+ The restrictions on arbitrary IO when GF is running in restricted mode is now
enforced in the types.
+ This hopefully also solves an intermittent problem when accessing the GF
shell through the web API provided by gf -server. This was visible in the
Simple Translation Tool and probably caused by some low-level bug in the
GHC IO libraries.
The SIO monad is a restriction of the IO monad with two purposes:
+ Access to arbitrary IO operations can be turned off by setting the environment
variable GF_RESTRICTED. There is a limited set of IO operations that are
considered safe and always allowed.
+ It allows output to stdout to be captured. This can be used in gf -server
mode, where output of GF shell commands is made part of HTTP responses
returned to clients.
Introduced the function
parallelCheck :: [Check a] -> Check [a]
that runs independent checks in parallel, potentially allowing faster grammar
compilation on multi-core computers, if you run gf with +RTS -N.
However, on my dual core laptop, this seems to slow down compilation somewhat
even though CPU utilization goes up as high as 170% at times.
(This is with GF compiled with GHC 7.0.4.)
In GF.Compile.CheckGrammar, use a new topological sorting function that
groups independent judgements, allowing them all to be checked before
continuing or reporting errors.
Reimplemented it with the new function accumulateError.
Also keeping the formatting of errors and warnings unchanged for now, to avoid
potentially causing problems in the GF Eclipse Plugin.
In addition to warnings, the Check monad in GF.Infra.CheckM can now accumulate
errors. There are two new functions
checkAccumError: Message -> Check ()
accumulateError :: (a -> Check a) -> a -> Check a
The former (with the same type as checkWarn) is used to report an accumulated
(nonfatal) error. The latter converts fatal errors into accumulated errors.
Accumulated errors are reported as regular errors by runCheck.
Also, the Check monad type has been made abstract.
The Setup.hs script now queries darcs to create more detailed version info
to include in the startup message.
Note thought that with distributed version control systems like darcs,
the only way to uniquely identify a version is by the set of patches included.
Since the patches are not totally ordered, just looking at the last patch is
not enough.
For official releases, we tag the current set of patches so we can refer to
it by name (e.g. RELEASE-3.3.3).
This reverts the previous change. Not preprocessing opers turns out to make a
difference in what needs to be mentioned in restricted inheritance/imports.
It is needed by greatestResource (and similar functions, presumably).
So keep both the list and the finite map of modules. This slows down some
things, but the compilation of PhrasebookFin.pgf benefits from it.
To be continued...
This speeds up the compilation of PhrasebookFin.pgf by 12%, mosly by speeding
up calls to lookupModule in calls from lookupParamValues, in calls
from allParamValues.
The invariant "modules are stored in dependency order" is no longer respected!
But the type MGrammar is now abstract, making it easier to maintain this or
other invariants in the future.
The command "gf -server" now starts a simple HTTP server on port 41295,
providing a simple web API to the GF compiler. It currently support the
follwing operations:
* creating new temporary directories for grammar uploads,
* uploading grammars files for use in the GF shell,
* executing GF shell commands, and
* accessing static files.
This means that GF now depends on some additional networking related packages,
but they should be available and easy to install on all platforms. There is
also a new configuration flag "server" in gf.cabal, so GF will be compiled
without support for server mode if the extra packages are unavailable.
Note that running gf -server while connected to the internet can be a security
risk. To prevent unauthorized access to the rest of the system, it is
advisable to run the server in GF_RESTRICTED mode and as a user with suitably
restricted file permissions.
The GF shell welcome message will now include something like
This is GF version 3.2.1-darcs.
Built on darwin/i386 with ghc-7.0, flags: interrupt
where a list of enabled configuration flags are included on the last line.
This is implemented in GF.Infra.BuildInfo by consulting the CPP macros
defined by the respective option in gf.cabal. For this to work,
GF.Infra.BuildInfo obviously has to be updated when new flags are added to
gf.cabal or if the CPP macros are renamed.
(Also, I suspect that if you reconfigure with different flags and rebuild GF
without cleaning first, the BuildInfo module will not be recompiled,
resulting in a misleading welcome message...)
By setting the environment variable GF_RESTRICTED before starting GF, the shell
will be run in restricted mode. This will prevent the GF shell from starting
arbitrary system commands (most uses of System.Cmd.system are blocked) and
writing arbitrary files (most commands that use writeFile et al are blocked).
Restricted mode is intended minimize the potential security risks involved
in allowing public access to the GF shell over the internet. It should be used
in conjuction with system level protection mechanisms (e.g. file permissions)
to make sure that a publicly acessible GF shell does not give access to parts
of the system that should not be publicly accessible.
