</span>ref inputs </span>"source"</span>))
</span>				#t)))))
</span>   (inputs
</span>    `((</span>"libstdc++"</span> ,(make</span>-</span>libstdc</span>++</span> gcc))
</span>      (</span>"zlib"</span> ,zlib)))
</span>   (native</span>-</span>inputs
</span>    `((</span>"unzip"</span> ,unzip)))
</span>   (synopsis </span>"A tool to describe and deploy infrastructure as code"</span>)
</span>   (description
</span>    </span>"Terraform allows you to describe your complete infrastructure in the form of code. Even if your servers come from different providers such as AWS or Azure, Terraform helps you build and manage these resources in parallel across providers."</span>)
</span>   (home</span>-</span>page </span>"https://hashicorp.com/terraform"</span>)
</span>   (license #f)))
</span>
</span>(define</span>-</span>public snam</span>-</span>terraform</span>-</span>1.6
</span>  (package
</span>    (inherit terraform)
</span>    (version </span>"1.6.6"</span>)
</span>    (source (origin
</span>             (method url</span>-</span>fetch)
</span>             (uri (</span>string</span>-</span>append </span>"https://releases.hashicorp.com/terraform/"</span> version </span>"/terraform_"</span> version </span>"_linux_amd64.zip"</span>))
</span>             (sha256
</span>              (base32
</span>	       </span>"002g0ypkkfqy5nf989jyk3m1l7l0455hsaq11xfhr5lbv4zqh5yi"</span>))))))
</span>
</span></code></pre>
I immediately added support to build older versions because that's
what the customer is on and terraform is quite version dependent
AFAICT.</p>
Now I can create a manifest for this project. I usually bootstrap them
with guile shell --export-manifes go gopls</code> or similar and then add
stuff when it comes up.</p>
;; What follows is a "manifest" equivalent to the command line you gave.
</span>;; You can store it in a file that you may then pass to any 'guix' command
</span>;; that accepts a '--manifest' (or '-m') option.
</span>
</span>(specifications</span>-></span>manifest
</span>  (</span>list </span>"go" "gopls" 
</span>        </span>"google-cloud-sdk" 
</span>        </span>"postgresql" 
</span>        </span>"snam-terraform-1.6" </span>; from snamellit channel
</span>        ))
</span></code></pre>
Direnv support</h1>
In order to manage my project environment and align it with the CI
environment I added the expected variables and use the guix support in
the stdlib of direnv. This will create a guix environment configured
from the manifest.</p>
use guix
</span>
</span>export DB_URL="postgresql://<db_ip>/myproj"
</span>export DB_USER="xyz"
</span>export DB_PASSWORD="secret"
</span>export PGPASSWORD=$DB_PASSWORD
</span>
</span>export VAULT_TOKEN="<blablabla>"
</span>export APPTIO_URL=https://acme.tpondemand.com
</span>export APPTIO_TOKEN=<blablabla>
</span>
</span>export OPENAI_API_KEY=<blablabla>
</span>
</span>export VAULT_ADDR=https://vault.acme.com
</span>export STATE_BUCKET=com-acme-test-myproj-tf-state
</span>
</span>export TF_VAR_project_short=myproj
</span>export TF_VAR_project=com-acme-test-${TF_VAR_project_short}
</span>
</span>PATH_add ./node_modules/.bin
</span></code></pre>
Emacs support</h1>
Direnv Support</h2>
Emacs direnv mode</em> will load the configuration from the .envrc</em> file
when opening a file in that project. The variables and apps are then
available for complition, LSP, shell, etc.</p>
;; enable direnv mode
</span>(direnv</span>-</span>mode)
</span></code></pre>
I just enable it globally because I want that always, not just for
terraform.</p>
Terraform Support</h2>
Enable some syntax highlighting and more importantly documentation
help. Also set format-on-save</code> and the indent to 2 spaces</p>
;; configure terraform support
</span>(</span>require</span> 'terraform</span>-</span>mode)
</span>(add</span>-</span>hook 'terraform</span>-</span>mode</span>-</span>hook 
</span>          (</span>lambda </span>()
</span>            (outline</span>-</span>minor</span>-</span>mode </span>1</span>)))
</span>(custom</span>-</span>set</span>-</span>variables
</span> '(terraform</span>-</span>indent</span>-</span>level </span>2</span>)
</span> '(terraform</span>-</span>format</span>-</span>on</span>-</span>save </span>t</span>))
</span></code></pre>
and expose the functionality in similar keybindings as I use for LSP
support :</p>
(evil-define-key 'normal terraform-mode-map
</span>  (kbd "<leader>c k") #'terraform-open-doc
</span>  (kbd "<leader>c f") #'terraform-format
</span>  (kbd "<leader>c F") #'terraform-format-buffer
</span>  (kbd "<leader>c n") 'flymake-goto-next-error
</span>  (kbd "<leader>c p") 'flymake-goto-prev-error)
</span></code></pre>
</em> will now open a browser window with the documentation of
the terraform element under the cursor. This does need terraform to be
installed though.</p>
Add support to Makefile</h2>
In order to save me from remembering the commandlines and because I
keep the terraform files in a terraform</em> directory I make some make</em>
targets to quickly access them.</p>

</span>tfinit</span>: 
</span>	</span>terraform</span> -chdir</span>=</span>terraform init -backend-config</span>=</span>"bucket=</span>${</span>STATE_BUCKET</span>}</span>"
</span>
</span>tfcheck</span>:
</span>	</span>terraform</span> -chdir</span>=</span>terraform validate
</span>
</span>tfapply</span>:
</span>	</span>terraform</span> -chdir</span>=</span>terraform apply
</span>
</span>tfplan</span>:
</span>	</span>terraform</span> -chdir</span>=</span>terraform plan
</span>
</span>tflint</span>:
</span>	</span>docker</span> run --rm -v `</span>pwd</span>`/terraform:/data -t ghcr.io/terraform-linters/tflint
</span>
</span></code></pre>
Workflow tips</h1>
Most of it is essentially hidden in the normal workflow. i.e. opening
a terraform file will load it, saving formats it. The compile</em> feature
can be used to do file checking and linting.</p>
Magit commit - push triggers the CI pipeline to run the deploy.</p>
It is easy to test things out locally with the Makefile and it reduces
the number of steps in the CI script , so less things which can do
weird things.</p>


KeePassXC from flatpak
Peter Tillemans — Sun, 12 May 2024 00:00:00 +0000
Table of Contents</h1>

KeePassXC from flatpak</a></li>
Allow access to the socket file</a></li>
keepassxc-proxy</a></li>
Configure Chrome</a></li>
Configure Brave</a></li>
Configure Firefox</a></li>
references</a></li>
</ol>
</a></p>
KeePassXC from flatpak</h1>
More and more browsers are coming packaged in containers like flatpak or snaps. Especially the ones of the chromium variety.</p>
Since browsers are at the best of times scary things with arbitrary code being executed in every webpage runnning them in a sandbox makes a lot of sense.</p>
However the sandbox also impacts communication with helpers like the password manager KeepassXC.</p>
In order to keep things reproducible on many machines, if we're going to fight with flatpak we might as well run keepassxc as a flatpak.</p>
$ flatpak install org.keepassxc.KeePassXC
</span></code></pre>
</a></p>
Allow access to the socket file</h1>
Allow read-only access to the keepassxc socket at
$XDG_{RUNTIME</sub>_{DIR</sub>/org.keepassxc.KeePassXC.BrowserServer:ro :</p>}}$ flatpak override --user \
</span>  --filesystem=xdg-run/app/org.keepassxc.KeePassXC:ro \
</span>  com.google.Chrome
</span></code></pre>
this needs to be done for each flatpak application needing access to keepassxc.</p>
</a></p>
keepassxc-proxy</h1>
There is  a statically compiled rust based socket proxy.</p>


rust based keepassxc proxy</a></p>
It can be compiled with MUSL for a fully static executable.</p>
Place it together with the configuration file</p>
</li>
</ul>
</a></p>
Configure Chrome</h1>
The Chrome flatpak can be configured in the folder
*~/.var/app/com.google.Chrome :</p>
❯ ls .var/app/com.google.Chrome/config/google-chrome/NativeMessagingHosts 
</span>keepassxc-proxy  org.keepassxc.keepassxc_browser.json
</span></code></pre>
the native messaging config file needs to be configured for the local
user:</p>
{
</span>    "allowed_origins": [
</span>        "chrome-extension://pdffhmdngciaglkoonimfcmckehcpafo/",
</span>        "chrome-extension://oboonakemofpalcgghocfoadofidjkkk/"
</span>    ],
</span>    "description": "KeePassXC integration with native messaging support",
</span>    "name": "org.keepassxc.keepassxc_browser",
</span>    "path": "/home/pti/.var/app/com.google.Chrome/config/google-chrome/NativeMessagingHosts/keepassxc-proxy",
</span>    "type": "stdio"
</span>}
</span></code></pre>
and do not forget to give access to the socket</p>
$ flatpak override --user --filesystem=xdg-run/app/org.keepassxc.KeePassXC:ro com.google.Chrome
</span></code></pre>
Notes;</p>

the path</strong> field needs to contain the full path including the username
AFAICT.</li>
The extension id can be stolen from the URL box when going into the
settings pane of the extension. It has changed in the past.</li>
</ul>
</a></p>
Configure Brave</h1>
we need again an org.keepassxc.keepassxc_{browser.json</sub></strong> file in
~/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/NativeMessagingHosts/</strong>
folder together with an executable version of the proxy compiled above.</p>}{
</span>    "allowed_origins": [
</span>        "chrome-extension://pdffhmdngciaglkoonimfcmckehcpafo/",
</span>        "chrome-extension://oboonakemofpalcgghocfoadofidjkkk/"
</span>    ],
</span>    "description": "KeePassXC integration with native messaging support",
</span>    "name": "org.keepassxc.keepassxc_browser",
</span>    "path": "/home/pti/.var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/NativeMessagingHosts/keepassxc-proxy",
</span>    "type": "stdio"
</span>}
</span></code></pre>
You can copy it from the Google Chrome config but do not forget to
update the path to the proxy.</p>
Now we still need to give access to brave to the keepassxc socket:</p>
$ flatpak override --user --filesystem=xdg-run/app/org.keepassxc.KeePassXC:ro com.brave.Browser
</span></code></pre>
</a></p>
Configure Firefox</h1>
I have firefox running native on my laptop so these shenanigans are
not needed. However the example I based most of was for firefox so I
assume it works similar. Note that the native messaging file is
different for firefox.</p>
{
</span>    "allowed_extensions": [
</span>        "keepassxc-browser@keepassxc.org"
</span>    ],
</span>    "description": "KeePassXC integration with native messaging support, workaround for flatpaked Firefox, see https://is.gd/flatpakFirefoxKPXC",
</span>    "name": "org.keepassxc.keepassxc_browser",
</span>    "path": "/home/pti/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts/keepassxc-proxy",
</span>    "type": "stdio"
</span>}
</span></code></pre>
it uses allowed_{extensions</sub></strong> iso allowed_{origin</sub></strong></p>}}
And give access to the socker file to firefox</p>
$ flatpak override --user --filesystem=xdg-run/app/org.keepassxc.KeePassXC:ro org.mozilla.firefox
</span></code></pre>
</a></p>
references</h1>

post on discourse flathub</a></li>
rust based keepassxc proxy</a></li>
Google Chrome documentation for Native Messaging</a></li>
Github Issue on keepassxc</a></li>
issue 1267 on keepassxc</a></li>
</ul>


Issue with SBCL console output in Sly
Peter Tillemans — Sat, 13 Apr 2024 00:00:00 +0000
Inconsistent output in REPL</h1>
When doing the examples in the Practical Common Lisp</em> book I had confusing output in the repl when prompting the user for CDs using SBCL.</p>
; Dedicated output stream setup (port 46185)
</span>; Redirecting all output to this MREPL
</span>; SLY 1.0.43 (#<MREPL mrepl-1-1>)
</span>CL-USER> (prompt-for-cd)
</span>Title: Unplugged
</span>Eric Clapton 
</span>8
</span>y
</span></code></pre>
Apparently a similar issue was first found on MacOSX and later confirmed on Arch.</p>
The suggestion was given to disable passing the output via a socket to have higher performance that via the protocol by adding</p>
(setf slynk:*use-dedicated-output-stream* nil)
</span></code></pre>
Since I rather have something working than it being highly performant and not-working I followed the suggestion which fixed the issue:</p>
CL-USER> (prompt-for-cd)
</span>Title: Bar 
</span>Artist: Foo Fighters
</span>Rating: 8
</span>Ripped: y
</span>
</span>y (y or n) y
</span>(:TITLE "Bar " :ARTIST "Foo Fighters" :RATING 8 :RIPPED T)
</span>CL-USER>  
</span></code></pre>
so I can continue with the chapter.</p>


Intercepting Bluetooth Keyboard Events
Peter Tillemans — Thu, 14 Dec 2023 00:00:00 +0000
Intercepting Bluetooth Keyboard Events</h1>
I like keyboards and I like custom keyboards. However many do not allow sufficient configuration to let
a key be Ctrl on hold and Esc on top. Notably the HHKB.</p>
USB devices are nicely listed in /dev/input/by-id/</em> folder but on my system the event device is anonymously placed in /dev/input/</em>.</p>
Figuring out the name</h2>
❯ for dev in /dev/input/*; do udevadm info --attribute-walk $dev; done | grep -A10 -B10 Keyboard
</span>Unknown device "/dev/input/by-id": No such device
</span>Unknown device "/dev/input/by-path": No such device
</span>    ATTRS{capabilities/led}=="1f"
</span>    ATTRS{capabilities/msc}=="10"
</span>    ATTRS{capabilities/rel}=="0"
</span>    ATTRS{capabilities/snd}=="0"
</span>    ATTRS{capabilities/sw}=="0"
</span>    ATTRS{id/bustype}=="0005"
</span>    ATTRS{id/product}=="0021"
</span>    ATTRS{id/vendor}=="04fe"
</span>    ATTRS{id/version}=="0001"
</span>    ATTRS{inhibited}=="0"
</span>    ATTRS{name}=="HHKB-Hybrid_1 Keyboard"
</span>    ATTRS{phys}=="04:33:c2:f4:e9:70"
</span>    ATTRS{power/control}=="auto"
</span>    ATTRS{power/runtime_active_time}=="0"
</span>    ATTRS{power/runtime_status}=="unsupported"
</span>    ATTRS{power/runtime_suspended_time}=="0"
</span>    ATTRS{properties}=="0"
</span>    ATTRS{uniq}=="cb:7a:7c:03:2d:f2"
</span></code></pre>
for other keyboards a bit of finagling for searching with grep might be needed or pipe into less</em> and scroll till you find it.</p>
Now I can add it to my */etc/interception/udevmon.d/ctrl_tap_esc.yaml :</p>
- JOB: "intercept -g $DEVNODE | dual-function-keys -c /etc/interception/dual-function-keys.yaml | uinput -d $DEVNODE"
</span>  DEVICE:
</span>    NAME: "PFU Limited HHKB-Hybrid"
</span>    EVENTS: 
</span>      EV_KEY: [KEY_LEFTCTRL]
</span>- JOB: "intercept -g $DEVNODE | dual-function-keys -c /etc/interception/dual-function-keys.yaml | uinput -d $DEVNODE"
</span>  DEVICE:
</span>    NAME: "PFU Limited HHKB-Hybrid Keyboard"
</span>    EVENTS: 
</span>      EV_KEY: [KEY_LEFTCTRL]
</span>- JOB: "intercept -g $DEVNODE | dual-function-keys -c /etc/interception/dual-function-keys.yaml | uinput -d $DEVNODE"
</span>  DEVICE:
</span>    NAME: "HHKB-Hybrid_1 Keyboard"
</span>    EVENTS: 
</span>      EV_KEY: [KEY_LEFTCTRL]
</span></code></pre>
The first 2 are for USB but that is still a work in progress</p>


Emacs Debugging with Dape
Peter Tillemans — Fri, 20 Oct 2023 00:00:00 +0000
For reasons I keep a set of machines where I regularly work on in sync so they offer a familiar environment. This includes a dual boot desktop (Ubuntu/Windows+WSL), laptop (Arch/Windows+WSL), a VPS(Arch) doing stuff, a  virtual Ubuntu thing which is always running to monitor stuff on my NAS, and a Steam deck (Arch kinda). I expect these to be familiar environments so I can do some light development and scripting on them at least.</p>
Test plan</h1>
In order to test the debugging support we need some minimum set of requirements to avoid descending in the abyss of incremental details.</p>
To evaluate the configuration for a  language we need</p>

a simple project in order not to be debugging the build system or the code itself taking more time than setting up the debugging. DAP is plenty complicated on its own.</li>
The DAP adapter installed with minimal manual work because otherwise it wont get done and there will be too much variance/rework between systems</li>
A set of familiar keybindings</li>
</ul>
My requirements are:</p>

