I worked a bit on the way the educational add-on creates URLs for new projects. It uses the title of a project now. I added also a feature to validate the project name uniqueness. I’ll work on the view of the projects next time.
I worked a bit on the way the educational add-on creates URLs for new projects. It uses the title of a project now. I added also a feature to validate the project name uniqueness. I’ll work on the view of the projects next time.
The Call for Location for the 2017 Conference opens on May 1st, and will close on July 31, 2016. All details are available on the following wiki page: https://wiki.documentfoundation.org/Events/2017/LibreOffice_Annual_Conference/Call_for_Location.
As for the past editions of the event, the idea is to get proposals in advance in order to have 2017 location set before 2016 Brno conference, to give the opportunity to the 2017 event organizers to attend 2016 conference to get familiar with all the details: location, schedule, collateral events, etc. Traditionally, the LibreOffice Conference takes place between September and November, with a preferred date of October.
Organizing the LibreOffice Conference is a time-consuming task, where several team members are needed. Shortly before the Conference, it tends to be a full-time job, so organizers should be able to invest the necessary amount of time. Also, dealing with finances and sponsors is one of the main responsibilities of the organizers, so they must be sure to collect enough funding before the Conference, and only spend the money that they have.
In the past, we have been receiving applications from several third parties, including casinos or professional event managers. Keep in mind that the LibreOffice Conference is a community event, by the community for the community. While we appreciate people with professional event management skills, proposals not supported and driven by community members (not only TDF members) will not be considered.
The proposal should cover the following topics (all details are on the wiki page): team, organizing entity, main venue, accommodation, reason why (you want to organize the LibreOffice Conference), and other relevant details that can support the application (such as collateral events). The proposal – in English – should be sent as plain text or HTML e-mail, or as Open Document File (ODT) to email@example.com.
There’s so much fantastic work going on in LibreOffice at the moment, in all areas of the project: development, translations, bug fixing, documentation, user support and much more. The community is doing stellar work to make the software better, faster, more reliable, easier to use, and available for everyone.
In May, we want to really highlight the efforts of everyone involved, so we’re going to run a special campaign: the Month of LibreOffice. This campaign will give contributors the opportunity to thank members of the community for their work, by awarding them barnstars like so:
But that’s just the start of it! We’ll also be awarding badges for contributions to LibreOffice. Every time someone has their code merged, confirms a bug, submits documentation updates, helps users on Ask LibreOffice or just spreads the good word on Twitter, we’ll award them a badge:
There are multiple badges to collect, and at the end of the campaign we’ll see who got the most. Maybe you can get them all!
The Month of LibreOffice will kick off on Monday 2nd May, so stay tuned to this blog for the full announcement and information on how to get involved…
I worked again with the index and search feature of Plone to finish the search function in the new add-on that could be the main part of a new LibreOffice educational site. I fixed the last bits and added some more entries to the categories fields. The index is working fine now. Committed my changes under GPL to TDF’s github repository.
Our Hoster Manitu is currently experiencing a DoS attack on its infrastructure. They are working on measures to fight the attack. This might affect the availability of many of our services.
I worked with the portal catalog of the current LibreOffice extensions and templates website to search for content that is not already set to language independent. There are some extensions and template projects and releases that has not this metadata. I changed some of them to that label today.
Today I would like to focus on a quite interesting project, even though it is rarely spoken of: The Document Liberation Project. The Document Liberation Project is LibreOffice’s sister project and is hosted inside the Document Foundation; it keeps its own distinct goals and ecosystem however. We often think of it as being overly technical to explain, as the project does not provide binaries everyone may download and install on a computer. Let’s describe in a few words what it does. The Document Liberation project aims at developing filters handling various file formats. The output of the project is then reused inside LibreOffice as well as in other Free Software such as (but not limited to) Inkscape, Abiword, etc.
