Zero Install roadmap

Version 0.18 of 0launch was released yesterday. Notable new features include:

• Signatures in XML comments. This allows us to present feeds nicely in a web-browser, as discussed previously.
• FTP support (not just HTTP).
• Support for extracting from RPMs.
• As an added layer of protection against bugs in tar and cpio, the extraction process is sandboxed using plash, if available.

You can see all these features in action by trying the sample Tgif interface. This interface can be viewed in any web-browser that supports XSLT, and when run it downloads an RPM using FTP, extracts it with plash for sandboxing and then runs it.

Planned future improvements include:

• Running applications with plash for sandboxing. Only the extraction is currently protected (which is useful on its own, because the digest is checked after an archive is extracted). Sandboxing the application itself is more complicated, but we should be able to do it for console applications at least (securing X applications is harder). I'm waiting for the next release of plash before trying though.
• Compiling from source. No comments on my previous blog about compiling from source. Maybe I'll just go ahead and implement something.
• Sharing downloads. I've got some Python code to do this, but I'm not sure that Python is the best language for writing SetUID programs.