Merge branch 'master' into erp5

598e5978 · Łukasz Nowak · cdff9aa0 · 4bd5d656 · 598e5978 · cdff9aa0
Commit 598e5978 authored Jun 29, 2011 by Łukasz Nowak
24 changed files
--- a/.gitignore
+++ b/.gitignore
 *pyc
+.installed.cfg
+bin/
 build
+develop-eggs/
 dist
+downloads/
+eggs/
+parts/
 slapos.cookbook.egg-info
--- a/00.Repository.Rules.txt
+++ b/00.Repository.Rules.txt
-SlapOS repository rules
-=======================
-Short version for impatient
---------------------------
-'master' branch is always stable. One shall never work in this branch. One
-shall expect reversion or removal of his commits in 'master' branch, if they
-are not because of merging another branch.
-Everyone has to create branch, basing on 'master' or any other branch. All
-work shall be done in such branch. It is advised to review it before merging
-into 'master'. It is very good habit to tag such merges.
-A bit more background
---------------------
-SlapOS repository 'master' branch is supposed to be stable. No new work is
-accepted on this branch. Each time someone uses (clones, extends) 'master'
-branch it is supposed to work (as far as it was tested).
-Tags on 'master' branch are supposed to be repeatable software definitions
-forever. All versions and external links shall be setup in a way, that they
-wouldn't change in day, month, year, etc.
-Everyone can make his own branch to introduce new software to SlapOS. There
-are no rules about those branches, as each software is specific.
-It is good idea to ask for review before merging changes into 'master' branch.
-Peer review can detect issues not detected by testing, development or self
-analysis.
-After some software is stabilised and no more work is planned it is acceptable
-to remove such abandoned branch in order to minimise amount of branches.
--- a/CHANGES.txt
+++ b/CHANGES.txt
-0.8 (unreleased)
+0.10 (unreleased)
 ================
- * No changes yet.
+ * No change yet.
+0.9 (2011-06-24)
+================
+ * mysql recipe : Changing slapos.recipe.erp5.execute to
+   slapos.recipe.librecipe.execute [Cedric de Saint Martin]
+0.8 (2011-06-15)
+================
+ * Add MySQL and MariaDB standalone software release and recipe
+   [Cedric de Saint Martin]
+ * Fixed slapos.recipe.erp5testnode instantiation [Sebastien Robin]
 0.7 (2011-06-14)
 ================

--- a/component/git/buildout.cfg
+++ b/component/git/buildout.cfg
@@ -13,8 +13,8 @@ parts =
 [git]
 recipe = hexagonit.recipe.cmmi
-url = http://kernel.org/pub/software/scm/git/git-1.7.3.4.tar.bz2
+url = http://kernel.org/pub/software/scm/git/git-1.7.4.5.tar.bz2
-md5sum = 3a2602016f98c529cda7b9fad1a6e216
+md5sum = 2fa6c4c847ed87523cf55de54af457eb
 configure-options =
  --with-curl=${curl:location}
  --with-openssl=${openssl:location}

--- a/component/lxml-python/buildout.cfg
+++ b/component/lxml-python/buildout.cfg
@@ -13,6 +13,9 @@ PATH = ${libxslt:location}/bin:%(PATH)s
 [lxml-python]
 recipe = zc.recipe.egg:custom
 egg = lxml
+find-links =
+  http://pypi.python.org/pypi/lxml/2.2.8
+  http://pypi.python.org/pypi/lxml/2.3
 rpath =
  ${libxml2:location}/lib/
  ${libxslt:location}/lib/

--- a/component/slapos/buildout.cfg
+++ b/component/slapos/buildout.cfg
@@ -18,24 +18,29 @@ python = python2.7
 recipe = z3c.recipe.scripts
 python = python2.7
 eggs =
+  slapos.libnetworkcache
+  zc.buildout
  ${lxml-python:egg}
  slapos.core
 [versions]
-zc.buildout = 1.5.3-dev-SlapOS-001
+zc.buildout = 1.5.3-dev-SlapOS-004
 Jinja2 = 2.5.5
 Werkzeug = 0.6.2
+buildout-versions = 1.6
 hexagonit.recipe.cmmi = 1.5.0
 lxml = 2.3
 meld3 = 0.6.7
-setuptools = 0.6c12dev-r88795
+netaddr = 0.7.5
-slapos.core = 0.2
+setuptools = 0.6c12dev-r88846
+slapos.core = 0.8
+slapos.libnetworkcache = 0.1
 xml-marshaller = 0.9.7
 z3c.recipe.scripts = 1.0.1
 zc.recipe.egg = 1.3.2
 # Required by:
-# slapos.core==0.2
+# slapos.core==0.8
 Flask = 0.6.1
 # Required by:
@@ -43,18 +48,13 @@ Flask = 0.6.1
 hexagonit.recipe.download = 1.5.0
 # Required by:
-# slapos.core==0.2
+# slapos.core==0.8
-netaddr = 0.7.5
-# Required by:
-# slapos.core==0.2
 netifaces = 0.5
 # Required by:
-# slapos.core==0.2
+# slapos.core==0.8
 supervisor = 3.0a10
 # Required by:
-# slapos.core==0.2
+# slapos.core==0.8
 zope.interface = 3.6.3
--- a/setup.py
+++ b/setup.py
@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 import glob
 import os
-version = '0.8-dev'
+version = '0.10dev'
 name = 'slapos.cookbook'
 long_description = open("README.txt").read() + "\n" + \
    open("CHANGES.txt").read() + "\n"
@@ -49,6 +49,7 @@ setup(name=name,
          'libcloud = slapos.recipe.libcloud:Recipe',
          'libcloudrequest = slapos.recipe.libcloudrequest:Recipe',
          'memcached = slapos.recipe.memcached:Recipe',
+          'mysql = slapos.recipe.mysql:Recipe',
          'nbdserver = slapos.recipe.nbdserver:Recipe',
          'nosqltestbed = slapos.recipe.nosqltestbed:NoSQLTestBed',
          'proactive = slapos.recipe.proactive:Recipe',

--- a/slapos/recipe/README.mysql.txt
+++ b/slapos/recipe/README.mysql.txt
+mysql
+=========
+Instantiates MySQL instance.
--- a/slapos/recipe/erp5testnode/__init__.py
+++ b/slapos/recipe/erp5testnode/__init__.py
@@ -98,7 +98,7 @@ class Recipe(BaseSlapRecipe):
              partition_reference=CONFIG['partition_reference'],
              environment=dict(PATH=os.environ['PATH']),
              vcs_authentication_list=eval(self.parameter_dict.get(
-                     'vcs_authentication_list')),
+                     'vcs_authentication_list', 'None')),
            )
          ]))

--- a/slapos/recipe/mysql/__init__.py
+++ b/slapos/recipe/mysql/__init__.py
+##############################################################################
+#
+# Copyright (c) 2010 Vifib SARL and Contributors. All Rights Reserved.
