- Zope-Announce - Zope lists

Security announcement
by Laurence Rowe 22 Jun '11

22 Jun '11

On behalf of the Plone and Zope Security Teams I'd like to draw your attention to a security announcement that has just been published. This is a pre-announcement only, it does not contain any vulnerability details. Your sites are a safe today as they were yesterday. However, as the problem that has been found is so serious we are giving you advance warning that a patch is upcoming and recommending that you plan a maintenance period for your sites to coincide with the full announcement on Tuesday next week. Full details are available at http://plone.org/products/plone/security/advisories/pre-announcement-201106… You can feel free to ask more questions on the plone-users mailing list or in the #plone IRC channel about details and how to protect yourself, but it is important to make a plan for this now. It is important to plan down-time at the time specified in that announcement or your site will potentially be at risk - following the release of a hotfix for the previous serious security vulnerability we received reports of automated attacks on unpatched sites. Laurence

1 0

PAS 1.5.5, 1.6.5, and 1.7.5 released
by Tres Seaver 30 May '11

30 May '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have pushed out releases of PAS in order to address a potential security vulnerability reported by Alan Hoey: https://bugs.launchpad.net/zope-pas/+bug/789858 The releases are available on PyPI: http://pypi.python.org/pypi/Products.PluggableAuthService/1.5.5 http://pypi.python.org/pypi/Products.PluggableAuthService/1.6.5 http://pypi.python.org/pypi/Products.PluggableAuthService/1.7.5 If you cannot install one of these versions for some reason, the patch on the Launchpad should be applicable (with some fuzz) to any PAS version since 1.4. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk3j2PoACgkQ+gerLs4ltQ7yfQCgt+WJSObr8jaZTyGdvH8oTFOC R6gAoJtsVcJVsIIOjQptR/O2XARjfdIt =y9Pc -----END PGP SIGNATURE-----

1 0

Announcement: 2011 Zope Foundation Board Elections and General Meeting
by Tres Seaver 27 Jan '11

27 Jan '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 (apologies in advance for the cross-post: we need this to reach the whole Zope community). The Zope Foundation board is pleased to announce that the regular 2011 general meeting of the foundation will be held on Wednesday, 16 March 2011, at 15:00 UTC. The meeting will be conducted via IRC at the following channel: irc://irc.freenode.net/#zope-foundation Prior to that meeting, the current board will conduct an elections in which foundation members will select seven (7) board members in accordance with the foundation bylaws[1]. Summary - ------- - - Nominations open via the foundation(a)zope.org mailing list until Friday, 2011-02-11. - - Voting via e-mail to a closed mailing list, from Wednesday, 2011-02-16 through Friday, 2011-03-04. - - Votes tallied by representatives of the current board, using "Meek and Warrent STV" method using OpenSTV software. - - General meeting and seating of the new board, Wednesday, 2011-03-16. Procedure for Elections - ----------------------- The procedure for the elections is as follows: - - Foundation members may nominate any member by responding to the board's announcement on the foundation(a)zope.org mailing list. Nominations will remain open until Friday, 2011-02-11, 23:00 UTC. - - At the close of the nominations period, the board will create a new mailman list, 'zf-elections-2011', and approve all ZF members to post to the list.. In order to preserve anonymity of votes, foundation members will not be subscribers to the list; access to the list archives will be restricted to the "tellers" appointed by the board. - - On Wednesday, 2011-02-16, the Secretary will send an e-mail announcing the opening of the voting period. This e-mail will contain the ballot, with careful instructions about how to rank preferences in the reply. The Reply-to header of this e-mail will be set to the 'zf-elections-2011' list. - - ZF members will vote by replying to that e-mail. Voting will remain open until Friday, 2011-03-04, 23:00 UTC. - - At the close of voting, the board will appoint two of its members as "tellers." The tellers will use the list archive to tabulate the members' votes, using the OpenSTV application[2] configured to use the Meek and Warren STV method[3]. The tellers will report the election results, along with the raw tallies, at a special board meeting to be held on Tuesday, 2011-03-15, 15:00 UTC. - - After canvassing the results from the tellers, the board will notify all nominees of the success / failure of their candidacy, thanking them for their willingness to serve. - - At the general meeting, the last item on the agenda will the announcement of the election results, including a vote to "seat" the board. An online version of this announcement is available at: http://foundation.zope.org/news/2011_election_and_general_meeting/ References - ---------- [1] http://foundation.zope.org/bylaws/zope_foundation_bylaws.pdf [2] http://stv.sourceforge.net/aboutopenstv [3] http://stv.sourceforge.net/votingmethods/meek Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk1B8owACgkQ+gerLs4ltQ7OaACfSBCwcbLsELAk/n9eW0CblmMz UvcAn0a1hIhLiocRo8GG431ccPnzDK7/ =2p6F -----END PGP SIGNATURE-----