I can run the program in the debugger</li>
I can pass command line arguments to the script</li>
I can break the program on a line in the editor</li>
I can examine variables in scope when the breakpoint is hit</li>
I can see the output of the program</li>
I can quit/restart and there should not be leaking of processes/network ports/buffers. I.e. I can get back to editing and debugging without rebooting my PC.</li>
(I would like to pass environment variables too, but since apparently direnv works fine for my purposes I hardly ever use it anymore, so keep that on the backburner for now.)</li>
</ul>
I do not really use debugging for something else. I actually seldom use the debugger. Mostly for learning new programming languages or playing with libraries concepts. If things get hairy I return back to logging/println debugging anyway (or adding more tests to herd the bugs in a small area).</p>
My test procedure is as follows.</p>

open the source code</li>
place a breakpoint early in the program after some variables are set</li>
<leader>dd</code> to start the debugger</li>
curse on the dape prompt to select the program and pass arguments, set the cwd</em> and more of that fun.</li>
check if the breakpoint is hit</li>
examine the variables</li>
continue to see the program continue with <leader>dc</code></li>
quit the program with <leader>dq</code></li>
verify we are back in our familiar editing session</li>
do a quick ps ax</code> to see if we do not have unwanted critters still crawling around the process space.</li>
</ul>
It is far from a comprehensive test, but we are testing here if the DAP adapter is properly installed and behaving as expected in my environment, not a validation test of the adapter itself.</p>
Javascript/Typescript example</h2>
I assume that if I can debug typescript, I can debug javascript. So I created a little typescript program to calculate the answer to the meaning of life, the universe and everything.</p>
But first installing the DAP adapter. It is a bit fiddly and I do not want to repeat that on all my systems so I let emacs to the heavy lifting. It are just the instructions from the dape</em> repo:</p>
(setq snam-vscode-js-debug-dir (file-name-concat user-emacs-directory "dape/vscode-js-debug"))
</span>(defun snam-install-vscode-js-debug ()
</span>  "Run installation procedure to install JS debugging support"
</span>  (interactive)
</span>  (mkdir snam-vscode-js-debug-dir t)
</span>  (let ((default-directory (expand-file-name snam-vscode-js-debug-dir)))
</span>    
</span>    (vc-git-clone "https://github.com/microsoft/vscode-js-debug.git" "." nil)
</span>    (message "git repository created")
</span>    (call-process "npm" nil "*snam-install*" t "install")
</span>    (message "npm dependencies installed")
</span>    (call-process "npx" nil "*snam-install*" t "gulp" "dapDebugServer")
</span>    (message "vscode-js-debug installed")))
</span>
</span>
</span></code></pre>
Then add the  dap config for the javascript and typescript modes:</p>
            (add</span>-to-</span>list</span> 'dape</span>-</span>configs
</span>                         `(vscode</span>-</span>js</span>-</span>node
</span>                           modes (js</span>-</span>mode js</span>-</span>ts</span>-</span>mode typescript</span>-</span>mode typescript</span>-</span>ts</span>-</span>mode)
</span>                           host </span>"localhost"
</span>                           port </span>8123
</span>                           command </span>"node"
</span>                           command</span>-</span>cwd ,(file</span>-</span>name</span>-</span>concat snam</span>-</span>vscode</span>-</span>js</span>-</span>debug</span>-</span>dir </span>"dist"</span>)
</span>                           command</span>-</span>args (</span>"src/dapDebugServer.js" "8123"</span>)
</span>                           :type </span>"pwa-node"
</span>                           :request </span>"launch"
</span>                           :cwd dape</span>-</span>cwd</span>-</span>fn
</span>                           :program dape</span>-</span>find</span>-</span>file</span>-</span>buffer</span>-</span>default
</span>                           :outputCapture </span>"console"
</span>                           :sourceMapRenames </span>t
</span>                           :pauseForSourceMap </span>nil
</span>                           :enableContentValidation </span>t
</span>                           :autoAttachChildProcesses </span>t
</span>                           :console </span>"internalConsole"
</span>                           :killBehavior </span>"forceful"</span>))
</span></code></pre>
The debugging our little app. Answer at the prompt:</p>
vscode-js-node :program "src/main.ts" 
</span></code></pre>
and the debug view opens:</p>
</p>
Python example</h2>
As indicated on the dape repo install the python DAP adapter</p>
$</span> pip install debugpy
</span></code></pre>
Add the default settings to dape-configs</code></p>
            (add</span>-to-</span>list</span> 'dape</span>-</span>configs
</span>                         `(debugpy
</span>                           modes (python</span>-</span>ts</span>-</span>mode python</span>-</span>mode)
</span>                           command </span>"c:/Python312/python.exe"
</span>                           command</span>-</span>args (</span>"-m" "debugpy.adapter"</span>)
</span>                           :type </span>"executable"
</span>                           :request </span>"launch"
</span>                           :cwd dape</span>-</span>cwd</span>-</span>fn
</span>                           :program dape</span>-</span>find</span>-</span>file</span>-</span>buffer</span>-</span>default))
</span></code></pre>
and update the command to wherever python is installed. This is from my windows machine which succeeded again to lose its default python config so I have to coerce it a bit to find it.</p>
Open a python file, and start the debugger. On the Dape config:</code> prompt enter:</p>
debugpy :args ["6" "7"]
</span></code></pre>
There are many more parameters, but dape</em> will ask the missing ones with the functions in the configuration, here dapy-cwd-fn</code> to fill in the current working directory (usually the project root) in the :cwd</code> field and dape-find-file-buffer-default</code> will propose the open file to run as the program to debug.</p>
It cannot meaningfully guess which parameters I want to pass so I add manually the :attr</code> field with the values "6"</code> and "7"</code> in a vector. Do not use a list for that as that is not properly encoded by the json converter.</p>
It asks to confirm the program and opens the debugging views:</p>
</p>
Go Example</h2>
Installing the go adapter is just installing delve</em> with your favorite package manager. If your package manager does not help (looking at you, chocolatey):</p>
go</span> install github.com/go-delve/delve/cmd/dlv@latest
</span></code></pre>
I did not bother to emacsify this as it is completely different for all my systems and I probably revisit that some time if I have a good idea to somehow abstract the differences away.</p>
Adding the config to dape-configs</code>:</p>
            (add-to-list 'dape-configs
</span>                         `(delve
</span>                           modes (go-mode go-ts-mode)
</span>                           command "dlv"
</span>                           command-args ("dap" "--listen" "127.0.0.1:55878")
</span>                           command-cwd dape-cwd-fn
</span>                           host "127.0.0.1"
</span>                           port 55878
</span>                           :type "debug"       ;; needed to set the adapterID correctly as a string type
</span>                           :request "launch"
</span>                           :cwd dape-cwd-fn
</span>                           :program dape-cwd-fn))
</span>
</span></code></pre>
see debugging tips for an experience report (I made some typo while copy pasting... ). I used it to illustrate how I got around installation hickups.</p>
Rust Example</h2>
Similar to Typescript I assume that if I can debug Rust, I should be able to debug C/C++ (which I try to avoid as much as possible).</p>
I automated the installation of the DAP adapter for LLD</p>
(</span>setq</span> snam</span>-</span>codelldb</span>-</span>dir (file</span>-</span>name</span>-</span>concat user</span>-</span>emacs</span>-</span>directory </span>"dape/codelldb"</span>))
</span>(</span>defun </span>snam-install-codelldb </span>()
</span>  </span>"Install Vadimcn.Vscode-Lldb DAP server for C/C++/RUST"
</span>  (interactive)
</span>  (</span>let* </span>((default</span>-</span>directory</span> snam</span>-</span>codelldb</span>-</span>dir)
</span>         (arch (</span>car </span>(</span>split</span>-</span>string</span> system</span>-</span>configuration </span>"-" </span>nil nil</span>)))
</span>         (os (pcase system</span>-</span>type
</span>               (</span>=</span>'windows</span>-</span>nt </span>"windows"</span>)
</span>               (</span>=</span>'gnu</span>/</span>linux </span>"linux"</span>)
</span>               (</span>=</span>'darwin </span>"darwin"</span>)
</span>               ('_ </span>"unknown"</span>)))
</span>         (version </span>"1.10.0"</span>)
</span>         (release</span>-</span>url (concat </span>"https://github.com/vadimcn/codelldb/releases/download/v"</span> version </span>"/codelldb-"</span> arch </span>"-"</span> os </span>".vsix"</span>)))
</span>    (mkdir default</span>-</span>directory </span>t</span>)
</span>    (url</span>-</span>copy</span>-</span>file release</span>-</span>url </span>"codelldb.zip" </span>t</span>)
</span>    (message </span>"codelldb archive downloaded"</span>)
</span>    (call</span>-</span>process </span>"unzip" </span>nil </span>"*snam-install*" </span>t </span>"codelldb.zip"</span>)
</span>    (message </span>"codelldb installed"</span>)
</span>    ))
</span></code></pre>
Again this is just the installation instructions from the dape</em> repo in emacs lisp.</p>
adding the default config:</p>
            (add</span>-to-</span>list</span> 'dape</span>-</span>configs
</span>                         `(codelldb
</span>                           modes (c</span>-</span>mode c</span>-</span>ts</span>-</span>mode
</span>                                         c</span>++-</span>mode c</span>++-</span>ts</span>-</span>mode
</span>                                         rust</span>-</span>ts</span>-</span>mode rust</span>-</span>mode)
</span>                           </span>;; Replace vadimcn.vscode-lldb with the vsix directory you just extracted
</span>                           command ,(</span>expand</span>-</span>file</span>-</span>name
</span>                                     (file</span>-</span>name</span>-</span>concat
</span>                                      snam</span>-</span>codelldb</span>-</span>dir
</span>                                      (concat </span>"extension/adapter/codelldb"
</span>                                              (</span>if </span>(</span>eq</span> system</span>-</span>type 'windows</span>-</span>nt)
</span>                                                  </span>".exe"
</span>                                                </span>""</span>))))
</span>                           host </span>"localhost"
</span>                           port </span>5818
</span>                           command</span>-</span>args (</span>"--port" "5818"</span>)
</span>                           :type </span>"lldb"
</span>                           :request </span>"launch"
</span>                           :cwd dape</span>-</span>cwd</span>-</span>fn
</span>                           :program dape</span>-</span>find</span>-</span>file))
</span></code></pre>
Since here the DAP is a binary I have to finagle the Windows file extension to make it work.</p>
Then opening a rust binary, here src/main.rs</code>, setting a breakpoint and launching the debugger.</p>
I answered on the prompt</p>
codelldb :args ["on"]
</span></code></pre>
to specify the arguments for the program to be debugged.</p>
Dape sees that the program is not specified so it asks for it and with tab completion tar<TAB>deb<TAB>bil<TAB></code> this is quickly selected and I am greeted with:</p>
</p>
Debugging Tips</h2>
When trying the Go example I hit a snag : the debugger started but no active thread was present.</p>
First stop is to open *dape_debug*</code> buffer :</p>
[info] Starting new multi session
</span>[info] Server process started ("dlv" "dap" "--listen" "127.0.0.1:55878")
</span>[info] 
</span>Process ("dlv" "dap" "--listen" "127.0.0.1:55878") exited with 1
</span>[info] Connection to server established 127.0.0.1:55878
</span>[io] Sending:
</span>(:arguments
</span> (:clientID "dape" :adapterID nil :pathFormat "path" :linesStartAt1 t :columnsStartAt1 t :supportsRunInTerminalRequest t :supportsProgressReporting t :supportsStartDebuggingRequest t)
</span> :type "request" :command "initialize" :seq 1)
</span>
</span>[info] 
</span>Process nil exited with 256
</span>[error] Timeout for reached for seq 1
</span></code></pre>
So the process immediately exits, but we see no output. It would be nice to get that in the buffer, but it isn't...</p>
Let's steal the command and run it in a terminal :</p>
Zeus :: ~ % dlv dap --listen 127.0.0.1:55878                                                                      >>>
</span>DAP server listening at: 127.0.0.1:55878
</span></code></pre>
Now restart the debugger by quitting the debug session and starting a fresh one (we cannot use the restart command as the adapter is not running, we need to restart the adapter not the debugged program).</p>
Zeus :: ~ % dlv dap --listen 127.0.0.1:55878                                                                      >>>
</span>DAP server listening at: 127.0.0.1:55878
</span>2023-10-20T18:13:02+02:00 error layer=dap DAP error: json: cannot unmarshal bool into Go struct field InitializeRequestArguments.arguments.adapterID of type string
</span>Zeus :: ~ %      
</span></code></pre>
Ok, the typechecker got a bool where it expected a string.  Opening dape.el</em> and searching for json-serialize</code> we find the location.</p>
(defun dape-send-object (process seq object)
</span>  "Helper for `dape-request' to send SEQ request with OBJECT to PROCESS."
</span>  (let* ((object (plist-put object :seq seq))
</span>         (json (json-serialize object :false-object nil))
</span>         (string (format "Content-Length: %d\r\n\r\n%s" (length json) json)))
</span>    (dape--debug 'io "Sending:\n%s" (pp-to-string object))
</span>    (process-send-string process string)))
</span></code></pre>
Let's print out the JSON we're sending :</p>
(defun dape-send-object (process seq object)
</span>  "Helper for `dape-request' to send SEQ request with OBJECT to PROCESS."
</span>  (let* ((object (plist-put object :seq seq))
</span>         (json (json-serialize object :false-object nil))
</span>         (string (format "Content-Length: %d\r\n\r\n%s" (length json) json)))
</span>    (dape--debug 'io "Sending:\n%s" (pp-to-string object))
</span>    (dape--debug 'io "Sending JSON:\n%s" json)
</span>    (process-send-string process string)))
</span></code></pre>
this gives</p>
(:arguments
</span> (:clientID "dape" :adapterID nil :pathFormat "path" :linesStartAt1 t :columnsStartAt1 t :supportsRunInTerminalRequest t :supportsProgressReporting t :supportsStartDebuggingRequest t)
</span> :type "request" :command "initialize" :seq 1)
</span>
</span>[io] Sending JSON:
</span>{"arguments":{"clientID":"dape","adapterID":false,"pathFormat":"path","linesStartAt1":true,"columnsStartAt1":true,"supportsRunInTerminalRequest":true,"supportsProgressReporting":true,"supportsStartDebuggingRequest":true},"type":"request","command":"initialize","seq":1}
</span>[info] 
</span></code></pre>
The supportsXXX things look to be bools, but the adapterID</em> feels funny to be a bool... Where does this come from?</p>
(defun dape--initialize (process)
</span>  "Send initialize request to PROCESS."
</span>  (dape-request process
</span>                "initialize"
</span>                (list :clientID "dape"
</span>                      :adapterID (plist-get dape--config
</span>                                            :type)
</span>                      :pathFormat "path"
</span>                      :linesStartAt1 t
</span>                      :columnsStartAt1 t
</span>                      ;;:locale "en-US"
</span>                      ;;:supportsVariableType t
</span>                      ;;:supportsVariablePaging t
</span>                      :supportsRunInTerminalRequest t
</span>                      ;;:supportsMemoryReferences t
</span>                      ;;:supportsInvalidatedEvent t
</span>                      ;;:supportsMemoryEvent t
</span>                      ;;:supportsArgsCanBeInterpretedByShell t
</span>                      :supportsProgressReporting t
</span>                      :supportsStartDebuggingRequest t
</span>                      ;;:supportsVariableType t
</span>                      )
</span>...
</span></code></pre>
Ok, it comes from the config :type</code> attribute... What do I have in my config???</p>
            (add-to-list 'dape-configs
</span>                         `(delve
</span>                           modes (go-mode go-ts-mode)
</span>                           command "dlv"
</span>                           command-args ("dap" "--listen" "127.0.0.1:55878")
</span>                           command-cwd dape-cwd-fn
</span>                           host "127.0.0.1"
</span>                           port 55878
</span>                           dape "debug"
</span>                           :request "launch"
</span>                           :cwd dape-cwd-fn
</span>                           :program dape-cwd-fn))
</span>
</span></code></pre>
Hmm... what is that dape</code> attribute. In all other configs there is a :type</code> in that place. That seems a slip of the finger triggering an unlucky evil command. (I checked on the repo and it was correct there so it was my fault). Let's change it to :type</code> and C-x C-e</code> the add-to-list</code> expression to update the default config.</p>
Let's try again :</p>
</p>
Ok, now we're cookin' with fire!!!</p>


Snamellit
Peter Tillemans — Tue, 05 Sep 2023 00:00:00 +0000
Welcome to Snamellit</h1>


Contact Information
Peter Tillemans — Tue, 05 Sep 2023 00:00:00 +0000
Peter Tillemans</p>
Snamellit BV</p>
Verbonstraat 57</p>
2000 Antwerpen</p>
VAT BE0892.789.787</p>


Home
Peter Tillemans — Sun, 28 Nov 2021 12:57:12 +0000
Brilliant design.