+#
+# WARNING: This program as such is intended to be used by professional
+# programmers who take the whole responsibility of assessing all potential
+# consequences resulting from its eventual inadequacies and bugs
+# End users who are looking for a ready-to-use solution with commercial
+# guarantees and support are strongly adviced to contract a Free Software
+# Service Company
+#
+# This program is Free Software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 3
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+#
+##############################################################################
+from slapos.recipe.librecipe import BaseSlapRecipe
+import hashlib
+import os
+import pkg_resources
+import sys
+import zc.buildout
+import ConfigParser
+class Recipe(BaseSlapRecipe):
+  def getTemplateFilename(self, template_name):
+    return pkg_resources.resource_filename(__name__,
+        'template/%s' % template_name)
+  def _install(self):
+    self.path_list = []
+    self.requirements, self.ws = self.egg.working_set()
+    # self.cron_d is a directory, where cron jobs can be registered
+    self.cron_d = self.installCrond()
+    self.logrotate_d, self.logrotate_backup = self.installLogrotate()
+    mysql_conf = self.installMysqlServer(self.getLocalIPv4Address(), 45678)
+    ca_conf = self.installCertificateAuthority()
+    key, certificate = self.requestCertificate('MySQL')
+    stunnel_conf = self.installStunnel(self.getGlobalIPv6Address(),
+        self.getLocalIPv4Address(), 12345, mysql_conf['tcp_port'],
+        certificate, key, ca_conf['ca_crl'],
+        ca_conf['certificate_authority_path'])
+    self.linkBinary()
+    self.setConnectionDict(dict(
+      stunnel_ip = stunnel_conf['public_ip'],
+      stunnel_port = stunnel_conf['public_port'],
+      mysql_database = mysql_conf['mysql_database'],
+      mysql_user = mysql_conf['mysql_user'],
+      mysql_password = mysql_conf['mysql_password'],
+    ))
+    return self.path_list
+  def linkBinary(self):
+    """Links binaries to instance's bin directory for easier exposal"""
+    for linkline in self.options.get('link_binary_list', '').splitlines():
+      if not linkline:
+        continue
+      target = linkline.split()
+      if len(target) == 1:
+        target = target[0]
+        path, linkname = os.path.split(target)
+      else:
+        linkname = target[1]
+        target = target[0]
+      link = os.path.join(self.bin_directory, linkname)
+      if os.path.lexists(link):
+        if not os.path.islink(link):
+          raise zc.buildout.UserError(
+              'Target link already %r exists but it is not link' % link)
+        os.unlink(link)
+      os.symlink(target, link)
+      self.logger.debug('Created link %r -> %r' % (link, target))
+      self.path_list.append(link)
+  def installCrond(self):
+    timestamps = self.createDataDirectory('cronstamps')
+    cron_output = os.path.join(self.log_directory, 'cron-output')
+    self._createDirectory(cron_output)
+    catcher = zc.buildout.easy_install.scripts([('catchcron',
+      __name__ + '.catdatefile', 'catdatefile')], self.ws, sys.executable,
+      self.bin_directory, arguments=[cron_output])[0]
+    self.path_list.append(catcher)
+    cron_d = os.path.join(self.etc_directory, 'cron.d')
+    crontabs = os.path.join(self.etc_directory, 'crontabs')
+    self._createDirectory(cron_d)
+    self._createDirectory(crontabs)
+    wrapper = zc.buildout.easy_install.scripts([('crond',
+      'slapos.recipe.librecipe.execute', 'execute')], self.ws, sys.executable,
+      self.wrapper_directory, arguments=[
+        self.options['dcrond_binary'].strip(), '-s', cron_d, '-c', crontabs,
+        '-t', timestamps, '-f', '-l', '5', '-M', catcher]
+      )[0]
+    self.path_list.append(wrapper)
+    return cron_d
+  def installLogrotate(self):
+    """Installs logortate main configuration file and registers its to cron"""
+    logrotate_d = os.path.abspath(os.path.join(self.etc_directory,
+      'logrotate.d'))
+    self._createDirectory(logrotate_d)
+    logrotate_backup = self.createBackupDirectory('logrotate')
+    logrotate_conf = self.createConfigurationFile("logrotate.conf",
+        "include %s" % logrotate_d)
+    logrotate_cron = os.path.join(self.cron_d, 'logrotate')
+    state_file = os.path.join(self.data_root_directory, 'logrotate.status')
+    open(logrotate_cron, 'w').write('0 0 * * * %s -s %s %s' %
+        (self.options['logrotate_binary'], state_file, logrotate_conf))
+    self.path_list.extend([logrotate_d, logrotate_conf, logrotate_cron])
+    return logrotate_d, logrotate_backup
+  def registerLogRotation(self, name, log_file_list, postrotate_script):
+    """Register new log rotation requirement"""
+    open(os.path.join(self.logrotate_d, name), 'w').write(
+        self.substituteTemplate(self.getTemplateFilename(
+          'logrotate_entry.in'),
+          dict(file_list=' '.join(['"'+q+'"' for q in log_file_list]),
+            postrotate=postrotate_script, olddir=self.logrotate_backup)))
+  def installCertificateAuthority(self, ca_country_code='XX',
+      ca_email='xx@example.com', ca_state='State', ca_city='City',
+      ca_company='Company'):
+    backup_path = self.createBackupDirectory('ca')
+    self.ca_dir = os.path.join(self.data_root_directory, 'ca')
+    self._createDirectory(self.ca_dir)
+    self.ca_request_dir = os.path.join(self.ca_dir, 'requests')
+    self._createDirectory(self.ca_request_dir)
+    config = dict(ca_dir=self.ca_dir, request_dir=self.ca_request_dir)
+    self.ca_private = os.path.join(self.ca_dir, 'private')
+    self.ca_certs = os.path.join(self.ca_dir, 'certs')
+    self.ca_crl = os.path.join(self.ca_dir, 'crl')
+    self.ca_newcerts = os.path.join(self.ca_dir, 'newcerts')
+    self.ca_key_ext = '.key'
+    self.ca_crt_ext = '.crt'
+    for d in [self.ca_private, self.ca_crl, self.ca_newcerts, self.ca_certs]:
+      self._createDirectory(d)
+    for f in ['crlnumber', 'serial']:
+      if not os.path.exists(os.path.join(self.ca_dir, f)):
+        open(os.path.join(self.ca_dir, f), 'w').write('01')
+    if not os.path.exists(os.path.join(self.ca_dir, 'index.txt')):
+      open(os.path.join(self.ca_dir, 'index.txt'), 'w').write('')
+    openssl_configuration = os.path.join(self.ca_dir, 'openssl.cnf')
+    config.update(
+        working_directory=self.ca_dir,
+        country_code=ca_country_code,
+        state=ca_state,
+        city=ca_city,
+        company=ca_company,
+        email_address=ca_email,
+    )
+    self._writeFile(openssl_configuration, pkg_resources.resource_string(
+      __name__, 'template/openssl.cnf.ca.in') % config)
+    self.path_list.extend(zc.buildout.easy_install.scripts([
+      ('certificate_authority',
+        __name__ + '.certificate_authority', 'runCertificateAuthority')],
+        self.ws, sys.executable, self.wrapper_directory, arguments=[dict(
+          openssl_configuration=openssl_configuration,
+          openssl_binary=self.options['openssl_binary'],
+          certificate=os.path.join(self.ca_dir, 'cacert.pem'),
+          key=os.path.join(self.ca_private, 'cakey.pem'),
+          crl=os.path.join(self.ca_crl),
