November 2003 - Zope-Announce

ANNOUNCE: Pound - reverse proxy and load balancer - v1.6
by Robert Segall 30 Nov '03

30 Nov '03

This is to announce the release of Pound v1.6. Changes in this version: - Callback for RSA ephemeral keys: - generated in a separate thread - used if required this will allow certain versions of IE to work correctly with Pound/SSL. - New X-SSL-cipher header encryption level/method - Added CheckURL parameter in config file - perform syntax check only if value 1 (default 0) - Allow for empty query/param strings in URL syntax - Additional SSL engine loading code - Added parameter for CA certificates - CA list is sent to client - Verify client certificates up to given depth - Fixed critical security vulnerability in syslog handling: this may allow a remote exploit, though none has been observed to date. The danger is minimised if you run Pound in a root-jail and/or as non-root user. Anyone using a version prior to 1.6 should upgrade as soon as possible. The software is at version 1.6 (production quality). Further testing (especially under heavy loads), improvements and suggestions are welcome. What is Pound (from the Web page) - a reverse-proxy: it passes requests from client browsers to one or more back-end servers. - a load balancer: it will distribute the requests from the client browsers among several back-end servers, while keeping session information. - an SSL wrapper: Pound will decrypt HTTPS requests from client browsers and pass them as plain HTTP to the back-end browsers. - an HTTP/HTTPS sanitizer: Pound will verify requests for correctness and accept only well-formed ones. - an HTTP/1.1 to 1.0 proxy. - a fail-over-server: should a back-end server fail, Pound will take note of the fact and stop passing requests to it until it recovers. - a request redirector - it will pass client requests to separate groups of servers, based on required URL and the presence or absence of headers (pattern matching) Pound was specifically developed to serve as a front-end for multiple instances of Zope running on top of a common ZEO storage, but can be used with any other web server. A patch for the Python source of z2.py is available as part of the distribution to allow using Pound's SSL capabilities. Pound is currently in use in several medium to large volume sites and seems to be holding up quite well: largest reported site does about 5.5 million requests per day, peaking at over 450 requests per second. The speed is well superior to other, equivalent solutions, the configuration is much simpler and the necessary resources (CPU, RAM, disk) are much, much lower. Pound is distributed under the GPL. For further information, download, etc. please see http://www.apsis.ch/pound Pound now has its own mailing-list - just send a message to pound-subscribe(a)apsis.ch in order to join. Enjoy and let me know how it works for you. -- Robert Segall Apsis GmbH Postfach, Uetikon am See, CH-8707 Tel: +41-1-920 4904

1 0

Zope X3 Milestone Release 4 is available for download
by Stephan Richter 26 Nov '03

