[Kune's installation] INSTALL instructions for DB creation and Developer's Guide issues
Hello everybody: I would like to propose to add some kind of explanation in kune/INSTALL file concerning database passwords. This file says that database passwords must be changed to something different than the placeholder text "PUT_HERE_A_DB_PASSWD". This is the right thing (since passwords are a very sensitive security concern), but no warning exists explaining that database password must match the one in all these files in order to start kune successfully: - src/main/resources/db/liquibase.properties - src/main/resources/META-INF/persistence.xml - script/liquibase-migrate.sh - script/liquibase-rollback.sh - pom.xml - src/main/webapp/WEB-INF/publicspace/config/database.yml So, shouldn't be the best (insecure) way to create the database to use the default ("db4kune") password? Also, I found some problems with these project settings/dependencies: - .project and .classpath are included in SVN repo, but Developer's Guide asks to generate this by making "mvn eclipse:eclipse". Couldn't be this a little contradictory/dangerous? - AspectJ nature is not needed but included in SVN's ".project" file. Is there a good reason for this? Thank you very much for your time, and please don't take this as an urgent task, lets come back from holidays at a slooooow pace ;-) Regards, Roberto.
First of all, greeeeeat feedback. I usually ask for this kind of comments about the INSTALL and the DEV_GUIDE (but without to much success). El 01/09/11 11:36, Roberto Aragón escribió:
Hello everybody:
I would like to propose to add some kind of explanation in kune/INSTALL file concerning database passwords. This file says that database passwords must be changed to something different than the placeholder text "PUT_HERE_A_DB_PASSWD". This is the right thing (since passwords are a very sensitive security concern), but no warning exists explaining that database password must match the one in all these files in order to start kune successfully:
- src/main/resources/db/liquibase.properties - src/main/resources/META-INF/persistence.xml - script/liquibase-migrate.sh - script/liquibase-rollback.sh - pom.xml - src/main/webapp/WEB-INF/publicspace/config/database.yml
Can you send us a INSTALL/DEV_GUIDE patch with this kind of things?
So, shouldn't be the best (insecure) way to create the database to use the default ("db4kune") password?
For dev purposes, to use db4kune is the easiest way right now (also thinking in SVN commits). For production, I'm working with the generation of one jar and to get all the properties/configuration files as parameters. The ideal for me will be to generate a debian package, but I have no experience packaging java applications currently (in the pom.xml we started to test the deb-maven-plugin to help with this but is not finished).
Also, I found some problems with these project settings/dependencies:
- .project and .classpath are included in SVN repo, but Developer's Guide asks to generate this by making "mvn eclipse:eclipse". Couldn't be this a little contradictory/dangerous?
maybe this should be in the DEV_GUIDE. Because to install Kune currently it's a job! take into account that issue 113 only need to import the /intro/ project (a different and simplest project than the one in /trunk/) in eclipse. http://kune.ourproject.org/issues/ticket/113
- AspectJ nature is not needed but included in SVN's ".project" file. Is there a good reason for this?
Mmmmm, since .project is generated from our pom.xml I don't remember who add this. Maybe guice: $ mvn dependency:tree (...) [INFO] [dependency:tree {execution: default-cli}] (...) [INFO] +- com.google.inject:guice:jar:3.0:compile [INFO] | +- javax.inject:javax.inject:jar:1:compile [INFO] | \- aopalliance:aopalliance:jar:1.0:compile
Thank you very much for your time, and please don't take this as an urgent task, lets come back from holidays at a slooooow pace ;-)
Thank you indeed for your feedback. Bests, Vicente
El Thu, 01 Sep 2011 12:07:42 +0200 "Vicente J. Ruiz Jurado" <[email protected]> escribió:
First of all, greeeeeat feedback. I usually ask for this kind of comments about the INSTALL and the DEV_GUIDE (but without to much success). I would have preferred to make an installation for development log which I think is better feedback, but I think the guide is 90% accurate an followable for an experienced developer (maybe a separated INSTALL file for users and DEV-INSTALL for devs would be a plus).
El 01/09/11 11:36, Roberto Aragón escribió:
Hello everybody:
I would like to propose to add some kind of explanation in kune/INSTALL file concerning database passwords. This file says that database passwords must be changed to something different than the placeholder text "PUT_HERE_A_DB_PASSWD". This is the right thing (since passwords are a very sensitive security concern), but no warning exists explaining that database password must match the one in all these files in order to start kune successfully:
- src/main/resources/db/liquibase.properties - src/main/resources/META-INF/persistence.xml - script/liquibase-migrate.sh - script/liquibase-rollback.sh - pom.xml - src/main/webapp/WEB-INF/publicspace/config/database.yml
Can you send us a INSTALL/DEV_GUIDE patch with this kind of things? Sure, please, see my proposal of patch attached.
So, shouldn't be the best (insecure) way to create the database to use the default ("db4kune") password?
For dev purposes, to use db4kune is the easiest way right now (also thinking in SVN commits).
For production, I'm working with the generation of one jar and to get all the properties/configuration files as parameters. The ideal for me will be to generate a debian package, but I have no experience packaging java applications currently (in the pom.xml we started to test the deb-maven-plugin to help with this but is not finished). I agree with you. Security in development instalation could be lowered if we warn enough, so I prefer to have a quick and dirty installation working if I know I should change passwords when I'm going into production phase.
Also, I found some problems with these project settings/dependencies:
- .project and .classpath are included in SVN repo, but Developer's Guide asks to generate this by making "mvn eclipse:eclipse". Couldn't be this a little contradictory/dangerous?
maybe this should be in the DEV_GUIDE. OK. Please, see proposal.
Because to install Kune currently it's a job! take into account that issue 113 only need to import the /intro/ project (a different and simplest project than the one in /trunk/) in eclipse. http://kune.ourproject.org/issues/ticket/113 I know, I know. But started to install Kune before accepting #113, sorry.
- AspectJ nature is not needed but included in SVN's ".project" file. Is there a good reason for this?
Mmmmm, since .project is generated from our pom.xml I don't remember who add this. Maybe guice: Never mind very much, because you could always rely on the project definition files comming from SVN repository, isn't it? It seems that that version is OK.
$ mvn dependency:tree (...) [INFO] [dependency:tree {execution: default-cli}] (...) [INFO] +- com.google.inject:guice:jar:3.0:compile [INFO] | +- javax.inject:javax.inject:jar:1:compile [INFO] | \- aopalliance:aopalliance:jar:1.0:compile
Thank you very much for your time, and please don't take this as an urgent task, lets come back from holidays at a slooooow pace ;-)
Thank you indeed for your feedback. Thank you too.
Bests,
Vicente
Regards, Roberto.
El 01/09/11 17:17, Roberto Aragón escribió:
I would have preferred to make an installation for development log which I think is better feedback, but I think the guide is 90% accurate an followable for an experienced developer (maybe a separated INSTALL file for users and DEV-INSTALL for devs would be a plus).
Well, let's see how goes the INSTALL production task that we are investigating, and later we'll update the doc accordingly. Anyway, thanks for your patch. Bests, -- Vicente
participants (2)
-
Roberto Aragón -
Vicente J. Ruiz Jurado