RFS: roundcube

[Vincent Bernat]

Dear mentors,

I am looking for a sponsor for my package "roundcube".

* Package name : roundcube
Version : 0.099+0.1b2.2-1
Upstream Author : Thomas Bruederli <***@gmail.com>
* URL : http://www.roundcube.net
* License : GPL
Section : web

It builds these binary packages:
roundcube - modern, skinable, AJAX based webmail solution for IMAP servers

The package is lintian clean.

The upload would fix these bugs: 333756, 344949

The package can be found on mentors.debian.net:
- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.099+0.1b2.2-1.dsc

I would be glad if someone uploaded this package for me.

This is still a beta quality software but I use it happily every
day. The package uses dbconfig-common to configure database. It
supports sqlite, MySQL and PostgreSQL backend. To avoid to pull too
much packages, it does not depend on any of those backends. Any
comment on this is welcome. I have put a note in README.Debian.

The other question is that roundcube requires a temp directory. I have
modified the config file to create /var/tmp/roundcube. I don't know
what should be the best way. If the directory already exists, it can
be a security risk (the user owning the directory could delete files
or put symlinks in it). Maybe should I put this temporary directory in
/var/lib/roundcube instead ?

Kind regards
Vincent Bernat

[Margarita Manterola]

Hi!

We use roundcube as our webmail in my office, so we'll be reviewing
it, and I might end up sponsoring it, I haven't yet looked at it, but

Post by Vincent Bernat
Version : 0.099+0.1b2.2-1

The version is the 0.1-beta2.2 I suggest that you use: 0.1~beta2.2,
this is exactly the kind of version that the ~ character was invented
for.

Post by Vincent Bernat
This is still a beta quality software but I use it happily every

The fact that it is a "beta" release doesn't mean that the quality is
much worse than a lot of non "beta" released software. It lacks
features, and it has some bugs, but it's pretty much a nice piece of
software. Even though it's not ready for a "stable" Debian release, I
think it's pretty much ready to be uploaded to "unstable" (taking into
account that it won't go into testing until Etch is released, and
after that it will be a long time until Lenny is released, which gives
roundcube time enough to stabilize itself)

Post by Vincent Bernat
day. The package uses dbconfig-common to configure database. It
supports sqlite, MySQL and PostgreSQL backend. To avoid to pull too
much packages, it does not depend on any of those backends. Any
comment on this is welcome. I have put a note in README.Debian.

As I said, I haven't looked at the packaging yet, but I think you
should "Recommend" them (separating them with | ). As far as I know,
roundcube is allowed to connect to a remote database, and thus you
wouldn't need the database to be installed in the same server.

[Vincent Bernat]

OoO En cette nuit nuageuse du dimanche 11 février 2007, vers 01:53,

Post by Margarita Manterola
The version is the 0.1-beta2.2 I suggest that you use: 0.1~beta2.2,
this is exactly the kind of version that the ~ character was invented
for.

OK, I have started over and I use 0.1~beta2.2 version number instead.

Post by Margarita Manterola

Post by Vincent Bernat
day. The package uses dbconfig-common to configure database. It
supports sqlite, MySQL and PostgreSQL backend. To avoid to pull too
much packages, it does not depend on any of those backends. Any
comment on this is welcome. I have put a note in README.Debian.

As I said, I haven't looked at the packaging yet, but I think you
should "Recommend" them (separating them with | ). As far as I know,
roundcube is allowed to connect to a remote database, and thus you
wouldn't need the database to be installed in the same server.

In fact, my note was not consistant with what was really done. I have
added mysql-server in Suggests and php5-mysql is in Depends :

Depends: dbconfig-common, apache2 | httpd, libapache2-mod-php5 | libapache-mod-php5 | php5 | php5-cgi | libapache2-mod-php4 | libapache-mod-php4 | php4-cgi | php4, php5-mysql | php5-mysqli | php4-mysql | php5-pgsql | php4-pgsql | php5-sqlite | php4-sqlite, ucf
Suggests: mysql-server | posgresql-server | sqlite

