My colleague and I are maintaining a ”Puppet boilerplate modules” project (something like puppet module generate on steroids). To keep up with the OSS spirit, we thought it would be a good idea to share it with the community.

The project helps you to create high quality Puppet modules in a fast and comfortable way. Main goals are to boost efficiency and Puppet code quality. Use it if you want to get module skeletons with:

• tidy and easily extendable structure
• good README skeleton, RDoc documentation and license information
• source code which follows the official style guide
• parameterized classes
• an easy way to push your new modules to GitHub or Bitbucket
• module variable debugging functionality

1. Clone the repository:

   $ git clone git://github.com/bitkollektiv/puppet-boilerplate-modules.git

2. Call the wizard to create the module skeleton for a new module:

   $ ./puppet-boilerplate-modules/newmodule.sh

   Hint: You can provide the answers by using parameters. Use newmodule.sh -h to get a parameter listing and usage instructions.

Some resources to get an impression of what to expect:

• An exemplary filezilla module which manages the FileZilla client on a node. It took ~ten minutes to create the whole module. 90% of the time was spent to write the README.
• The documentation for the module, created with puppet doc --mode rdoc. Just unzip the archive and open index.html to view it.
• Some screenshots of the module wizard (→ newmodule.sh):

• Each manifest file encapsulates the Puppet code for a specific job. This ensures a clean module structure. The name of the manifest should say what it does in general, the RDoc block at the top provides more details. Example: the application boilerplate comes with the following files in /manifests:
  • init.pp
    Contains the main module class. It validates the module parameters and coordinates the actions (e.g. by chaining resources).
  • params.pp
    Sets the default values for the parameters of the main module class (→ init.pp) and manages internal module variables. Therefore, many operating system dependent differences like package names are addressed in here.
  • package.pp
    Coordinates all software package management related actions. Normally, there is no need to edit this file.
  • config.pp
    Coordinates all configuration related actions. Many modules won't need this because most there is no need for a special application configuration. If so, just delete the file and the references in init.pp.
  • repo.pp
    Coordinates all package repository related actions. Many modules won't need this because an additional repository is not needed to install the application. If so, just delete the file and the references in init.pp.
• Everything you must edit/check after you generated a module is marked with a FIXME/TODO. E.g. the package list or some class calls.
• You don't need to use GitHub/Bitbucket. The DVCS repository hosting part of the wizard is completely optional.
• There is always room for improvement. If you're able to add any contributions to make our project better, please let me know or discuss your thoughts right here in the comments.

I upgraded the OS of two servers last weekend. The planned downtime was also used to install LSI 3ware 9650SE-4LPML RAID controllers plus Battery Backup Unit (BBU). The BBU enables the controller to keep the write cache during a power failure. However, I was not able to create a RAID array with “Write Cache: enabled” on one system. I always got the message “Parameter not changeable” when the configuration was stored.

The solution was simple: wait. The Battery Backup Unit (BBU) on the system was not charged enough, therefore the controller denied enabling the “Write Cache” setting. So if you get the message “Parameter not changeable” when configuring a LSI 3ware Raid Controller, check if the “Write Cache” setting is the root of it if a charging or failed BBU caused it. You can check the BBU status in the Controller BIOS Setup (I found “BBU Ready: no” in “Information→Battery”).

I'm fairly new to the Red Hat and Fedora Linux eco-system. Therefore I just wanted to teach myself some details about RPM and YUM today, especially how to use the commands to handle package signatures and repository GPG keys.¹⁾ I noticed many unanswered forum postings during my research. That's why I decided to write this little blog entry, helping search-engine users to find more answers than questions.

• List all GPG keys on the RPM/YUM keyring:

  rpm -q 'gpg-pubkey-*' | sort

  The GPG keys are handled as gpg-pubkey-XXXXXXXX-YYYYYYYY packages. XXXXXXXX is the key ID in lowercase chars without 0x prefix. YYYYYYYY is the key creation time as unix timestamp in hex without 0x prefix.²⁾ Example usage:

  $ rpm -q 'gpg-pubkey-*' | sort
  gpg-pubkey-00a4d52b-4cb9dd70
  gpg-pubkey-069c8460-4d5067bf

  As you can see, my example RPM knows about the GPG keys 0x00A4D52B and 0x069C8460.