Simplicity at scale.</h1>
</p>
</p>
I'm Aabha, I like simple and clean design.</h2>
PORTFOLIO</a></p>
</p>
Experience delicate and beautiful design</h2>
CONSULTATIONS</a></p>

“We are so grateful we found Aabha. Having her navigate the project made all the difference.”</p>
Paul F - San Fransisco</p>
</blockquote>
Let me design your home</h3>
Book a Consultation</a></p>


Running Emacs with wsl2-xrdp
Peter Tillemans — Sun, 17 Jan 2021 00:00:00 +0000
Why</h1>
I have been using Emacs in WSL2 using an X server running in Windows and
that works fine as long as long as the computer does not go to sleep.
When the computer goes to sleep, the X connection is cut and the emacs
process crashes. I like to just have my emacs session available so I can
continue where I was last time and I like my computer to go to sleep
when I not use it because Global Warming.</p>

start emacs in WSL2 in GUI mode</li>
can be reconnected after sleep</li>
copy-paste works transparent</li>
</ul>
Plan</h1>

use xrdp</strong> as remote desktop is built into windows</li>
configure xrdp to startup in WSL2</li>
run emacs in a remote desktop session</li>
</ul>
Installation</h1>
Install xrdp</h2>
Arch wiki page for xrdp</a></p>
$</span> yay -S xrdp xorgxrdp-git
</span></code></pre>
We do not have systemd in WSL2 so I started the daemons manually with a
small script */usr/local/bin/start-xrdp:</p>
#!/bin/bash
</span>sudo</span> /usr/sbin/xrdp
</span>sudo</span> /usr/sbin/xrdp-sesman
</span></code></pre>
We can now start it with start-xrdp</strong> from the bash command line or
using wsl -u root /usr/local/bin/start-xrdp</strong>. If not running as root
(or recently authenticated sudo access) it will ask for your Linux
password to allow running as sudo</strong>.</p>
Trying to connect lets me login but after a timeout is shows a dialog
box telling me Xorg did not want to start. This is confirmed in the
/var/log/xrdp-sesman.log</strong> file.</p>
The root cause is that I cannot read properly because if I could, I
would have read to add allowed\users</del>=anybody</em> to the
/etc/X11/Xwrapper.config</strong> file to allow Xorg</strong> to be started by
regular users like me instead of only root</strong>.</p>
Once that is there I get a nice black screen after login.</p>
Note: Each time WSL2 restarts it gets a random ip address. So I created
a small script to dig out the actual ip address out of the output of
ip address</strong> :</p>
#!/bin/bash
</span>ip</span> address show dev eth0 </span>| </span>grep </span>"inet " </span>| </span>sed</span> -e </span>'s/.*inet \([^/]*\).*/\1/'
</span></code></pre>
Which I gave the original name of /usr/local/bin/ip-address</strong> (do not
forget to chmod +x /usr/local/bin/ip-address</code> to make it executable) so
I can easily call it from powershell with wsl ip-address</code>.</p>
Installing DBUS replacement</h2>
DBUS is the de-facto GNU/Linux desktop communication bus which glues all
kind of GUI apps together. I do not know if it is directly used by Emacs
or any of the extensions I use, however it reduces the amount of errors
and warnings.</p>
$</span> yay -S dbus-x11
</span></code></pre>
allows xfce and other programs to feel happy and display the desktop
with an emacs window. Now just maximizing the window and the goal is
reached.</p>
Automatic start of Emacs only</h2>
In order to just start emacs maximized in a single remote desktop window
we only need to start it as the only program in the XSession. This of
course also means there is no chrome on the X-Window or the ability to
lauch other programs outside of Emacs. This is exactly how I like it.</p>
#file:~/.xinitrc
</span>emacs</span> -mm
</span></code></pre>
If you rather have a full desktop environment, see further.</p>
Installing Xfce4 (Optional)</h2>
I'd rather have something more lightweight as window manager, but I
have experience with Xfce4 in Arch and I also like something which just
works.</p>
I only intend to run emacs in the window however having something a bit
more capable which works can help me debug the environment. (I have some
font things to sort out too...)</p>
$</span> sudo pacman -S xfce4
</span></code></pre>
and then start it form ~/.xinitrc</strong></p>
emacs </span>&
</span>startxfce4
</span></code></pre>
If you have skipped the DBUS</strong> setup above, this hangs while the
~/.xorgxrdp.log</strong> file is filling up with errors complaining about
missing connection to dbus.</p>
Using this from Windows</h1>
Starting from the command-line</h2>
We can start remote desktop session using</p>
>_ mstsc /v:$(wsl ip-address) /h:2560 /w:1600
</span></code></pre>
This works, however we get now a prompt to accept the certificate and we
still need to login. We can make this smoother</p>
Accepting the certificate</h2>
You can accept the certificate and let remote desktop add it to your
certificate stores. This solves this interruption.</p>
However, this still happens each time the ip address changes.</p>
Automatic login</h2>
Start remote desktop</strong> GUI using the search or from the start menu.</p>
Fill in the ip address returned by wsl ip-address</code> and your username.
Enable the flag to store your password. Login and save the configuration
as e.g. emacs.rdp</strong>.</p>
We can now start emacs using</p>
>_ cmdkey /generic:$(wsl ip-address) /user:<username> /pass:<password>
</span>>_ mstsc /v:$(wsl ip-address)
</span></code></pre>
We can assemble this is a small script wsl-emacs.ps1</strong> somewhere on
your path:</p>
wsl </span>-</span>u root </span>/</span>usr</span>/</span>local</span>/</span>bin</span>/</span>start-xrdp
</span>$</span>address </span>= $</span>(wsl ip</span>-</span>address)
</span>$</span>userName </span>= </span>"pti"
</span>$</span>userPwd </span>= </span>"shht!Secret"
</span>cmdkey </span>/</span>generic:</span>$</span>address </span>/</span>user:</span>$</span>userName </span>/</span>pass:</span>$</span>userPwd
</span>mstsc </span>/</span>v:</span>$</span>address
</span></code></pre>
Which allows us to start our wsl-emacs</strong> from powershell or as a
startup application with a shortcut. It ensures the xrdp</strong> daemons are
running (they are idempotent, so the script can be run multiple times),
then the credentials are created so they can be picked up by remote
desktop.</p>
To add a shortcut to the start menu:</p>

Type Win-R and open
*%AppData%\Microsoft</code>{=latex}\Windows</code>{=latex}\Start</code>{=latex}
Menu\Programs*</code>{=latex}</li>
create a new shortcut</li>
set as target *powershell.exe "&
'<path-of-script>\wsl</code>{=latex}-emacs.ps1'</li>
</ul>
Note the weird "&</strong> on the command-line.</p>
A note on security</h2>
Since you can run any command from the windows command-line as root, the
current logged in person has full access to anything in the WSL Linux
machines. As such there is not a big hole added by adding your linux
password somewhere securely in your account files such as the startup
script.</p>
This does not mean you should not have secure passwords, as your linux
box can expose its ports (not by default but just assume they are) and
allow e.g. ssh access. Since I assume a lot of WSL2 hosts will be used
fast and loose as a development box, there is a good chance that sooner
or later a port is opened for reasons.</p>
So I would not worry too much your linux box password is exposed in the
emacs startup script as long as it is hard enough and not used anywhere
else. If you'd like to get it from some secure vault on your PC or from
your infrastructure, go for it.</p>
tldr;</p>

use a strong password for your WSL box</li>
do not reuse an existing password</li>
secure your startup script so it is only readable by you.</li>
</ul>


Access NAS Drive using Windows 10 PIN login
Peter Tillemans — Mon, 26 Oct 2020 00:00:00 +0000
Each time I login using the PIN of my Microsoft account, my mounted
folders on the NAS are not mounted. After login I get a notification
that not all mounted drives could be connected. When double clicking on
the failed mount I get a silly error regarding duplicate sessions or
something, and I can access after logging in.</p>
This is irritating, but also breaks automations like auto importing
notes and documents into evernote from the NAS folder.</p>
Attempt 1</h1>
This seems to be a known issue with PIN (and by extension face
recognition (?)) login.</p>
On Windows answers I found a
workaround</a>
:</p>

Open the Credential Manager</strong></li>
Select Windows Credential</strong></li>
Add a Windows Credential</strong> (it will actually modify the existing
one)</li>
network address : \\ [your NAS]{.underline}</li>
User name : your</del> NAS_\pti</code>{=latex}</li>
Password : [your password on the NAS]{.underline}</li>
</ul>
From now on your drive should be mounted after rebooting.</p>
Unfortunately, it does not.</p>
Removing and adding again does not help either.</p>
Attempt 2 : remap network drives on login</h1>
In 2018 [another
workaround](https://support.microsoft.com/en-us/help/4471218/mapped-network-drive-may-fail-to-reconnect-in-windows-10-version-1809#:~:text=Workaround%201%3A%20Create%20a%20startup%20item&text=If%20the%20device%20has%20not,t%20automatically%20reconnect%20network%20drives.&text=A%20log%20file%20(StartupLog.,to%20open%20the%20mapped%20drives.)
was published.</p>
This relies on a powershell script launched by a Command script to walk
over unavailable mapped drives and map them again.</p>
It uses 2 scripts:</p>
*%ProgramData%\Microsoft</code>{=latex}\Windows</code>{=latex}\Start</code>{=latex} Menu\Programs</code>{=latex}\StartUp</code>{=latex}\MapDrives</code>{=latex}.cmd</h2>
A startup scrip to kickoff remapping after login</p>
PowerShell</span> -Command </span>"Set-ExecutionPolicy -Scope CurrentUser Unrestricted" </span>>> </span>"%TEMP%\StartupLog.txt" </span>2</span>>&</span>1
</span>PowerShell</span> -File </span>"%SystemDrive%\Scripts\MapDrives.ps1" </span>>> </span>"%TEMP%\StartupLog.txt" </span>2</span>>&</span>1
</span></code></pre>
%SystemDrive%\Scripts</code>{=latex}\MapDrives</code>{=latex}.ps1</h2>
$i</span>=</span>3
</span>while</span>(</span>$</span>True){
</span>    </span>$</span>error.clear()
</span>    </span>$</span>MappedDrives = Get-SmbMapping |where -property Status -Value Unavailable -EQ | select LocalPath</span>,</span>RemotePath
</span>    foreach( </span>$</span>MappedDrive in </span>$</span>MappedDrives)
</span>    {
</span>        try {
</span>            New-SmbMapping -LocalPath </span>$</span>MappedDrive.LocalPath -RemotePath </span>$</span>MappedDrive.RemotePath -Persistent </span>$</span>True
</span>        } catch {
</span>            Write-Host </span>"There was an error mapping </span>$</span>MappedDrive</span>.RemotePath to </span>$</span>MappedDrive</span>.LocalPath"
</span>        }
</span>    }
</span>    </span>$</span>i = </span>$</span>i - 1
</span>    if(</span>$</span>error.Count -eq 0 -Or </span>$</span>i -eq 0) {break}
</span>
</span>    Start-Sleep -Seconds 30
</span>
</span>}
</span></code></pre>
Evaluation</h2>
After rebooting and logging in, I still get the error that not all
drives could be mounted, however, by the time I can check in the
explorer the volume is mounted and ready to be used.</p>
Not very elegant as the notification still feels terribly yanky, but at
least it no longer interferes my workflows.</p>


Setting Up Blogging with Emacs
Peter Tillemans — Thu, 15 Oct 2020 00:00:00 +0000
I'd like to blog more notes on stuff I do and it would be nice to have
a smooth workflow in my editor of choice.</p>
It is too late to explain a lot, but all these things were proudly found
elsewhere. See the references list at the end of this post.</p>
Creating the blog project</h1>
To deploy to github as a personal blog you have to create a repo in the
form <username>.github.io</strong>. Since I name my projects the same as
the repos the name was a quick choice.</p>
The structure is as follows:</p>
<root> -+- blog -+- posts -+- <blog posts>
</span>        |        +- org-template -+- <templates>
</span>        |        +- css -+- <css files>
</span>        +- public -+- <built website>
</span>        +- .github -+- workflow --- main.yml  <github actions>
</span>        +- publish.el
</span>        +- Makefile  <local develop actions>
</span>
</span>
</span></code></pre>
Configuring org-publish</h1>
This is what the publish.el</strong> file is for.</p>
Prepare some snippets for the HTML pages</p>
First off, a link to the CSS:</p>
(</span>setq</span> website</span>-</span>html</span>-</span>head </span>"<link rel=</span>\"</span>stylesheet</span>\"</span> href=</span>\"</span>css/site.css</span>\"
</span>  type=</span>\"</span>text/css</span>\"</span>/>"</span>)
</span></code></pre>
Let's also add a navigation menu at the top of each page:</p>
(</span>setq</span> website</span>-</span>html</span>-</span>preamble
</span>      </span>"<div class=</span>\"</span>nav</span>\"</span>>
</span><ul>
</span><li><a href=</span>\"</span>/</span>\"</span>>Home</a></li>
</span><li><a href=</span>\"</span>https://github.com/ptillemans</span>\"</span>>GitHub</a></li>
</span></ul>
</span></div>"</span>)
</span></code></pre>
And a footer :</p>
(</span>setq</span> website</span>-</span>html</span>-</span>postamble </span>"<div class=</span>\"</span>footer</span>\"</span>> Copyright 2020 %a (%v
</span>  HTML).<br> Last updated %C.<br> Built with %c.  </div>"</span>)
</span></code></pre>
And now we can all tie it together by creating the
org-publish-project-alist</strong>:</p>
(</span>setq</span> org</span>-</span>publish</span>-</span>project</span>-</span>alist
</span>      `((</span>"posts"
</span>
</span>         </span>;; configure project structure
</span>         :base</span>-</span>directory </span>"blog/posts/"
</span>         :base</span>-</span>extension </span>"org"
</span>         :publishing</span>-</span>directory </span>"public/"
</span>         :recursive </span>t
</span>         :publishing</span>-</span>function org</span>-</span>html</span>-</span>publish</span>-to-</span>html
</span>
</span>         </span>;; configure index creation
</span>         :auto</span>-</span>sitemap </span>t
</span>         :sitemap</span>-</span>title </span>"Blog Index"
</span>         :sitemap</span>-</span>filename </span>"index.org"
</span>         :sitemap</span>-</span>style tree
</span>         :sitemap</span>-</span>file</span>-</span>entry</span>-</span>format </span>"%d - %t"
</span>         :sitemap</span>-</span>sort</span>-</span>files anti</span>-</span>chronologically
</span>
</span>         :html</span>-</span>doctype </span>"html5"
</span>         :html</span>-</span>html5</span>-</span>fancy </span>t
</span>         :html</span>-</span>head ,website</span>-</span>html</span>-</span>head
</span>         :html</span>-</span>preamble ,website</span>-</span>html</span>-</span>preamble
</span>         :html</span>-</span>postamble ,website</span>-</span>html</span>-</span>postamble
</span>
</span>         :author </span>"Peter Tillemans"
</span>         :email </span>"pti@snamellit.com"
</span>         :</span>with-</span>creator </span>t</span>)
</span>
</span>        (</span>"blog-static"
</span>         :base</span>-</span>directory </span>"blog/posts/"
</span>         :base</span>-</span>extension </span>"png</span>\\</span>|jpg</span>\\</span>|gif</span>\\</span>|pdf</span>\\</span>|mp3</span>\\</span>|ogg</span>\\</span>|swf"
</span>         :publishing</span>-</span>directory </span>"public_html/"
</span>         :recursive </span>t
</span>         :publishing</span>-</span>function org</span>-</span>publish</span>-</span>attachment)
</span>
</span>        (</span>"css"
</span>         :base</span>-</span>directory </span>"blog/css/"
</span>         :base</span>-</span>extension </span>"css"
</span>         :publishing</span>-</span>directory </span>"public/css"
</span>         :publishing</span>-</span>function org</span>-</span>publish</span>-</span>attachment
</span>         :recursive </span>t</span>)
</span>
</span>        (</span>"all"</span> :components (</span>"posts" "css" "blog-static"</span>))))
</span></code></pre>
Make local testing easy</h1>
The commands to build the blog are not hard, but hard to remember and
hard to type.</p>
Let's make a makefile to help:</p>
.PHONY</span>: </span>all publish publish_no_init
</span>
</span>all</span>: </span>publish
</span>
</span>publish</span>: </span>publish.el
</span>    </span>@</span>echo </span>"Publishing... with current Emacs configurations."
</span>    </span>emacs</span> --batch --load publish.el --funcall org-publish-all
</span>
</span>publish_no_init</span>:
</span>    </span>@</span>echo </span>"Publishing... with --no-init"
</span>    </span>emacs</span> --batch --no-init --load publish.el --funcall org-publish-all
</span>
</span>clean</span>:
</span>    </span>@</span>echo </span>"Cleaning up..."
</span>    </span>rm</span> -rf public
</span>    </span>@</span>rm</span> -rvf </span>*</span>.elc
</span>    </span>@</span>rm</span> -rvf public
</span>    </span>@</span>rm</span> -rvf </span>~</span>/.org-timestamps/</span>*
</span>
</span>serve</span>: </span>publish
</span>    </span>@</span>echo </span>"Serving site"
</span>    </span>python</span> -m http.server --directory public
</span></code></pre>
For local testing just do:</p>
$</span> make clean serve
</span></code></pre>
If the only change is new content then not cleaning is much faster.</p>
Deploy to Github Pages</h1>
A slightly modified version of the initial workflow will do the
publishing:</p>
# This is a basic workflow to help you get started with Actions
</span>
</span>name</span>: </span>CI
</span>
</span># Controls when the action will run. Triggers the workflow on push or pull request
</span># events but only for the master branch
</span>on</span>:
</span>  </span>push</span>:
</span>    </span>branches</span>: </span>[ </span>master </span>]
</span>  </span>pull_request</span>:
</span>    </span>branches</span>: </span>[ </span>master </span>]
</span>
</span># A workflow run is made up of one or more jobs that can run sequentially or in parallel
</span>jobs</span>:
</span>  </span># This workflow contains a single job called "build"
</span>  </span>build</span>:
</span>    </span># The type of runner that the job will run on
</span>    </span>runs-on</span>: </span>ubuntu-latest
</span>
</span>    </span># Steps represent a sequence of tasks that will be executed as part of the job
</span>    </span>steps</span>:
</span>      - </span>uses</span>: </span>actions/checkout@master
</span>        </span>with</span>:
</span>          </span>fetch-depth</span>: </span>1
</span>
</span>      - </span>name</span>: </span>build
</span>        </span>uses</span>: </span>docker://iquiw/alpine-emacs
</span>        </span>if</span>: </span>github.event.deleted == false
</span>        </span>with</span>:
</span>          </span>args</span>: </span>emacs --batch --load publish.el --funcall org-publish-all
</span>
</span>
</span>      - </span>name</span>: </span>deploy
</span>        </span>uses</span>: </span>peaceiris/actions-gh-pages@v1.1.0
</span>        </span>if</span>: </span>success()
</span>        </span>env</span>:
</span>          </span>GITHUB_TOKEN</span>: </span>${{ secrets.PERSONAL_ACCESS_TOKEN }}
</span>          </span>PUBLISH_BRANCH</span>: </span>gh-pages
</span>          </span>PUBLISH_DIR</span>: </span>./public
</span></code></pre>
Note that you need to put a secret PERSONAL~ACCESSTOKEN~</strong> with an
access token which has basic push access to the repo to push the built
site to the gh-pages branch.</p>
For the emacs call, I just copied the command from the Makefile</strong>.</p>
After a push the site is usually up by the time I check, say in about a
minute.</p>
Setting up a Capture Template</h1>
This proved to be the hardest part to get working.</p>
I am using Doom Emacs</strong> so I wrap everything in
with-eval-after-load</strong>.</p>
The challenge was that the title is needed to create the slug for the
filename and then again as title for the post. So my ugly solution is to
stuff it in a variable and get the variable back in the template.</p>
(</span>with-</span>eval</span>-</span>after</span>-</span>load</span> 'org</span>-</span>capture
</span>  (</span>defvar</span> snamellit</span>/</span>blog</span>-</span>title </span>"test-title"</span>)
</span>
</span>  (</span>setq</span> snamellit</span>-</span>blog</span>-</span>template </span>"#+title: %(progn snamellit-blog-title)
</span>#+date: %t
</span>#+author: Peter Tillemans
</span>#+email: pti@snamellit.com
</span>
</span>%?"</span>)
</span>
</span>  (</span>defun </span>snamellit</span>/</span>capture</span>-</span>blog</span>-</span>post</span>-</span>file ()
</span>    (</span>let* </span>((title (</span>read</span>-from-</span>minibuffer </span>"Post Title: "</span>))
</span>           (slug (</span>replace</span>-</span>regexp</span>-</span>in</span>-</span>string </span>"[^a-z0-9]+" "-" </span>(downcase title))))
</span>      (</span>setq</span> snamellit</span>/</span>blog</span>-</span>title title)
</span>      (</span>format </span>"~/Projects/ptillemans.github.io/blog/posts/%s-%s.org"
</span>              (</span>format</span>-</span>time</span>-</span>string </span>"%Y-%m-%d" </span>(current</span>-</span>time</span>))
</span>              slug)))
</span>
</span>  (add</span>-to-</span>list</span> 'org</span>-</span>capture</span>-</span>templates
</span>               '(</span>"b" "Blog Post"</span> plain
</span>                 (file snamellit</span>/</span>capture</span>-</span>blog</span>-</span>post</span>-</span>file)
</span>                 (file </span>"~/.doom.d/tpl-blog-post.org"</span>))))
</span>
</span></code></pre>
The tpl-blog-post.org</strong> template file :</p>
#+title: %(progn snamellit/blog-title)
</span>#+date: %<%Y-%m-%d>
</span>
</span>%?
</span></code></pre>
It is very minimal and I'd like to keep it that way.</p>
In use</h1>
To create a blog post</p>

