Bart van Andel wrote:
> - Open Hugin 2009.2.4450 (by Ad), on my Windows Vista SP3 setup.
> - Clicked "Align..." on the assistant tab, which started APSCpp 2.5.2.
It can't be APSCpp 2.5.2 - APSCpp 2.5.2 has not been released yet.
If a binary says it is 2.5.2... caveat emptor.
The current status of APSCpp:
* 2.5.2 does not exist. The trunk, that will eventually become 2.5.2, is
broken, work in progress, with no estimated time to fix. Nobody is
actively working on it *now*. Nobody should distribute binaries made
from APSCpp's trunk, as requested by Bruno a few weeks ago.
* 2.5.0 is the official "stable" release, but it has memory leaks and is
likley to crash on large projects / low memory.
* Bruno issued recently a tarball of APSCpp 2.5.1 (RC2 right now) which
is 2.5.0 + fixes. The RCs are also tagged in SVN. RC2 is the recommended
one to build and distribute, and is likely to become the official stable
release before the end of the month.
> NB: upon trying with an older version of APSCpp (the one supplied with
> SVN 4075), the "Align" button in the assistant tab yields a perfect
> result (including correct exposures) right away.
I don't recall what version of APSCpp is delivered with Ad's SVN 4075
snapshot (note that SVN 4075 is not enough to characterize a version of
Hugin - it could be trunk/4075; or 2009.2/4075; or 0.7.0/4075).
From what you describe it seems that it is 2.5.0.
Bottom line of all of this: CAVEAT EMPTOR. Verify binaries before using
them and before trusting them to do what you expect them to do.
Thanks Bart for going through the pains of doing it.
Yuv
I AM NOT SARCASTIC. I AM DEAD SERIOUS (AND YES, I AM SCREAMING, BECAUSE
IT SEEMS THAT USERS DON'T HEAR THE MESSAGE).
> but this might indicate that
> the version information on APSCpp (and probably other tools as well)
> is not descriptive enough in its current form.
that's part of the problem. Let's see if I can make it clear.
"Caveat emptor" means that if you download something from somewhere, you
should check that it is what it says to be.
This starts with the builder. It is the builder's responsibility to make
sure the code that he downloaded from SourceForge is not tampered. This
is why we have sha1 checksums.
Tampering can happen along the road. An error in an internet
transmission. Or a malicious attack on SourceForge. Or plenty of other
things.
Once the code is on the builder's machine even more things can go wrong
- a bug in the build chain, an obscure corrupt registry entry, a
firewall blocking a critical operation, a virus or trojan infecting the
freshly created binary... you name it. There is a lot of risk involved,
and I have not even mentioned *intentional tampering* - e.g. a malicious
person wanting to spread a virus will piggy-back on users' blind
excitement for free (as in beer) software
It is the end-users' responsibility to verify what executable they
download and run on their system.
The builder can be proactive and help them; communicate to them what he
built from; how he built; and providing checksums. But this is
completely out of control of the Hugin project.
What we can control is that the sourcecode that we upload to SF is
"good". We do this with a basic test before uploading; and with sha1
checksums to guarantee integrity.
We also try to automate and systemize version naming to give
*additional* indication of what this stuff is, but it is *very easy* for
anybody to change the version string. Bottom line: don't rely on a
version string only.
> APSCpp from Ad's 4075 build ("Version 0000.00.0.4075 Ad Huikeshoven"
> in hugin's About screen -- it isn't mentioned anywhere from which
> branch, not inside Hugin, not on Ad's download page, but on this group
> [1] it is mentioned as "SVN version 4075, or hugin 0.8.0-rc5") simply
> says "Version 2.5.0 for hugin 0.7". The version supplied with Ad's
> 4012 build is an exact binary copy.
Nice research. *I* could build a very simple program whose only purpose
is "format C:\" and make it look like Hugin, and have the same version
string "Version 0000.00.0.4075 Ad Huikeshoven". So what do you do next?
run it? then complain with Ad? or with the Hugin team?
> What about a new command line argument "--version" which gives
> detailed version information, like: version number, build state (alpha/
> beta/rc/release etc), which branch (can this even be done
> automatically?)
you're trying to solve the wrong problem with the wrong tool.
Wrong problem: it does not matter what Hugin or APSCpp *say* - if you've
come so far, you've already exposed yourself to a major risk.
Wrong tool: if what you look for is "build state", there are only two
states: official: download from SourceForge. unofficial: everything
else. CAVEAT EMPTOR.
That said, it is not that we are not trying to give you information.
Ad has improved his communication. On his website he tries to mention
which version of the most dynamic projects (autopano, libpano,
enblend/enfuse and of course Hugin) he uses. That communication could be
improved with the branch when there are branches in the repository. Just
an SVN number does not say which branch was used, and Hugin trunk/4450
is different than Hugin 2009.2/4450. It will perform differently and
will deceive user's expectations. Moreover, Ad's installers do not have
a sha1 checksum. How do I know that I downloaded what he uploaded? that
his server has not been attacked and tampered by a third party? that
something went wrong in the pipes?
We, the Hugin team, have improved communication. Much of the sensible
version information is already in the Hugin tools. APSCpp is not a Hugin
tool and follows a different convention. Build state is not relevant
(see above) and would require manual intervention, which means there
would be omissions and mistakes. We currently automate the basic thing
which is version number (odd/even minor version for trunk/release), and
the SVN number. For Windows there is an additional check where the
Builder has to enter a name and a date, but these are not verified
entries - I can run the CMake build system and enter "Barack Obama" in
the HUGIN_BUILDER field and "25-Dec 24 B.C." on the build date.
And what can't be done automatically is not worth doing because there
will be errors and omissions.
, SVN revision, build date, compiler, build by whom?
> Sounds like a nice job for a fresh Hugin programmer (including myself,
> but I currently should really be doing other things).
yeah, right. there are always other things to do. then just don't get
into trouble. if you don't have time to verify what you download before
installing it, don't install it.
Yuv
With the current Hugin trunk the command-line tools -h option does
tell you the exact current version:
nona -h
nona: stitch a panorama image
nona version 2009.5.0.4622
The next enblend release will have a --version string that includes
all sorts of information including the name of the person who built
the binary.
--
Bruno