• List all GPG keys on the RPM/YUM keyring with a brief description:

   rpm -q 'gpg-pubkey-*' --qf '%{name}-%{version}-%{release} -> %{summary}\n'

  The GPG keys are handled as gpg-pubkey-XXXXXXXX-YYYYYYYY packages. XXXXXXXX is the key ID in lowercase chars without 0x prefix. YYYYYYYY is the key creation time as unix timestamp in hex without 0x prefix.³⁾ Example usage:

  $ rpm -q 'gpg-pubkey-*' --qf '%{name}-%{version}-%{release} -> %{summary}\n'
  gpg-pubkey-069c8460-4d5067bf -> gpg(Fedora (15) <fedora@fedoraproject.org>)
  gpg-pubkey-00a4d52b-4cb9dd70 -> gpg(RPM Fusion free repository for Fedora (15) <rpmfusion-buildsys@lists.rpmfusion.org>)

  As you can see, my example RPM knows about the GPG keys 0x00A4D52B and 0x069C8460.

• List all GPG keys on the RPM/YUM keyring with all details:

  rpm -qi 'gpg-pubkey-*'

• Check the fingerprint of a GPG key on the RPM/YUM keyring:

  rpm -q 'gpg-pubkey-XXXXXXXX-*' --qf '%{description}\n' | gpg --quiet --with-fingerprint

  XXXXXXXX is the key ID in lowercase chars without 0x prefix. Example usage:

  $ rpm -q 'gpg-pubkey-069c8460-*' --qf '%{description}\n' | gpg --quiet --with-fingerprint
  pub  4096R/069C8460 2011-02-07 Fedora (15) <fedora@fedoraproject.org>
        Key fingerprint = 25DB B54B DED7 0987 F4C1  0042 B4EB F579 069C 8460

• Remove / delete a GPG key from the the RPM/YUM keyring:

  rpm -e --allmatches 'gpg-pubkey-XXXXXXXX-*'

  XXXXXXXX is the key ID in lowercase chars without 0x prefix. Example usage:

  $ rpm -e --allmatches 'gpg-pubkey-00a4d52b-*'

  This command would remove the GPG key with ID 0x00A4D52B.

• Connect a GPG key to the RPM/YUM keyring:

  rpm --import '/path/to/public-key'

  Recent RPM versions can download keys via HTTP(S) and are even able to find ACSII-armored key blocks within HTML files. Example usage:

  $ rpm --import "http://pool.sks-keyservers.net:11371/pks/lookup?op=get&search=0x00A4D52B"

  This command would load the the GPG key 0x00A4D52B from a public keyserver and import it into RPM. Please note that SKS keyservers need working TCP connections on Port 11371.

Signatures ensure that the packages you install are what was produced by the software maintainer and have not been altered (accidentally or maliciously) by any mirror or third party. YUM should do these checks automatically when installing something out of a repository. However, you may want to check the GPG signature of a RPM package by yourself:

rpm -Kv /path/to/example.rpm

RPM needs the correct public key for this check. If you don't know how to get it, read on to learn what to do.

A perfect real-world example is the RPM Fusion setup to configure the RPM Fusion repositories on your Fedora system. They provide setup packages to install the needed .repo files and GPG keys without hassle. But you should verify them to make sure they are not altered and are really containing the original RPM Fusion keys instead the ones an attacker is using to sign it's malicious packages for his fake repository.

Let' start. RPM Fusion says we can configure everything with the following command:⁴⁾

Read more…

Puppet is a¹⁾ powerful open source tool to automate the configuration of and software management on Unix-like²⁾ operating systems. This posting is a distillate of the resources I collected during my Puppet learning phase. I hope it helps to get an overview about what Puppet can do for you and how to use it (plus providing existing Puppet users some new ideas or tips).

Selected slides and presentations (overview, use-cases, experts, tips)

• Puppet for dummies - ZendCon 2011 Edition
• Developing infrastructures with Puppet (JS slides, use the ← and → key)
• Being a Puppet Master: Automating Amazon EC2 with Puppet & Friends
• Puppet 101 - Puppet @ Stanford University
• Lessons learned when introducing puppet in an existing large scale corporate environment
• Puppet at Loggly
• One-Man Ops with Puppet & Friends
• Are we compliant?
• A Puppet Approach To Application Deployment And Automation In Nokia
• Puppet Modules Standards and Interoperability
• Kickstart & Puppet, Booking.com
• Puppet at High Scale

Read more…

Since PHP5, methods can return objects (including $this). This enables you to chain the method calls after preparing your class by returning the object itself. Therefore, “Method chaining” may save you e.g. much copy & paste or chars to type, reducing typing time for dozens of $obj->method() calls.