SPC-X b will create the post</li>
Give a title for the post</li>
A template file is created (unfortunately in plain text)</li>
Enter the idea, hook and save with C-c C-c</li>
Open the org file with SPC-f r (open recent file)</li>
Flesh out the post using org-mode goodness</li>
save, commit and push to git</li>
</ul>
After push the github action will bring it live</p>
References</h1>
Following links were useful in setting this up:</p>

How to blog with Emacs Org
mode</a></li>
GitHub Pages
documentation</a></li>
The Org Mode Manual</a></li>
The Meg in Progress post on building a static blog with
org-mode.</a></li>
Website with org-mode</a></li>
Richard Kallos' post on site generation with Org
Mode</a></li>
Blogging with Org
mode</a></li>
Org Capture Tricks from
Storax</a></li>
</ul>


Add tap Escapt to HHKB
Peter Tillemans — Tue, 08 Sep 2020 00:00:00 +0000
I configure all apps I can to use vim</em> keybindings. Which means I use
the Escape</em> key very often.</p>
On my custom keyboards I have usually QMK or similar available to remap
the keys and use a tap on the CapsLock to mean Escape</em> and hold to mean
Control</em>. On the macbook pro I used Karabiner</em> to program the same
effect. And even on Windows I found a AutoHotKey</em> script. On Linux I
use an event interceptor between the keyboard and the rest of the OS.</p>
So either the keyboard does it natively or the useless CapsLock is
remapped to the much more useful Ctrl/Esc combination.</p>
Happy Hacking Keyboard</h1>
This year I got a HHKB for my birthday. I have been wanting one of those
for a real long time, but choice anxiety and the new models arriving
last year prevented me from pulling the trigger so my family conspired
to end my suffering by buying me Hybrid Type-S. Super happy with it.</p>
Of course it took some time to get used to the different location of the
backspace, and the practical use of the 2 keys top right. However my
muscle memory really expects the Esc</em> to be under my pinky.</p>
No problem I thought a quick Google will sort that out. Nope...</p>
Been looking on and off for about a week before posting something in the
subreddit. No reply, probably because I forgot to add a nice picture.</p>
The general consensus is to just buy an Hasu controller and use QMK to
implement the tap dance. However I do not want to rip out the guts of my
new keyboard, and ordering one will take some time too.</p>
My Solution</h1>
A thought crossed my mind to just try to do the same with the Control as
I do to the CapsLock in my autohotkey script. So I copy pasted the
CapsLock remapping to the end of the file and replaced CapsLock with
Control in the copy. Reloaded the script and everything seemed to work.</p>
Waited a few days to confirm, and wrote it down before I forget.</p>
Here is the relevant part:</p>
Control::Send </span>{esc}
</span>Control </span>& </span>a::Send</span> ^a
</span>Control </span>& </span>b::Send</span> ^b
</span>Control </span>& </span>c::Send</span> ^c
</span>Control </span>& </span>d::Send</span> ^d
</span>Control </span>& </span>e::Send</span> ^e
</span>Control </span>& </span>f::Send</span> ^f
</span>Control </span>& </span>g::Send</span> ^g
</span>Control </span>& </span>h::Send</span> ^h
</span>Control </span>& </span>i::Send</span> ^i
</span>Control </span>& </span>j::Send</span> ^j
</span>Control </span>& </span>k::Send</span> ^k
</span>Control </span>& </span>l::Send</span> ^l
</span>Control </span>& </span>m::Send</span> ^m
</span>Control </span>& </span>n::Send</span> ^n
</span>Control </span>& </span>o::Send</span> ^o
</span>Control </span>& </span>p::Send</span> ^p
</span>Control </span>& </span>q::Send</span> ^q
</span>Control </span>& </span>r::Send</span> ^r
</span>Control </span>& </span>s::Send</span> ^s
</span>Control </span>& </span>t::Send</span> ^t
</span>Control </span>& </span>u::Send</span> ^u
</span>Control </span>& </span>v::Send</span> ^v
</span>Control </span>& </span>w::Send</span> ^w
</span>Control </span>& </span>x::Send</span> ^x
</span>Control </span>& </span>y::Send</span> ^y
</span>Control </span>& </span>z::Send</span> ^z
</span>Control </span>& </span>0::Send</span> ^0
</span>Control </span>& </span>1::Send</span> ^1
</span>Control </span>& </span>2::Send</span> ^2
</span>Control </span>& </span>3::Send</span> ^3
</span>Control </span>& </span>4::Send</span> ^4
</span>Control </span>& </span>5::Send</span> ^5
</span>Control </span>& </span>6::Send</span> ^6
</span>Control </span>& </span>7::Send</span> ^7
</span>Control </span>& </span>8::Send</span> ^8
</span>Control </span>& </span>9::Send</span> ^9
</span>Control </span>& </span>'::Send ^'
</span>Control </span>& </span>,::Send</span> ^,
</span>Control </span>& </span>.::Send</span> ^.
</span>Control </span>& </span>/::Send</span> ^/
</span>Control </span>& </span>-::Send</span> ^-
</span>Control </span>& =</span>::Send </span>^</span>=
</span>Control </span>& </span>[::Send</span> ^[
</span>Control </span>& </span>]::Send</span> ^]
</span></code></pre>
Not elegant, but works fine for me.</p>


Install Latex in Windows
Peter Tillemans — Tue, 08 Sep 2020 00:00:00 +0000
I have some latex templates to format documents to create fancy formal
looking PDF versions of my plaintext mode documents I create in
org-mode</em> in emacs</em>, well spacemacs</em> actually.</p>
Installation</h1>
Since this are tools built in the UNIX world I expected a protracted
battle before I got all settings right, especially since there was no
version of Live Tex in the chocolatey repositories. I never tried MikTex
before.</p>
Installing MikTex</h2>
That is easy, in an admin shell run :</p>
></span> choco </span>install</span> miktex
</span></code></pre>
This will take a bit so we can already fetch the templates.</p>
Installing the custom LaTeX templates</h2>
I keep my templates in git repositories for easy updating. Some are
shared with others so new features are sometimes added. Let's make a
place for these</p>
In the msys terminal :</p>
$</span> cd
</span>$</span> mkdir -p .local/texmf/tex/latex
</span></code></pre>
I want to use the .local/texmf</em> as the local extension folder, but
MikTex</em> will not allow to select it if the tex/latex</em> folders are
missing. Also this is consistent with the Mac and Linux versions.</p>
Installing the custom templates</h2>
Just add the repos for the .sty</em> and .cls</em> files to the folder we just
made:</p>
$</span> cd </span>~</span>/.local/texmf/tex/latex
</span>$</span> git clone git@gitlab.xomeplace.com:latex/xomeplace-latex.git
</span>$</span> ... repeat for other templates ...
</span></code></pre>
Configuring MikTex</h2>
After installation look for MikTex in the Start Menu</em> to start the
config tool. It will complain that no update has been done yes, so I
humoured it by updating, none are available since it is just installed,
but it keeps regularly reminding me to update. I assume this'll go away
once some update arrives.</p>
Add the texmf</em> folder we created :</p>

Press the '+' icon</li>
Navigate the ~/.local/texmf</li>
Confirm</li>
</ul>
Keep the tool open because we need to copy the location of the bin</em>
folder in the next step.</p>
## Add the TeX tools to the PATH</p>
I only use the TeX tools from Spacemacs so I'll just add it there. The
Spacemacs dev team decided to make the environment variables, including
the path, load from a config file. Having been at the receiving end of
the confusion which follows from the subtle differences when launching
Emacs</em> as daemon, from the GUI menu or from the command line, I
heartily applaud this approach.</p>
In any case I just update the PATH in Spacemacs</em></p>

Space f e e (to open the environment config file)</li>
find the line with PATH= ( '</em>' PATH Enter, maybe some /n* to
find the one)</li>
Copy the location from the config tool</li>
Paste it in the PATH value (do not forget the ';' separator)</li>
Esc : w (to save changes)</li>
Space f e E (to reload the new value)</li>
</ul>
Using it</h1>
Well nothing new here, it kind of just works:</p>
Creating a PDF</h2>
Open an org file with the LaTeX headers</em> or add them with , e e #</em>
and select latex from the list. Check the LATEX~CLASS~</em> is one of the
custom classes.</p>
Then , e e l o</em> and ... nothing will happen, ..., well emacs tells it
is busy with the texfile. It takes a while, taskmaster shows processes
blinking in and of existence under the Emacs process. I assume MikTex is
compiling stuff in the background of first use.</p>
Eventually it returns stating PDF export failed and to consult the log
file.</p>
Fix Errors</h2>
The end of the logfile showed scary things of not being able to write.
Let's ignore those for now : I learned to treat the first errors in the
LaTeX log output first, and retry and move my way down the log till
there are no more errors.</p>
First Error : 'Libertine Font' was not found, a bit further the same
with 'Lato'.</p>
Download the fonts, unzip, select all .ttf</em> files and right-click
install.</p>
Try again and the PDF opens ... in the Edge Browser ??? And the Edge
Browser attached itself to the taskbar??? Again??? I need to tackle that
some time.</p>
Well, it works. Take the document and send it to those you wanted to
impress.</p>


Leveraging Env Vars in Rust Apps
Peter Tillemans — Sun, 06 Sep 2020 00:00:00 +0000
Environment variable have gained a lot of importance since the rise of
the container based deployments and (consequently) the popularity of the
12 factor app</a>.</p>
It also has become very practical with the widespread support of the
.env</em> file in the project folder which makes configuring apps during
development very practical.</p>
Using environment in Rust</h1>
The std::env</a> package
gives access to the environment variables, and also information about
the working directory, the location of the program executing, temp
folder, etc...</p>
The method we really are interested in is
var</a>.</p>
match</span> env::var(</span>"MQTT_BROKER"</span>) {
</span>    </span>Ok</span>(mqtt_broker) </span>=></span> mqtt_init(</span>&</span>mqtt_broker</span>).await,
</span>    </span>Err</span>(e) </span>=></span> error</span>!</span>(</span>"No broker specified in MQTT_BROKER environment variable.({})"</span>, e)
</span>}
</span></code></pre>
It returns a Result<String, VarError></em> which we can easily pattern
match on and give readable feedback to the user.</p>
I thing this is perfectly fine for simple, small apps I am likely to
write in the foreseeable future.</p>
Controlling Logging from the Environment</h1>
Another thing needed for smallisch apps is a logging system with the
following requirements:</p>

Controllable via environment</li>
Add a timestamp</li>
Output to stdout or stderr (a 12 factor thing)</li>
Namespace modules</li>
Override config for specific modules</li>
</ul>
Rust has a standard logging API defined in the log
crate</a> crate for which a large
selection of implementations is available.</p>
The first one on the list with
implementations</a>
fit all my requirements, so that's fine.</p>
All we need to do is initialize it after reading the environment
variables from the .env</em> file :</p>
async</span> fn main() {
</span>    </span>dotenv::dotenv</span>().ok();
</span>    env_logger::init();
</span>    ...
</span></code></pre>
and we are logging using the standard debug!</code>{.verbatim},
info!</code>{.verbatim}, warn!</code>{.verbatim}, ... macros.</p>
Scaling to larger apps</h1>
When apps grow (or just when they live long enough) they tend to
accumulate config options and layers of modules making logging also a
headache.</p>
When confronted with these issues I saw that the config</em> and envy</em>
crates offer nice layered configuration support and straightforward
pouring in type safe structs.</p>
Similarly there are more flexible, and consequently more complex,
logging frameworks like log4rs</em>. There are also structured logging
libraries but I still need to see how these can work in containers
without adding additional hoops to jump through.</p>
Let's hope my apps stay small and simple and do not need this
additional complexity.</p>