+          request_dir=self.ca_request_dir
+          )]))
+    # configure backup
+    backup_cron = os.path.join(self.cron_d, 'ca_rdiff_backup')
+    open(backup_cron, 'w').write(
+        '''0 0 * * * %(rdiff_backup)s %(source)s %(destination)s'''%dict(
+          rdiff_backup=self.options['rdiff_backup_binary'],
+          source=self.ca_dir,
+          destination=backup_path))
+    self.path_list.append(backup_cron)
+    return dict(
+      ca_certificate=os.path.join(config['ca_dir'], 'cacert.pem'),
+      ca_crl=os.path.join(config['ca_dir'], 'crl'),
+      certificate_authority_path=config['ca_dir']
+    )
+  def requestCertificate(self, name):
+    hash = hashlib.sha512(name).hexdigest()
+    key = os.path.join(self.ca_private, hash + self.ca_key_ext)
+    certificate = os.path.join(self.ca_certs, hash + self.ca_crt_ext)
+    parser = ConfigParser.RawConfigParser()
+    parser.add_section('certificate')
+    parser.set('certificate', 'name', name)
+    parser.set('certificate', 'key_file', key)
+    parser.set('certificate', 'certificate_file', certificate)
+    parser.write(open(os.path.join(self.ca_request_dir, hash), 'w'))
+    return key, certificate
+  def installStunnel(self, public_ip, private_ip, public_port, private_port,
+      ca_certificate, key, ca_crl, ca_path):
+    """Installs stunnel"""
+    template_filename = self.getTemplateFilename('stunnel.conf.in')
+    log = os.path.join(self.log_directory, 'stunnel.log')
+    pid_file = os.path.join(self.run_directory, 'stunnel.pid')
+    stunnel_conf = dict(
+        public_ip=public_ip,
+        private_ip=private_ip,
+        public_port=public_port,
+        pid_file=pid_file,
+        log=log,
+        cert = ca_certificate,
+        key = key,
+        ca_crl = ca_crl,
+        ca_path = ca_path,
+        private_port = private_port,
+    )
+    stunnel_conf_path = self.createConfigurationFile("stunnel.conf",
+        self.substituteTemplate(template_filename,
+          stunnel_conf))
+    wrapper = zc.buildout.easy_install.scripts([('stunnel',
+      'slapos.recipe.librecipe.execute', 'execute')], self.ws, sys.executable,
+      self.wrapper_directory, arguments=[
+        self.options['stunnel_binary'].strip(), stunnel_conf_path]
+      )[0]
+    self.path_list.append(wrapper)
+    return stunnel_conf
+  def installMysqlServer(self, ip, port, database='db', user='user',
+      template_filename=None, mysql_conf=None):
+    if mysql_conf is None:
+      mysql_conf = {}
+    backup_directory = self.createBackupDirectory('mysql')
+    if template_filename is None:
+      template_filename = self.getTemplateFilename('my.cnf.in')
+    error_log = os.path.join(self.log_directory, 'mysqld.log')
+    slow_query_log = os.path.join(self.log_directory, 'mysql-slow.log')
+    mysql_conf.update(
+        ip=ip,
+        data_directory=os.path.join(self.data_root_directory,
+          'mysql'),
+        tcp_port=port,
+        pid_file=os.path.join(self.run_directory, 'mysqld.pid'),
+        socket=os.path.join(self.run_directory, 'mysqld.sock'),
+        error_log=error_log,
+        slow_query_log=slow_query_log,
+        mysql_database=database,
+        mysql_user=user,
+        mysql_password=self.generatePassword(),
+    )
+    self.registerLogRotation('mysql', [error_log, slow_query_log],
+        '%(mysql_binary)s --no-defaults -B --user=root '
+        '--socket=%(mysql_socket)s -e "FLUSH LOGS"' % dict(
+          mysql_binary=self.options['mysql_binary'],
+          mysql_socket=mysql_conf['socket']))
+    self._createDirectory(mysql_conf['data_directory'])
+    mysql_conf_path = self.createConfigurationFile("my.cnf",
+        self.substituteTemplate(template_filename,
+          mysql_conf))
+    mysql_script_list = []
+    for x_database, x_user, x_password in \
+          [(mysql_conf['mysql_database'],
+            mysql_conf['mysql_user'],
+            mysql_conf['mysql_password']),
+          ]:
+      mysql_script_list.append(pkg_resources.resource_string(__name__,
+                     'template/initmysql.sql.in') % {
+                        'mysql_database': x_database,
+                        'mysql_user': x_user,
+                        'mysql_password': x_password})
+    mysql_script_list.append('EXIT')
+    mysql_script = '\n'.join(mysql_script_list)
+    self.path_list.extend(zc.buildout.easy_install.scripts([('mysql_update',
+      __name__ + '.mysql', 'updateMysql')], self.ws,
+      sys.executable, self.wrapper_directory, arguments=[dict(
+        mysql_script=mysql_script,
+        mysql_binary=self.options['mysql_binary'].strip(),
+        mysql_upgrade_binary=self.options['mysql_upgrade_binary'].strip(),
+        socket=mysql_conf['socket'],
+        )]))
+    self.path_list.extend(zc.buildout.easy_install.scripts([('mysqld',
+      __name__ + '.mysql', 'runMysql')], self.ws,
+        sys.executable, self.wrapper_directory, arguments=[dict(
+        mysql_install_binary=self.options['mysql_install_binary'].strip(),
+        mysqld_binary=self.options['mysqld_binary'].strip(),
+        data_directory=mysql_conf['data_directory'].strip(),
+        mysql_binary=self.options['mysql_binary'].strip(),
+        socket=mysql_conf['socket'].strip(),
+        configuration_file=mysql_conf_path,
+       )]))
+    self.path_list.extend([mysql_conf_path])
+    # backup configuration
+    backup_directory = self.createBackupDirectory('mysql')
+    full_backup = os.path.join(backup_directory, 'full')
+    incremental_backup = os.path.join(backup_directory, 'incremental')
+    self._createDirectory(full_backup)
+    self._createDirectory(incremental_backup)
+    innobackupex_argument_list = [self.options['perl_binary'],
+        self.options['innobackupex_binary'],
+        '--defaults-file=%s' % mysql_conf_path,
+        '--socket=%s' %mysql_conf['socket'].strip(), '--user=root']
+    environment = dict(PATH='%s' % self.bin_directory)
+    innobackupex_incremental = zc.buildout.easy_install.scripts([(
+      'innobackupex_incremental', 'slapos.recipe.librecipe.execute', 'executee')],
+      self.ws, sys.executable, self.bin_directory, arguments=[
+        innobackupex_argument_list + ['--incremental'],
+        environment])[0]
+    self.path_list.append(innobackupex_incremental)
+    innobackupex_full = zc.buildout.easy_install.scripts([('innobackupex_full',
+      'slapos.recipe.librecipe.execute', 'executee')], self.ws,
+      sys.executable, self.bin_directory, arguments=[
+        innobackupex_argument_list,
+        environment])[0]
+    self.path_list.append(innobackupex_full)
+    backup_controller = zc.buildout.easy_install.scripts([
+      ('innobackupex_controller', __name__ + '.innobackupex', 'controller')],
+      self.ws, sys.executable, self.bin_directory,
+      arguments=[innobackupex_incremental, innobackupex_full, full_backup,
+        incremental_backup])[0]
+    self.path_list.append(backup_controller)
+    mysql_backup_cron = os.path.join(self.cron_d, 'mysql_backup')
+    open(mysql_backup_cron, 'w').write('0 0 * * * ' + backup_controller)
+    self.path_list.append(mysql_backup_cron)
+    # The return could be more explicit database, user ...