Many people have files and documents that are sitting somewhere on their hard drives and that were first generated by an ancient office suite, word processor or spreadsheet application. Most of these file formats were never publicly documented. As a result, people experience vendor lock-in as they are unable to convert them in a stable, supported and open file format they can actually use. In order to solve this conundrum the Document Liberation project has a set of export filters that convert files to ODF, epub and even Abiword format. Its crownjewel, so to speak, is the set of import filters it has been collecting over the years and that it has improved. Those filters range from MS Publisher files to Clarisworks and Apple Keynote and also have many rarely used file formats. Let’s take a look at the list mentioned on the project’s website:
Corel WordPerfect import library.
Corel WordPerfect Graphics import library.
Microsoft Works import library.
A library for import of many legacy Mac document formats.
AbiWord import library.
Corel Draw import library.
Microsoft Publisher import library.
Microsoft Visio import library.
Apple Keynote/Pages/Numbers import library.
Aldus/Macromedia/Adobe FreeHand import library.
A library for import of many e-book formats.
Adobe PageMaker import library.
This list is impressive and keeps growing. One may also notice the usefulness of the project for digital artists and designers. You can help the project in three ways:
* help developing these filters and libraries
* help documenting the formats the project tries to manage
* submit test documents and assess how effective the filters are in real life.
You may of course donate to the Document Foundation as well. The Document Liberation project matters a lot. It matters for many different people and for the ecosystem of desktop software relying on these files, from office suites to graphical design tool and document processors. If you feel like you could help, do not hesitate one bit, your contribution will be much appreciated and you will help liberating the world, one document at a time.
Last month we had some spam attacks on our TDFWIKI. We blocked the new accounts and deleted the pages manually. A really big thank goes to cloph as he helped me and disabled the manual registration for new users when I wasn’t available.
After that we had modified again our Title-Blacklist to prevent pages create with well known spam titles (mostly including phone numbers for Canada and USA, some words like phone support, printer assistance, etc.).
Now we should improve our “abuse filter” which checks every edit for spammers who try to add phone numbers to the page content itself. Sadly we realized that it prevented sophie to add and create the recordings of the BoD calls, so it got deactivated again. This is still on my todo list.
After rereading my “unread” planet blog post – in this case Charles’ Losing the Art of Wiki , I added as suggested by beluga / buovjaga to add yet another extension: an improvement to the RecentChanges page.
For the migration of our virtualization servers to our own rack and the upgrade to 10G based Intranet, we plan the downtime of excelsior on April 26, 0730UTC, and the downtime of falcon on April 27, 0730UTC. The downtime should last about one hour. The vms that will be affected are:
excelsior has been migrated. There are some slight issues regarding the intranet connection, all public services are available again.
The newly fitted network card for excelsior seems to have one faulty port. Excelsior needs to be shutoff again to replace the interface
A HDD on excelsior also failed during migration, it will be replaced during the second downtime.
Excelsior is up and running.
Migration of falco takes a bit longer than expected - again Network card struggles - working on it.
Falco is up and running.
In March 2016, we asked the community how they use the sidebar and how they feel it should evolve. About 290 participants answered the single choice questions and around 100 answered the free text question. All in all, users want …
After adding support for reading OOXML signatures in LibreOffice, I continued with implementing OOXML signature export (as in: not only verification, but signing).
By verification, I mean that I count the signature of the input document, then compare it with an existing signature, and if they match, it is verified. This can be also called "import", as I only read an existing signature, I don’t create one. By signing, I mean the creation of a new signature, which is always good — if it isn’t, that’s a programming error. This can be also called "export", as I write the new signature into the document.