Relm on Windows
Peter Tillemans — Fri, 04 Sep 2020 00:00:00 +0000
There are essentially 2 methods for compiling Gtk apps</p>

using msvc</em> compiler and .LIB files</li>
using "gnu" backend and msys2 libraries</li>
</ul>
It is a pick your poison situation, the first option requires unpacking
zip files and organizing stuff so the rust compiler can find the
libraries and the runtime the DLLs.</p>
The other option requires configuring rust to essentially cross compile
to the x86~64~-pc-windows-gnu</em> target.</p>
Since I know how to cross compile from my recent experiments with
compiling for embedded ARM processors and I generally know my way better
around the unixy msys environment, the latter it is.</p>
Installing Gtk in Msys2/Mingw64</h1>
Installing gtk3 is easy as it can be installed with pacman</em></p>
$</span> pacman -S mingw64/mingw-w64-x86_64-gtk3
</span></code></pre>
Add some support for integrating with c libraries and linking, etc...</p>
$</span> pacman -S mingw-w64-x86_64-toolchain base-devel
</span></code></pre>
Being optimistic I installed glade. Probably wont need it today but it
is a good test to see if Gtk apps at least start.</p>
$</span> pacman -S mingw-w64-x86_64-glade
</span></code></pre>
Glade starts and shows the GUI so the first milestone was reached.</p>
Preparing rust and cargo</h1>
First install the cross compilation target</p>
$</span> rustup target add x86_64-pc-windows-gnu
</span></code></pre>
I can now compile with</p>
$</span> PKG_CONFIG_ALLOW_CROSS=1 cargo build --target</span>=</span>x86_64-pc-windows-gnu
</span></code></pre>
To always enably this environment variable in the project folder I added
a .env</em> file with</p>
PKG_CONFIG_ALLOW_CROSS</span>=</span>1
</span></code></pre>
which is picked up by the zsh dotenv plugin when I enter the folder.</p>
Similarly we can change the default target for cargo with adding</p>
build]
</span>target</span> = </span>"x86_64-pc-windows-gnu"
</span></code></pre>
to *.cargo/config.toml</p>
We can now simply do</p>
$</span> rust build
</span></code></pre>
or</p>
$</span> rust run
</span></code></pre>
Using VSCode</h1>
When using vscode</em> the rust language server needs to have this
enviroment setup too so it can do its magic. For debugging and running
you can do this in launch.json</em> by setting the variables in the env</em>
property, but this is (logically) not used for the language server.
There seem no way to have vscode</em> respect the .env</em> file soon enough
for the language server to pick it up.</p>
The solution I settled on was to launch vscode</em> from the command line
in the project folder:</p>
$</span> code .
</span></code></pre>
The prompt returns immediately and vscode</em> is seeing the same
environment as the shell. (This does imply that the vscode bin directory
is on the path.)</p>
Of course this wisdom was gained by fixing 1 error message after another
while trying to build an example in a 2018 blogpost. In hindsight I
could have started with the examples provided with the relm sourcecode,
but where would be the fun in that?</p>


Logging Notification Messages in Ubuntu
Peter Tillemans — Mon, 22 Jul 2013 11:48:16 +0000
Ubuntu contains a nice notification system to talk to the user about noteworthy events. However when the message dissappears, by default, it is gone. Often I am busy with something else when the notification pops up and I pay little notice. Then somewhere in my brain, something gets triggered by a word, and by the time I focus on the message to really</strong> read it, the message disappears. Some of these appear after booting or logging in, so it is not trivial to redisplay them. Then I really need a system for logging notification messages for reading what I missed. Ideally there was a scroll back buffer in the notification feature. Maybe there is, but I didn't find it.</p>
Standard Notification Logging</h2>
The developers provided a log in *~/.cache/notify-osd.log*. (see [[https://wiki.ubuntu.com/NotifyOSD][NotifyOSD page an the ubuntu wiki]]) for logging notification messages. So this used to be a moot point as a quick $ tail ~/.cache/notify-osd gave me what I needed. However somewhere between 12.04 and 13.04 the default behavior was changed to no longer log to this file by default. My last entry was from December 2012. It was considered as a developer feature and was disabled for the general public, but controllable using an environment variable : LOG=1. To enable this globally, edit */etc/environment* and add LOG=1 However, since this is such a vague variable, I guess that this will enable logging in more than just *notify-osd*. I am fine with this (at least until my disk runs out). The wiki, which actually contains a design document rather than documentation, makes no mention of it. It is also not very logical as the file is reset when logging in, so it should never pose a threat to the disk space. In any case, I dropped a small note in the wiki to point users in the right direction.</p>
Logging Notifications with an App</h2>
There is also an app for that. You can install the package indicator-notifications which keeps track of notifcations that you receive. You can install with the following $ sudo add-apt-repository ppa:jconti/recent-notifications $ sudo apt-get update $ sudo apt-get install indicator-notifications You'll have to log out and log back in. It shows up as a mailbox in the top panel and turns green when you get new messages. For more info about logging notifications see http://askubuntu.com/questions/288348/how-can-i-read-notifyosd-messages-after-they-are-displayed</a></p>


Uploading documents to Plone with WebDAV
Peter Tillemans — Thu, 29 Mar 2012 22:03:41 +0000
Preparing Plone</strong> to start the WebDAV service and setting the
permissions to allow the users to make use of it is only half the
battle, actually using it, especially from automated systems like
build servers is another struggle.</p>
Using the Cadaver</em> WebDAV client</h2>
Although WebDAV is currently well integrated in modern desktop
environments, a CLI alternative is useful for automation, like
Jenkins</em> build scripts.</p>
Automatic Login</h3>
Ideally we want password-less operation from script, both from a usability as from a security standpoint.</p>
Cadaver</em> supports automatically logging in to servers requiring authentication via a .netrc file, like the ftp</em> client. The syntax is such that the file can be shared for both tools.</p>
The file ~/.netrc may be used to automatically login to a server requiring authentication. The following tokens (separated by spaces, tabs or newlines) may be used:</p>
machine host</h4>
Identify a remote machine host which is compared with the hostname given on the command line or as an argument to the open command. Any subsequent tokens up to the end of file or the next machine or default token are associated with this entry.</p>
default</h4>
This is equivalent to the machine token but matches any hostname. Only one default token may be used and it must be after all machine tokens.</p>
login username</em></h4>
Specifies the username to use when logging in to the remote machine.</p>
password secret</em></h4>
Specifies the password to use when logging in to the remote machine. (Alternatively the keyword passwd</strong> may be used)</p>
Example ~/.netrc file</h4>
default
</span>login jenkins
</span>passwd secret 
</span></code></pre>
Example Session</h4>
Troubleshooting</h3>
Error 409 Conflict</h4>
This can mean a lot of things, like a real conflict. However most of the time it means that the folder where the stuff is uploaded does not exist:</p>
dav:/cmdb/Members/pti/> mput Dropbox/Apps/Byword/plone_webdav.md
</span>Uploading Dropbox/Apps/Byword/plone_webdav.md to `/cmdb/...':
</span>Progress: [=============================>] 100,0% of 1488 bytes failed:
</span>409 Conflict 
</span></code></pre>
This actually tries to upload the file to a subfolder _Dropbox/Apps/Byword_which does not exist, causing this confusing error.</p>
Simply changing the local directory solves the issue:</p>
dav:/cmdb/Members/pti/> lcd Dropbox/Apps/Byword
</span>dav:/cmdb/Members/pti/> mput plone_webdav.md
</span>Uploading plone_webdav.md to `/cmdb/Members/pti/plone_webdav.md':
</span>Progress: [=============================>] 100,0% of 1488 bytes succeeded. 
</span></code></pre>
Cannot create folders using WebDAV</h4>
Problem: The WebDAV "make folder" method, MKCOL, requires the "Add Folders" permission. This is not normally granted to Members or Owners on the site.</p>
dav:/cmdb/Members/jenkins/> mkcol test2
</span>Creating `test2': Authentication required for Zope on server `cmdb-uat.elex.be':
</span>Username: 
</span>Password: 
</span>Retrying: Authentication required for Zope on server `cmdb-uat.elex.be':
</span>Username: Terminated by signal 2. 
</span></code></pre>
Plone asks to login again because the current user has insufficient rights.</p>
Workaround: In the Zope Management Interface, under the "Security" tab for the Plone root, check the "Owners" and "Managers" box for the "Add Folders" permission setting.</p>
~  ᐅ cadaver dav://cmdb-uat.elex.be:1980/cmdb/Members/jenkins
</span>dav:/cmdb/Members/jenkins/> mkcol test2
</span>Creating `test2': succeeded.
</span>dav:/cmdb/Members/jenkins/> 
</span></code></pre>
Source: Members Can't Create Folders Through WebDAV</a></p>
Automating Cadaver with davpush.pl</strong></h2>
Cadaver uses an ftp like command language to interact with the WebDAV server. This is very flexible, but impractical when a large number of files and folders must be uploaded. This happens often when the documentation for a new release must replace the previous version.</p>
Cadaver accepts its input on the stdin</strong> stream, which allows us to pipe a script of commands to it. Since it is non-trivial to create and maintain such a script by hand, a script generator is needed. The generator presented here is meant to be simple and easy to use and modify. No attempt was made to made to add advanced syncing (like removing deleted files), handle exceptions gracefully or 'do the right thing'.</p>
With that in mind, organize the docs in such a way that it is easy to delete the target folder and push a fresh copy to clean everything up. This is common (and good) practice anyway in order to effectively use relative links within a subsite.</p>
The principle is to cd</strong> to the root directory of the documentation root and run the script there and point it to the target.</p>
Usage</h3>
davpush.pl dav://_hostname_:_port_/_upload path_ 
</span></code></pre>
Uploads all files and folders recursively to the WebDAV folder passed in the url.</p>
Code</h3>
#!/usr/bin/perl
</span>use File::Find;
</span>
</span>my $script = "";
</span>
</span>sub wanted() {
</span>  my $f = $File::Find::name;
</span>  if (-f $f) {
</span>    $script .= "put $fn";
</span>  } else {
</span>    $script .= "cd $target_dirn";
</span>    $script .= "mkdir $fn";
</span>    $script .= "cd $fn"
</span>  }
</span>}
</span>
</span>my $url = $ARGV[0];
</span>print "URL: $url";
</span>
</span>if ($url =~ m#dav://.*?(/S*)#) {
</span>
</span>  my $target_url = "$0";
</span>  my $target_dir = "$1";
</span>
</span>  find({'wanted'=>&wanted, 'no_chdir' => 1},   ".");
</span>
</span>
</span>  $pid = open(POUT, "| cadaver $url");
</span>  print POUT $script;
</span>  print POUT "byen";
</span>  close POUT;
</span>
</span>} else {
</span>  print "Usage: davpush.pl dav://<hostname>:<port>/<upload path>n";
</span>  print "n";
</span>  print "Uploads all files and folders recursively to the WebDAV folder passed in the url.";
</span>} 
</span></code></pre>
Code Notes</h3>
The standard perl File::Find</strong> module traverses the folder tree in the right order to make sure all folders are created before other files or folders are created in them. Default behavior is to chdir</strong> to the directory, but then we lose the nice paths relative from the root, which would require additional administration entering and leaving the directory. Setting the no_chdir</strong> flag in the options keeps the paths like we want them in the script. (Look at the preprocess</strong> and postprocess</strong> options to help with the directory admin, but I think the added complexity will outweigh the gains for small to moderate trees)</p>
For every file or folder, the wanted</strong> subroutine is called. For files we just add a mput</strong> command to copy the file over, because it keeps the path intact. If there is a file already (and the permissions are not screwed up) then it is overwritten. When we enter a new folder then we create the folder. If the folder already exists we get a (harmless) 405 Method Not Allowed</strong> error. Here we make another offer to the God of Simplicity</em>, and ignore</em> it.</p>
After walking the tree, we have the script in the $script</strong> variable. It is unceremoniously piped as input for cadaver</strong>. We add the bye</strong> command to close the session, and we're done. The output of cadaver</strong> appears on the stdout</strong> for easy verification using a MkI Eyeball</em> check or by piping it to grep</strong>.</p>
Sample session</h3>
~/Dropbox/Apps/Byword  ᐅ perl ~/tmp/davpush.pl dav://cmdb-uat.elex.be:1980/cmdb/Members/pti
</span>URL: dav://cmdb-uat.elex.be:1980/cmdb/Members/ptiCreating `.': failed:
</span>405 Method Not Allowed
</span>Uploading ./plone_webdav.html to `/cmdb/Members/pti/plone_webdav.html':
</span>Progress: [=============================>] 100,0% of 4007 bytes succeeded.
</span>Uploading ./plone_webdav.md to `/cmdb/Members/pti/plone_webdav.md':
</span>Progress: [=============================>] 100,0% of 6369 bytes succeeded.
</span>Uploading ./Untitled.txt to `/cmdb/Members/pti/Untitled.txt':
</span>Progress: [=============================>] 100,0% of 203 bytes succeeded.
</span>Uploading ./Uploading to `/cmdb/Members/pti/Uploading': Could not open file: No such file or directory
</span>Uploading documents to `/cmdb/Members/pti/documents': Could not open file: No such file or directory
</span>Uploading to to `/cmdb/Members/pti/to': Could not open file: No such file or directory
</span>Uploading Plone to `/cmdb/Members/pti/Plone': Could not open file: No such file or directory
</span>Uploading with to `/cmdb/Members/pti/with': Could not open file: No such file or directory
</span>Uploading WebDAV.md to `/cmdb/Members/pti/WebDAV.md': Could not open file: No such file or directory
</span>Creating `./foo': failed:
</span>405 Method Not Allowed
</span>Creating `./foo/bar': failed:
</span>405 Method Not Allowed
</span>Creating `./foo/bar/baz': failed:
</span>405 Method Not Allowed
</span>Uploading ./foo/bar/baz/plone_webdav.md to `/cmdb/Members/pti/foo/bar/baz/plone_webdav.md':
</span>Progress: [=============================>] 100,0% of 3380 bytes succeeded.
</span>Creating `./images': failed:
</span>405 Method Not Allowed
</span>Uploading ./images/SJ09_1.jpg to `/cmdb/Members/pti/images/SJ09_1.jpg':
</span>Progress: [=============================>] 100,0% of 31637 bytes succeeded.
</span>Uploading ./images/SJ09_2.jpg to `/cmdb/Members/pti/images/SJ09_2.jpg':
</span>Progress: [=============================>] 100,0% of 29182 bytes succeeded.
</span>Uploading ./images/SJ09_3.jpg to `/cmdb/Members/pti/images/SJ09_3.jpg':
</span>Progress: [=============================>] 100,0% of 31296 bytes succeeded.
</span>Uploading ./images/SJ09_4.jpg to `/cmdb/Members/pti/images/SJ09_4.jpg':
</span>Progress: [=============================>] 100,0% of 31094 bytes succeeded.
</span>Uploading ./images/SJ09_5.jpg to `/cmdb/Members/pti/images/SJ09_5.jpg':
</span>Progress: [=============================>] 100,0% of 26886 bytes succeeded.
</span>Uploading ./images/SJ09_6.jpg to `/cmdb/Members/pti/images/SJ09_6.jpg':
</span>Progress: [=============================>] 100,0% of 29373 bytes succeeded.
</span>Uploading ./images/SJ09_7.jpg to `/cmdb/Members/pti/images/SJ09_7.jpg':
</span>Progress: [=============================>] 100,0% of 34486 bytes succeeded.
</span>Uploading ./images/SJ09_8.jpg to `/cmdb/Members/pti/images/SJ09_8.jpg':
</span>Progress: [=============================>] 100,0% of 28561 bytes succeeded.
</span>Uploading ./images/SJ09_9.jpg to `/cmdb/Members/pti/images/SJ09_9.jpg':
</span>Progress: [=============================>] 100,0% of 27381 bytes succeeded.
</span>Connection to `cmdb-uat.elex.be' closed. 
</span></code></pre>


