Zero Install: 0export

0export

0export creates self-installing bundles for distribution on CD, etc

Normally, a program is run by passing its name (a URI) to the 0launch command. This downloads the appropriate feeds, choose a set of implementations (a version of the program, along with any libraries it needs) and downloads them too.

However, it is sometimes useful to bundle a program and its libraries together on a CD (for example) so that it can be used on machines without a network connection, or where the network is very slow. It is also useful for archival purposes, in case the original web-sites supplying required libraries become unavailable.

0export takes the URI of a program and creates a "setup.sh" file; a self-extracting archive containing everything needed to run the program. This file can be executed on a machine without a network connection to install or run the program.

Unlike the bundles created by the related Zero2Bundle program, programs installed using setup.sh are added to the Zero Install cache and are therefore still shared between users, and will get updates over the web where possible.

Name	0export
Maintainer	Thomas Leonard
License	GNU General Public License
SCM	GIT repository

Current status
Installing 0export
Creating a setup.sh for your program
Format of the setup.sh
Testing
FAQ

Current status

This program is not yet complete. At the end of the installation process, the installer should add a launcher for the program to the user's desktop. Currently, it just runs the program directly (meaning that if the user wants to run the program again, they have to run the setup.sh script again!).

Installing 0export

This program has not been officially released yet. However, you can use the developer version like this:

$ git clone git://repo.or.cz/0export.git
$ 0alias 0export 0export/0export.xml

Creating a setup.sh for your program

Run 0export, passing in the name of the installer file to create and the name (URI) of the main program. For example, to create an installer for Edit:

$ 0export setup.sh http://rox.sourceforge.net/2005/interfaces/Edit

The resulting setup.sh file can be copied to a CD and run on another machine. This machine does not need a network connection. It also does not need to have Zero Install installed on it before-hand.

However, if the machine does have a network connection then the user will be notified of updates in the usual way.

Format of the setup.sh

The bulk of the setup.sh file is an archive containing:

All feeds needed to run the program.
All GPGs keys signing the feeds.
All selected implementations (versions).
A copy of Zero Install, in case the target system doesn't have it.
An installation script.

To make the archive self-extracting, a short shell script is prepended to the archive which unpacks it to a temporary directory and then runs the installer. If you want to extract the files without executing anything, you can get the information you need from the first four lines of the script, which look like this:

#!/bin/sh
# 0export 0.1
archive_offset=00831
archive_format=application/x-bzip-compressed-tar

Testing

To test the installer:

$ sh setup.sh

The script currently (0.1-pre) does the following:

Runs gpg --import on each GPG key in the archive, adding the keys that signed the feeds to your key-ring.
Runs 0launch --import on each feed in the archive. Every signing GPG key is added to the trusted list for the feed's domain. This allows checking for updates in future without confirming the keys. If the user already has a newer version of the feed, the import has no effect.
Chooses a set of implementations (0launch --get-selections URI) in minimal network use mode and with the implementations in the setup.sh available.
Copies any selected implementations into the system or user's cache (~/.cache/0install.net/implementations).
Runs the program (0launch --offline URI).

In future, the last step will be to install a launcher in the user's menus instead. All steps use the bundled version of 0launch.

FAQ

What about security?: Running an executable isn't a great way to install a program. The normal Zero Install process of dragging a feed link to a trusted installation program is much better. However, distributions have been very slow to support this. 0export is an attempt to boot-strap the adoption process. The setup.sh script is designed to be easy to parse, so that in future it can be used as a simple archive.
Why doesn't it confirm before trusting the keys?: If the setup.sh is genuine then this is what you want. If it isn't, it's already too late. Even if the normal install script asked for confirmation, a malicious version could be modified to skip the check. One of many reasons why install scripts are a bad idea.
Support for multiple architectures or multiple applications in one bundle?: Not yet, but it's easy to add.
What about a GUI?: Hopefully in the future.