+    return mysql_conf
--- a/slapos/recipe/mysql/certificate_authority.py
+++ b/slapos/recipe/mysql/certificate_authority.py
+import os
+import subprocess
+import time
+import ConfigParser
+def popenCommunicate(command_list, input=None):
+  subprocess_kw = dict(stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+  if input is not None:
+    subprocess_kw.update(stdin=subprocess.PIPE)
+  popen = subprocess.Popen(command_list, **subprocess_kw)
+  result = popen.communicate(input)[0]
+  if popen.returncode is None:
+    popen.kill()
+  if popen.returncode != 0:
+    raise ValueError('Issue during calling %r, result was:\n%s' % (
+      command_list, result))
+  return result
+class CertificateAuthority:
+  def __init__(self, key, certificate, openssl_binary,
+      openssl_configuration, request_dir):
+    self.key = key
+    self.certificate = certificate
+    self.openssl_binary = openssl_binary
+    self.openssl_configuration = openssl_configuration
+    self.request_dir = request_dir
+  def checkAuthority(self):
+    file_list = [ self.key, self.certificate ]
+    ca_ready = True
+    for f in file_list:
+      if not os.path.exists(f):
+        ca_ready = False
+        break
+    if ca_ready:
+      return
+    for f in file_list:
+      if os.path.exists(f):
+        os.unlink(f)
+    try:
+      # no CA, let us create new one
+      popenCommunicate([self.openssl_binary, 'req', '-nodes', '-config',
+          self.openssl_configuration, '-new', '-x509', '-extensions',
+          'v3_ca', '-keyout', self.key, '-out', self.certificate,
+          '-days', '10950'], 'Automatic Certificate Authority\n')
+    except:
+      try:
+        for f in file_list:
+          if os.path.exists(f):
+            os.unlink(f)
+      except:
+        # do not raise during cleanup
+        pass
+      raise
+  def _checkCertificate(self, common_name, key, certificate):
+    file_list = [key, certificate]
+    ready = True
+    for f in file_list:
+      if not os.path.exists(f):
+        ready = False
+        break
+    if ready:
+      return False
+    for f in file_list:
+      if os.path.exists(f):
+        os.unlink(f)
+    csr = certificate + '.csr'
+    try:
+      popenCommunicate([self.openssl_binary, 'req', '-config',
+        self.openssl_configuration, '-nodes', '-new', '-keyout',
+        key, '-out', csr, '-days', '3650'],
+        common_name + '\n')
+      try:
+        popenCommunicate([self.openssl_binary, 'ca', '-batch', '-config',
+          self.openssl_configuration, '-out', certificate,
+          '-infiles', csr])
+      finally:
+        if os.path.exists(csr):
+          os.unlink(csr)
+    except:
+      try:
+        for f in file_list:
+          if os.path.exists(f):
+            os.unlink(f)
+      except:
+        # do not raise during cleanup
+        pass
+      raise
+    else:
+      return True
+  def checkRequestDir(self):
+    for request_file in os.listdir(self.request_dir):
+      parser = ConfigParser.RawConfigParser()
+      parser.readfp(open(os.path.join(self.request_dir, request_file), 'r'))
+      if self._checkCertificate(parser.get('certificate', 'name'),
+          parser.get('certificate', 'key_file'), parser.get('certificate',
+            'certificate_file')):
+        print 'Created certificate %r' % parser.get('certificate', 'name')
+def runCertificateAuthority(args):
+  ca_conf = args[0]
+  ca = CertificateAuthority(ca_conf['key'], ca_conf['certificate'],
+      ca_conf['openssl_binary'], ca_conf['openssl_configuration'],
+      ca_conf['request_dir'])
+  while True:
+    ca.checkAuthority()
+    ca.checkRequestDir()
+    time.sleep(60)
--- a/slapos/recipe/mysql/mysql.py
+++ b/slapos/recipe/mysql/mysql.py
+import os
+import subprocess
+import time
+import sys
+def runMysql(args):
+  sleep = 60
+  conf = args[0]
+  mysqld_wrapper_list = [conf['mysqld_binary'], '--defaults-file=%s' %
+      conf['configuration_file']]
+  # we trust mysql_install that if mysql directory is available mysql was
+  # correctly initalised
+  if not os.path.isdir(os.path.join(conf['data_directory'], 'mysql')):
+    while True:
+      # XXX: Protect with proper root password
+      # XXX: Follow http://dev.mysql.com/doc/refman/5.0/en/default-privileges.html
+      popen = subprocess.Popen([conf['mysql_install_binary'],
+        '--skip-name-resolve', '--no-defaults', '--datadir=%s' %
+        conf['data_directory']],
+        stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+      result = popen.communicate()[0]
+      if popen.returncode is None or popen.returncode != 0:
+        print "Failed to initialise server.\nThe error was: %s" % result
+        print "Waiting for %ss and retrying" % sleep
+        time.sleep(sleep)
+      else:
+        print "Mysql properly initialised"
+        break
+  else:
+    print "MySQL already initialised"
+  print "Starting %r" % mysqld_wrapper_list[0]
+  sys.stdout.flush()
+  sys.stderr.flush()
+  os.execl(mysqld_wrapper_list[0], *mysqld_wrapper_list)
+def updateMysql(args):
+  conf = args[0]
+  sleep = 30
+  is_succeed = False
+  while True:
+    if not is_succeed:
+      mysql_upgrade_list = [conf['mysql_upgrade_binary'], '--no-defaults', '--user=root', '--socket=%s' % conf['socket']]
+      mysql_upgrade = subprocess.Popen(mysql_upgrade_list, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+      result = mysql_upgrade.communicate()[0]
+      if mysql_upgrade.returncode is None:
+        mysql_upgrade.kill()
+      if mysql_upgrade.returncode != 0 and not 'is already upgraded' in result:
+        print "Command %r failed with result:\n%s" % (mysql_upgrade_list, result)
+        print 'Sleeping for %ss and retrying' % sleep
+      else:
+        if mysql_upgrade.returncode == 0:
+          print "MySQL database upgraded with result:\n%s" % result
+        else:
+          print "No need to upgrade MySQL database"
+        mysql_list = [conf['mysql_binary'].strip(), '--no-defaults', '-B', '--user=root', '--socket=%s' % conf['socket']]
+        mysql = subprocess.Popen(mysql_list, stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        result = mysql.communicate(conf['mysql_script'])[0]
+        if mysql.returncode is None:
+          mysql.kill()
+        if mysql.returncode != 0:
+          print 'Command %r failed with:\n%s' % (mysql_list, result)
+          print 'Sleeping for %ss and retrying' % sleep
+        else:
+          is_succeed = True
+          print 'SlapOS initialisation script succesfully applied on database.'