Disable authentication for global proxy settings on Ubuntu
Peter Tillemans — Fri, 22 Jul 2011 14:33:00 +0000
2011-07-22 Fri 16:33 Figure out proxy settings Linux</a> Ubuntu has a Network Proxy chooser which allows you to select a location (a la MacOSX). This works well enough except that the UI is a bit counter-intuitive (in my humble opinion)which causes me to regularly nuke some predefined setting inadvertently. This is not a big deal though. However for update manager (and several other tools) to pick up the new proxy settings you need to push the settings down to the system level. This takes 2 times typing your password. Now, this IS a big deal. When I go back and forth between work and home I have to change this at least 2 times per day. Also it irks me that a detail setting like the proxy is not auto-detected and I need to login to change this 'system' setting. My laptop is essentially a single user system and I do not see switching the proxy as a serious security issue, even with 3 kids running around the home. To come back to auto-detection, while this works fine at work, it fails to figure out that at home that there is a direct connection to the Internet. I can probably fix this by replacing my aging wireless router with my Time Capsule as the Internet gateway router, but I prefer to have the Time Capsule close to my desk. In any case the Network proxy</strong> shows 2 times the authentication dialog box. A particularly nice feature (Is this new in Natty?) is that the dialog shows for which DBUS setting access is being asked. The first dialog asks access to com.ubuntu.systemservice.setProxy</strong>. This response is configured in the file /usr/share/polkit-1/actions/com.ubuntu.systemservice.policy</strong>. This is a very readable XML file which contains a section for the setProxy</strong> action. I feel no reservation in allowing unchecked access to the setProxy</strong>. Although this might make a man-in-the-middle attack easier someone with the sophistication to pull this off, does not need to doctor my PC to do it.</p>
<action id="com.ubuntu.systemservice.setproxy"\>
</span>  <description>Set current global proxy</description>
</span>  <message>System policy prevents setting proxy settings</message>
</span>  <defaults>
</span>    <!-- PTI : original settings
</span>    <allow\_inactive>no</allow\_inactive>
</span>    <allow\_active>auth\_admin\_keep</allow\_active>
</span>    -->
</span>    <allow\_inactive>yes</allow\_inactive>
</span>    <allow\_active>yes</allow\_active>
</span>  </defaults>
</span></action>
</span></code></pre>
Retrying, and indeed one of the authentication requests dropped. Note that the action was configured with auth_admin_keep</strong> which according to the docs would mean we should be authenticated for some time,so I would not expect the second authentication I am getting. Must be a subtlety which escapes me at the moment. The second action is more problematic since the set-system</strong> om the system gconf settings is much less fine-grained than setProxy</strong> and can potentially cause more damage to the system.
<action id="org.gnome.gconf.defaults.set-system">
<description gettext-domain="GConf2">Change GConf system values</description>
<message gettext-domain="GConf2">Privileges are required to change GConf system values</message>

<allow_inactive>no</allow_inactive>

<allow_active>yes</allow_active>
</defaults>
</action></p>
After relaxing this second method, I can finally easily switch proxies between Locations. There are several things bugging me:</p>

The set-system method really is too wide in scope.</li>
There should be a more elegant way that modifying files under /usr/share</strong></li>
My system should actually switch location unaided.</li>
</ol>
For the time being, I fixed a frustration and learned something in the process. The result is not yet fully satisfactory, but that will improve over time. **</p>

Tutorial explaining editing static files</a></li>
pklocalauthority man page</a></li>
Install Updates as Unprivileged User</a></li>
</ul>
Of course there is a more elegant solution than editing files under /usr/share</strong> folder. Everything is explained in the man pages pklocalauthority</strong> and PolicyKit.conf</strong> (among others). But that's for another day...</p>


Making dotFiles visible on the Mac
Peter Tillemans — Wed, 20 Jul 2011 20:56:00 +0000
Dotfiles, can't live with 'em, can't live without 'em. Dot files are the term for folders and files starting with a '.' so they do not show upwhen using plain ls</strong>. Tha Mac has a cool keycode to toggle visibility of dotfiles in the File Open/Save</strong> dialog, but this does not work in the finder for one reason or another. In practice this meant I had to deal with dotFiles and dotDriectories I found on the net some incantation to force the setting for the finder to show/hide the dotfiles. Upon restarting the finder the widows will reopen with the updated setting. I found on the net some snippets of sh script (but I forgot where and cannot immediately retrieve it), and I immediately dumped them in my ~/bin</strong> folder. ~/bin/hide-dotfiles :</p>
#!/bin/sh
</span>defaults write com.apple.finder AppleShowAllFiles -bool FALSE
</span>killall Finder
</span></code></pre>
~/bin/show-dotfile :```</p>
#!/bin/sh
</span>defaults write com.apple.finder AppleShowAllFiles -bool TRUE
</span>killall Finder
</span></code></pre>
So in order to toggle the setting in the graphical finderyou drop to the commandline set the flag in the desired state and restart the finders. Works nice… One remark : if you suddenly see strange icons on your desktop, then you probably still have the dotFiles visible selected. hide-dotfiles</strong> will clean your desktop up again. *</p>


Building debian packages in a cleanroom
Peter Tillemans — Thu, 14 Jul 2011 16:19:00 +0000
Overview and Goals</h3>
We build our solutions mostly on Ubuntu Natty and we deploy to Debian (currently lenny). One problem we face is that Debian has a slow release cycle and the packages are dated. Before a new release is approved and deployed to our target servers it can still take many months causing us to have to use up to 3 year old technology. So we are often faced to 'backport' packages or debianize existing packages if we want to use the current releases. In the past we had different build servers for the target architectures. However this is a heavy solution and scales poorly. It also makes upgrading to the next release that much heavier. So we need a system for building debian packages that is :</p>

Fully automated</li>
Target multiple distributions Debian (lenny,squeeze) and Ubuntu(natty, maverick)</li>
Build on development machines(a) and Jenkins/Hudson CI servers(b)</li>
easily configurable</li>
memorizable process</li>
</ol>
The goal is to make packages for internal consumption, and the process outlined here falls short of the community standards.</p>
Enter pbuilder</h3>
Of course we are not the first or only one with this issue. In fact we are laggards and there are excellent articles on the 'net to help us with these goals. e.g.</p>

PBuilder User Manual</a></li>
Pbuilder Tricks on the Debian Wiki</a></li>
PBuilder How To over at the Ubuntu Wiki</a></li>
</ul>
The pbuilder</strong> program create a clean room environment of a freshly installed empty debian or ubuntu distro, chroot into it and starts building based on the project metadata, mostly from the debian/control</strong> file. It does this by unpacking a preconfigured base</strong> image of the selectable target , installing the build dependencies, building the package in the cleanroom, moving the artifacts to the hosting machine and cleaning everything up again. And it does this actually surprisingly fast. This clearly satisfies goals 1 and 2 (and half of 3 if we assume a developer has full control over his laptop). The pbuilder</strong> is configured through commandline options, which are clear and friendly enough but you end up with commandlines of several lines long which are impossible to type in a shell and are a maintenance nightmare in build scripts (clearly conflicts with point 5). Also in the ideal world we would be able to retarget a build without touching the checked out files, e.g. with environment variable (see goals 3 and 4).</p>
Configuring pbuilder</h3>
On the Pbuilders Tricks page I found a big smart shell script to use as the pbuilder</strong> configuration file ~/.pbuilderrc</strong>.</p>
\# Codenames for Debian suites according to their alias. Update these when needed.
</span>UNSTABLE\_CODENAME="sid"
</span>TESTING\_CODENAME="wheezy"
</span>STABLE\_CODENAME="squeeze"
</span>OLDSTABLE\_CODENAME="lenny"
</span>STABLE\_BACKPORTS\_SUITE="$STABLE\_CODENAME-backports"
</span>
</span>\# List of Debian suites.
</span>DEBIAN\_SUITES=($UNSTABLE\_CODENAME $TESTING\_CODENAME $STABLE\_CODENAME $OLDSTABLE\_CODENAME
</span>    "unstable" "testing" "stable" "oldstable")
</span>
</span>\# List of Ubuntu suites. Update these when needed.
</span>UBUNTU\_SUITES=("natty" "maverick" "jaunty" "intrepid" "hardy" "gutsy")
</span>
</span>\# Mirrors to use. Update these to your preferred mirror.
</span>DEBIAN\_MIRROR="ftp.be.debian.org"
</span>UBUNTU\_MIRROR="mirrors.kernel.org"
</span>
</span>\# Optionally use the changelog of a package to determine the suite to use if
</span>\# none set.
</span>if \[ -z "${DIST}" \] && \[ -r "debian/changelog" \]; then
</span>    DIST=$(dpkg-parsechangelog | awk '/^Distribution: / {print $2}')
</span>    # Use the unstable suite for Debian experimental packages.
</span>    if \[ "${DIST}" == "experimental" \]; then
</span>        DIST="unstable"
</span>    fi
</span>fi
</span>
</span>\# Optionally set a default distribution if none is used. Note that you can set
</span>\# your own default (i.e. ${DIST:="unstable"}).
</span>: ${DIST:="$(lsb\_release --short --codename)"}
</span>
</span>\# Optionally set the architecture to the host architecture if none set. Note
</span>\# that you can set your own default (i.e. ${ARCH:="i386"}).
</span>: ${ARCH:="$(dpkg --print-architecture)"}
</span>
</span>NAME="$DIST"
</span>if \[ -n "${ARCH}" \]; then
</span>    NAME="$NAME-$ARCH"
</span>    DEBOOTSTRAPOPTS=("--arch" "$ARCH" "${DEBOOTSTRAPOPTS\[@\]}")
</span>fi
</span>
</span>BASETGZ="/var/cache/pbuilder/$NAME-base.tgz"
</span>DISTRIBUTION="$DIST"
</span>BUILDRESULT="/var/cache/pbuilder/$NAME/result/"
</span>APTCACHE="/var/cache/pbuilder/$NAME/aptcache/"
</span>BUILDPLACE="/var/cache/pbuilder/build/"
</span>
</span>\# make sure folders exist
</span>mkdir -p $BUILDRESULT
</span>mkdir -p $APTCACHE
</span>
</span>echo "Target : $BUILDRESULT" >>/tmp/dist
</span>
</span>if $(echo ${DEBIAN\_SUITES\[@\]} | grep -q $DIST); then
</span>
</span>    OTHERMIRROR="deb file:///var/cache/pbuilder/$NAME/result ./"
</span>    BINDMOUNTS="/var/cache/pbuilder/$NAME/result"
</span>    HOOKDIR="/var/cache/pbuilder/$NAME/hooks"
</span>    EXTRAPACKAGES="apt-utils"
</span>    # Debian configuration
</span>    MIRRORSITE="http://$DEBIAN\_MIRROR/debian/"
</span>    COMPONENTS="main contrib non-free"
</span>    DEBOOTSTRAPOPTS=("${DEBOOTSTRAPOPTS\[@\]}" "--keyring=/usr/share/keyrings/debian-archive-keyring.gpg")
</span>    if $(echo "$STABLE\_CODENAME stable" | grep -q $DIST); then
</span>        EXTRAPACKAGES="$EXTRAPACKAGES debian-backports-keyring"
</span>        OTHERMIRROR="$OTHERMIRROR | deb http://www.backports.org/debian $STABLE\_BACKPORTS\_SUITE $COMPONENTS"
</span>    fi
</span>elif $(echo ${UBUNTU\_SUITES\[@\]} | grep -q $DIST); then
</span>    # Ubuntu configuration
</span>    MIRRORSITE="http://$UBUNTU\_MIRROR/ubuntu/"
</span>    COMPONENTS="main restricted universe multiverse"
</span>    DEBOOTSTRAPOPTS=("${DEBOOTSTRAPOPTS\[@\]}" "--keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg")
</span>else
</span>    echo "Unknown distribution: $DIST"
</span>    exit 1
</span>fi
</span></code></pre>
I just updated the distribution names to the current situation and added the directory where the packages are collected as a repository so subsequent builds can use these packages as dependencies. I also specified the keyrings to use for Debian and Ubuntu and made sure the expected folders are created to mount them in the clean room. I created this in my account on my development laptop and added a symbolic link in ~root/.pbuilderrc to this file so I can update it from my desktop environment and do not have to get my brain all twisted up to try to remember with which configuration I am busy in my shell, sudo, su -</strong>, … THe way the script works is that the configuration adapts itself to the content of the DIST</strong> and ARCH</strong> environment variables. So to configure lenny-amd64</strong> as target is sufficient to do</p>
~ > export DIST=lenny
</span>~ > export ARCH=amd64
</span></code></pre>
This approach is also perfect Jenkins or Hudson to determine the target build from checked out sources, since it can be specified in the build recipe. (satisfies goals 3b, 4 and 5) Since we have to run these programs using sudo we must make sure the environment variables are passed by sudo. We can do this in the Defaults</strong> line of the /etc/sudoers</strong> file with the envkeep</strong> instruction.</p>
...
</span>Defaults  env\_reset,env\_keep="DIST ARCH http\_proxy ftp\_proxy 
</span> https\_proxy no\_proxy"
</span>... snip ...
</span>\# Cmnd alias specification
</span>Cmnd\_Alias PBUILDER=/usr/sbin/pbuilder, /usr/bin/pdebuild
</span>... snip to end of file ...
</span>\# Allow members of group sudo to execute any command
</span>%sudo   ALL=(ALL:ALL) ALL
</span>
</span>pti     ALL=(ALL) NOPASSWD: PBUILDER
</span>jenkins ALL=(ALL) NOPASSWD: PBUILDER
</span>\#includedir /etc/sudoers.d
</span></code></pre>
You add the DIST</strong> and ARCH</strong> variables there. I also included the environment variables for proxying so I can easily switch between environment on my laptop and these changes propagate to sudo (which is also useful for plain apt-get, by the way). I also added a line to show how to make the tools available for a user without having to give their password. This is not needed for interactive work, but very much so for the user as which the CI server is running (in our case jenkins</strong>). Note that the definition should be after the group definitions, otherwise these take precedence and jenkins has to provide his password (read: is hanging during the build).</p>
Creating the target base images</h3>
The heavy lifting is now done. Let's create an base.tgz</strong> for lenny-amd64.</p>
~ > export DIST=lenny
</span>~ > export ARCH=amd64
</span>~ > sudo pbuilder create
</span></code></pre>
Now go and have a cup of coffee (or read some emails). Rinse and repeat for the other target platforms.</p>
Backporting existing packages</h3>
In theory backporting would be as simple as</p>
~  ᐅ cd tmp
</span>~/tmp  ᐅ apt-get source mongodb
</span>Reading package lists... Done
</span>Building dependency tree
</span>Reading state information... Done
</span>Need to get 1,316 kB of source archives.
</span>Get:1 http://be.archive.ubuntu.com/ubuntu/ natty/universe mongodb 1:1.6.3-1ubuntu2 (dsc) \[2,276 B\]
</span>Get:2 http://be.archive.ubuntu.com/ubuntu/ natty/universe mongodb 1:1.6.3-1ubuntu2 (tar) \[1,285 kB\]
</span>Get:3 http://be.archive.ubuntu.com/ubuntu/ natty/universe mongodb 1:1.6.3-1ubuntu2 (diff) \[29.0 kB\]
</span>Fetched 1,316 kB in 1s (679 kB/s)
</span>gpgv: Signature made Thu 17 Mar 2011 11:49:37 PM CET using RSA key ID D5946E0F
</span>gpgv: Can't check signature: public key not found
</span>dpkg-source: warning: failed to verify signature on ./mongodb\_1.6.3-1ubuntu2.dsc
</span>dpkg-source: info: extracting mongodb in mongodb-1.6.3
</span>dpkg-source: info: unpacking mongodb\_1.6.3.orig.tar.gz
</span>dpkg-source: info: unpacking mongodb\_1.6.3-1ubuntu2.debian.tar.gz
</span>dpkg-source: info: applying debian-changes-1:1.6.3-1
</span>dpkg-source: info: applying build-process-remove-rpath
</span>dpkg-source: info: applying mozjs185
</span>~/tmp  ᐅ DIST=lenny ARCH=amd64 sudo pbuilder build mongodb\_1.6.3-1ubuntu2.dsc
</span>I: using fakeroot in build.
</span>I: Current time: Thu Jul 14 14:28:17 CEST 2011
</span>I: pbuilder-time-stamp: 1310646497
</span>I: Building the build Environment
</span>I: extracting base tarball \[/var/cache/pbuilder/lenny-amd64-base.tgz\]
</span>...
</span></code></pre>
and you should get a nice set of debian packages in */var/cache/pbuilder/lenny-amd64. In practice you will often end up with errors like :</p>
... snip ...
</span>The following packages have unmet dependencies:
</span>  pbuilder-satisfydepends-dummy: Depends: xulrunner-dev (>= 2.0~) but it is not installable
</span>The following actions will resolve these dependencies:
</span>
</span>Remove the following packages:
</span>pbuilder-satisfydepends-dummy
</span>
</span>Score is -9850
</span>
</span>Writing extended state information... Done
</span>... snip ...
</span>I: cleaning the build env
</span>I: removing directory /var/cache/pbuilder/build//6279 and its subdirectories
</span></code></pre>
In these case you have to walk the dependency tree till you find the leafs, and walk back up the branches to the trunk. Note also that chances are that unless you target machines which only serve a very specific purpose, you might end up with packages which are uninstallable since you pull out the rug from other installed packages. However we have the principle to use 1 virtual host to deliver 1 service, hence there are very little packages deployed to them and nothing complicated like desktop environments. Simple leaf packages often build without a hitch:</p>
~/tmp  ᐅ DIST=lenny sudo pbuilder build libevent\_1.4.13-stable-1.dsc
</span>I: using fakeroot in build.
</span>I: Current time: Thu Jul 14 14:44:00 CEST 2011
</span>I: pbuilder-time-stamp: 1310647440
</span>I: Building the build Environment
</span>I: extracting base tarball \[/var/cache/pbuilder/lenny-amd64-base.tgz\]
</span>I: creating local configuration
</span>I: copying local configuration
</span>I: mounting /proc filesystem
</span>I: mounting /dev/pts filesystem
</span>I: Mounting /var/cache/pbuilder/ccache
</span>... snip ...
</span>dpkg-genchanges: including full source code in upload
</span>dpkg-buildpackage: full upload (original source is included)
</span>W: no hooks of type B found -- ignoring
</span>I: Copying back the cached apt archive contents
</span>I: unmounting /var/cache/pbuilder/lenny-amd64/result filesystem
</span>I: unmounting /var/cache/pbuilder/ccache filesystem
</span>I: unmounting dev/pts filesystem
</span>I: unmounting proc filesystem
</span>I: cleaning the build env
</span>I: removing directory /var/cache/pbuilder/build//15214 and its subdirectories
</span>I: Current time: Thu Jul 14 14:49:57 CEST 2011
</span>I: pbuilder-time-stamp: 1310647797
</span>~/tmp  ᐅ ls -al /var/cache/pbuilder/lenny-amd64/result
</span>total 5260
</span>drwxr-xr-x 2 root root    4096 2011-07-13 19:47 .
</span>drwxr-xr-x 5 root root    4096 2011-07-13 19:13 ..
</span>-rw-r--r-- 1 pti  pti     2853 2011-07-14 14:49 libevent\_1.4.13-stable-1\_amd64.changes
</span>-rw-r--r-- 1 pti  pti     9129 2011-07-14 14:49 libevent\_1.4.13-stable-1.diff.gz
</span>-rw-r--r-- 1 pti  pti      907 2011-07-14 14:49 libevent\_1.4.13-stable-1.dsc
</span>-rw-r--r-- 1 pti  pti   499603 2009-12-05 23:04 libevent\_1.4.13-stable.orig.tar.gz
</span>-rw-r--r-- 1 pti  pti    61956 2011-07-14 14:49 libevent-1.4-2\_1.4.13-stable-1\_amd64.deb
</span>-rw-r--r-- 1 pti  pti    31262 2011-07-14 14:49 libevent-core-1.4-2\_1.4.13-stable-1\_amd64.deb
</span>-rw-r--r-- 1 pti  pti   172950 2011-07-14 14:49 libevent-dev\_1.4.13-stable-1\_amd64.deb
</span>-rw-r--r-- 1 pti  pti    51588 2011-07-14 14:49 libevent-extra-1.4-2\_1.4.13-stable-1\_amd64.deb
</span>-rw-r--r-- 1 root root    9051 2011-07-14 14:48 Packages
</span>~/tmp  ᐅ
</span></code></pre>
Using pdebuild</strong> for building packages</h3>
Many of our packages are debianized and can be build using debuild</strong>. I use here the Ubuntu sources of tokyocabinet as an example (which uses the libevent package we just built, btw):</p>
~/tmp/tokyocabinet-1.4.37  ᐅ DIST=lenny ARCH=amd64 pdebuild
</span>...snip...
</span> dpkg-genchanges  >../tokyocabinet\_1.4.37-6ubuntu1\_amd64.changes
</span>dpkg-genchanges: not including original source code in upload
</span>dpkg-buildpackage: binary and diff upload (original source NOT included)
</span>W: no hooks of type B found -- ignoring
</span>I: Copying back the cached apt archive contents
</span>I: unmounting /var/cache/pbuilder/lenny-amd64/result filesystem
</span>I: unmounting /var/cache/pbuilder/ccache filesystem
</span>I: unmounting dev/pts filesystem
</span>I: unmounting proc filesystem
</span>I: cleaning the build env
</span>I: removing directory /var/cache/pbuilder/build//4199 and its subdirectories
</span>I: Current time: Thu Jul 14 15:05:27 CEST 2011
</span>I: pbuilder-time-stamp: 1310648727
</span>~/tmp/tokyocabinet-1.4.37  ᐅ ls /var/cache/pbuilder/lenny-amd64/result
</span>...snip...
</span>tokyocabinet\_1.4.37-6ubuntu1\_amd64.changes
</span>tokyocabinet\_1.4.37-6ubuntu1.debian.tar.gz
</span>tokyocabinet\_1.4.37-6ubuntu1.dsc
</span>tokyocabinet\_1.4.37.orig.tar.gz
</span>tokyocabinet-bin\_1.4.37-6ubuntu1\_amd64.deb
</span>tokyocabinet-doc\_1.4.37-6ubuntu1\_all.deb
</span></code></pre>
Sometimes the dependencies break on the version of debhelpers. This version is added conservatively by the dh* scripts and often is overly conservative. Many packages build just fine with older versions of the debhelpers.</p>
Setting up automated build</h3>
To set this up on the build server we have to replicate the steps above</p>