26 Nov '03

Hello everyone in the Zope community and beyond, We are pleased to announce that Zope X3 MS4 is out of the door. Much work has been done since the last release in June, 2003, including major fundamental refactorings of the Component Architecture, I18n/L10n, filesystem syncing, and new TTW capabilities. Get it now! You can find a source and Windows binary archive at the URL below. URL: http://dev.zope.org/Zope3/Milestone4 Here the release notes: Zope X3 Milestone Release 4 is available for download What is Zope X3? It's Zope 3 "experimental". This is the release that will provide the new features of Zope 3 without any Zope 2 support. Zope 3.0 will provide support for Zope 2 content and products, probably using conversion utilities of some sort. Backward compatibility notes - If you have any add-on prodycts that used the old context-wrapper or "context awareness" APIs, you will need to update these use the new, and much simpler, location API. See zope/app/interfaces/location.py. - If you have add-on products that register views or resources using the view or resource directives from the zope ZCML namespace, you will need to change the value of the 'type' attribute to refer to a request type, rather than a presentation type. - If you have an add-on product that defines new layers, you need to use the zope:layer or browser:layer directive to define the layer before you use it in a skin definition or a view or resource definition: <browser:layer name="rotterdam" /> - If you had a local (through the web) adapter service, you will need to recreate it and reactivate your adapter registrations. - If you had a local (through the web) view service, you will need to create a local presentation service and reactivate your page or view registrations. Features - Changed the way presentation components are managed. o The view, resource, and skin services have been combined into a new presentation service. o Views and resources now adapt requests. They are registered for request types rather than presentation types. - Refactored the way interfaces, declarations and adapters are implemented. We now use a cleaner architecture that no-longer requires a caching mechanism beyond what's provided by the underlying data structures. This has led to a significant speed up for Zope 3. - Refactored the way location-related events are generated and handled. For more details, see: http://dev.zope.org/Zope3/LocationRelatedEvents http://dev.zope.org/Zope3/SimplifyObjectLifecycleAndLocationEvents - Refactored the way object location is modeled. Zope 3 no longer uses context wrappers. Instead, objects have __parent__ attributes that reference their containers. Objects that don't maintain these attributes themselves are warpped in persistent proxy objects that do so. For more details, see: http://dev.zope.org/Zope3/ParentGeddon - Added catalogs. Catalogs can be used in two-ways: o Site-wide utilities A catalog is created in a site-management folder and registered as a named utility. o Local content objects. A catalog is added to a regular content folder. - Added object fields. Object fields provide a simple composite field mechanism. An object field is defined by a schema and, thus, can contain sub-fields. - Added working widgets for list fields. List fields contain a sequence of monogenous values. - Improved forms error reporting. Error messages now appear next to fields where errors occured. - Major fixes to the TAL I18n-Namespace support. Almost all fixes were backported to Zope 2.7 as well. - Templated Pages support for a <disabled script> tag, that allows inline Python code. The <disabled script> tag can be used in other TAL sources as well, but is turned off by default. - Internationalized all Zope 3 (Python, ZCML and Page Templates) user-readable strings. Zope 3 was then localized to German and partially to Spanish, Brazilian Portuguese and French. - Implemented explicit message ids in ZCML - New Persistent/Mutable Schemas allow us to generate Schema-based interfaces through the Web. - New local Menu Service and Content Component Definitions allow you to create simple Content objects TTW. - Major fssync improvements. The commands to use now are "zsync" and "zbundle". New flags include: copy, login (+ new options for checkout), logout, mkdir, resolve, revert. fssync behaves now very similar to SVN. - Introspector uses the Interface service now, instead of the ++module++ namespace. - Refactoring and cleanup of the schema/form code. - Improvements to the OnlineHelp, which has been deactivated for this release since it is broken since the recent geddons. - ZODB 4: Changed serialization logic to support persistent proxies. Added an add() method to Connection and allowed it to run during commit(). - In the future, Zope 3 will use ZODB 3, which will support new-style classes, since the development of ZODB 4 stopped in late summer. - Various improvements to ZConfig Miscellaneous - Progress with the TUV-IT security accredidation - Many maintainance work and bug fixes. Much thanks to everyone who contributed to this release: Jim Fulton, Christian Theune, Marius Gedminas, Tim Peters, Jeremy Hylton, Fred Drake, Sidnei da Silva, Philipp von Weitershausen, Steve Alexander, Guido van Rossum, Barry Warsaw, Albertas Agejevas, Viktorija Zaksiene, Andreas Jung, Anthony Baxter, Phillip Eby, Richard Jones, Tom Cameron, Kevin Littlejohn, Stuart Bishop, Andy Hird, Peter Simmons, Christian Theune, Adam Summers, Stephan Richter, Chris McDonough, Garrett Smith, Godefroid Chapelle, Paul Roe, Kiki Pruvot, Don Baarda, David Fregon, Rob Zaar, Jan Smith, Richard Volpato, Roger Ineichen, Gary Poster, Bjorn Tillenius, Martijn Faassen, Chris Withers, Paul Everitt, Dominik Huber Requirements Zope3 requires Python 2.3.2 or later. You might get a segfault when shutting down the Zope servers. This is due to a bug in weakref and will be fixed in the upcoming Python 2.3.3 release. You can safely ignore the segfault. Downloads - Source release: "ZopeX3-0.0m4.src.tgz", http://dev.zope.org/Zope3/ZopeX3-0.0m4.src.tgz. Follow the instructions for building from source in README.txt. - A windows binary release: "ZopeX3-0.0m4.win32.zip", http://dev.zope.org/Zope3/ZopeX3-0.0m4.win32.zip. This is an "in-place" build. Just unzip it and run it. Use Python 2.3.2 and skip the building part of the instructions. Regards, Stephan and the Zope 3 team

