Author Topic: Updates Module (Read 4954 times)

ghostimage · « **on:** January 11, 2007, 12:23:04 pm »

Hiya,

Fairly new to setting up and running Bebot, thanks all who put in their own time to keep it running

This week I've been collecting all the modules and stitching them all together, Jack's post http://bebot.link/index.php/topic,627.0.html alas comes about a week too late for me - but really good stuff having it all grouped together! (nice one JJ

)

This post got me thinking, how about a module called !updates which could load a list of known current modules from a website and then check the version numbers of your own modules so that you know you're running the most current.

Each module could have a release number built into the PHP file in the format x.y.z where X is major release (critical/security update), y is a feature release and z is bug fix release.

Then either superadmin or (if delegated) admin could run "!update check" to see if anything new is about or "!update now" to download and install updated modules (assuming someone is willing to host

I was thinking that the "!update check" command could list current version, release version and a link to show the changelog.

neongen · « **Reply #1 on:** January 11, 2007, 08:56:12 pm »

this is not IGN bot (sorry) if we go that way the next thing people ask for is IGN whatsoever

and if you run a bebot you know how much people code to them, then who decide what shall be an update and what shall not? and it only takes 2 min to go in on the forum to see if there is a updated module to bebot, and i'm pretty sure that bebot is what it is because there is so many coder to it.

so you can not make it like that because allmost every bebot out there is custom made by the "owner"

Xenixa · « **Reply #2 on:** January 11, 2007, 09:19:54 pm »

Hmm, well actually the idea has merit. But since Bebot is still very much beta and our core group of devs is fairly big I would say a module of this scope would only be good for SVN point releases.

Alot of the extras posted by myself and others havn't even really made it into the 'official' code yet as those modules are generally a work in progress. So a update command would have to be limited to those commands that are official and included in the SVN.

Maybe when Bebot gets out of minor point releases and into a Full version something like this could be implemented.

Khalem · « **Reply #3 on:** January 13, 2007, 04:45:43 pm »

An update check could be nice and could fairly easily be done for SVN versions at least.

Some sort of central system could be doable in the future im sure, but the idea of anything being allowed to download/update trough the use of a single command gives me shivers all the way to the bottom of my spine as it's a worm of can in terms of security.

ghostimage · « **Reply #4 on:** January 15, 2007, 12:03:45 pm »

Quote from: Khalem on January 13, 2007, 04:45:43 pm

An update check could be nice and could fairly easily be done for SVN versions at least.

Some sort of central system could be doable in the future im sure, but the idea of anything being allowed to download/update trough the use of a single command gives me shivers all the way to the bottom of my spine as it's a worm of can in terms of security.

Yea I had thought about that, it wouldn't be too hard to sign the modules using GPG or equivalient though perhaps. But even just something that checks SVN for updates would be cool

(Oh and hiya Khal btw

)

Khalem · « **Reply #5 on:** January 15, 2007, 04:06:43 pm »

That should have been, can of worms btw O.o

Glarawyn · « **Reply #6 on:** January 16, 2007, 06:28:33 pm »

I'm in favor of an update check that will show you if new versions of BeBot or custom modules are available.

But functionality that allows the bot to download updates and install them automatically similar to IGN? No way. It would take me about 15 minutes (coding + testing time) to whip up a module that would read your bot's config file and send me your AO accounts username and password. The same could be (and probably has been) done with IGN bot. This kind of functionality is simply not a good idea.

GPG signing of modules would be a step in the right direction, but the odds of all contributors meeting face to face for a key signing party is slim to none. And on top of that, we would have to force module developers to release their modules in a specified format such as a zip file with a modules sub directory, the signature file to be verified, etc. There's a lot involved and thus a lot of places for things to go wrong.

It's not just a can of worms. It's a bait shop and worm farm.