Skip navigation.

Zero Install roadmap

Version 0.18 of 0launch was released yesterday. Notable new features include:

  • Signatures in XML comments. This allows us to present feeds nicely in a web-browser, as discussed previously.
  • FTP support (not just HTTP).
  • Support for extracting from RPMs.
  • As an added layer of protection against bugs in tar and cpio, the extraction process is sandboxed using plash, if available.

You can see all these features in action by trying the sample Tgif interface. This interface can be viewed in any web-browser that supports XSLT, and when run it downloads an RPM using FTP, extracts it with plash for sandboxing and then runs it.

Planned future improvements include:

  • Running applications with plash for sandboxing. Only the extraction is currently protected (which is useful on its own, because the digest is checked after an archive is extracted). Sandboxing the application itself is more complicated, but we should be able to do it for console applications at least (securing X applications is harder). I'm waiting for the next release of plash before trying though.
  • Compiling from source. No comments on my previous blog about compiling from source. Maybe I'll just go ahead and implement something.
  • Sharing downloads. I've got some Python code to do this, but I'm not sure that Python is the best language for writing SetUID programs.

Using the new interface with

Using the new interface with the older 0launch gives the following error:

Error updating interface '':

No signatures found. Errors from GPG:
gpg: no valid OpenPGP data found.
gpg: decrypt_message failed: eof

How do you plan to gracefully upgrade? Or do we just need to wait until most users have upgraded before using the new format?

XML comment signatures

Yes, I just intend to keep using the old format for a few months.

For the Tgif interface using the old format won't help, though, because it also needs FTP and RPM support, which also only come with version 0.18.

Syndicate content