[sean finney]

hi vincent,

Post by Vincent Bernat
In fact, my note was not consistant with what was really done. I have
Depends: dbconfig-common, apache2 | httpd, libapache2-mod-php5 | libapache-mod-php5 | php5 | php5-cgi | libapache2-mod-php4 | libapache-mod-php4 | php4-cgi | php4, php5-mysql | php5-mysqli | php4-mysql | php5-pgsql | php4-pgsql | php5-sqlite | php4-sqlite, ucf
Suggests: mysql-server | posgresql-server | sqlite

if you use dbconfig-common, you should also have an or'd Depends between
the database client packages that it supports. i guess that'd be:

mysql-client | virtual-mysql-client | postgresql-client-8.1 |
postgresql-client


future versions of dbconfig-common will have a bit more intelligence
about providing the admin with a way to stop and install one of the
above packages before continuing, but currently packages should
do what's above to make sure at least one supported client program
is available.

as for the tmp dir issue, if you don't feel safe using /var/tmp, you
should use /var/cache/package/some-subdirectory-name instead, along with
a cronjob to clear out the old files. i'd recommend using a
subdirectory so you have the freedom to use the parent directory for
more later in case the need ever arises.


sean

[Vincent Bernat]

OoO En ce début de soirée du dimanche 11 février 2007, vers 21:47,

Post by sean finney

Post by Vincent Bernat
Depends: dbconfig-common, apache2 | httpd, libapache2-mod-php5 | libapache-mod-php5 | php5 | php5-cgi | libapache2-mod-php4 | libapache-mod-php4 | php4-cgi | php4, php5-mysql | php5-mysqli | php4-mysql | php5-pgsql | php4-pgsql | php5-sqlite | php4-sqlite, ucf
Suggests: mysql-server | posgresql-server | sqlite

if you use dbconfig-common, you should also have an or'd Depends between
mysql-client | virtual-mysql-client | postgresql-client-8.1 |
postgresql-client

OK, I add sqlite to the list too.

Post by sean finney
as for the tmp dir issue, if you don't feel safe using /var/tmp, you
should use /var/cache/package/some-subdirectory-name instead, along with
a cronjob to clear out the old files. i'd recommend using a
subdirectory so you have the freedom to use the parent directory for
more later in case the need ever arises.

OK. Any tip for the cronjob ? 15 days old files ? Something like :
find /var/cache/roundcube/temp -type f -mtime +15 -print0 | xargs -0 rm

[sean finney]

Post by Vincent Bernat

Post by sean finney
as for the tmp dir issue, if you don't feel safe using /var/tmp, you
should use /var/cache/package/some-subdirectory-name instead, along with
a cronjob to clear out the old files. i'd recommend using a
subdirectory so you have the freedom to use the parent directory for
more later in case the need ever arises.

find /var/cache/roundcube/temp -type f -mtime +15 -print0 | xargs -0 rm

it really depends on the application and what the data in question is.
if it's data that will only be used once ever, perhaps it's overkill to
be using /var/cache at all and /var/tmp would be better. if it's data
that might be used a few times and regenerated if needed,
then /var/cache is definitely the right place for it.

in any case, if you use something outside of /var/tmp, i'd suggest
making the mtime parameter configurable:

MAX_TMPFILE_LIFETIME=15
# MAX_TMPFILE_LIFETIME can be overridden in this file
if [ -r /etc/default/roundcube ]; then
. /etc/default/roundcube
fi
find /var/cache/roundcube/temp -type f -mtime +$MAX_TMPFILE_LIFETIME ...


sean

[Vincent Bernat]

OoO En cette matinée pluvieuse du lundi 12 février 2007, vers 10:11,

Post by sean finney
MAX_TMPFILE_LIFETIME=15
# MAX_TMPFILE_LIFETIME can be overridden in this file
if [ -r /etc/default/roundcube ]; then
. /etc/default/roundcube
fi
find /var/cache/roundcube/temp -type f -mtime +$MAX_TMPFILE_LIFETIME ...

OK, I have included your snippet of code. I don't provide
/etc/default/roundcube since it would be a commented file only and the
cron job seems already documented.

- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.1~beta2.2-4.dsc

RoundCube can be localized. However, the localization files are in
separate tarballs. Should I package them as separate packages or
should I include the translation into the main package ?

I think the second option is better, but how can I package a single
binary package from several upstream tarballs ? Should I include the
translations in the orig.tar.gz ?

[Richard Laager]

OoO En cette matinée pluvieuse du lundi 12 février 2007, vers 10:11,

Post by sean finney
MAX_TMPFILE_LIFETIME=15

Do these files really need to stick around for 15 days?