+    sys.stdout.flush()
+    sys.stderr.flush()
+    time.sleep(sleep)
--- a/slapos/recipe/mysql/template/initmysql.sql.in
+++ b/slapos/recipe/mysql/template/initmysql.sql.in
+CREATE DATABASE IF NOT EXISTS %(mysql_database)s;
+GRANT ALL PRIVILEGES ON %(mysql_database)s.* TO %(mysql_user)s@'%%' IDENTIFIED BY '%(mysql_password)s';
+#GRANT ALL PRIVILEGES ON %(mysql_database)s.* TO %(mysql_user)s@* IDENTIFIED BY '%(mysql_password)s';
--- a/slapos/recipe/mysql/template/logrotate_entry.in
+++ b/slapos/recipe/mysql/template/logrotate_entry.in
+%(file_list)s {
+  daily
+  dateext
+  rotate 30
+  compress
+  notifempty
+  sharedscripts
+  create
+  postrotate
+    %(postrotate)s
+  endscript
+  olddir %(olddir)s
+}
--- a/slapos/recipe/mysql/template/my.cnf.in
+++ b/slapos/recipe/mysql/template/my.cnf.in
+# ERP5 buildout my.cnf template based on my-huge.cnf shipped with mysql
+# The MySQL server
+[mysqld]
+# ERP5 by default requires InnoDB storage. MySQL by default fallbacks to using
+# different engine, like MyISAM. Such behaviour generates problems only, when
+# tables requested as InnoDB are silently created with MyISAM engine.
+#
+# Loud fail is really required in such case.
+sql-mode="NO_ENGINE_SUBSTITUTION"
+skip-show-database
+port = %(tcp_port)s
+bind-address = %(ip)s
+socket = %(socket)s
+datadir = %(data_directory)s
+pid-file = %(pid_file)s
+log-error = %(error_log)s
+#log-slow-file = %(slow_query_log)s
+long_query_time = 5
+max_allowed_packet = 128M
+query_cache_size = 32M
+plugin-load = ha_innodb_plugin.so
+# The following are important to configure and depend a lot on to the size of
+# your database and the available resources.
+#innodb_buffer_pool_size = 4G
+#innodb_log_file_size = 256M
+#innodb_log_buffer_size = 8M
+# Some dangerous settings you may want to uncomment if you only want
+# performance or less disk access. Useful for unit tests.
+#innodb_flush_log_at_trx_commit = 0
+#innodb_flush_method = nosync
+#innodb_doublewrite = 0
+#sync_frm = 0
+# Uncomment the following if you need binary logging, which is recommended
+# on production instances (either for replication or incremental backups).
+#log-bin=mysql-bin
+# Force utf8 usage
+collation_server = utf8_unicode_ci
+character_set_server = utf8
+skip-character-set-client-handshake
+[mysql]
+no-auto-rehash
+socket = %(socket)s
+[mysqlhotcopy]
+interactive-timeout
--- a/slapos/recipe/mysql/template/openssl.cnf.ca.in
+++ b/slapos/recipe/mysql/template/openssl.cnf.ca.in
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+[ new_oids ]
+# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+# Policies used by the TSA examples.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+####################################################################
+[ CA_default ]
+dir		= %(working_directory)s		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several ctificates with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem # The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+x509_extensions	= usr_cert		# The extentions to add to the cert
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+# Extension copying option: use with caution.
+# copy_extensions = copy
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+default_days	= 3650			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= default		# use public key default MD
+preserve	= no			# keep passed DN ordering
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+####################################################################
+[ req ]
+default_bits		= 2048
+default_md		= sha1
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+#attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
+string_mask = utf8only
+# req_extensions = v3_req # The extensions to add to a certificate request
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_value		= %(country_code)s
+countryName_min			= 2
+countryName_max			= 2
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_value	= %(state)s
+localityName			= Locality Name (eg, city)
+localityName_value		= %(city)s
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_value	= %(company)s
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+emailAddress			= Email Address
+emailAddress_value = %(email_address)s
+emailAddress_max		= 64
+# SET-ex3			= SET extension number 3
+#[ req_attributes ]
+#challengePassword		= A challenge password
+#challengePassword_min		= 4
+#challengePassword_max		= 20
+#
+#unstructuredName		= An optional company name
+[ usr_cert ]
+# These extensions are added when 'ca' signs a request.
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+basicConstraints=CA:FALSE
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+# This is OK for an SSL server.
+# nsCertType			= server
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+# For normal client use this is typical
+# nsCertType = client, email
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+# Copy subject details
+# issuerAltName=issuer:copy
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+# This is required for TSA certificates.
+# extendedKeyUsage = critical,timeStamping
+[ v3_req ]
+# Extensions to add to a certificate request
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+[ v3_ca ]
+# Extensions for a typical CA
+# PKIX recommendation.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+# Some might want this also
+# nsCertType = sslCA, emailCA
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+[ crl_ext ]
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+basicConstraints=CA:FALSE
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+# This is OK for an SSL server.
+# nsCertType			= server
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+# For normal client use this is typical
+# nsCertType = client, email
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+# Copy subject details
+# issuerAltName=issuer:copy
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+####################################################################
+[ tsa ]
+default_tsa = tsa_config1	# the default TSA section
+[ tsa_config1 ]
+# These are used by the TSA reply generation only.