First, thanks to the Dutch Ministry of Defense who made this work possible (as part of a project implementing trusted signing and communication in LibreOffice), this included:
signing a previously unsigned document
appending a signature to an already signed document
removing a signature from a document with multiple signatures
removing the last signature of a signed document, turning it into an unsigned one
Obviously the hardest part was the initial success: signing a previously
unsigned document, in a way that is accepted by both LibreOffice and MSO. One
trick here is that while in ODF the signature stream is simply added to an
existing document storage, in OOXML the storage has to refer to the signature
sub-storage (it’s not a stream, as it has a stream for each individual
signature), then it has to be signed, and finally the signature can be added
to the document storage. So instead of reading the document, then appending
the signature, here we need to modify the document, and then we can append the
signature. By referring the signature sub-storage, I mean it is necessary to
[Content_Types].xml (so it contains a mime type for both the
extension, and also for the individual
/_xmlsignatures/sigN.xml streams) and
_rels/.rels stream has to refer
will contain the list of actual signatures. A surprising detail is that the
signature is required to contain quite some software and hardware details
about your environment, like monitor resolution, Windows version and so on.
For a cross-platform project like LibreOffice this isn’t meaningful, not to
mention we have no interest in leaking such information. So what I did instead
is writing hardcoded values based on what my test environment would produce,
just to please MSO. ;-)
After the initial OOXML signature exporter was ready, the next challenge was adding multiple signatures. The problem here is that you have to roundtrip the existing signatures perfectly. And when I write perfectly, I really mean it: if a single character is written differently, then the hash of the signature will be different, so the roundtrip (when we write back an existing and a new signature to the document) will invalidate the signature. And there is no way around that: the very point of the signature is that only the original signer can re-calculate the signature hash. :-) So what we do is simply threating the existing signatures as a byte array, and when writing back, then we don’t try to re-construct the signature stream based on the xmlsecurity data model, but simply write back the byte array. This way it’s enough to extract parts of the signature which are presented to the user (date, certificate, comment), and we don’t need to parse the rest.
Removing one of multiple existing signatures isn’t particularly hard, you just
need to update
[Content_Types].xml which refer each and every signature stream. It’s a good
idea to truncate them before writing, otherwise you may get a not even
well-formed XML as a result.
Finally removing the last signature is a matter of undoing all changes we did
while adding the first signature (the content type list and the toplevel
relation list), finally removing the signature sub-storage all-together. I
also factored out all this signature management code from
DigitalSignaturesDialog (which is a graphical dialog) to
DocumentSignatureManager, so that all the above mentioned features can be
Putting all of these together, LO can now do all signature add, append, remove and clean operations a user would expect from what is referred as simply OOXML signature support. As usual, you can try this right now with a 5.2 daily build. :-)
Due to the upgrade of our infrastructure, there will be a planned downtime for our virtualization host dauntless, with the following VMs and services affected:
The downtime will be on Wednesday, April 20, 0730 UTC and last for about 30 Minutes.
The downtime lasted about 150 Minutes due to the following problems that occured:
A pootle security update needs to be installed. Due to the needed database migrations, this might take quite a long time. The update process starts on Monday, 18 April, 0300 UTC and might take up to 12 hours. During that timeframe, pootle will be offline.
The database migration is still in progress as of Wednesday, 20 April, 1230 UTC. It is taking longer than expected by the pootle experts.
Details about the ongoing migration:
After evaluating the different options (continuing migration/aborting migration and downgrade), we decided to continue on until Friday Noon. If no sufficient progress was made by then, the migration will be aborted and the pootle installation downgraded.
At the LibreOffice Espania Summit I gave a workshop about LibreOffice extension development.
For that, I prepared a starter extension which contains all the boilerplate code & config you need to create an extension for LibreOffice. It is designed to work with the LOEclipse plugin and contains a step-by-step guide to setup the development environment.
You can find the starter extension here: https://github.com/smehrbrodt/libreoffice-starter-extension, feel free to use it to create your own LibreOffice extension.
The Document Foundation invites members and volunteers to submit proposals for papers. Whether you are a seasoned presenter or have never stood up in public before, if you have something interesting to share about LibreOffice, we want to hear from you!
Proposals should be filed by July 15th, 2016 in order to guarantee that they will be considered for inclusion in the conference program.