<?php
 
//common way
class foo {	
    public function one() {
        echo "one ";
    }
    public function two() {
        echo "two ";
    }
    public function three() {
        echo "three\n\n";
    }
}
$object = new foo();
$object->one();
$object->two();
$object->three();
 
 
//with method chaining (note the "return $this;")
class bar {	
    public function one() {
        echo "one ";
        return $this;
    }
    public function two() {
        echo "two ";
        return $this;
    }
    public function three() {
        echo "three\n\n";
        return $this;
    }
}
$object = new bar();
$object->one()
       ->two()
       ->three();
?>

I did not made any performance measurements right now… so I can't say if method chaining is faster/slower in common environments or not. And to be honest, I don't use method chaining for myself:

• You simply can't see if a class supports method chaining without trying it or looking at its source.
• The need for all these return $this; within the class methods.
• IMHO, both reasons are leading to inconsistent coding styles and behaviors in real world applications containing 3rd party classes.

The interface of Google Groups implies that you can only subscribe with a Google Account and its email address. But even Google makes it harder than it should be, it is possible to use any other valid email address to subscribe. You just have to call the subscription page manually by editing a URL:

http://groups.google.com/group/name-of-the-group/boxsubscribe?email=your-url-encoded-email-address

Just substitute the following:

• name-of-the-group → the group you want to subscribe to
• your-url-encoded-email-address → your url-encoded email address

I just released updated versions of the following DokuWiki templates:

• vector – current MediaWiki/Wikipedia look and feel.
• monobook – traditional MediaWiki/Wikipedia look and feel.
• prsnl10 – minimalist template, suitable for portfolio and personal websites.
• mnml-blog – minimalist template, suitable for blogging with BlogTNG.

All of them are compatible to “Angua” and its awesome new media manager. Have fun.

Vorgehen, falls man ein PayPal-Konto löschen will:

1. Bei PayPal einloggen und sicherstellen, dass keine Transaktionen mehr offen sind.
2. http://www.paypal.com/cgi-bin/webscr?cmd=_close-account aufrufen.
3. Den Anweisungen folgen und gefühlte tausendmal bestätigen, dass man es mit der Schließung des Kontos ernst meint.

Der Link ist scheinbar nicht mehr direkt über das PayPal-Menü aufrufbar (meiner Erinnerung nach war früher ein entsprechender Punkt unter “Mein Profil” aufgeführt). Aktuell findet man den Link über das interaktive Hilfecenter via Suchwort “kündigen”. Um sich die Sucherei zu ersparen sei der Direktlink hier für's “Archiv” verbloggt.

Some userspace programs got problems with the 2.6.x→3.x kernel numbering transition. To prevent the need to fix everything at once, the Fedora developers decided to ship 3.x kernels as 2.6.4x on Fedora 15 Lovelock and use the correct numbering scheme on Fedora releases ≥16 Verne.

This kernel version numbering hack makes some problems with the current VirtualBox 4.1.6 on Fedora 15: /etc/init.d/vboxdrv setup exits with an error (/var/log/vbox-install.log says that recompiling VBoxPci-linux.o failed). The reason is simple: A check thinks that the running kernel 2.6.41.1 is older than 3.1. Therefore the wrong header file gets included (asm/amd_iommu.h instead of linux/amd-iommu.h).

Quick fix to get your VirtualBox working again:

1. Open the belonging source code file as root:

   $ su -
   $ gedit /var/lib/dkms/vboxhost/4.1.6/source/vboxpci/linux/VBoxPci-linux.c

2. Search for

   #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0)
   # include <asm/amd_iommu.h>
   #else

   (~line 37) and replace it with

   #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0)
   # include <linux/amd-iommu.h>
   #else

3. Recompile the needed modules:

   $ su -c '/etc/init.d/vboxdrv setup'

If you are searching for a powerful laptop to run Fedora 15 Lovelock on, have a look at the Lenovo ThinkPad T420 4180W1G/4180PH1.¹⁾ It simply rocks. All the internal peripherals are working out of the box (LAN, WLAN, graphics, sound, microphone, webcam, volume up/down and mute buttons, brightness control buttons, eSATA…). The Intel HD3000 processor graphics runs smoothly. Even no problems with external monitors up to a 2560×1600 resolution or when using both the built-in screen plus an external monitor connected to the Mini Dock Series 3 45N6678 docking station. The Intel Core i5-2520M CPU provides VT-d and VT-x. So everything is fine if you want to run VMs.

