Installing from trunk - checksums

[Cynebeald]

Hello,

I'm having a little problem installing the trunk version of serendipity on a new webhost because of the missing checksum file. I can work around it (either commenting out the call to the verification, or hacking the checksum generation script and run it on the server), but I was wondering if there is any "official" method. How do the developers work around this?

Should there be some "graceful" workaround, for example, if the checksum file is missing, do something like in the upgrader.inc.php file?

Code: Select all

<?php if (is_readable($basedir . 'checksums.inc.php')) {
    $badsums = serendipity_verifyFTPChecksums();
?>

[garvinhicking]

Hi!

What does the code line return for you? I thought is_readable() would not create any error when a file is not existing?

I must admit I have not yet checked out Judebert's checksum code for some time, so I'll try to get judebert into this discussion here.

Regards,
Garvin

[Cynebeald]

The actual problem is in the include/functions_installer.inc code, where the checksum function isn't guarded (the system just assumes that you're installing a release version which has the checksum files in place):

Code: Select all

/**
 * Check the serendipity Installation for problems, during installation
 *
 * @access public
 * @return boolean  Errors encountered?
 */
function serendipity_checkInstallation() {
    global $serendipity, $umask;

    $errs = array();

    $badsums = serendipity_verifyFTPChecksums();
    foreach ($badsums as $rfile => $sum) {
        $errs[] = sprintf(CHECKSUM_FAILED, $rfile);
    }
    ...

The actual error line is in the serendipity_verifyFTPChecksums() function, which does this:

Code: Select all

/**
 * Validate checksums for all required files.
 * 
 * @return A list of all files that failed checksum, where keys are the 
 *    relative path of the file, and values are the bad checksum
 */
function serendipity_verifyFTPChecksums() {
    // Load the checksums
    require_once S9Y_INCLUDE_PATH . 'checksums.inc.php';

Regards,
Cynebeald

[judebert]

Well, I'm blushing.

I never considered the case where people would download the SVN directly. I figured the only way people would be getting the trunk would be from one of Garvin's builds.

I'll go ahead and wrap that line with an if(). Meanwhile, you can generate your own checksums! In the bundled_libs directory, there's a create_release.sh shell script. When Garvin creates a nightly build or release build, this script generates the checksums. You can run it yourself to get the file you need. (Searching the forum for the filename should tell you about its parameters; of course, you could always examine it and just execute the useful bit by hand.)

[Cynebeald]

I never considered the case where people would download the SVN directly. I figured the only way people would be getting the trunk would be from one of Garvin's builds.

I think the easiest way to keep in sync with the trunk (esp. if you want or have to do a few modifications of your own, like incorporate some templates and plugins) is actually mirroring the repository using something like svk or hgsvn. I tried using "vendor branches" a few times, but once files start getting moved around in the original software (or there have been a lot of changes in the source), it starts getting harder and harder to get things merge correctly.

Either that, or using some standalone patch management system like quilt and I'm not l33t enough for that (besides, I'm on windows, and I have no idea if quilt runs on cygwin).

Meanwhile, you can generate your own checksums!

Yeah, I figured that bit out, but I don't have shell access, so I'd have to run it using the php script in the browser (with a few modifications so it would actually run) - generating the checksums from the files already on the server (which probably defeats the purpose of the checksums). The easiest thing I thought of was just commenting the block in the installer

[judebert]

Actually, the installation script tries to use the php, if a command-line php interpreter is available. Without shell access on a box with a local copy, it would be difficult anyway.

Commenting out that portion of the install is a fine solution, at least until I get it surrounded.

[judebert]

Okay, I just checked in the change. Apparently I tried upgrading, but never installing. This time I gave it a thorough test. I've installed Serendipity succesfully five times today! It took me less than an hour, and that includes the four times I *wanted* it to fail, and the three idiot mistakes.

The earlier code was checking file integrity after the user had made it all the way to actually installing the software. I moved it to the first page, where Serendipity checks if the server supports the minimum configuration. It's first in line, so it's hard to miss. Rather than completely ignoring the missing checksum file, it reports the loss as a warning. Files with bad checksums are also warnings, so if you've customized your installation, you can still install.

All in all, three files were changed. Everything's checked in, so you should be able to re-sync from trunk any time you like.

Sorry for the difficulties.

[Cynebeald]

No problem, thanks for the fast update! I'll probably be be forced to reinstall serendipity anyway, because my host changed the server config a little bit, and I found out that Serendipity detects a whole lot of stuff when it's installed (like, if it's allowed to use php_value).