The conference program will be based on the following tracks:
a) Development, APIs, Extensions, Future Technology
b) Quality Assurance
c) Localization, Documentation and Native Language Projects
d) Appealing Libreoffice: Ease of Use, Design and Accessibility
e) Open Document Format, Document Liberation and Interoperability
f) Advocating LibreOffice
– Enterprise Deployments and Migrations, Certifications and Best Practices, Building a successful business around LibreOffice
– Round table with company representatives
– Small local businesses, governments and non profit, to be conducted in Czech language
Presentations, case studies, workshops, and technical talks will discuss a subject in depth, and will last 30 minutes (including Q&A). Lightning talks will cover a specific topic and will last 20 minutes (including Q&A). Sessions will be streamed live and recorded for download.
Please send a short description/bio of yourself as well as your talk/workshop proposal to the program committee address: firstname.lastname@example.org
If you do not agree to provide the data for the talk under the “Creative Commons Attribution-Share Alike 4.0 License”, please explicitly state your terms. In order to make your presentation available on TDF YouTube channel, please do not submit talks containing copyrighted material (music, pictures, etc.).
If you want to give multiple talks, please send a separate email for each.
Finally arrived at Las Palmas, I joked to go by sailboat, it might actually have been easier. My USB pen, was called a weapon in the airport….yes it is used to tap on my tablet…long discussion, and end effect, I need to bey a new one (honestly wonder if the security officer is a tablet user).
we are 12 people listening to a bunch of interesting stuff, an elegant mixture of user level talk and programming. It is actually interesting to see the flashy C++ classes from a user view (looks very simple, no inheritence and no clang control).
Let us do command line.
No let us be users.
We continue tomorrow and Saturday, so please come if you happen to be in las palmas.
Berlin, April 7, 2016 – The Document Foundation (TDF) announces LibreOffice 5.1.2, the second minor release of the LibreOffice 5.1 family.
LibreOffice 5.1.2 is targeted at technology enthusiasts, early adopters and power users. For more conservative users, and for enterprise deployments, TDF suggests the “still” version: LibreOffice 5.0.5. For enterprise deployments, The Document Foundation suggests the backing of professional support by certified people (a list is available at: http://www.libreoffice.org/get-help/professional-support/).
People interested in technical details about the release can access the change log here: https://wiki.documentfoundation.org/Releases/5.1.2/RC1 (fixed in RC1) and https://wiki.documentfoundation.org/Releases/5.1.2/RC2 (fixed in RC2).
LibreOffice 5.1.2 is immediately available for download from the following link: http://www.libreoffice.org/download/libreoffice-fresh/.
LibreOffice users, free software advocates and community members can support The Document Foundation with a donation at http://donate.libreoffice.org.
Due to the migration of our colocated servers to a new rack (our own rack for that), the following servers will be unreachable for about an hour on Tuesday, 12 April, from 0730 UTC on. The following servers will be affected by the move:
The following services will be affected:
No other services will be affected.
The Document Foundation (TDF), the charitable entity behind the world’s leading free office suite LibreOffice, seeks for companies or individuals to
design and implement a profile safe mode for LibreOffice
to start work as soon as possible.
For bug reports and QA issues, users are from time to time required to use a fresh user profile, i.e. without settings different from the built-in defaults, with no document restore enabled and with all extensions disabled. Until now, the easiest route to achieve this is to delete or rename the existing user profile.
A feature should be implemented that enables the user to start LibreOffice in a temporary safe mode as outlined above, without having to manually delete their profile, and with the ability to return to the regular state afterwards.
In addition, the user should be able to choose which elements are to be put in safe mode, e.g. configuration, extension, documents, templates, and also be presented with an option to actually reset their profile permanently.
Besides an UI item from where the functionality can be triggered, the safe mode dialog should also pop up after a program crash to help the user identify and report the problem.
The scope of this task includes:
C++ Programming language for the LibreOffice client part
English (Conversationally fluent in order to coordinate and plan with members of TDF)
TDF welcomes applications from all suitably qualified persons regardless of their race, sex, disability, religion/belief, sexual orientation or age.
