<XgF>
ocdtrekkie: once the spks are unpacked you could do deduplication between them
<nwf>
Is it known / expected that sharelatex under Sandstorm barfs ("desynchronizes" and "full refresh") if I have it in vim mode and use "p" but that "P" works fine?
<asheesh>
Nope.
chuan has quit [Remote host closed the connection]
<nwf>
Where should I file the bug?
<asheesh>
Google [sandstorm sharelatex github]... no useful links.
<asheesh>
Argh, I neglected to "Fix bug with guided tour".
<asheesh>
I guess I should do that today.
<simonv3>
spent some time today teaching myself Blaze and looking for a decent meteor package for a syntax highlighter and ended up with this: https://github.com/simonv3/sandbin, still needs to be packaged though
rustyrazorblade has joined #sandstorm
<asheesh>
Oh btw simonv3 there was a design talk at last night's SF meetup that I think you would like.
twodimes-shout has quit [Remote host closed the connection]
jadewang has joined #sandstorm
<kentonv>
.... hoo boy.
<maurer>
I would suggest not engaging at all with him.
<maurer>
Either positively or negatively.
<kentonv>
of course
<mrdomino>
probably sane. his public image is pretty awful regardless of what else i can say about the guy.
<kentonv>
I've met him in professional contexts. AFAICT he tries his best to keep his professional identity and behavior entirely separate from his insane political alter ego.
<mrdomino>
i worked with him for 6 months, hung out at his house a few times. he doesn't seem to be an unreasonable person, at least by my read. i can't make heads or tails of the stuff he's written -- i'd venture guesses like that it needs insane amounts of context and doesn't compress well, or that he found it useful to be provocative, or something, but really i just don't get it.
BigShip has quit [Ping timeout: 250 seconds]
<mrdomino>
i also can't discount the "he's totally insane" hypothesis. but i don't have enough confidence in it to hold it as primary.
<mrdomino>
anyway. hella OT. my bad.
* asheesh
waves, good afternoon.
* mrdomino
waves
<kentonv>
I wouldn't call him insane as a person, but I think his political ideas are very wrong (not just because they're unpopular, I have specific criticisms). But yeah, not really a topic for this channel.
<mrdomino>
i got openproject to the point of booting but now i'm procrastinating on trying to write an omniauth sandstorm strategy
jemc has quit [Ping timeout: 276 seconds]
<mrdomino>
any ideas on pros/cons of doing that as opposed to ripping out omniauth and replacing it with something simpler?
<mrdomino>
it seems like openproject sorta went all in on it, so ripping it out might be kind of painful, but i also haven't studied their model of permissions or accounts all that well yet
<zarvox>
strictly speaking, you can't "log in" in the traditional sense, so you might only need to write the Rack middleware to pull stuff from the X-Sandstorm-* headers
raoulzecat has quit [Read error: Connection reset by peer]
tierce has joined #sandstorm
<maurer>
kentonv: btw, when you suggested memcmp, would using kj::ArrayPtr via getDataSectionAsBlob and checking the bytes fall under the ub problem as well, or does that work OK?
<asheesh>
So you asked for pros & cons.
<asheesh>
My hunch is that removing and ripping it out is going to feel very fun but be unmaintainable.
<asheesh>
You'll have to touch lots of parts of the code.
<asheesh>
Doing it in the omniauth way is going to be less fun, probably. As zarvox remarks it'll be reasonably simple, all things considered.
<asheesh>
One big question mark is permissions, rather than just authentication (username/user ID).
<iangreenleaf>
omniauth-sandstorm would be an awesome plugin to have in general, that would come in handy for tons of Rails projects
<asheesh>
https://github.com/phildini/django-sandstorm is a phildini-brand package that does things totally reasonably well and is pretty similar to whatever you'd end up writing in Ruby.
<kentonv>
maurer: I think that works, since blobs are char arrays (unsigned or otherwise)
<maurer>
OK
<maurer>
(I figured using that might be a good way to avoid accidental success when memcmping past the end of the array)
<asheesh>
It's nice that it supports a bunch of things that Sandstorm does, too.
<kentonv>
maurer: because of the debug-mode bounds checking? As long as the tests are good. :)
<asheesh>
If I were you, I'd make a separate Sandstorm app called omniauthdemo and have that depend on your omniauth-sandstorm thing, though, fwiw.