OK, I have included your snippet of code. I don't provide
/etc/default/roundcube since it would be a commented file only and the
cron job seems already documented.

/etc/default/roundcube seems like a standardized place for this sort of
thing. It seems like you should include that file so people will know
they can customize MAX_TMPFILE_LIFETIME.

RoundCube can be localized. However, the localization files are in
separate tarballs. Should I package them as separate packages or
should I include the translation into the main package ?

Are those tarballs released separately from Roundcube?

Richard

[Vincent Bernat]

Post by Richard Laager

Post by Vincent Bernat
OoO En cette matinée pluvieuse du lundi 12 février 2007, vers 10:11,

Post by sean finney
MAX_TMPFILE_LIFETIME=15

Do these files really need to stick around for 15 days?

I don't think. But it is a safe value.

Post by Richard Laager

Post by Vincent Bernat
OK, I have included your snippet of code. I don't provide
/etc/default/roundcube since it would be a commented file only and the
cron job seems already documented.

/etc/default/roundcube seems like a standardized place for this sort of
thing. It seems like you should include that file so people will know
they can customize MAX_TMPFILE_LIFETIME.

OK.

Post by Richard Laager

Post by Vincent Bernat
RoundCube can be localized. However, the localization files are in
separate tarballs. Should I package them as separate packages or
should I include the translation into the main package ?

Are those tarballs released separately from Roundcube?

Yes.

[Gunnar Wolf]

Post by Vincent Bernat

Post by Richard Laager

Post by sean finney
MAX_TMPFILE_LIFETIME=15

Do these files really need to stick around for 15 days?

I don't think. But it is a safe value.

Maybe you should depend on (or recommend at least) tmpreaper for this?
It's a neat tool, specialized for the task, and with no ad-hoc and
hard to find configurations.

Greetings,

[Thijs Kinkhorst]

Post by Gunnar Wolf

Post by Vincent Bernat

Post by Richard Laager

Post by sean finney
MAX_TMPFILE_LIFETIME=15

Do these files really need to stick around for 15 days?

I don't think. But it is a safe value.

Maybe you should depend on (or recommend at least) tmpreaper for this?
It's a neat tool, specialized for the task, and with no ad-hoc and
hard to find configurations.

Agreed. With SquirrelMail we do not include a cron job, but refer the
user to install a package like tmpreaper. No need to be duplicating code
all over the place.


Thijs

[sean finney]

Post by Thijs Kinkhorst
Agreed. With SquirrelMail we do not include a cron job, but refer the
user to install a package like tmpreaper. No need to be duplicating code
all over the place.

but for clarity: are these tmpfiles left in /tmp or /var/tmp, or are
they in /var/cache somewhere?

there are two seperate issues here really: (1) where does the data
belong and (2) how should it be managed/deleted?

i don't know enough about the software to have an opinion on either one,
fwiw.

sean

[Thijs Kinkhorst]

Post by sean finney
but for clarity: are these tmpfiles left in /tmp or /var/tmp, or are
they in /var/cache somewhere?
there are two seperate issues here really: (1) where does the data
belong and (2) how should it be managed/deleted?

The answer to (1) is that it's in /var/cache/squirrelmail/
and to (2) is to use the same tool that manages /tmp since desired
behaviour is the same, so no need to reinvent the wheel. Keep the code
in one place.


Thijs

[Vincent Bernat]

OoO En cette nuit nuageuse du dimanche 11 février 2007, vers 01:18,

Your diff includes po/templates.pot which is autogenerated, right? You
should see if you can avoid creating that file, or you should delete it
to avoid having it show up in the diff.

I have followed the steps in po-debconf(7). It is not clear for me
that I should or not put the call to po-debconf in debian/rules.

Your dependencies list PHP 4 first. I think you should list PHP 5 first,
since it's newer. Also, you list sqlite as the first backend, when I'd
Depends: ..., libapache2-mod-php5 | ..., php5-mysql | ..., ...

I have changed this.

I'm not sure how I feel about configuring and restarting a web server by
default. How do other packages handle this?

I have stolen this piece of code from zabbix package. I suppose that
in the future, webapps-common will handle this. phpmyadmin does the
same.

There's a log folder configured... Do you need to configure log rotation
then?

You are right. I will do this today.

