Status meeting in 22 minutes - wiki.mozilla.org/SeaMonkey/StatusMeetings/2024-12-08

hi all - here for the meeting

oh, there is a meeting today?

Then I'm early, for once~

tomman yes in 11 minutes

10 :)

hello .*

Hi njsg

Status meeting in 2 minutes - wiki.mozilla.org/SeaMonkey/StatusMeetings/2024-12-08

hi rsx11m

hi IanN frg WG9s tomman

rsx11m hi

hi rsx11m

hi tomman

world.hello~

Status meeting time - wiki.mozilla.org/SeaMonkey/StatusMeetings/2024-12-08

HI all

I we going back to the Kernigan and Ritchie C programming language book? they said everyone's first computer program was to write :Helo World"

I do

Who's taking minutes?

I do++

thanks

Nominees for Friends of the Fish Tank?

I nominate IanN for hosting thiese meetings

second

seconded

eeep

fourthed

8-)

thanks

Action Items

bau real life demands pile up unfortunately so not doing additiona stuff I want.

hi nsITobin

hello

Status of the SeaMonkey Infrastructure

Our Windows signing key expires in January. New ones are costly and hardware based. No time to chase this rabbit.

Signing s*cks with hardware token only.

wait, is now MS enforcing HSMs for codesigning?

oof

Also Apple broke running unsinged applications in 15.1. No time or knowledge to set up notarizting infra too.

makes sense from a security perspective (Given the cert leaks out there), but still it stings

Apple s*cks too these days.

tomman You can alwas revoke it.

nsITobin they are all hardware token based now.

nsITobin: it's not the cert but the process MS now requires

usually that's what it happens when someone finds that your cert has been used to sign malware with it, but time is the essence

but yeah, hardware adds another point of failure and complexity

...apparently you can also use a "cloud-based" solution, eww

> SSLPOINT has teamed up with Certum, Europe’s top Certificate Authority, to offer you the “Code Signing SimplySign” product line. This software-based solution securely stores the private key in a virtual vault, meeting industry standards without the need for extra hardware tokens.

We might self sign and if someone wants to check he needs to add our cert. Betterbird does it this way.

certum on here is a virtual software token not hardware BUT it is an invidual dev..

i find it odd that MS does not seem to understand the whole concept of a personal computer. this is MY computer I should conftol what i can and cannot run not you

need to work out if this works for us: melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing

Currently I sing my builds in a vm to check if all is well. Same on the offcial infra then. Not sure how to account for that. Maybe with the azure client added to the vm.

if so, should be fairly simple

"securely stores the private key in a virtual vault"

oops backlog stuck

I think we need to get 2.53.20 out fast and then see what can be done.

seconded

Moonchild could NOT get digicert hardware tokens to actually work for this purpose btw his last known strat was to interrupt packaging and manually sign then resume using windows batch scripts..

codesigning is such an an unreasonable burdon.

can the current certificate be used to sign a/the new one for self-signing, or is that not possible or hard to make use of?

for anyone not making millions

I think selfsigned authinticode would be a more dire situation than not signing at all unless the situation has changed in the past few years

nsITobin I have a good script fro this integrated intot eh packaging process. Does a repackage too.

Only needed a few tweaks for the build files. Basically does the build then signs then packages then resigned/repackage for l10n and then does the final signing.

I intended to once Moonchild actually EXPLAINED his process to build it IN to the packaging system its why I stripped down Mozilla's overcomplicated packaging to something simpler so custom handling to be added for this or whatever else needed to diddle with the binaries like an alt-windows installer and such.. but all that mozilla trash was in my way..

at least the situation on Windows regarding codesigning remains "simpler" than the mess on Mac, where Apple keeps rewriting the rules with every minor MacOS release

I can basically call any batch program or script for it.

and you need a real mac for Apple I think.

do you know the secrets to the mozilla process?

or its all yours

nsITobin its so undocumented and taskcluster specific I gave up understanding it. Complicated+++++

tomman: Microsoft only rewrites their rules once they know what google and apple have already gotten away with.. microsoft learned from the browser war.. its actually conserning..

the other thing happening with infra is that ewong has been migrating linux boxes from 7.x/8.8 to 8.9

I really don't want to use a gitlab or github build pipeline for anything. Want to stay independent of this stuff. Separate Azure is the only option I would even consider other than doing it locally only.

I need to look into really setting up the 2019 builder.

IanN: I do know the secrets to kickstart rhel systems so if you guys ever need advice or need to simplify your infra deployment with a directed configuration I am in some practice with it now..

So far 2012 R2 wirks fine but 2 boxes are not my cup of tea and cost money.

I need to work out kvm cause vmware is not a sustainable future for me.

or anyone

so half way through meeting and still on this code signing issue can we table this and get on with the rest of the agenda?

Status of the SeaMonkey Source Tree

2.53 is now at 2.53.21b1 pre. Todays level is also what will becomes the 2.53.20 beta unless someone finds another patch to add.

