GDScript packaging

[Cooper, David]

Hello,

I’m working on PR 3024 to add gdscript highlighting and packaging of exercise resources for local activecode support in html and runestone publications.

Thanks Rob for your patience reviewing my changes and your detailed notes on parts that I missed in the last pass. I was able to sort out most of them.

I have a couple of design questions to address, and one implementation question.

First, for the 2 design questions, I have a helper python file, called godot_helper.py, that checks for the right version of Godot and its corresponding export templates. 

1. That script currently imports the certifi library, which is not part of the standard library, because there are some edge cases using MacOS where installs from python.org  don’t have the certificates set up correctly by default.  Does anyone have thoughts about using or not using certifi? 

2. After downloading the correct version of Godot and its corresponding templates, there isn’t currently an integrity check to see that it wasn’t tampered with. However, it is downloading directly from the release area of godotengine’s repository on GitHub.com. Should there be an integrity check, and if so, are there suggestions for implementing this?

Next, for the implementation question:

Currently godot is run directly on the source files, and so some of the intermediate temporary files end up being saved in the source directory. Ideally, the source files would be copied to a temporary directory, and then godot would be run on that directory instead of the source directory. Is there a standard temp directory to work with, and is there an example I can look at that does this so that I can leave the source directory untouched?

Thank you,

David

David G. Cooper, PhD
Assistant Professor
Computer Science

West Chester University

25 University Ave

Office 142

x2651

dco...@wcupa.edu

[Cooper, David]

I figured out the implementation question.

So, it’s just the 2 design questions:

1. Is certifi a reasonable non-standard library import

2. Should an integrity check of godot and the export templates be done before packaging each exercise, or once per packaging run?

Thanks,

David G. Cooper, PhD
Assistant Professor
Computer Science

West Chester University

25 University Ave

Office 142

x2651

dco...@wcupa.edu

[Andrew Scholer]

Brief, on phone...

It looks like the requests package has certifi as a dependency and PTX requires requests. So depending on certifi seems reasonable. 

Not sure I understand what is being verified? The files downloaded from GitHub? That sounds like a one time thing on download. Once they are on the local filesystem I don't see why you world reverify. 

Andrew

--
You received this message because you are subscribed to the Google Groups "PreTeXt development" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pretext-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/pretext-dev/701C51C8-BE27-4439-8992-667AE4856C04%40wcupa.edu.

[Cooper, David]



Brief, on phone...

It looks like the requests package has certifi as a dependency and PTX requires requests. So depending on certifi seems reasonable. 

Great!

Not sure I understand what is being verified? The files downloaded from GitHub? That sounds like a one time thing on download. Once they are on the local filesystem I don't see why you world reverify. 

It depends on if we’re concerned that someone might sideload an unstable version of Godot or the export templates.

I’m not sure what the likelihood of a man in the middle attack would be for the download since it’s using github.com directly and not a mirror.

But, if anyone thinks it’s necessary, I don’t think it’s too hard to do.

To view this discussion visit https://groups.google.com/d/msgid/pretext-dev/CACm44N-VEozsZDioWsWWv9JVbNReqRKCbJpEyZ_JfG863xRMcA%40mail.gmail.com.

[Cooper, David]

I added a checksum integrity check for the download. 

If anyone thinks more should be done, please chime in.

Thanks,

David

David G. Cooper, PhD
Assistant Professor
Computer Science

West Chester University

25 University Ave

Office 142

x2651

dco...@wcupa.edu