<maurer>
kentonv: Yeah, I mean, I'm going to add a test for the short structs, but I could see it accidentally succeeding if I don't have the debug bounds checks if I made an error
TwoJames2 has joined #sandstorm
<kentonv>
maurer: yep, makes lots of sense to me
<asheesh>
mrdomino: If you were dealing with a system with more inconsistency between it and Sandstorm, it might make more sense to make the app not depend on omniauth, but that's my take for now.
<mrdomino>
good idea. write omniauth-sandstorm, use omniauth-demo to get it working, then port openproject to omniauth-sandstorm.
<zarvox>
I am +1 on having omniauth-sandstorm for omniauth, akin to accounts-sandstorm for meteor
<mrdomino>
unfortunately i have basically exhausted my one week of lots-of-free-time, so i can't promise anything on when that happens
<mrdomino>
depending on how settling in goes next week at CML, i'll either be able to keep working on it or let y'all know that it's up in the air
rustyrazorblade has quit [Quit: rustyrazorblade]
TwoJames has quit [Ping timeout: 264 seconds]
<asheesh>
Cool, mrdomino!
<asheesh>
I read your CML announcement; I'm excited and relaxed[1;5Dforward-lookingly- for you!
<asheesh>
I'm excited and forward-lookingly-relaxed for you.
<asheesh>
I also wonder if someone else here is possibly a Ruby fan and interested in writing an omniauth-sandstorm.
tierce has quit [Ping timeout: 276 seconds]
<asheesh>
simonv3: I like your sandbin. I wish there were a way to create grains from one's own command line.
<asheesh>
Then I could have a pastebin script that made a new grain every time, owned by me.
<zarvox>
That would be cool. I think Sandstorm would need to grow the ability to allow apps to programatically spawn new grains of other apps.
tierce has joined #sandstorm
<zarvox>
Which I'm sure is somewhere on the roadmap, but probably not super close
<maurer>
Oh yeah, random idea that's been bouncing around in my head that I surely won't have time to get to - using gotty + devtools to create a sandstorm app for doing development on a particular software project
<maurer>
It'd allow you to prepopulate their dev environment, give logical branches even in situations where your vcs doesn't have them, and allow you to share your precise environment when something isn't working with another dev without having to let them into your whole computer
<zarvox>
oh asheesh did you/geofft ever build anything like that LD_PRELOAD you discussed to patch out all the pty/tty/ptmx interactions into a userspace library?
<zarvox>
I suspect you'd need that to support running gotty inside Sandstorm, since you don't get /dev in the sandbox
<asheesh>
gotty runs locally, and then exposes data to the world, right?
<asheesh>
So I think that if you made the HTTP side of this be a Sandstorm grain, it wouldn't need the pty/tty/ptmx interactions ldpreload'd out.
<asheesh>
Oh, but if you wanted to actually do the development in the sandbox, then yes.
DanC has joined #sandstorm
<maurer>
The end goal of such a thing would be ot make it much faster for a user to get a working dev environment, make a few changes, test, and then submit a PR
<maurer>
(I'm sure you've all experienced the long dance when you try to help a new project)
<asheesh>
Yeah, for sure.
<asheesh>
Having said that, I would totally use gotty as a read-only screen sharing tool within Sandstorm, too!
<zarvox>
DanC: IIRC, it's fixed in Rocket.Chat git master, but not in any published Rocket.Chat package on Sandstorm.
<kentonv>
DanC: I mean it looks like they submitted a fix, as indicated by the log above. I don't think they've submitted a new spk to the app market including that fix.
<DanC>
ah.
<DanC>
I guess I could open a "submit new spk" issue
<DanC>
kentonv beat me to it :)
<DanC>
well, sort of
* DanC
hunts for the thing that shows who signed the rocketchat spk
<DanC>
oh... I've been playing with nix a bit lately. Anybody building spk's with nix these days?
<DanC>
how do I go from a grain in my list of grains to the app?
<zarvox>
There's no direct link today. You can find the app under Apps though.
<zarvox>
I think maurer is the person to talk to about spk on nix?
<DanC>
ah... I think I have chatted with him in #nixos
<DanC>
good to know
<zarvox>
:)
<DanC>
where I see "The app publisher has proven using PGP that they control these accounts." is that using keybase.io stuff?