Just some missing l10n needs to be done.

Release Train

I plan to do a few l10n tweaks in the official central repo e.g. cZ port is still listed as 9999 for https help.

2.53.21b1 will be done this week I hope.

2.53.20b1

Extensions Tracking

(was there some recent redesign in bugzilla?)

oh boy, hadn't noticed Bugzilla got another redesign... now the top bar keeps "floating" in place, without filling the top of the viewport

Mozilla "enhanced" bugzilla so no longer 100% useable with SeaMonkey. Slow as hell and not user friendly in another browser too but that comes with the "enhancements" these days.

most likely that means they're relying on some Chromeism

yeah, and I get text over the page, which is probably lack of webfonts. Need to see if logging in fixes it

Its private fields dynamic imports shadow dom and other things. Lets not discuss it. It is as it is and is not as good as before.

2.Next, Feature List, Planning & Roundtable

bau

nj just a hint i have found txt over page can usually be avoided in firefox if you invoke reader mode not sure how to do in seamonkey

njsg: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

WG9s: css hacks will probably be the way to go if it doesn't go away based on some preference

been doing lots of cZ tidy ups, will continute for 2.53.21

I wonder if we shouldn't reformat it first. The real changes will get last in searchfox otherwise.

as long as central is still there...

Or reformat the new changes for now.

So the pats will not be tocued later.

^toched

^touched drat

I'd love to help with conforming older sm parts with the general xul toolkit layout

like the extensions

oh perhaps touchee'd!

Not sure bout DOMi but cZ very sure

I have been working on trying to get comm-central builds requireing less of my time to fix by basing them on last successful TB nightly build repo state

aynway for the boss to decide :)

so we are asking Springsteen?

OH btw. forgot. For source: Permantly checked in stuff up to 59a1 into gitlab and heptapod this week. Trimming the patch queue a bit.

yup

AOB

bau

Next meeting in 4 weeks time, 5th January 2025

thanks for your time today

have a great holiday season

happy x mas and a happy slide into the new year.

happy egg hunting!

(wrong holiday...)

lol

I don't have to hunt eggs, they're all in my fridge

Its the easter santa Charlie Brown!

Oh it was the easter beagle...

meow!

lol

I am looking at bugzilla and wondering what features are considered core to the workflow of the SeaMonkey project.. and the most complicated bit I see is dependacy tagging everything else is form, attach, and post content.

which is very trivial

happy holidays

see you in the new year

charlie brown? is that where someone keeps pulling the eggs when you find them?

Until they set us "free" I am not worrying much about it.

c u all

bye

I am that old to remember

bye and see you here as away

time to continue with laundry here~

Fe-fe, fi-fi, fo-fo, fum

I smell smoke in the auditorium

that was for nwho seemed confused about charlie brown

was a cartoon strip called peanuts here in the 1950's

but the coasters also had a big hit with a song aobut Charlie Brown.

A bit dated now but this and the halloween special are still fun

yes the great pumpkin charlie brown

but I thnik it was Linus who was actually the great pumpkin fan but then you wonder if Linus Torvalds was named after him and therfore so is Linux

this is the song I was referring too youtu.be/-D0SUGdO4ok

I was thinking if it was the lucy football scene but with easter eggs :-P

I'm not sure I've watched these cartoons, it's possible I did, possible I didn't

my overview for a bugzilla-like system i am gonna code up

the latest "why you piss me off so badly, Google" failure of the day: Google Translate

it won't translate websites anymore on SM

because among other things, it relies on this: developer.mozilla.org/en-US/docs/We…PI/HTMLSlotElement/assignedElements

TypeError: l.assignedElements is not a function

but wait, it gets even more stupider

MDN's table of supported browser versions won't even render anymore here!

"BCD tables only load in the browser"

all you get is that... placeholder now

because MDN now requires dynamic imports too

Jesus Fried Christus, I want to burn San Francisco so badly right now

udn.realityripple.com/docs/Web/API/HTMLSlotElement/assignedElements finally, some sane resource

"Firefox 66, Chrome 65"

so not exactly new, but someone just discovered that feature that nobody was using and... well "ooh, shiny"

well remember how fedora got rid of ftp then switched to custom elements for the site making it so unless you KNEW the plain http address you can't GET fedora from an older or simply less advanced browser

and worse did it for their browser startsite making the first thing fedoras see when they open seamonkey is a webcompat issue.. That's just shitty imo and reenforces MY claims that fedora has no WHOLE ECOSYSTEM conception whatsoever so no one is ultimently held accountable for anything outside hunting the indiviual down and shaming them.. in public .. which in my experience gets you banned more than not.

its not really individual packagers and such but the composite result of all of it..

i dunno i didn't even want to put this into words cause I hate the implications so much but more and more it seems, broadly, people are more about keeping the machine chugging along but don't particularly care and are NOT held responsible for what those machines are actually churning out..

cause that will change at any time anyway

./mach build

well shit

guess I can't build now

:P