Downsides, pitfalls and notes:

• The built-in speakers are really bad, even for a laptop.
• The keyboard shows signs of cosmetic wear after a few weeks of usage.
• Microsoft tax a.k.a. Windows 7 Professional 64bit. At least, you can use the pre-installed Windows to update the laptop's firmware with a few clicks before installing Linux. And the license may be used to run a Windows 7 VM (although the laptop is shipped without installation media, you can download the original Windows 7 ISO images from Digital River).
• I can't tell if the fingerprint sensor and the Class 1 Smartcard Reader are working out of the box because I do not need nor did I test them. But the Smartcard Reader is at least recognized by the OS.
• When using the Mini Dock Series 3 45N6678, the analog sound line-out is not passed-through (everything else works). This means you still have to use the laptop's headphone connector to connect speakers.
• If you are looking for similar models out of the T420 family, you should know that some of them got two graphics adapters (a combination of Intel and NVIDIA). I don't know if these make any trouble or need special configuration because the 4180W1G/4180PH1 comes with Intel graphics only.

Tip for German readers: Studenten, Lehrer, Lehrkräfte und wissenschaftliche Mitarbeiter bekommen das ThinkPad T420 4180PH1 bei Brünings + Sander mit erheblichem Rabatt. Ich habe nichts mit der Firma zu tun und bekomme auch keine Provision. Aber meine Erfahrungen mit B+S waren bisher stets positiv.

The HPC 615 was very popular because of its attractive cost-performance ratio.¹⁾ I just installed Fedora 15 Lovelock on a HPC 615 with AMD Athlon X2, 320GiB HDD, ATI Radeon HD3200 and 4GiB RAM. Everything works out-of-the-box with one exception: Wireless LAN. There was no firmware for the Broadcom BCM4312 WLAN chip. However. Version 4.150.10.5 of the proprietary firmware works like a charm:

1. The B43 firmware cutter tool is used to extract and install the proprietary Broadcom firmware. Use a LAN cable to get internet connection. Open a terminal and install it:

   su -c 'yum install b43-fwcutter'

2. Download the firmware and use b43-fwcutter to extract and install it:

   su -
   cd /tmp
   wget http://downloads.openwrt.org/sources/broadcom-wl-4.150.10.5.tar.bz2
   tar xjf ./broadcom-wl-4.150.10.5.tar.bz2
   cd ./broadcom-wl-4.150.10.5/driver/
   b43-fwcutter -w /lib/firmware/ wl_apsta_mimo.o

   Reboot or restart the network. Your WLAN should work now.

Note: I tried several things before. Known solutions and b43-openfwwf were not able to provide a stable connection when using WPA2. Same for other versions of the proprietary Broadcom firmware.

Font rendering is a matter of taste. However, I personally think Ubuntu's default font rendering is the most eye-pleasing one of the whole Linux eco-system. And if a website's CSS font stack is looking good on Ubuntu, you can be relatively sure that it also works for Mac or MS Windows as long as the used fonts are available on these platforms. It is not hard to get the same font rendering on Fedora. This text is just a bit longer than a few commands because I try to provide additional background information and useful web-search-keywords which you may need if you have other targets than a 100% Ubuntu-like rendering.

To achieve the desired result, you have to know which parameters exist and how to change them. The most important things are:

• Resolution (DPI).
• Font hinting and the used font hinting method.
• Font rasterization. Especially the used anti-aliasing method and its strength.
• The used font rendering engine. The one shipped with Fedora comes without subpixel rendering (more on this later).

So let's look at the defaults applied on Ubuntu 10.10. You can do this on the terminal with xrdb -query:

Xft.dpi:	96
Xft.antialias:	1
Xft.hinting:	1
Xft.hintstyle:	hintslight
Xft.rgba:	rgb
Xft.lcdfilter:	lcddefault

As you can see, Ubuntu is using RGB anti-aliasing with subpixel rendering (lcd-default means “subpixel (LCD)” method) and slight font hinting. Now compare this with the default values on Fedora 15 Lovelock:

Xft.antialias:	1
Xft.dpi:	96
Xft.hinting:	1
Xft.hintstyle:	hintmedium
Xft.rgba:	none

This shows that Fedora does use grayscale anti-aliasing, a stronger font hinting style and no subpixel rendering by default. This is the reason why the same fonts look different on Fedora and Ubuntu.

