Comments on: Merb 1.0.5 and 1.0.6

By: Matt Aimonetti

Matt Aimonetti — Wed, 17 Dec 2008 21:04:35 +0000

Carl forgot to give the url of his screencast and article:

http://splendificent.com/2008/12/merb-dependencies-and-bundler-conquered-screencast/

Great job Carl!

By: Liam Morley

Liam Morley — Wed, 17 Dec 2008 18:55:31 +0000

After trying 1.0.6.1, bundling is MUCH easier, thanks for all the hard work. One question on symlinks, you mention the following two points in your blog:

* “The only exception to that rule is thor, which allows bin/thor to be run on a new remote machine that has only Ruby and Rubygems installed.”
* “The preferred way to achieve this is by symlinking gems/gems and gems/specifications into your deployed copy of merb.”

Am I misunderstanding you, or are those two mutually exclusive? If /myapp/gems/gems/ already exists because it contains thor, how can I symlink /myapp/gems/gems/ to /shared/gems/gems? Won’t I get a “cannot overwrite directory”, even with -f? As that’s what I’m getting. :)

By: Yehuda Katz

Yehuda Katz — Wed, 17 Dec 2008 16:08:50 +0000

@dean yeah. The new bundler requires a single config/dependencies.rb for any project. It would actually work on Rails apps or standalone apps too, as long as you provide a config/depenencies.rb.

By: Andy L.

Andy L. — Wed, 17 Dec 2008 15:57:47 +0000

rick: Here is some info on this:

http://golem.ph.utexas.edu/~distler/blog/archives/001181.html

Hope it helps.

By: Dean Strelau

Dean Strelau — Wed, 17 Dec 2008 15:15:50 +0000

This update seems to break `merb:gem:redeploy` for flat apps, where there is no dependencies.rb file. Was that intentional?

By: dmilith

dmilith — Wed, 17 Dec 2008 11:16:34 +0000

Sorry but under JRuby 1.1.6(trunk) jgem install merb-core throws:

ERROR: While executing gem … (ConcurrencyError)
Detected invalid array contents due to unsynchronized modifications with concurrent users

this problem does not concern CRuby.

By: Carl Lerche

Carl Lerche — Wed, 17 Dec 2008 09:47:25 +0000

Alright, so the screencast is being delayed. Turns out that it actually takes a good amount of time to put one together, edit it, upload it, etc…

It’ll be available sometime tomorrow (well, technically speaking, sometime today).

By: rick

rick — Wed, 17 Dec 2008 09:23:31 +0000

Andy: what’s the source? The old rails sanitizer was pretty bad, but the newer white list implementation is much better. I don’t believe the html5 sanitizer adds any more protections, but it does handle svg/mathml tags.

By: Andy L.

Andy L. — Wed, 17 Dec 2008 02:43:35 +0000

HTML5Lib page:
http://code.google.com/p/html5lib/

By: Andy L.

Andy L. — Wed, 17 Dec 2008 02:40:58 +0000

Yehuda, from what I read about 1 year ago, regular whitelist sanitization ala Rails is pretty unsecure. Following some guys’ recommendation (who seemed to know what they were talking about), I ended up using the HTML5Lib library and its sanitization module — source code at:
http://code.google.com/p/html5lib/source/browse/trunk/ruby/lib/html5/sanitizer.rb

Check it out.

And thank you for Merb!
:)