Create the ~/.pbuilderrc file</li>
Symbolic link to this file in ~root/.pbuilderrc</li>
Allow jenkins to use sudo for building packages</li>
Create a jenkins job to (re)build the packages</li>
Create jobs to build the packages</li>
</ol>


Enable real idletime for Org Mode on Ubuntu
Peter Tillemans — Mon, 04 Jul 2011 09:11:00 +0000
Org Mode can use the idle time to correct time tracking entries. On the Mac this works on the idle time of the computer, on other platforms it uses the idle time of emacs. Hence if you do a significant task in another program it will be idle for org-mode. There is a little program delivered with org-mode sources to estimate the "real" idle time based on the information used by screensavers. Unfortunaltely it is in source code and needs to be compiled first. Everything is actually well documented, just scattered. Let's see where that little program is located</p>
$ locate x11idle
</span>/home/pti/.emacs.d/vendor/org-mode/UTILITIES/x11idle.c
</span></code></pre>
This conveniently shows the location of the source file. If you might find a x11info</strong> file (without .c) in a bin directory then it is already installed and you're done. If you get no results and there is some remark that the database is too old then it is time to refresh it using sudo updatedb</strong>. Then the lookup should find the file. Now go to the folder where the file is located. In my case :</p>
$ cd ~/.emacs.d/vendor/org-mode/UTILITIES
</span></code></pre>
We need to make sure we have the necessary X screensaver libraries for compiling :```</p>
$ sudo apt-get install lib-xss-de
</span>sudo apt-get install libxss-dev
</span>Reading package lists... Done
</span>Building dependency tree
</span>Reading state information... Done
</span>The following extra packages will be installed:
</span>  x11proto-scrnsaver-dev
</span>The following NEW packages will be installed:
</span>  libxss-dev x11proto-scrnsaver-dev
</span>0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
</span>Need to get 34.1 kB of archives.
</span>After this operation, 225 kB of additional disk space will be used.
</span>Do you want to continue \[Y/n\]?
</span>Get:1 http://be.archive.ubuntu.com/ubuntu/ natty/main x11proto-scrnsaver-dev all 1.2.1-1 \[21.3 kB\]
</span>Get:2 http://be.archive.ubuntu.com/ubuntu/ natty/main libxss-dev amd64 1:1.2.1-1 \[12.9 kB\]
</span>Fetched 34.1 kB in 0s (200 kB/s)
</span>Selecting previously deselected package x11proto-scrnsaver-dev.
</span>(Reading database ... 567603 files and directories currently installed.)
</span>Unpacking x11proto-scrnsaver-dev (from .../x11proto-scrnsaver-dev\_1.2.1-1\_all.deb) ...
</span>Selecting previously deselected package libxss-dev.
</span>Unpacking libxss-dev (from .../libxss-dev\_1%3a1.2.1-1\_amd64.deb) ...
</span>Processing triggers for man-db ...
</span>Setting up x11proto-scrnsaver-dev (1.2.1-1) ...
</span>Setting up libxss-dev (1:1.2.1-1) ...
</span></code></pre>
Now we can compile x11idle</strong>. We need to specify to link against the X11 and X Screensaver libraries (Xss). I immediately place the resulting executable file in ~/bin/x11idle</strong>. Alternatively you could use the /usr/local/bin folder, but first compile to a temporary location like /tmp</strong> and move it there : sudo mv /tmp/x11idle /usr/local/bin</strong>.```</p>
$ gcc -o ~/bin/x11idle -lX11 -lXss x11idle.c
</span>x11idle.c: In function ‘main’:
</span>x11idle.c:19:5: warning: format ‘%u’ expects type ‘unsigned int’, but argument 2 has type ‘long unsigned int’
</span>$ x11idle
</span>22
</span>$ x11idle
</span>20
</span></code></pre>
I tried to run it using the normal path and got 22 and 20 seconds idle time : it works !!! The orgmode code will now find and use it. For more background info see</p>

Blogpost about getting idle time in linux.</a></li>
The message with the patch proposal for including it with org-mode</a></li>
</ul>
2011-07-04 Mon 11:11 Track down reason for Dangling Time References</a></p>


Organizing Windows using the Keyboard with Compiz Grid
Peter Tillemans — Thu, 30 Jun 2011 11:44:00 +0000
The Mac has a great utility called Divvy to easily map windows to
loacation on the screen using the keyboard. Fiddling with the mouse to
get multiple windows in the right location is a productivity killer
and a pain in the neck (or shoulder, or elbow, or …)</p>
Ubuntu (and of course any other Linux distro with compiz) has a
similar feature built in as a plugin for compiz. Type Alt-F2 and enter
ccsm</strong> + Return in the command prompt to launch the CompizConfig
Settings manager.</p>
Select the Window Management</strong> from the left menu and enable the
Grid</strong> plugin. Click on it so you can look at the key bindings in
the Bindings</strong> tab. If you are on a desktop or a big laptop with a
separate numeric keyboard you are set. As you can see the locations
for the windows are by default mapped in a logical fashion like the
arrow keys on the numeric keypad. However my laptop does not have a
separate numeric keyboard and enabling it before typing the key code
is a pain. Remapping them is easy by clicking on the button with the
key code. A window appears with a Grab key code</strong> button. Click it
and type the new keycode you want to assign it to.</p>
If there is a conflict, you will get a window explaingin the conflict
and asking how to resolve it. My first attempt was to remap the laptop
numeric keys using the super keys. This conflicted with the unity
launcher since the top row 7-8-9 map to the apps in the launcher. To
avoid conflicts I use now Control-Super with the keys around the j-key
(which is the home key for the right hand) Also autokey (a text macro
expander) is mapped to Super-K</p>

Control-Super-j : 100% (maximize)</li>
Control-Super-h : 50% left</li>
Control-Super-k : 50% right</li>
Control-Super-u : 50% top</li>
Control-Super-m : 50% bottom</li>
Control-Super-y : 25% top-left</li>
Control-Super-i : 25% top-right</li>
Control-Super-n : 25% bottom-left</li>
Control-Super-, : 25% bottom-right</li>
</ul>
If Control-Super-j is used to maximize a window, clicking on one of
the other keys will first restore it to the original size and position
and only map it to its place on the second click. I consider this a
feature, but you are free to interprete it as a bug. Result, this is
now super practical way to divide my windows on my screen.</p>


Proxy Support for Grails
Peter Tillemans — Tue, 28 Jun 2011 11:59:43 +0000
Not a big thing, actually for me it is. I am always struggling with
proxy settings. It requires a lot of different incantations to be
done, every program deals with it differently, support for platform
settings is flaky, ... Grails deals with this is a way which
pleasantly surprised me :</p>
> grails add-proxy <name> --host=<hostname> --port=<portno> e.g. grails add-proxy client --host=proxy --port=3128
</span></code></pre>
allows you to create a setting for a proxy and bind it to a name. It
also supports username/password. Switching to the setting involves
only</p>
> grails set-proxy client
</span></code></pre>
to enable the proxy setting, and</p>
> grails clear-proxy
</span></code></pre>
when I get back in a transparent environment. (for completeness there
is a remove-proxy</strong> command which is useful to remove those
passwords after the need has passed). I particularly impressed  that
this was done in a simple and straightforward without the need fo
brain gymnastics trying to remember which arcane curse needs to be put
at what location in which file. Nice.</p>


Fix for Sonar choking on 'result returns more than one elements'
Peter Tillemans — Thu, 23 Jun 2011 12:54:05 +0000
Recently our sonar installation on our Hudson CI choked again, this time with an error I have not seen before. It was just before the release of an important milestone for the team, so not being unable to publish new version on the test server could not come on a worse time.</p>
In the Console Log of a failing built we found the message.</p>
\[INFO\] ------------------------------------------------------------------------
</span>\[INFO\] BUILD FAILURE
</span>\[INFO\] ------------------------------------------------------------------------
</span>\[INFO\] Total time: 5.791s
</span>\[INFO\] Finished at: Thu Jun 23 09:20:05 CEST 2011
</span>\[INFO\] Final Memory: 20M/429M
</span>\[INFO\] ------------------------------------------------------------------------
</span>\[ERROR\] Failed to execute goal org.codehaus.mojo:sonar-maven-plugin:2.0-beta-2:sonar (default-cli) on project pfus: Can not execute Sonar: PicoLifecycleException: method 'public void org.sonar.batch.ProjectTree.start() throws java.io.IOException', instance 'org.sonar.batch.ProjectTree@50a6023a, java.lang.RuntimeException: wrapper: result returns more than one elements -> \[Help 1\]
</span></code></pre>
Ok, apparently something returns 2 results which should only have one result and it stands to reason that it is coming from the database. Pity there is no indication on which table would be affected.</p>
Some googling retrieved this post</a> which points to the snapshots table and more specifically to records with the field islast set to true.</p>
A quick check in .../conf/sonar.properties</strong> revealed the database connection parameters.</p>
Ok, this is a good time to check you have an up-to-date backup of your database. (Or make one if you're not sure)</p>
Using your SQL query tool of choice (I used the built in Data Sources tool in IntelliJ) connect to the database.</p>
The snapshots table contains a project_id which confusingly does not really contains projects, but actually all kinds of assets, artefacts, files, however you ike to call it. Unfortunately there are many thousands. Even if I limited to only the ones with islast=1</strong> there were close to 1000 records.</p>
Narrowing further down with :</p>

**select project\_id, cnt
</span>  from (select project\_id,
</span>          count(\*) as cnt
</span>        from snapshots
</span>        where islast=1
</span>        group by project\_id) as cntsnap
</span>  where cnt > 1**
</span></code></pre>
</blockquote>
Gave me the project_id I've been looking for, in my case 2089 Now a quick</p>

select * from snapshots where project_id=2089</p>
</blockquote>
Gave the 2 offending rows. A quick glance showed that one of them was very suspicious : the parent_id was the same as his own project_id and there were lots of null columns. I deleted the row based on the id</strong>. Retriggered hudson</strong> to rebuild the project, and the build succeeded and sonar seems to be happy again. I hope there will be no other repercussions. For our purposes the sonar data is not really critical and we could also restart without any impact. If your sonar data is more critical a better choice would be to restore from backup before the build started failing.</p>


Adding audit information to entities in the Seam framework.
Peter Tillemans — Tue, 11 Nov 2008 13:15:51 +0000
Since we write a lot of stuff for use in the production side of the business we need to comply with rules which allow effective control that the processes and procedures have been followed. In the automotive industry people take these measures seriously.</p>
One of these requirements we often get is that all configuration data elements must contain information on who created this information and when, and similarly for the last update.</p>
Since the advent of EJB3 and JPA we now have nice POJO entities which clearly show the structure of the data and the last thing we want is to add a bunch of boilerplate code which multiplies the number of code lines with redundant stuff.</p>
This blogpost of Daniel Pfeifer</a> shows how to do this using an entity listener. However, it does not work using Seam since we cannot get the user information through the EJBContext, at least not on JBoss 4.2.3.</p>
After wasting the better part of an afternoon barking up the wrong tree, the answer came to me next morning during breakfast. I have the unhealthy habit of reading PDF-files between bites, in this case chapter 15 of the Seam manual. The security section. (Yes, I know, I hould have done this sooner, you know : "if all else fails, read the manual.")</p>
Seam provides a nice utility class aptly named org.jboss.seam.security.Identity</em> which provides all we need to get the name of the person logged in the current session. So replacing the implementation of getCallerIdentity()</em> with the following, we now have nice audit trails.</p>

/**

* Get the name of the currently logged in user.

*

* This part contains the framework specific code to get the active username.

* In this case we use the Seam provided Identity.instance() to get at this

* information.