1 0

Grok 1.3 released!
by Jan-Wijbrand Kolman 20 Jan '11

20 Jan '11

Hi, The Grok development team is happy to announce the Grok 1.3 release! Where the previous release was mostly about slimming down the dependency hierarchy of packages that comprises Grok, this release brings several important changes in functionality typically found Grok-based applications. Grok 1.3 is based on the Zope Toolkit 1.1c1 release! Since the ZTK 1.1 release drops Python-2.4 support and gains Python 2.7 support, it was able to update quite a number of packages, most notably the ZODB. Grok does currently not need to override any version of packages defined in the ZTK! The list of Grok specific package version can be found here: http://grok.zope.org/releaseinfo/1.3/versions.cfg To upgrade existing project you might find the upgrade notes helpful, to be found here: http://grok.zope.org/doc/1.3/upgrade.html Amongst other changes, Grok 1.3 brings: * The long awaited support for the most recent martian version. * The long awaited merge of the template registry refactoring. This should result in considerable less spurious warnings concerning unassociated templates. * Integration of the Fanstatic [1] library and WSGI components. From the Fanstatic website: """ Fanstatic is a small but powerful framework for the automatic publication of resources on a web page. Think Javascript and CSS. It just serves static content, but it does it really well. """ The "static" directory functionality in Grok based projects is now based on Fanstatic and the compatibility layer provided by zope.fanstatic [2]. * Removal of the automatic test discovery and registration that was provided by the z3c.testsetup package. For newly created projects, the grokproject tool will layout examples of setting up test suites. Note that this is a first step in the way towards more drastic improvements in regards to test discovery and running tests. Other important notes: * The updated grokproject tool will not be able to build new project based on Grok version < 1.3. * Besides working on code, the Grok community is also working on improving the documentation, both the "official" documentation and the "community"-driven efforts. This is quite an undertaking and not yet finished. We realize this release will again bring quite some structural changes that might affect your projects in some way. Please let us know when you run into problems upgrading your projects on the grok-dev mailing list or on the #grok IRC channel. We will try to help and it will also help us, the Grok developers, by fixing bugs and other issues. [1] http://fanstatic.org/ [2] http://pypi.python.org/pypi/zope.fanstatic/

1 0

Silva 2.3 final Released
by Wim Boucquaert 22 Dec '10

22 Dec '10

21 December 2010 Infrae is pleased to announce the final release of Silva 2.3. This release contains a gamut of new features for users, system administrators, and developers. The most important changes for users are support for mobile skins based on browser detection, and a robust reference management system that preserves links between resources. System administrators should note that Silva now supports WSGI servers and this is the recommended way to run it. Developers will enjoy a more consistent API and vastly improved testing infrastructure. Silva for mobile devices: Silva integrates with Mobi, a middleware suite for detecting mobile devices. Mobi reads the user agent header in requests and categorizes it into one of three device types, then passes the category along. The silva.core.layout system then chooses the best presentation for the device. For more in-depth information on Mobi have a look at the technical site: http://mobi.infrae.com/. User features: * A reference system management has been implemented. In a Silva Document (and in Silva News Network items), images and linked objects can be connected using references. Those images and links are not broken when referenced objects are moved or renamed. * Content cannot be deleted if it is the target of a reference. This prevents having broken links in documents. Silva Links, Silva Ghost Folders, Silva Ghosts, Silva Indexers and Silva Find also use the same reference mechanism. Managers have the option to break references if needed. * On Images and Files, it is possible to see in which documents are referencing them. With this feature, it is also possible to identify site unused images and files. * The XML import/export has been improved, removing many bugs (export of acquired metadata for instance). It’s been extended to preserve proper references on import independent of the import and export location. One cannot export content objects that have a reference target outside of the export tree. * The forms editor has been removed from Silva Documents. However the underlying XML is still accessible for managers. * Many SMI screens have been refactored, removing a lot of back button bugs. Extension User features: * Silva News Network has been refactored with improved calendaring functionality. * Silva Forum has been refactored and has new subscription and captcha features. * Silva Find, Silva Poll and Silva OAI have been refactored to work with Silva 2.3 and its requirements. * A new extension silva.security.overview have been written to provide an overview of who has security access where in the Silva site. * A new extension silva.security.logging has been written to log detailed user actions. Sysadmin features: * Silva supports WSGI servers. It is now the recommended way to run Silva. You can use Paster or Apache’s mod_wsgi. * With the WSGI support, error logs hae been improved. They give provide more information which helps facilitate debugging of production bugs. * HTTP headers for GET and HEAD requests have been optimized in order to improve caching with Squid and other reverse proxies. * Silva now uses PAS for authentication by default. This makes it easier to connect Silva to third party authentication systems like Active Directory, LDAP, Raduis, SQL. You no longer need to write custom code for this. * The 2.3 release uses Python 2.6 and Zope 2.12. It won’t work with Python 2.4 or any previous version of Zope. Developer features: * The z3c.form and zope.formlib components have been replaced by zeam.form. * The reference system silva.core.references is reusable in any Silva extension. * The SMI uses silva.core.layout and can be themed with a CSS of your choice. * The subscription feature has been refactored into an extension silva.app.subscriptions. It’s been built to be usable by any Silva extension (an extension can send any message it wishes to a list of subscribed people). * Zope Events have been added to much existing Silva functionality. This lets you plugin your extensions to the publication and security sub-systems. * Various code optimizations have been fine tuned. * A new test setup system makes testing easier. * Many tests have been added, cleaned, refactored and improved. Removed products: * The old SilvaLayout product is no longer distributed by default (the so-called Legacy Layout is still supported, but not installed by default). * The XMLWidgets components have been removed. Developer documentation: The http://docs.infrae.com/ site has been improved with extensive documentation. Installation: Silva 2.3 should be installed using buildout or using Paster and selecting the ‘simple-instance’ distribution. For more information on the Silva installation procedure see: http://docs.infrae.com/silva/2.3/buildout.html Contact: FMI contact Sylvain Viollon, info at infrae com, +31 10 243 7051.