1 0

PloneCollectorNG 1.0 RC1 released
by Andreas Jung 25 Nov '03

25 Nov '03

I am pleased to announce the release of PloneCollectorNG 1.0 RC1 (PCNG) PCNG is a bugtracking system for Plone. It is based on the concepts and ideas of CMFCollector and CMFCollectorNG but it is a complete re-write. One major highlight of this new version is the built-in TTW editor for Archetypes schemas. This means you can edit the complete fields for your issue (field types and widgets) through-the-web including the use of schemats etc. Another goal of the new implementation was to focus on security. So I dropped the old workflow and created a new one (which is much simpler). The codebase is very small and generic and therefore very much extensible for the future. Changes since 1.0 beta 3: - lots minor UI changes and tweaks - full i18n support for German Requirements: - Plone 2.0 (Plone 1.X untested) - Archetypes 1.0.1 (AT 1.2 is *not* supported yet; please don't ask me when AT 1.2 well be supported. It's done when it is done) ATTENTION: If you upgrade from an earlier release of PCNG you should re-install the product using the Add/Remove products in the Plone setup. ATTENTION TO USERS of Plone 2.0 beta 3: portal_workflow has been removed in Plone 2b3 from the action provider list. This is a *big problem* and will be fixed in the next Plone release. To fix this: - remove the "deleteActionProvider()" call in CMFPlone/setup/ConfigurationMethods.py line 175 - *recreate* your Plone 2.0 site (if created *with* Plone 2.0 beta 3) - there is currently no support from my side to re-enable the portal_workflow as action provider for Plone sites created under Plone 2.0 beta 3 Wiki and Download: http://www.zope.org/Members/ajung/PloneCollectorNG Cheers, -aj

1 0

Re: Epoz 1.0 released!
by Guido Wesdorp 21 Nov '03

21 Nov '03

Epoz 1.0 released! The Epoz team is proud to present version 1.0 of Epoz, a 'document-centric' client-side editor for Mozilla, Netscape and Internet Explorer. Epoz is a WYSIWYG (What You See Is What You Get) editor written in JavaScript, and was originally created by Maik Jablonski. This version has been completely rewritten by Paul Everitt, Guido Wesdorp and Philipp von Weitershausen (and several other contributors, for a complete list refer to the CVS log on Sourceforge). The objective of the rewrite was to improve stability and extensibility and make it usable as an editor for content management platforms such as Silva. Epoz can be also used in combination with Zope, Plone (although integration code won't be complete until version 1.1) and all webservers that support the HTTP PUT command. The Epoz rewrite was sponsored by Infrae, the makers of Silva. Epoz is: o Easy to integrate - Epoz can be easily integrated into Zope based servers as well as non-Zope webservers. Currently there is integration code for Zope 2, Zope 3, and Silva. We hope to add code for integrating Epoz into Apache, MMBase, Interchange, and more in the near future. o Easy to customize and extend - Epoz can be customized and extended in several ways. For simple modifications much of the configuration can be set as attributes on the editor iframe, while buttons, tools and layout can be changed via the CSS. For larger customizations there's a simple JavaScript plugin API, and also the core has a clean and solid architecture to allow full extensibility. o High-tech and up-to-date - Epoz uses CSS in favor of HTML for layout and presentation. It supports asynchronous saving to the server. It sets event handlers from code instead of from the HTML (excepting the toolbar), which makes the code a lot cleaner. It uses DOM functionality to build up HTML. On those and other fronts it tries to use the most modern standardized techniques available on all supported browsers to ensure a good user-experience and clean code. Epoz can be downloaded from the project page on SourceForge: http://sourceforge.net/projects/epoz There is a mailinglist: http://lists.sourceforge.net/lists/listinfo/epoz-development as well as an issuetracker to report bugs: http://codespeak.net/issues/epoz/ If you have a bug to report, please post it on the issuetracker after first checking it hasn't already been reported. If you'd like to contribute to Epoz, either with JavaScript patches or plugins or with integration code, or if you have a question or remark, please post a message on the mailinglist. The Epoz team would like to thank the following people and organizations: - Maik Jablonski for starting the project and inspiration - Infrae for sponsoring the project - The ETH university in Zürich for feedback and sponsoring Infrae - Holger Krekel for allowing us to use his infrastructure - All beta testers and everybody who has contributed to the project We hope Epoz is a nice experience and that you will enjoy using it as much as we did writing it! Cheers, the Epoz team .