*

* @param t

* @return

*/

private String getCallerIdentity(Traceable t) {

   try {

     // get the identity principal to get information about the current active user

     Principal principal = Identity.instance().getPrincipal();

     if (log.isDebugEnabled())

       log.debug("AuditLogger.getCallerIdentity returned " + principal.getName());</p>
     return principal.getName();</p>
   } catch (Exception e) {

     log.error("Exception received : " + e.getClass().getName() + ":" + e.getMessage());

     return "unknown";

   }

}</p>
</blockquote>
I provided both the interface and mapped superclass implementations for convenience. All what is now remaining is to extend our configuration POJO's from the TraceableEntity class (and create an update script, and modify the UI to get at the audit info, ...) to make our stuff auditable.</p>


Learnings from the PMI Benelux Day.
Peter Tillemans — Sun, 28 Sep 2008 00:29:48 +0000
I went to the PMI Benelux Day today. The theme today was A symphony of Knowledge,</em> a theme which ran through the plenary sessions topics. I choose to see the use of earned value techniques applied to the Galileo project presented by Francois Picaut. It was interesting to see how this technique was applied in a quite straightforward manner by just entereing the AC provided by the accountants and the EV provided by the products completed at roughly biweekly milestones. All other performance numbers were calculated from these numbers_._ One learning was that in the case of subcontracted work under a FFP contract, the EV = AC. Of course once you think it over this is evident, but this quarter took a while to drop. Some additional metrics were defined like the ES (Earned Schedule, or the time when the current EV should have been reached) and 'To Complete Performance Indexes' in their cost and scope variations. Apprently these metrics should show the effectiveness of the project management when plotted over time.  He applied EVT on FFP projects with good success as part of project assurance. One anekdote was the case when the project manager presented a 'project on track' report while the EV calculations showed the project would end with a 1.000.000EUR loss. This triggered a discussion about the variances which triggered corrective actions. As such this proved the value of the method to confirm the results from bottom-up or other estimates.  In the area of risk management presented Daniel vander Borcht a session about why the ABCD methodology works where so many other risk management approaches fail. ABCD stnds for Assumption Based Communication Dynamics and a key part is the central role of assumptions in this model. Next to the classic issue register and risk register a assumption register is introduced. I need to research this some more Jean Diederich presented the Test Monkeys and Banana Software talk. He made the case that thinking of testing still occurs way too late in the project. He proposes to involve tests at the earliest opportunity to help start the acceptance test design, release test design, ... in parallel to development rather than afterwards. This is the same story I heard from Suzanne Robertson a couple of weeks ago in the context of requirement gathering. This confirms again my conviction that a good requirements process will make life in the project considerably easier.  A last presentation was by Hedda Pahlson-Muller regarding KPO's or knowledge process outsourcing. This was a very instructive talk which clarified this form of outsourcing. Roughly they provide analysts or other knowledge workers in the company the possibility to have an external team to do the legwork and provide collected data for further analysis by the company itself. Due to this business model they face a glass ceiling to the service they cannot deliver analysis or recommendations. For this they are looking for PM/Consultants to use their experience to analyse and interprete the data for the companies which ask this. Nice interesting day, bought a couple of books, talked PM with other people. Time well spent.</p>


Java is a First Class Citizen on Ubuntu Hardy Linux
Peter Tillemans — Fri, 08 Aug 2008 18:07:52 +0000
Lately I hear a lot of Java bashing from a very vocal part of the Linux community. I do a lot of Java, I use Linux on my main laptop and I like this just fine. I use daily freemind (Java mindmapper) and openoffice (which is Java enabled). I was doing this for the past years since Windows XP ate my C-drive for the N-th time (and now it did the same on my gaming rig at home, grrr... ).</p>
I keep a 'Tools' directory in my home drive and place there the Java tools and libraries I get from the net. Creating a little bash script in ~/bin</em> which calls the startup script from the java tools almost always does the right thing, so I was contented. Well, I need to do some LDAP hacking. Last times I did that in perl, python, ruby and Java so it was groovy's turn.</p>
On a whim I type :</p>
pti@pti-laptop:~/workspace/salesforce$ sudo apt-get install groovy
</span></code></pre>
and to my big surprise I get :```</p>
Reading package lists... Done
</span>Building dependency tree
</span>Reading state information... Done
</span>The following extra packages will be installed:
</span>  antlr junit4 libasm2-java libbcel-java libbsf-java libclassworlds-java  libcommons-cli-java
</span>libcommons-collections3-java libcommons-lang-java libcommons-logging-java liblog4j1.2-java
</span>libmockobjects-java libmx4j-java  libregexp-java libservlet2.3-java libxpp3-java libxstream-java
</span>Suggested packages:
</span>  groovy-doc libbcel-java-doc jython rhino libclassworlds-java-doc
</span>  libcommons-collections3-java-doc liblogkit-java libavalon-framework-java
</span>  libgnumail-java
</span>Recommended packages:
</span>  liblog4j1.2-java-gcj
</span>The following NEW packages will be installed:
</span>  antlr groovy junit4 libasm2-java libbcel-java libbsf-java
</span>  libclassworlds-java libcommons-cli-java libcommons-collections3-java
</span>  libcommons-lang-java libcommons-logging-java liblog4j1.2-java
</span>  libmockobjects-java libmx4j-java libregexp-java libservlet2.3-java
</span>  libxpp3-java libxstream-java
</span>0 upgraded, 18 newly installed, 0 to remove and 0 not upgraded.
</span>Need to get 7025kB of archives.
</span>After this operation, 14.7MB of additional disk space will be used.
</span>Do you want to continue \[Y/n\]?
</span></code></pre>
Ok, this was not what I expected... Of course I type 'Y' and let it rip. Now my curiosity take the upper hand and I try some more :```</p>
pti@pti-laptop:~/workspace/salesforce$ sudo apt-get install maven
</span>Reading package lists... Done
</span>Building dependency tree       
</span>Reading state information... Done
</span>E: Couldn't find package maven
</span></code></pre>
Tough luck. But wait, there are 2 mavens, let's try :```</p>
pti@pti-laptop:~/workspace/salesforce$ sudo apt-get install maven2
</span>Reading package lists... Done
</span>Building dependency tree       
</span>Reading state information... Done
</span>The following extra packages will be installed:
</span>  ant libcommons-codec-java libcommons-collections-java
</span>  libcommons-httpclient-java libcommons-net-java libcommons-openpgp-java
</span>  libdoxia-java libganymed-ssh2-java libjdom0-java libjsch-java libjtidy-java
</span>  liblogkit-java liboro-java libplexus-classworlds-java
</span>  libplexus-component-api-java libplexus-container-default-java
</span>  libplexus-interactivity-api-java libplexus-utils-java
</span>  libplexus-velocity-java libslide-webdavclient-java libwagon-java
</span>  libwerken.xpath-java velocity
</span>Suggested packages:
</span>  ant-doc libcommons-httpclient-java-doc libcommons-openpgp-java-doc
</span>  libdoxia-java-doc libjtidy-java-doc libgnumail-java
</span>  libplexus-classworlds-java-doc libplexus-component-api-java-doc
</span>  libplexus-container-default-java-doc libplexus-interactivity-api-java-doc
</span>  libplexus-utils-java-doc libplexus-velocity-java-doc libwagon-java-doc
</span>  velocity-doc
</span>Recommended packages:
</span>  ant-optional ant-gcj
</span>The following NEW packages will be installed:
</span>  ant libcommons-codec-java libcommons-collections-java
</span>  libcommons-httpclient-java libcommons-net-java libcommons-openpgp-java
</span>  libdoxia-java libganymed-ssh2-java libjdom0-java libjsch-java libjtidy-java
</span>  liblogkit-java liboro-java libplexus-classworlds-java
</span>  libplexus-component-api-java libplexus-container-default-java
</span>  libplexus-interactivity-api-java libplexus-utils-java
</span>  libplexus-velocity-java libslide-webdavclient-java libwagon-java 
</span>  libwerken.xpath-java maven2 velocity
</span>0 upgraded, 24 newly installed, 0 to remove and 0 not upgraded.
</span>Need to get 6211kB of archives.
</span>After this operation, 25.2MB of additional disk space will be used.
</span>Do you want to continue \[Y/n\]? 
</span></code></pre>
Hmmmmm....... This is better.... There is some refence to ant.. Yep, that too... Jedit, jython, jruby, scala (I did not do LDAP with scala yet...) follow in quick succession... Well, time to fire up synaptic and search for Java. A seemingly endless list of packages appears. App Servers :</p>

glassfish</li>
tomcat (actually I knew that from before)</li>
jetty</li>
</ul>
Dev Tools:</p>

Emma</li>
Junit</li>
Junit4</li>
JMock</li>
...</li>
</ul>
A bunch of the commons libraries, ... Half a dozen of jdk's. Java bindings for all the windowing toolkits out there : Gtk, Qt-jambi, ... I also finally found the jdbc driver for postgresql which I was frantically looking for a couple of weeks ago and finally downloaded from the postgres site. There is an old eclipse version, but actually this is a tool which I prefer to live in my Tools directory for updating the plugins. The only thing I did not find was findbugs. Well there is probably a lot more missing, but my inspiration dried up. I could clear out half of my tools folders because they are replaced with ubuntu version. I am now even more contented than I was. I just love to type 'apt-get install ' when I want something, and now I found more of what I want.</p>


Deliverables and Activities Ahah!! Moment
Peter Tillemans — Tue, 15 Jul 2008 01:32:39 +0000
Something I already knew became suddenly clear today : the product or
product pieces in the WBS and the relation to the activities. Although
I already knew for a long time that it is good practice to make the
WBS deliverable oriented instead of activity oriented it remained
always a gradient where activities blended seamlessly in
deliverables.</p>
The key was that I used a mental trick derived from 'Getting Things
Done', which says that you must write your activities action oriented,
with a verb, active voice, i.e. do something. I was rephrasing the
activities this way (more bang per spreadsheet cell). </p>
Now I applied this reasoning to the WBS work packages, but I rewrote
it as things, or part of things. Again the clarity improved
considerably and wordiness got down. And then : klabammm.... flash of
light : activities were clearly separated from the WBS work packages,
the grey area between them was gone!!!.</p>
I am quite sure if I read my PM books again I will find this trick in
every single one, but I had to "invent" it myself before I understood
and felt it, instead of just knowing it.</p>


Eclipse Ganymede crashes on 64-bit Ubuntu Hardy Herron
Peter Tillemans — Sat, 12 Jul 2008 06:56:04 +0000
In java6 there is a bug in the 64-bit linux version of the jvm which causes eclipse to crash when opening projects with some aditional plugins installed. Both the openjdk as the sun versions are affected. for more info see :</p>

Bug #206620 in openjdk-6 (Ubuntu)</a></li>
Bug#478560: sun-java6-jdk: SIGSEGV when loading Eclipse workspace</a></li>
</ul>
In the mean time this has been fixed in openjdk7, but this might take a while before this shows up in the repositories. In the mean time the jdk5 does not have this problem and works perfectly well with eclipse. So a quick</p>
sudo aptitude install sun-java5-jdk
</span></code></pre>
installs the needed software. However if the java6 is still installed, chances are it will be preferred over the java5 version of the programs. There are 2 ways to make sure eclipse uses java5 Use java5 for ALL programs.</strong> To change the preference tell the alternatives system to use the java5 version.</p>
pti@pti-laptop:~$ **sudo update-alternatives --config java**
</span>\[sudo\] password for pti: 
</span></code></pre>
There are 3 alternatives which provide `java'.</p>
 Selection    Alternative
</span>-----------------------------------------------
</span>          1    /usr/lib/jvm/java-6-sun/jre/bin/java
</span>          2    /usr/lib/jvm/java-1.5.0-sun/jre/bin/java 
</span>       \*  3    /usr/lib/jvm/java-6-openjdk/jre/bin/java
</span></code></pre>
Press enter to keep the default[*], or type selection number: 2</strong></p>
Using '/usr/lib/jvm/java-1.5.0-sun/jre/bin/java' to provide 'java'. 
</span></code></pre>
To choose the alternatives with a GUI it is a good idea to install galternatives</strong>. Tell only eclipse to use java5.</strong> Since the bug only shows up on my system (so far) in eclipse, I prefer the speedier java6 as default. Luckiliy we can tell eclipse to use a specific jvm in the eclipse.ini</strong> file. Open eclipse.ini</strong> in your eclipse home with your favorite editor and add the following 2 lines to the beginning of the file</p>
 -vm
</span>    /usr/lib/jvm/java-1.5.0-sun/jre/bin/java
</span></code></pre>
This will tell the eclipse launcher to use java5 to launch eclipse.</p>


OpenProj Locks up with Blank Grey Windows
Peter Tillemans — Wed, 11 Jun 2008 11:20:02 +0000
The symptom is that after starting sometimes there is some blurp
dialog and afterwards the Tip of the Day</strong></em> dialog appears. This
stays grey and the application accepts no more events. You need to
kill it to get out of there.</p>
This happens at the place which is protected by a firewall and has no
transparent proxy. At home it worked fine albeit on my Macbook and not
on my Ubuntu laptop.</p>
The reason  is that there is some phone home
functionality built in and with wireshark I could see the application
trying to connect to a webserver. Probably to get the tips of the
day. Behind the firewall this did not work and the application is just
hanging there.</p>
I suspect that sooner or later it will time out, but I
am not that patient. Since this is a regular occurence with java
applications I also immediately knew that I had to tell it where the
proxy can be found. In the file ~/.openproj/run.conf</strong> file replace
the line :</p>
JAVA\_OPTS="-Xms128m -Xmx768m" 
</span></code></pre>
with</p>
JAVA\_OPTS="-Dhttp.proxyHost=proxy -Dhttp.proxyPort=3128 -Xms128m
</span></code></pre>
-Xmx768m"</p>
This directs the java runtime library to use the proxy
http://proxy:3128/.</strong> And voila!  ... Openproj starts immediately
and in its full glory?</p>

Snamellit

Install GUIX on Macbook 12

Post Installation</h2>

Sound : no sound from speakers.</h3> There is no sound coming from the speakers.</p> There is sound coming from the headphone jack. Good enough for use in the living.</p> I'll call this a feature, not a bug.</p>

Things I would do differently</h2> Basically use btrfs to have a single encrypted LUKS volume to deal with and split the volumes in btrfs. That would also give the other goodness of btrfs and should be well supported by grub.</p> But for now I'll enjoy my new couch laptop.</p>

Screenshot in Sway with GUIX

Consolidating Secrets in Pass

Samba Adventures with Guix

Refactoring Emacs Config using Org

Goals to achieve</h1> I like to jot down some things I want to achieve to help me decide when is done and guide some decision along the way to avoid me getting stuck in the middle of a bramble forrest.</p> I came up with:</p>

Recover the Infrastructure from the Old Configuration</h2> The tangling code proved to be very robust and will work fine with Crafted Emacs.</p>

Doing it.</h1> I will spare the grind of the actual migration. Actually migrating was no problem. Dealing with the long tail of issues was.</p>

Issues</h2>

Workflows for Unix Password Store with Emacs and Shell

Deploying Cuirass on GuixSD

Terraform workflow using Guix and Emacs

Emacs support</h1>

KeePassXC from flatpak

Issue with SBCL console output in Sly

Intercepting Bluetooth Keyboard Events

Emacs Debugging with Dape

Snamellit

Welcome to Snamellit</h1>

Contact Information

Home

Brilliant design. Simplicity at scale.</h1> </p> </p>

Running Emacs with wsl2-xrdp

Plan</h1> use xrdp</strong> as remote desktop is built into windows</li> configure xrdp to startup in WSL2</li>

Installation</h1>

Accepting the certificate</h2> You can accept the certificate and let remote desktop add it to your certificate stores. This solves this interruption.</p> However, this still happens each time the ip address changes.</p>

Access NAS Drive using Windows 10 PIN login

Attempt 1</h1> This seems to be a known issue with PIN (and by extension face recognition (?)) login.</p>

Setting Up Blogging with Emacs

Creating the blog project</h1> To deploy to github as a personal blog you have to create a repo in the form <username>.github.io</strong>. Since I name my projects the same as the repos the name was a quick choice.</p> The structure is as follows:</p>

Configuring org-publish</h1> This is what the publish.el</strong> file is for.</p> Prepare some snippets for the HTML pages</p> First off, a link to the CSS:</p>

Sound : no sound from speakers.</h3>
There is no sound coming from the speakers.</p>
There is sound coming from the headphone jack. Good enough for use in the living.</p>
I'll call this a feature, not a bug.</p>

Things I would do differently</h2>
Basically use btrfs to have a single encrypted LUKS volume to deal with and split the volumes in btrfs. That would also give the other goodness of btrfs and should be well supported by grub.</p>
But for now I'll enjoy my new couch laptop.</p>

Recover the Infrastructure from the Old Configuration</h2>
The tangling code proved to be very robust and will work fine with Crafted Emacs.</p>

Doing it.</h1>
I will spare the grind of the actual migration. Actually migrating was no problem. Dealing with the long tail of issues was.</p>

Brilliant design.
Simplicity at scale.</h1>
</p>
</p>

Accepting the certificate</h2>
You can accept the certificate and let remote desktop add it to your certificate stores. This solves this interruption.</p>
However, this still happens each time the ip address changes.</p>