1 0

Re: [Zope-Annce] [Zope-dev] Zope 2.13.0 final released
by Andreas Jung 05 Nov '10

05 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Great work! Cheers, Andreas Hanno Schlichting wrote: > On behalf of the Zope 2 developers community I am pleased to announce > the official release of Zope 2.13.0. > > Major changes: > > - Supports Python 2.6 and 2.7 > - Includes ZODB 3.10 - which adds multi-threading to the ZEO server > - Contains WSGI support > - Ships with the Zope Toolkit 1.0 > - A number of performance improvements in ZCatalog > - lots of other smaller fixes and features > > For more details, check: http://docs.zope.org/zope2/releases/2.13/WHATSNEW.html > Release notes: http://docs.zope.org/zope2/releases/2.13/CHANGES.html > > If you have found a bug, please report it on Launchpad: > https://bugs.launchpad.net/zope2/ > > I would like to thank all people having contributed to this release. > Special thanks to Tres Seaver for bringing WSGI support to Zope 2, > Jens Vagelpohl for his tireless bug-fixing efforts and Yvo Schubbe for > testing the pre-releases against CMF and helping out with bug fixes > and some new features. > > Hanno Schlichting > Zope 2 Release Manager > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > https://mail.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > https://mail.zope.org/mailman/listinfo/zope-announce > https://mail.zope.org/mailman/listinfo/zope ) - -- ZOPYX Limited | zopyx group Charlottenstr. 37/1 | The full-service network for Zope & Plone D-72070 Tübingen | Produce & Publish www.zopyx.com | www.produce-and-publish.com - ------------------------------------------------------------------------ E-Publishing, Python, Zope & Plone development, Consulting -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQGUBAEBAgAGBQJM1DUeAAoJEADcfz7u4AZj8skLwOGbh32LMr8dyQRtRvPpPzhT 7PRaD6mgWSYQyFS4u5qO2J9vVziNw6mbLANFLq2lBSxDGf6Gp5E8A3EpR/w51N+0 Y5S/iS/Kb1qMPxEV1TBf/Ai8dXio0tPZCE6dp5610Tfv3HPP4mFi/Owi3EbcFZ5J tJMjFuQYYLhpX5mwp0yRY1WgKxIfDoE207pZW53+RjuUNTqthXIH6zRTeZjj2u04 ehnAQeD19mhML/gco5I04BQktU33WmQv8VgtJu2M8nMEvW2wxoCWjWepABVQ/mlZ 1w7JSzT3gsNnR9MCxuNLfXQ4lbKN8Mn3+RsIwOfnxYFoayaCO7AtWd2JvPDrIb6G zc1tcsIbqmnfMG9ZeEsPwOgO16+rG4AaAlEfEv2LpKo2Qp0nZY3quImGHFcKS4op 44cq1+nOqAV9jP+06LZwCcgOn5eXfHlNHTU8SS6mGyJxg4KYI5NH3C1hXws+RdkH 7oc0/hT1n5srmuvliHKeuFM2KRooaAo= =J7f6 -----END PGP SIGNATURE-----