1 0

CMFBoard 1.3.1 Released
by Nikolay Kim 20 Nov '03

20 Nov '03

CMFBoard is a board system for Plone online demo http://www.cmfboard.org/forums/ Changes * fix some stupid bugs in 1.3 version * security fix with ownership !!!!! owner of topic can edit any replies * Quick reply form (at the end of thread) Full, Quick, None * Email and IM user information * autosubscribe to topic for creator * preference form * remove JS confirm call * "Jump to" in all view * change skin layout (move images to another folder) * fix bug with "view mode" and poll cookie name (used the same cookie name) * added threaded view to forum view * sort order in topic view * "Private Message" through CMFMessage * basic through email reply submitting (mail-list functionality) "Download" http://www.cmfboard.org/download/CMFBoard-1.3.1.tar.gz "Download from Sourceforge" http://prdownloads.sourceforge.net/collective/CMFBoard-1.3.1.tar.gz?download

1 2

ZODB 3.2.1b1 released
by Jeremy Hylton 19 Nov '03

19 Nov '03

ZODB 3.2.1b1 was released from the regular location today: http://www.zope.org/Products/ZODB3.2 This is a bug fix release that tracks the Zope 2.7b3 release earlier today. The ZODB release was made from the same CVS tag as the Zope release, so the shared code is nearly identical. The final release of ZODB 3.2.1 will match Zope 2.7 exactly. I've included the latest news items below. Jeremy What's new in ZODB3 3.2.1 beta 1 ================================ Release-date: 18-Nov-2003 This code in this release should be identical to the code in Zope 2.7.0 beta 3. Changed the ZEO server and control process to work with a single configuration file; this is now the default way to configure these processes. (It's still possible to use separate configuration files.) The ZEO configuration file can now include a "runner" section used by the control process and ignored by the ZEO server process itself. If present, the control process can use the same configuration file. Fixed a performance problem in the logging code for the ZEO protocol. The logging code could call repr() on arbitrarily long lists, even though it only logged the first 60 bytes; worse, it calls repr() even if logging is currently disabled. Fixed to call repr() on individual elements until the limit is reached. ReadConflictErrors have an experimental new method, ignore(). If a database connection raises a read conflict, the current transaction was eventually be aborted. If the ignore() method is called, it will allow a transaction to commit after receiving a read conflict. This method should be used with great care, because ignoring read conflicts may allow inconsistent data to be written to the database. Several bare string exceptions were changed to raise exception objects. All these exceptions were in fairly obscure parts of the code. Bug fix for Acquisition in ExtensionClass. Zope Collector #1056: aq_acquire() ignored the default argument. The zdaemon.Daemon module was removed, because it is no longer used by zdaemon. The ZEO test suite is more robust. A variety of small changes were made that make it less likely to fail on slow or loaded machines.

1 0

Announce: Zope 2.7.0 beta 3 released
by Brian Lloyd 18 Nov '03

18 Nov '03

Zope 2.7.0 represents a concentration on software configuration and installation improvement over older versions. Note that Zope 2.7 now requires Python 2.3.2. You may download Zope 2.7.0b3 from Zope.org at: http://www.zope.org/Products/Zope/2.7.0b3/2.7.0b3 Particular features of interest in Zope 2.7.0: - DBTab integration (mounted databases for Zope). - New logging module support. - ./configure; make; make install installation from source - configuration-file-driven configuration - integration of ReStructuredText - OrderedFolder support - Many bugxfixes For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.7.0b3/CHANGES.txt - http://www.zope.org/Products/Zope/2.7.0b3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: - http://www.zope.org/Documentation/Misc/InstallingZope.html Brian Lloyd brian(a)zope.com V.P. Engineering 540.361.1716 Zope Corporation http://www.zope.com

1 0

ZopeMag Weekly News - Issue 8
by Mark Pratt 17 Nov '03

17 Nov '03

Hello all, Just wanted to let you know that Issue 8 of ZopeMag Weekly News is out. Go to: http://weekly.zopemag.com/ We don't announce every edition on this mailinglist so you just have to remember to pay us a weekly visit ;-) Regards, Mark