+dir		= /etc/pki/tls		# TSA root directory
+serial		= $dir/tsaserial	# The current serial number (mandatory)
+crypto_device	= builtin		# OpenSSL engine to use for signing
+signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/cacert.pem	# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+clock_precision_digits  = 0	# number of digits after dot. (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
+				# (optional, default: no)
--- a/slapos/recipe/mysql/template/stunnel.conf.in
+++ b/slapos/recipe/mysql/template/stunnel.conf.in
+foreground = yes
+output = %(log)s
+pid = %(pid_file)s
+syslog = no
+CApath = %(ca_path)s
+key = %(key)s
+CRLpath = %(ca_crl)s
+cert = %(cert)s
+[service]
+accept = %(public_ip)s:%(public_port)s
+connect = %(private_ip)s:%(private_port)s
--- a/software/erp5testnode/software.cfg
+++ b/software/erp5testnode/software.cfg
@@ -38,6 +38,10 @@ arguments = sys.argv[1:] + ["bootstrap"]
 section = python2.6
 version = 1
+[versions]
+# Use SlapOS patched zc.buildout
+zc.buildout = 1.5.3-dev-SlapOS-001
 [eggs]
 recipe = zc.recipe.egg
 eggs =
@@ -50,429 +54,3 @@ recipe = slapos.recipe.template
 url = ${:_profile_base_location_}/instance.cfg
 output = ${buildout:directory}/template.cfg
 mode = 0644
-[versions]
-# Use SlapOS patched zc.buildout
-zc.buildout = 1.5.3-dev-SlapOS-002
-[versions]
-AccessControl = 2.13.4
-Jinja2 = 2.5.5
-Products.OFSP = 2.13.2
-Werkzeug = 0.6.2
-hexagonit.recipe.cmmi = 1.5.0
-lxml = 2.3
-manuel = 1.5.0
-mechanize = 0.2.5
-meld3 = 0.6.7
-mr.developer = 1.17
-slapos.cookbook = 0.4
-slapos.core = 0.2
-slapos.recipe.template = 1.1
-zope.i18n = 3.7.4
-zope.tales = 3.5.1
-#Required by:
-#Products.ExternalMethod 2.13.0
-#Products.PythonScripts 2.13.0
-#DocumentTemplate 2.13.1
-#Products.ZCTextIndex 2.13.2
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-Acquisition = 2.13.7nxd001
-#Required by:
-#Products.PythonScripts 2.13.0
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-DateTime = 3.0b1
-#Required by:
-#Products.MIMETools 2.13.0
-#Products.PythonScripts 2.13.0
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-DocumentTemplate = 2.13.1
-#Required by:
-#MultiMapping 2.13.0
-#Products.ExternalMethod 2.13.0
-#Record 2.13.0
-#Missing 2.13.1
-#Persistence 2.13.2
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-ExtensionClass = 2.13.2
-#Required by:
-#slapos.core 0.2
-Flask = 0.6.1
-#Required by:
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-Missing = 2.13.1
-#Required by:
-#Zope2 2.13.7
-MultiMapping = 2.13.0
-#Required by:
-#Products.ExternalMethod 2.13.0
-#Products.OFSP 2.13.2
-#Products.ZCTextIndex 2.13.2
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#Products.ZCatalog 2.13.14
-Persistence = 2.13.2
-#Required by:
-#Zope2 2.13.7
-Products.BTreeFolder2 = 2.13.3
-#Required by:
-#Zope2 2.13.7
-Products.ExternalMethod = 2.13.0
-#Required by:
-#Zope2 2.13.7
-Products.MIMETools = 2.13.0
-#Required by:
-#Zope2 2.13.7
-Products.MailHost = 2.13.1
-#Required by:
-#Zope2 2.13.7
-Products.PythonScripts = 2.13.0
-#Required by:
-#Zope2 2.13.7
-Products.StandardCacheManagers = 2.13.0
-#Required by:
-#Zope2 2.13.7
-Products.ZCTextIndex = 2.13.2
-#Required by:
-#Zope2 2.13.7
-Products.ZCatalog = 2.13.14
-#Required by:
-#slapos.cookbook 0.4
-PyXML = 0.8.5
-#Required by:
-#Zope2 2.13.7
-Record = 2.13.0
-#Required by:
-#Products.PythonScripts 2.13.0
-#Zope2 2.13.7
-RestrictedPython = 3.6.0
-#Required by:
-#zdaemon 2.0.4
-#zLOG 2.11.1
-#Zope2 2.13.7
-#ZODB3 3.10.3
-ZConfig = 2.9.0
-#Required by:
-#Products.ExternalMethod 2.13.0
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#zope.container 3.12.0
-ZODB3 = 3.10.3
-#Required by:
-#slapos.cookbook 0.4
-Zope2 = 2.13.7
-#Required by:
-#Zope2 2.13.7
-ZopeUndo = 2.12.0
-#Required by:
-#mr.developer 1.17
-#slapos.core 0.2
-argparse = 1.2.1
-#Required by:
-#slapos.recipe.template 1.1
-collective.recipe.template = 1.8
-#Required by:
-#Zope2 2.13.7
-docutils = 0.7
-#Required by:
-#hexagonit.recipe.cmmi 1.5.0
-hexagonit.recipe.download = 1.5.0
-#Required by:
-#Zope2 2.13.7
-initgroups = 2.13.0
-#Required by:
-#slapos.core 0.2
-#slapos.cookbook 0.4
-netaddr = 0.7.5
-#Required by:
-#slapos.core 0.2
-netifaces = 0.5
-#Required by:
-#Zope2 2.13.7
-#zope.i18n 3.7.4
-#zope.testbrowser 4.0.2
-pytz = 2011g
-#Required by:
-#zc.buildout 1.5.3-dev-SlapOS-001
-setuptools = 0.6c12dev-r88846
-#Required by:
-#slapos.core 0.2
-supervisor = 3.0a10
-#Required by:
-#Zope2 2.13.7
-tempstorage = 2.12.1
-#Required by:
-#Products.StandardCacheManagers 2.13.0
-#Zope2 2.13.7
-#zope.sendmail 3.7.4
-transaction = 1.1.1
-#Required by:
-#slapos.cookbook 0.4
-xml-marshaller = 0.9.7
-#Required by:
-#Products.PythonScripts 2.13.0
-#Zope2 2.13.7
-zExceptions = 2.13.0
-#Required by:
-#Zope2 2.13.7
-zLOG = 2.11.1
-#Required by:
-#ZODB3 3.10.3
-zc.lockfile = 1.0.0
-#Required by:
-#slapos.cookbook 0.4
-zc.recipe.egg = 1.3.2
-#Required by:
-#Zope2 2.13.7
-zdaemon = 2.0.4
-#Required by:
-#zope.site 3.9.2
-zope.annotation = 3.5.0
-#Required by:
-#zope.container 3.12.0
-zope.broken = 3.6.0
-#Required by:
-#Zope2 2.13.7
-#zope.browsermenu 3.9.1
-#zope.publisher 3.12.6
-zope.browser = 1.3
-#Required by:
-#Zope2 2.13.7
-zope.browsermenu = 3.9.1
-#Required by:
-#Zope2 2.13.7
-zope.browserpage = 3.12.2
-#Required by:
-#Zope2 2.13.7
-#zope.ptresource 3.9.0