<maurer>
DanC: yo
<DanC>
maurer, have you built a spk with nix? got any breadcrumbs to follow?
<maurer>
DanC: My solution is not super complete yet, but I can point you at a .nix file I've made that will build the spk binary on nix
<maurer>
DanC: And I've manually invoked that spk binary on a nix closure before, though nothing automated yet
<maurer>
DanC: And from everything I can tell, it's just a matter of doing it to make a thing that turns a nix closure into an spk
<simonv3>
asheesh: someone suggested in the thread where I brought it up that it would be cool for it to have an API, which I think is similar to what you have in mind?
<DanC>
I guess I hadn't imagined building the spk with nix... just building an app with nix and then using spk tools to package it. but that sounds cool.
<maurer>
DanC: However, I'm already terribly overcommitted, so don't expect me to write it super soon :P
<zarvox>
maurer: DanC: I think you should be able to accomplish your goals with a particularly-shaped sandstorm-pkgdef.capnp
<maurer>
zarvox: Yeah, basically what the script would consist of would be something that enumerates a nix-closure, then pushes all those paths into sandstorm-pkgdef.capnp
<zarvox>
namely, you'd specify a single SourceMap which maps (your closure folder) to /, and then alwaysinclude /
<maurer>
zarvox: I just haven't written it yet
<DanC>
oh? I don't see how a .capnp is relevant.
<maurer>
DanC: There are two ways to use the spk binary to create a package
<maurer>
DanC: One, which is a little handwavy, is spk dev
<DanC>
an maurer, I have no expectations that you'll grant any more of my wishes. I'm just happy to see whatever bits you have come up with for your own purposes.
<maurer>
DanC: in this version, you run your app under the supervision of spk, and run it through its paces with your testsuite
<maurer>
DanC: spk then finds all the resources you accessed, and produces a sandstorm-pkgdef.capnp
<maurer>
this is mostly useful for non-nix-style systems where the exact closure of your package is unclear
<DanC>
.capnp syntax is used to define packages? ok, my head hurts.
<DanC>
wait... pkgs/sandstorm/default.nix builds sandstorm itself, yes? That's not my goal; my goal is to build a .spk that contains a nix closure
BigShip has joined #sandstorm
<zarvox>
think of sandstorm-pkgdef.capnp as the place that you put all the packaging metadata, like "who made this package?" and "what should it run when you create a new grain" and "what files does this package contain?"
<maurer>
DanC: It builds sandstorm itself so you can get the spk binary
<maurer>
DanC: spk is a program which is used to create foo.spk files
<DanC>
I'm lost. how is the spk binary relevant? ah.
<zarvox>
spk takes as input a sandstorm-pkgdef.capnp and then generates the foo.spk file based on what the pkgdef declares
<maurer>
DanC: So basically, what you'd end up doing in a more automated version would be that if you had a nix package foo, you'd :
<zarvox>
the sandstorm-pkgdef.capnp expresses, through the sourceMap, fileList, and alwaysInclude fields, what files should be included in the output .spk
<maurer>
1.) Enumerate the closure, finding all the relevant trees
<maurer>
2.) Put each tree into alwaysInclude
<maurer>
3.) Run spk, handing it the manifest
<maurer>
and it should produce a containerized version of the thing for running on sandstorm
<maurer>
I've only done this manually, not automatically
<maurer>
DanC: Just ignore the part about using spk dev to find your deps by testing, and replace it with that nix-store -q --requisites output
<DanC>
thanks. This is consistent with my vague sense of things. I'm not doing it right now, but here's hoping you're around to hold my hand when I do :)
<DanC>
can I copy this chat to... ah. yes. public logs.
<maurer>
DanC: Yeah, can't gaurantee I'll respond immediately, but I do generally respond to pings to my name in here or in #nixos
<maurer>
Getting this all working cleanly is on my eventual todo list, but that list is a lot longer than you might hope it is :P
<gkoz>
which published apps use the powerbox request/offer protocol?
<DanC>
it's available?
<asheesh>
Secretly it's available.
<asheesh>
Obviously not so secret since I'm saying as much on IRC.
<asheesh>
There are only test apps for now; no apps in the app market do.
<gkoz>
oh, I didn't realize it's not in master
<asheesh>
It is in master! It's just that we don't talk about it much because it's still semi-in-flux and we have zero docs for it.