1 0

Grok (Toolkit) 1.2 released!
by Jan-Wijbrand Kolman 26 Oct '10

26 Oct '10

Hi, The Grok development team is happy to announce the Grok - also know as the Grok Toolkit - 1.2 release! This release took a huge effort from the Grok development team to reduce the number of (legacy) dependencies, most importantly removing a very large number of zope.app.* packages from the stack! This results in a smaller and more manageable footprint. The Grok (Toolkit) 1.2 uses zc.buildout-1.5.2 and the new features it brings. Most importantly, the possibility to safely use the system Python for creating new projects. This should especially help newcomers who want to try out Grok. We can simplify the installation instructions by leaving out the "virtualenv" steps. The Grok (Toolkit) 1.2 is based on the Zope Toolkit 1.0 release! The Grok (Toolkit) does diverge a little from the ZTK 1.0 for a couple of its dependencies. These are listed separately in the Grok Toolkit versions file that can be found here: http://grok.zope.org/releaseinfo/1.2/versions.cfg The list of changes can be found here: http://grok.zope.org/doc/1.2.1/changes.html To upgrade existing project you might find the upgrade notes helpful, to be found here: http://grok.zope.org/doc/1.2.1/upgrade.html The 1.2 release will __not__ bring two still long awaited changes: * Support for the latest martian version. * The improved template registry merge. They will have to wait for the 1.3 release. Another important note: Because of the update to zc.buildout-1.5.2 and other structural changes, the new grokproject version will not be able to install projects for Grok < 1.2. We realize this release will bring quite some structural changes that might affect your projects in some way. Please let us know when you run into problems upgrading your projects on the grok-dev mailinglist or on the #grok IRC channel. We will try to help and it will also help us, the Grok developers, by fixing bugs and other issues. Enjoy! Kind regards, jw

1 0

Zope Toolkit 1.0 release
by Jan-Wijbrand Kolman 13 Oct '10

13 Oct '10

Hello. On behalf of the Zope Toolkit release team and the Zope community, I'm happy to announce the release of Zope Toolkit version 1.0! You can read more about the release at http://docs.zope.org/zopetoolkit/releases/overview-1.0.html. The first ZTK release supports all of Python 2.4, 2.5 and 2.6. To use the ZTK release, you can use: [buildout] extends = http://download.zope.org/zopetoolkit/index/1.0/ztk-versions.cfg http://download.zope.org/zopetoolkit/index/1.0/zopeapp-versions.cfg This release focuses on cleaning up the ztk and zopeapp package lists by deprecating packages that are not used by any of the frameworks that use the ZTK. It should provide a stable set of libraries that are known to work well together and for the frameworks to expand on. We post our meeting notes at http://docs.zope.org/zopetoolkit/releaseteam/index.html. Feel free to start discussing with us on this mailing list. Kind regards, Jan-Wijbrand Kolman

1 0

ZSyncer 1.0.3 Released!
by Chris Withers 07 Oct '10

07 Oct '10

Hi All, This is purely a bug fix release for problems I experienced when replacing local objects by absolute path. Installable from: http://pypi.python.org/pypi/Products.ZSyncer Subversion source repository: https://secure.simplistix.co.uk/svn/ZSyncer/ Documentation: http://packages.python.org/Products.ZSyncer/ Full change log: http://packages.python.org/Products.ZSyncer/changes.html cheers, Chris -- Simplistix - Content Management, Batch Processing & Python Consulting - http://www.simplistix.co.uk

1 0

Zope 2 Instance 1.1 Released!
by Chris Withers 23 Sep '10

23 Sep '10

Hi All, New release out, this one brings compatability with zc.recipe.rhrc... This package provides a buildout recipe for creating a Zope 2 instance based around a deployment. The deployment concept originates from zc.recipe.deployment and allows the deployment to control where resources of a particular type are created. While zc.recipe.deployment is suited to production use, you will likely find that gocept.recipe.deploymentsandbox is more useful for development. This recipe is only compatible with Zope 2.12+. Full information can be found here: http://www.simplistix.co.uk/software/zope/zope2instance Lemme know if you have any problems, comments or suggestions... cheers, Chris -- Simplistix - Content Management, Batch Processing & Python Consulting - http://www.simplistix.co.uk

1 0