-zope.browserresource = 3.12.0
-#Required by:
-#Products.StandardCacheManagers 2.13.0
-#Zope2 2.13.7
-#zope.pagetemplate 3.5.2
-#zope.lifecycleevent 3.7.0
-#zope.contentprovider 3.7.2
-#zope.viewlet 3.7.2
-#zope.i18n 3.7.4
-#zope.security 3.8.2
-#zope.container 3.12.0
-#zope.publisher 3.12.6
-#zope.traversing 3.14.0
-zope.component = 3.10.0
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-#zope.sendmail 3.7.4
-#zope.publisher 3.12.6
-zope.configuration = 3.7.4
-#Required by:
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#zope.site 3.9.2
-zope.container = 3.12.0
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-zope.contentprovider = 3.7.2
-#Required by:
-#Zope2 2.13.7
-zope.contenttype = 3.5.3
-#Required by:
-#Zope2 2.13.7
-zope.deferredimport = 3.5.3
-#Required by:
-#Products.ZCatalog 2.13.14
-#zope.container 3.12.0
-zope.dottedname = 3.4.6
-#Required by:
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#zope.lifecycleevent 3.7.0
-#zope.viewlet 3.7.2
-#zope.schema 3.8.0
-#zope.site 3.9.2
-#zope.publisher 3.12.6
-zope.event = 3.5.0-1
-#Required by:
-#Zope2 2.13.7
-#zope.testing 3.10.2
-#zope.publisher 3.12.6
-zope.exceptions = 3.6.1
-#Required by:
-#zope.container 3.12.0
-zope.filerepresentation = 3.6.0
-#Required by:
-#Zope2 2.13.7
-#zope.size 3.4.1
-#zope.pagetemplate 3.5.2
-#zope.tal 3.5.2
-#zope.viewlet 3.7.2
-#zope.sendmail 3.7.4
-#zope.security 3.8.2
-#zope.traversing 3.14.0
-zope.i18nmessageid = 3.5.3
-#Required by:
-#slapos.core 0.2
-#Zope2 2.13.7
-zope.interface = 3.6.3
-#Required by:
-#Products.BTreeFolder2 2.13.3
-#Zope2 2.13.7
-#zope.site 3.9.2
-zope.lifecycleevent = 3.7.0
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-#zope.security 3.8.2
-#zope.publisher 3.12.6
-zope.location = 3.9.0
-#Required by:
-#Zope2 2.13.7
-#zope.ptresource 3.9.0
-zope.pagetemplate = 3.5.2
-#Required by:
-#Zope2 2.13.7
-zope.processlifetime = 1.0
-#Required by:
-#Zope2 2.13.7
-#zope.publisher 3.12.6
-#zope.traversing 3.14.0
-zope.proxy = 3.6.1
-#Required by:
-#Zope2 2.13.7
-zope.ptresource = 3.9.0
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-#zope.traversing 3.14.0
-zope.publisher = 3.12.6
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-#zope.sendmail 3.7.4
-#zope.security 3.8.2
-#zope.testbrowser 4.0.2
-zope.schema = 3.8.0
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-#zope.site 3.9.2
-#zope.traversing 3.14.0
-zope.security = 3.8.2
-#Required by:
-#Zope2 2.13.7
-zope.sendmail = 3.7.4
-#Required by:
-#Zope2 2.13.7
-zope.sequencesort = 3.4.0
-#Required by:
-#Zope2 2.13.7
-zope.site = 3.9.2
-#Required by:
-#Zope2 2.13.7
-zope.size = 3.4.1
-#Required by:
-#Zope2 2.13.7
-zope.structuredtext = 3.5.1
-#Required by:
-#Zope2 2.13.7
-#zope.tales 3.5.1
-zope.tal = 3.5.2
-#Required by:
-#Zope2 2.13.7
-zope.testbrowser = 4.0.2
-#Required by:
-#Zope2 2.13.7
-zope.testing = 3.10.2
-#Required by:
-#Zope2 2.13.7
-#zope.viewlet 3.7.2
-zope.traversing = 3.14.0
-#Required by:
-#Zope2 2.13.7
-zope.viewlet = 3.7.2
--- a/software/kumofs/software.cfg
+++ b/software/kumofs/software.cfg
@@ -16,6 +16,18 @@ extends =
  ../../component/rdiff-backup/buildout.cfg
  ../../component/lxml-python/buildout.cfg
+# Use only quite well working sites.
+allow-hosts =
+  *.nexedi.org
+  *.python.org
+  *.sourceforge.net
+  dist.repoze.org
+  effbot.org
+  github.com
+  peak.telecommunity.com
+  psutil.googlecode.com
+  www.dabeaz.com
 versions = versions
 parts +=
@@ -60,13 +72,13 @@ output = ${buildout:directory}/template.cfg
 mode = 0644
 [versions]
-slapos.cookbook = 0.4
+slapos.cookbook = 0.7
 erp5.recipe.cmmiforcei686 = 0.1.1
 hexagonit.recipe.cmmi = 1.5.0
 hexagonit.recipe.download = 1.5.0
-# Required by slapos.cookbook==0.4
+# Required by slapos.cookbook==0.7
 slapos.core = 0.2
 collective.recipe.template = 1.8
 netaddr = 0.7.5

--- a/software/mariadb/instance.cfg
+++ b/software/mariadb/instance.cfg
+[buildout]
+parts =
+  instance
+eggs-directory = ${buildout:eggs-directory}
+develop-eggs-directory = ${buildout:develop-eggs-directory}
+[instance]
+recipe = ${instance-recipe:egg}:${instance-recipe:module}
+dcrond_binary = ${dcron:location}/sbin/crond
+innobackupex_binary = ${xtrabackup:location}/bin/innobackupex
+logrotate_binary = ${logrotate:location}/usr/sbin/logrotate
+mysql_binary = ${mariadb:location}/bin/mysql
+mysql_install_binary = ${mariadb:location}/bin/mysql_install_db
+mysql_upgrade_binary = ${mariadb:location}/bin/mysql_upgrade
+mysqld_binary = ${mariadb:location}/libexec/mysqld
+openssl_binary = ${openssl:location}/bin/openssl
+perl_binary = ${perl:location}/bin/perl
+rdiff_backup_binary = ${buildout:bin-directory}/rdiff-backup
+stunnel_binary = ${stunnel:location}/bin/stunnel
--- a/software/mariadb/software.cfg
+++ b/software/mariadb/software.cfg
+[buildout]
+extensions =
+  slapos.zcbworkarounds
+  slapos.rebootstrap
+find-links +=
+    http://www.nexedi.org/static/packages/source/slapos.buildout/
+extends =
+  ../../component/mariadb/buildout.cfg
+  ../../component/dcron/buildout.cfg
+  ../../component/logrotate/buildout.cfg
+  ../../component/stunnel/buildout.cfg
+  ../../component/python-2.7/buildout.cfg
+  ../../component/perl/buildout.cfg
+  ../../component/xtrabackup/buildout.cfg
+  ../../component/rdiff-backup/buildout.cfg
+  ../../component/lxml-python/buildout.cfg
+# Use only quite well working sites.