As always, TDF will give some preference to individuals who have previously shown a commitment to TDF, including but not limited to members of TDF. Not being a member, or never having contributed before, does not exclude any applicants from consideration.
The task offered is a project-based one-off, with no immediate plans to a mid- or long-term contractual relationship. It is offered on a freelance, project basis. Individuals and companies applying can be located anywhere in the world.
TDF is looking forward to receiving your applications, your financial expectations (name the final price for the turnkey project), and the earliest date of your availability, via e-mail to Florian Effenberger at email@example.com no later than May 6, 2016. You can encrypt your message via PGP/GnuPG.
Applicants who have not received feedback by June 6, 2016 should consider that their application, after careful review, was not accepted.
In the first part of the survey results analysis, we showed how people use LibreOffice Draw. Those questions were of quantitative nature with an exact answer that easily can be summed up and averaged. In this second part, we are …
In February 2016, we asked the community for what purpose LibreOffice Draw is being used and in what direction it should evolve. The response to this survey was incredible, with more than 2,000 participants answering the questionnaire and almost 1,000 …
Berlin, April 1st, 2016 – The Document Foundation unveils breakthrough DUPE technology, to rescue legacy overhead projectors – still available in thousands of conference rooms worldwide – from eternal oblivion. DUPE technology, based on a patented DUal PErambulation approach, will be integrated in LibreOffice Impress 5.2.
The concept behind the DUal PErambulation technology is extremely simple, and highly sophisticated at the same time. The user is at the center of the action, as he perambulates to the printer to collect overheads, and then he perambulates to the overhead projector to present the contents to the audience.
“We have been trying to solve the compatibility issue with legacy overhead projectors, based on enhancement requests from our user base, for several years”, says Italo Vignoli, who has been leading a specific R&D task force since 2010. “DUPE technology was one of our last attempts before giving up, and represents an elegant solution to the problem”.
By splitting the action in two distinct tasks, DUPE technology overcomes any potential driver issue, and is extremely robust. “A single approach was crashing the software, because of the different image rasterization technology of the two peripherals, and was impossible to release at the same time for three different operating systems. On the contrary, a dual approach works just fine and is even compatible with mobile printing solutions”, adds Italo Vignoli.
Bugs such as wrinkles in carpets and suspended cables, which represent a potential issue for the perambulator, will be chased, reproduced and possibly solved during a special bug hunting session, which will be organized in advance on the release date.
After adding support for SHA-256 hashes in LibreOffice, I turned towards implementing OOXML signature import (as in: verification, not signing) in LibreOffice. First, thanks to the Dutch Ministry of Defense who made this work possible (as part of a project implementing trusted signing and communication in LibreOffice), I collected a list of building blocks needed for this to work:
support for the Relationships Transform Algorithm (described in ISO/IEC 29500-2:2012) in xmlsec
an actual XML parser for the OOXML signature in
a new filter flag, so that our code no longer assumes "is ODF" means "supports digital signing" and
some refactoring in
xmlsecurity/, so that our digital signature code doesn’t
assume that multiple signatures are always written to a single file
The xmlsec bits are now upstream, it seems to me that new algorithm is needed, so that MSO can avoid signing a number of streams (files in ZIP containers), while still being able to verify that all normal streams are signed. Given that MSO by default doesn’t sign all streams (so that e.g. the metadata of the document can be modified without invalidating signatures), this is in use even for a hello-world document. This implies that a typical OOXML signature will never gain the best "signed" category in LO, as we’ll always warn that even though the signature is valid, not all streams are signed. This is a bit of a rant, but better not hide the reality: a default ODF signature covers more than a default OOXML signature.
The OOXML signature parser had to extract all information from the signature markup that’s interesting for LibreOffice, like the certificate, the signature date or the signature description. I considered extending the ODF signature parser instead of implementing a new one for OOXML, since both markups are based on the same W3C signing spec, but they are different enough that the added complexity doesn’t outweigh the benefit of code sharing here.