1. Install the freetype-freeworld package. You need subpixel rendering the achieve the same results as on Ubuntu. The FreeType rendering engine shipped by default comes without it but you can install the freetype-freeworld package out of the RMPfusion-free repository to get a version with subpixel rendering. If not already happend, enable RPM Fusion on your system. Open a terminal and install the freetype-freeworld package:

   su -c "yum install freetype-freeworld"

   You should know that subpixel rendering is patented and therefore not completely free (as in speech). Using this package might not be legal in your country. The choice is yours and it is your legal responsibility to make sure that the software you are installing can be legally used.

2. Adjust the hinting style and enable RGB anti-aliasing. Ubuntu it using hintslight hinting by default, Fedora comes with hintmedium. Additionally, we need RGB instead of grayscale anti-aliasing. Open a terminal and execute the following commands to set the anti-aliasing and hinting style:

   gsettings "set" "org.gnome.settings-daemon.plugins.xsettings" "hinting" "slight"
   gsettings "set" "org.gnome.settings-daemon.plugins.xsettings" "antialiasing" "rgba"

3. Activate the lcddefault lcdfilter. Unfortunately, there is no GSettings key for it (at least as I'm writing this), therefore you have to create a hidden .Xresource file with the Xft.lcdfilter: lcddefault setting in your home directory. Open a terminal and execute the following command to do so:

   echo "Xft.lcdfilter: lcddefault" > ~/.Xresources

4. Some settings need a restart to take effect, so reboot your system. If everything worked you should get the following xrdb -query output (the output order does not matter if the values are the same):

   Xft.antialias:	1
   Xft.dpi:	96
   Xft.hinting:	1
   Xft.hintstyle:	hintslight
   Xft.lcdfilter:	lcddefault
   Xft.rgba:	rgb

• You may find the gnome-tweak-tool interesting. E.g. it provides an option to switch the window-title-bar font. Use the following command to install it:

  su -c "yum install gnome-tweak-tool"

• I used the command line tool gsettings to adjust the GSettings key values above. If you want to influence and explore available keys by using a GUI, have a look at the dconf-editor. Use the following command to install it:

  su -c "yum install dconf-editor"

• You may want to use the Ubuntu fonts, too. They are not included in the main repositories right now,¹⁾ therefore I wrote the install-ubuntufonts-fedora.sh bash script to make the font installation faster and easier. There is a high probability that this script will never be useful to someone else than myself. But you never know. If you want to use it, open a terminal and run the following commands to download and execute it (copy and paste recommended):

  wget "http://blog.andreas-haerter.com/_export/code/2011/07/18/install-ubuntufonts-fedora.sh?codeblock=1" -O "/tmp/install-ubuntufonts-fedora.sh"
  chmod a+rx "/tmp/install-ubuntufonts-fedora.sh"
  su -c "/tmp/install-ubuntufonts-fedora.sh"

  Please read the Ubuntu Font Licence for all the rules that govern the use of the fonts.

• If you want to go any further, you should know some things about the fontconfig system. First of all, it is controlled by *.conf files. Fedora is looking for them at the /etc/fonts/conf.d/ directory and they get imported in alphabetical order.²⁾ Please note that every file in this directory should be a symlink pointing to a real config file located in /etc/fonts/conf.avail/. This makes it possible to deactivate settings by deleting the symlink in /etc/fonts/conf.d/ without loosing the corresponding config file in /etc/fonts/conf.avail/. It is also recommended to follow the rule “one setting, one file”. This makes sure you always know which files configures what.
  All settings at /etc/fonts/conf.d/ are affecting all user accounts and therefore you need root privileges to create or edit the files. If you want to influence only a specific user account, it is also possible to place files in the user's ~/.fontconfig/ directory (simply create it if it is not already existing).
• I assume that your display is using RGB pixels (the subpixel layout test page can help you to verify this). If your monitor is using BGR, V-RGB, or V-BGR pixels, you might want to use another anti-aliasing setting than rgba.

• ScreenFontSettings
• Improve Fonts in Fedora
• The Lagom LCD monitor test pages

Edit 2011-07-21: Here are the demanded screenshots. You can use your keyboard to navigate trough them (← and → key). The last one shows a terminal with Ubuntu fonts.