Post by Vincent Bernat
The other question is that roundcube requires a temp directory. I have
modified the config file to create /var/tmp/roundcube. I don't know
what should be the best way. If the directory already exists, it can
be a security risk (the user owning the directory could delete files
or put symlinks in it). Maybe should I put this temporary directory in
/var/lib/roundcube instead ?

/var/tmp is for temporary files that need to survive a reboot, right? Is
that the case here? I'm not sure what to suggest about a temp file
location.

roundcube stores sessions and attachments at least into this
directory. I don't think it should survive a reboot.

[Vincent Bernat]

OoO La nuit ayant déjà recouvert d'encre ce jour du samedi 10 février

Post by Vincent Bernat
- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget
http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.099+0.1b2.2-1.dsc

New version is here :
The package can be found on mentors.debian.net:
- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.1~beta2.2-2.dsc

It now setups a logrotate item for logs.

[Vincent Bernat]

OoO La nuit ayant déjà recouvert d'encre ce jour du samedi 10 février

Post by Vincent Bernat
* Package name : roundcube
Version : 0.099+0.1b2.2-1
* URL : http://www.roundcube.net
* License : GPL
Section : web

Another new version is available with language selection via
debconf.

- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.1~beta2.2-7.dsc

Therefore, I have two questions. Here is my snippet of code :

db_metaget roundcube/language languages && oldchoices="$RET"
if [ ! "$oldchoices" -o "$instd_langs" != "$oldchoices" ]; then
db_subst roundcube/language languages $instd_langs
db_fset roundcube/language seen false
db_set roundcube/language en
fi

I use db_set because the default from template is not respected (I
think this is because of db_subst). However, when the user install
additional language from roundcube-l10n-extra, the choice is reset to
en. I would like to keep its choice if possible. Removing db_set leads
the default choice to be de_CH or am.

And the other question : what is the cleanest way to re-ask this
question if roundcube-l10n-extra is installed ? Duplicating the
snippet of code and the template ? dpkg-reconfigure in postinst ?

[sean finney]

hi vincent,

Post by Vincent Bernat
db_metaget roundcube/language languages && oldchoices="$RET"
if [ ! "$oldchoices" -o "$instd_langs" != "$oldchoices" ]; then
db_subst roundcube/language languages $instd_langs
db_fset roundcube/language seen false
db_set roundcube/language en
fi

imho, instead of explicitly setting it to en, you should try to
determine what the current language is (and fail back to en if you
can't). this is somewhat related to the "debconf is not a registry"
dogma, where a debconf answer should usually be reflected by a
filesystem-based configuration option, which is then used to
preseed the debconf value before the config is run.

Post by Vincent Bernat
And the other question : what is the cleanest way to re-ask this
question if roundcube-l10n-extra is installed ? Duplicating the
snippet of code and the template ? dpkg-reconfigure in postinst ?

i'd say the code is probably small enough that if you're only doing this
for one package (assuming there aren't more roundcube-l10n-foo packages)
that it doesn't make sense to do anything super complicated and a simple
cut and paste ought to do.


sean

[Vincent Bernat]

OoO En cette matinée ensoleillée du samedi 17 février 2007, vers

Post by sean finney
imho, instead of explicitly setting it to en, you should try to
determine what the current language is (and fail back to en if you
can't). this is somewhat related to the "debconf is not a registry"
dogma, where a debconf answer should usually be reflected by a
filesystem-based configuration option, which is then used to
preseed the debconf value before the config is run.

OK, I have done this.

Post by sean finney

Post by Vincent Bernat
And the other question : what is the cleanest way to re-ask this
question if roundcube-l10n-extra is installed ? Duplicating the
snippet of code and the template ? dpkg-reconfigure in postinst ?

i'd say the code is probably small enough that if you're only doing this
for one package (assuming there aren't more roundcube-l10n-foo packages)
that it doesn't make sense to do anything super complicated and a simple
cut and paste ought to do.

I have done this too.

New version:
- URL: http://mentors.debian.net/debian/pool/main/r/roundcube
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube/roundcube_0.1~beta2.2-8.dsc

And:
- URL: http://mentors.debian.net/debian/pool/main/r/roundcube-l10n-extra
- Source repository: deb-src http://mentors.debian.net/debian unstable main contrib non-free
- dget http://mentors.debian.net/debian/pool/main/r/roundcube-l10n-extra/roundcube-l10n-extra_0.1~beta2.2-2.dsc

I think the package is now in pretty good shape. Anyone willing to
upload it ?