<asheesh>
It's honestly not much in flux. kentonv is planning on making the first successful powerbox app soon, over the coming week, I believe, and he's been fixing things in master so that it works for him.
<gkoz>
interesting, thanks
<asheesh>
You're welcome. I realize that's a bit muddled of an answer.
<asheesh>
It all probably actually works properly at the moment. Consider pinging zarvox for his test app.
mnutt has quit [Quit: My Mac has gone to sleep. ZZZzzz…]
BigShip has quit [Remote host closed the connection]
twodimes-shout has joined #sandstorm
twodimes-shout has quit [Remote host closed the connection]
twodimes-shout has joined #sandstorm
<nwf>
asheesh: Am I correct in understanding that Sandstorm apps can get URLs for particular resources within them and that these URLs do not necessarily grant access to the entire grain?
twodimes-shout has quit [Quit: Bye!]
<nwf>
(Practically, my use of Sandstorm has not given me opportunity beyond grains which are single-resource, ala etherpad or sharelatex)
<maurer>
nwf: While I don't know whether such an ability exists, I do know:
mnutt has joined #sandstorm
<asheesh>
"these URLs do not necessarily grant access to the entire grain" <-- the grain only ever knows the various ephemeral base URLs (temp subdomains) for it.
<maurer>
1.) There is a reason that has been your experience - people are pushed during packaging to structure their app as one grain = one resource when possible
<asheesh>
And it knows its own URL structure
<maurer>
2.) Individual grains can have per-user permissioning, though atm this is usually just read vs write
<nwf>
asheesh: So if you spin up a grain with URL endpoints /a and /b, it can ask Sandstorm for a URL for /a that you can share with me, but once I have that cap, I can just ask the application for /b, too?
<asheesh>
nwf: Yeah, totally true - if you have legit access to a grain, nothing in Sandstorm stops you from accessing particular sub-paths of that grain.
<nwf>
grain.capnp's AppPersistent's save() made it sound like there was a more interesting thing going on.
<nwf>
Though this may be because I don't quite know how all the pieces fit together. :)
<nwf>
None of the X-Sandstorm-foo headers indicate that I've nominally been given access to only a particular URL?
<maurer>
Man, I'm just derping all over the place with using github's PR system, sorry about that kentonv
<kentonv>
maurer: haha, it's pretty bad yeah
<asheesh>
nwf: Now I have to look up AppPersistent.
<nwf>
Is it correct to say, then, that Sandstorm's only idea of permissions to a grain are to all of that grain and that it would be somewhat tricky for an application to leverage sandstorm sharing for different facets (sets of endpoints) within itself?
* nwf
probably needs to redo some of the prose in this paper, armed with better understanding
<maurer>
kentonv: Basically what happened there was I realized that if what I was worried about was possible, the old code was wrong too, so then I looked at how to encode a non-word-sized composite list, and when I realized I couldn't, came back and deleted my comment, then when I reloaded the page later, saw your response
<kentonv>
maurer: So, posting a comment sends an email. I tried to click through from the email to the comment and got a sort of "not found" error, but it was the same error I see when clicking through to a commit that has been force-pushed out of existence, so I thought it was something to do with that. But then I found your comment in the PR log, somehow not deleted, and replied there.
jadewang has quit [Remote host closed the connection]
<maurer>
Yeah, I'm just going to try going with the "never delete, never edit" strategy for github prs, and then when we're done, I can clean it up as needed
<digitalcircuit>
maurer: also, don't force-push to a closed pull-request; Github won't let you open it again. Learned that from doing it myself :/
<gkoz>
zarvox: what about the inter-grain communication angle? are there any outlines for how grains might cooperate?
<maurer>
digitalcircuit: Yeah, I picked up the habit from working with certain other code review platforms of packaging a PR into exactly one diff
<maurer>
digitalcircuit: which is why I initially reflexively force pushed
Treora has quit [Quit: Konversation terminated!]
<digitalcircuit>
You ran into the same issue? I vaguely guessed; well, now we both know :)
<maurer>
kentonv: Turns out the DASSERT actually fails on setListToEmpty
<maurer>
I'm _guessing_ that's because the value is garbage there due to the list being length 0
<maurer>
and thus having no tag
<kentonv>
maurer: I guess it should be properly-initialized to zero somewhere?
<maurer>
Yeah, I'll go look and see if I can find it