+allow-hosts =
+  *.nexedi.org
+  *.python.org
+  *.sourceforge.net
+  dist.repoze.org
+  effbot.org
+  github.com
+  peak.telecommunity.com
+  psutil.googlecode.com
+  www.dabeaz.com
+versions = versions
+parts +=
+# Create instance template
+#TODO : list here all parts.
+  template
+  libxslt
+  eggs
+  instance-recipe-egg
+# XXX: Workaround of SlapOS limitation
+# Unzippig of eggs is required, as SlapOS do not yet provide nicely working
+# development / fast switching environment for whole software
+unzip = true
+[rebootstrap]
+# Default first version of rebootstrapped python
+version = 2
+section = python2.7
+[instance-recipe]
+egg = slapos.cookbook
+module = mysql
+[instance-recipe-egg]
+recipe = zc.recipe.egg
+python = python2.7
+eggs = ${instance-recipe:egg}
+[eggs]
+recipe = zc.recipe.egg
+python = python2.7
+eggs =
+  ${lxml-python:egg}
+[template]
+# Default template for the instance.
+recipe = slapos.recipe.template
+url = ${:_profile_base_location_}/instance.cfg
+md5sum = 69c32a67c5640d36ee042d2cfc35843d
+output = ${buildout:directory}/template.cfg
+mode = 0644
+[versions]
+slapos.cookbook = 0.9
+# Required by slapos.cookbook==0.9
+slapos.core = 0.4
+collective.recipe.template = 1.8
+netaddr = 0.7.5
+xml-marshaller = 0.9.7
+setuptools = 0.6c12dev-r88795
+hexagonit.recipe.cmmi = 1.5.0
+hexagonit.recipe.download = 1.5.0
+plone.recipe.command = 1.1
+# Use SlapOS patched zc.buildout
+zc.buildout = 1.5.3-dev-SlapOS-001
--- a/software/memcached/software.cfg
+++ b/software/memcached/software.cfg
@@ -14,7 +14,19 @@ extends =
  ../../component/stunnel/buildout.cfg
  ../../component/rdiff-backup/buildout.cfg
  ../../component/lxml-python/buildout.cfg
+# Use only quite well working sites.
+allow-hosts =
+  *.nexedi.org
+  *.python.org
+  *.sourceforge.net
+  dist.repoze.org
+  effbot.org
+  github.com
+  peak.telecommunity.com
+  psutil.googlecode.com
+  www.dabeaz.com
 versions = versions
 parts =
@@ -59,9 +71,9 @@ output = ${buildout:directory}/template.cfg
 mode = 0644
 [versions]
-slapos.cookbook = 0.4
+slapos.cookbook = 0.7
-# Required by slapos.cookbook==0.4
+# Required by slapos.cookbook==0.7
 slapos.core = 0.2
 collective.recipe.template = 1.8
 netaddr = 0.7.5

--- a/software/mysql-5.1/instance.cfg
+++ b/software/mysql-5.1/instance.cfg
+[buildout]
+parts =
+  instance
+eggs-directory = ${buildout:eggs-directory}
+develop-eggs-directory = ${buildout:develop-eggs-directory}
+[instance]
+recipe = ${instance-recipe:egg}:${instance-recipe:module}
+dcrond_binary = ${dcron:location}/sbin/crond
+innobackupex_binary = ${xtrabackup:location}/bin/innobackupex
+logrotate_binary = ${logrotate:location}/usr/sbin/logrotate
+mysql_binary = ${mysql-5.1:location}/bin/mysql
+mysql_install_binary = ${mysql-5.1:location}/bin/mysql_install_db
+mysql_upgrade_binary = ${mysql-5.1:location}/bin/mysql_upgrade
+mysqld_binary = ${mysql-5.1:location}/libexec/mysqld
+openssl_binary = ${openssl:location}/bin/openssl
+perl_binary = ${perl:location}/bin/perl
+rdiff_backup_binary = ${buildout:bin-directory}/rdiff-backup
+stunnel_binary = ${stunnel:location}/bin/stunnel
--- a/software/mysql-5.1/software.cfg
+++ b/software/mysql-5.1/software.cfg
+[buildout]
+extensions =
+  slapos.zcbworkarounds
+  slapos.rebootstrap
+find-links +=
+    http://www.nexedi.org/static/packages/source/slapos.buildout/
+extends =
+  ../../component/mysql-5.1/buildout.cfg
+  ../../component/dcron/buildout.cfg
+  ../../component/logrotate/buildout.cfg
+  ../../component/stunnel/buildout.cfg
+  ../../component/python-2.7/buildout.cfg
+  ../../component/perl/buildout.cfg
+  ../../component/xtrabackup/buildout.cfg
+  ../../component/rdiff-backup/buildout.cfg
+  ../../component/lxml-python/buildout.cfg
+# Use only quite well working sites.
+allow-hosts =
+  *.nexedi.org
+  *.python.org
+  *.sourceforge.net
+  dist.repoze.org
+  effbot.org
+  github.com
+  peak.telecommunity.com
+  psutil.googlecode.com
+  www.dabeaz.com
+versions = versions
+parts +=
+#TODO : list here all parts.
+# Create instance template
+  template
+  libxslt
+  eggs
+  instance-recipe-egg
+  rdiff-backup
+# XXX: Workaround of SlapOS limitation
+# Unzippig of eggs is required, as SlapOS do not yet provide nicely working
+# development / fast switching environment for whole software
+unzip = true
+[rebootstrap]
+# Default first version of rebootstrapped python
+version = 2
+section = python2.7
+[instance-recipe]
+egg = slapos.cookbook
+module = mysql
+[instance-recipe-egg]
+recipe = zc.recipe.egg
+python = python2.7
+eggs = ${instance-recipe:egg}
+[eggs]
+recipe = zc.recipe.egg
+python = python2.7
+eggs =
+  ${lxml-python:egg}
+[template]
+# Default template for the instance.
+recipe = slapos.recipe.template
+url = ${:_profile_base_location_}/instance.cfg
+md5sum = 2764597a6e4fe243cdf6e37b6535e767
+output = ${buildout:directory}/template.cfg
+mode = 0644
+[versions]
+slapos.cookbook = 0.9
+# Required by slapos.cookbook==0.9
+slapos.core = 0.4
+collective.recipe.template = 1.8
+netaddr = 0.7.5
+xml-marshaller = 0.9.7
+setuptools = 0.6c12dev-r88795
+hexagonit.recipe.cmmi = 1.5.0
+hexagonit.recipe.download = 1.5.0
+plone.recipe.command = 1.1
+# Use SlapOS patched zc.buildout
+zc.buildout = 1.5.3-dev-SlapOS-001