1 0

Archetypes 1.2.0 final Released
by Sidnei da Silva 17 Nov '03

17 Nov '03

The Archetypes Team is proud to present the Archetypes 1.2.0 final release. This release is a recommended upgrade for everyone using Archetypes 1.0.x as it brings a whole set of improvements which also include security and some unicode handling fixes. What is Archetypes? Archetypes (formerly known as CMFTypes) is a framework designed to facilitate the building of applications for Plone and CMF. Its main purpose is to provide a common method for building content objects, based on schema definitions. Fields can be grouped for editing, making it very simple to create wizard-like forms. If you are new to Archetypes, you can also check the free introductory Archetypes article, published in ZopeMag: http://www.zopemag.com/Issue006/Section_Articles/article_IntroToArchteypes.… Changes since 1.0.1: - Revisited security permissions - New BSD-like licensing option (1.0.2 - 1.2.0beta1 were licensed under the GPL) - The new BaseUnit is used by default now. The old one is still available but will be removed on the next release - Added ``VariableSchemaSupport`` - Multi-Catalog support (one catalog per portal type) - Improved mime-type detection when uploading files - New test suite, based on ZopeTestCase_ - Templates are now using the Plone 2.0 style (which makes them somewhat unusable under Plone 1.0.x, unfortunately) - Should be usable with plain CMF (though not as pretty :) - Added registries for Widgets, Fields, Types, Validators (missing Storage registry, will be added on 1.2.1) - DisplayList is now public, meaning you can import it from a Script (Python) - 'visible' setting on Widgets should work now - It is possible to specify the Image class on the ImageField now, thanks to Jeff Kunce - Extended fields index attribute syntax to support extra arguments. That allows for instance to add a ZCTextIndex:: index='ZCTextIndex, lexicon_id=lexicon, index_type=Okapi BM25 Rank' - Added several interface tests, thanks to Tiran - Should work with External Editor in most of the cases - Should work with WebDAV if you have a PrimaryFieldMarshaller, and set 'primary = 1' on a TextField - Default marshaller is RFC822Marshaller, which marshalls all the fields as RFC822-style headers, plus the primary field as the body of the document. - Added some initial support for the ArcheBuilder_. This is in its very very initial state, but you can read about the plans at `this url`_ As of beta3, ArchGenXML is included in this tarball. Here's a short description of ArchGenXML: ArchGenXML is a commandline utility that generates Plone applications based on the Archetypes framework from XMI (UML) and XSD (XMLSchema) files. It is tested with the XMI output from the following tools: ObjectDomain, Sybase PowerDesigner, ArgoUML, Poseidon, KDE's Umbrello. Tarball: http://prdownloads.sourceforge.net/archetypes/archetypes-1.2.0.tgz?download .. _ZopeTestCase: http://cvs.sourceforge.net/viewcvs.py/collective/ZopeTestCase/ .. _this url: http://awkly.org/Members/sidnei/weblog_storage/blog_92759 .. _ArcheBuilder: http://awkly.org/files/archebuilder/archebuilder.xul -- Sidnei da Silva <sidnei(a)awkly.org> http://awkly.org - dreamcatching :: making your dreams come true http://plone.org/about/team#dreamcatcher To err is human, to forgive, beyond the scope of the Operating System.

1 0

PloneCollectorNG 1.0 beta 2 released
by Andreas Jung 16 Nov '03

16 Nov '03

I am pleased to announce the release of PloneCollectorNG 1.0 beta 2 (PCNG) PCNG is a bugtracking system for Plone. It is based on the concepts and ideas of CMFCollector and CMFCollectorNG but it is a complete re-write. One major highlight of this new version is the built-in TTW editor for Archetypes schemas. This means you can edit the complete fields for your issue (field types and widgets) through-the-web including the use of schemats etc. Another goal of the new implementation was to focus on security. So I dropped the old workflow and created a new one (which is much simpler). The codebase is very small and generic and therefore very much extensible for the future. Changes since V 1.0 beta 1 - the complete UI for issues is now generic. No more needs to touch the skins - UI: using fieldsets instead of <DIV class="group"> etc. - added a new member preference to turn email notifications on/off - lots of minor UI improvements and cleanup - completed migration script for CMFCollectorNG -> PloneCollectorNG - Upgrade maintenance option for changed collector schemas - Collector and Issue instance use now !BTreeFolder2 as base class (this might raise some upgrade problems with existing PCNG instances). - added 'pcng_overview' for an overview over all collector instances including some stats - added filters to search form ATTENTION: If you upgrade from an earlier release of PCNG you should re-install the product using the Add/Remove products in the Plone setup. ATTENTION TO USERS of Plone 2.0 beta 3: portal_workflow has been removed in Plone 2b3 from the action provider list. This is a *big problem* and will be fixed in the next Plone release. To fix this: - remove the "deleteActionProvider()" call in CMFPlone/setup/ConfigurationMethods.py line 175 - *recreate* your Plone 2.0 site (if created *with* Plone 2.0 beta 3) - there is currently no support from my side to re-enable the portal_workflow as action provider for Plone sites created under Plone 2.0 beta 3 Wiki and Download: http://www.zope.org/Members/ajung/PloneCollectorNG Cheers, -aj

1 1