The next step was to add a new
SUPPORTSSIGNING filter flag in
mark the DOCX, XLSX and PPTX file filters as such, and then of course find
places mostly in
xmlsecurity/ that assume only ODF files can be
signed, and modifying those checks to also handle this new flag.
Finally, a difference between ODF and OOXML signatures is that ODF puts all of them in a single stream, and all the signing and verifying code works with that stream. However, in case of OOXML, all signatures are in separate streams, so if we want to work with a single object as kind of a signature context, we need a storage (a sub-directory inside the ZIP container), and work with that.
Putting all of these together, we now have unit tests that take test documents having "good" and "bad" signatures, and the verification result in LO will match with the one of MSO. As usual, you can try this right now with a 5.2 daily build. :-)
I’ve finally published the sponsor prospectus for LibreOffice Conference 2016. The conference is run by volunteers, but it would not be possible without support of sponsors. The sponsor packages start at €1000, but there are also more targeted options to support the conference which start at €500 (sponsoring coffee, snacks, lunch,…).
If you know of a company that could be interested in sponsoring LibreOffice Conference, please reach out to them. Every contribution counts!
As it happened with MD5 hashes in the past, the world is currently moving from SHA1 hashes to SHA-256 hashes these days. This affects LibreOffice’s ODF signing feature as well, where we previously wrote and read SHA-1 hashes, but not SHA-256 ones. First, thanks to the Dutch Ministry of Defense who made this work possible (as part of a project implementing trusted signing and communication in LibreOffice), I could start work on tdf#76142 which attached a reproducer document as well, helping the implementation of this feature.
If you’re not into the digital signature details, SHA-256 is relevant in two aspects here:
it can be a signature method, denoted by the
http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 URI, and
it can be a digest method, denoted by the
Hashing is interesting in the context of digital signatures because typically not the whole document is signed, just a hash of it, and crypto frameworks like nss or mscrypto typically tie these two together, so you just say you sign with rsa-sha256, which in more detail means hashing with SHA-256 and then signing using rsa.
A valid signed document using SHA-256 hashing looked like this before:
I.e. we failed to validate the signature, and presented a dialog that suggested the signature is not valid. After my changes, it looks like this:
I.e. no error on loading, and the status bar icon tells the user that everything is fine, except that we can’t validate the certificate used for signing.
As for when should LibreOffice start writing (not reading) SHA-256 hashes when creating signatures, it’s an open question. Probably best to wait till most users already have a version that can read those hashes. Then we would still keep support for reading SHA-1 hashes, but we would use SHA-256 when creating new signatures.
Another detail is that the hard work of signing in LibreOffice is done by using libxmlsec. We bundled a heavily patched version from 2009, and it wasn’t clear how much work it is to port our patches to a newer upstream version, so I’ve initially backported the SHA-256 patches to our older version (for the nss and mscrypto backends of libxmlsec, as that covers what LibreOffice uses on Linux, Windows and OS X). At the end I managed to update our bundled libxmlsec to a newer (even if not the newest yet) version, so latest master got rid of those custom backports. As usual, you can try this right now with a 5.2 daily build. :-)
Bruce Byfield’s much-anticipated book, Designing with LibreOffice has been published by Friends of OpenDocument, Inc. Read about it here or jump straight to the download/buy page to get a free PDF or buy a printed copy.
Carla Schroder, Author of The Linux Cookbook, The Linux Network Cookbook, and The Book of Audacity, says this about the book:
“Designing With LibreOffice” teaches everything you need to know about document production: chapters, footnotes, citations, indexes, outlines, cross-references, incorporating images and spreadsheets, and controlling the appearance of your documents. It is well-organized and contains abundant examples, and is suitable for beginners to wizened old pros, who will probably discover things about LibreOffice that they didn’t know.