- devel - lists.freelock.com

LedgerSMB 1.6.19 released
by Erik Huelsmann 10 Feb '20

10 Feb '20

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.6.19 * Fix authentication issue due to inconsistent cookie handling (Erik H) Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.19/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.19 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.19 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.19 These are the sha256 checksums of the uploaded files: 17d784a326e7963cd048e05c32d9a65ba56b43734ed72b6266d866456f225a6f ledgersmb-1.6.19.tar.gz 2822affae38bfd27c74812288bd33bac129b00c1890b2232d28794673c40bcf8 ledgersmb-1.6.19.tar.gz.asc

1 0

Splitting authentication layers
by Erik Huelsmann 08 Feb '20

08 Feb '20

Hi, As part of my preparations to introduce web services, I've found that many web APIs provide two ways to authenticate: (a) a session cookie which can be obtained by "logging in", or (b) an "API key" ; either the API key or the session cookie is then provided with each request to the API, authenticating the request with the session and/or user. It should be noted that neither requests providing an API key nor those providing a session cookie contain further credentials. For our (API) authentication, ideally, I'd like to be able to provide both the "api key" and the "session cookie" patterns for request authorization. Additionally, I'd like session authentication to be available using: - Username & password (preferably through CRAM-SHA2 or higher SHA) * Note that in this scenario, the password validation could be anything; even a Kerberos or LDAP server - WebAuth / FIDO2 - OAuth2 - Client certificate - (and more, if we come up with those) == The Problem == Our current authentication setup requires plain text username and password on the initial login and each further request. We currently use basic auth to supply these values. In addition, we use a session cookie, but that only serves to validate the session. Thus every request currently requires the username, password and session cookie. The username and password are required because those are used to set up the database connection at the start of the request handling. Most of the authentication systems above don't maintain a username/password combination visible to our server. By consequence, I'm looking for ways to eliminate the need for the username+password in the Web request. Also, if we'd want to use "API key" type authentication, that API key would need to hold in it (encrypted, but decryptable to the server) the username and password in order to be able to log into the database. Note that the previous sentence explicitly states "in the Web request": ideally, LedgerSMB authentication can happen on two different levels -- the web request level and the database connection level. Basically, I'd like to start making the distinction between the web request authentication and the database authentication in such a way that our database authorization (access control) remains PostgreSQL-role-based (that is: doesn't change from the current model). == The Proposal == My current idea is to separate the web authentication from the database authentication. The web application would use a generic user to set up the database connection, switching the session authorization to the role associated with the user, as if the user had logged in directly on the database. Technically, this is achieved by the Pg command 'SET SESSION AUTHORIZATION = username'. This means that once the session has been verified (either through the API key provided or the session cookie), authorization can be switched to the (web)authenticating user and regular processing (as we know it today) can continue. This solution using the session authorization is very similar to what the Graphile (graphile.org) project uses [they use SET ROLE instead of SET SESSION AUTHORIZATION -- there are subtle differences between their approach and my proposal]. The solution has the benefit of supporting direct connections to the database as they are today with all methods built into PostgreSQL, adding into the mix a second set of authorization options better suited to a web authentication scenario. == The Request == Please comment on the above to get a good common understanding of what I'm describing and the best possible implementation at that. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 1

Some questions about the PGObject modules
by Chris Bennett 03 Feb '20

03 Feb '20

Hi, I've been working on and submitting ports, but there has been port-a-thons and hackathons right as I submit stuff. I took a long holiday this year as it rained and snowed almost non-stop. I also got delayed by my laptop having some kind of problem. I couldn't fix it, but it works fine with an older version of OpenBSD and I'm just running -current on my servers and doing this work there. I submitted PGObject a while back. Someone had to update the postgresql database test module for the testing to work. Then I realized looking closer that it does the same thing I do, it gets $dbh from elsewhere. I'm looking over the rest of these modules, but so far I am seeing mostly the same. Except for DBAdmin. So far running the database tests for that one are failing, including from the actual Perl build. I'm not sure that I am doing the tests properly. I'm going to ask and look at other ports in OpenBSD to see if I'm doing the tests correctly. We never directly use the Perl build for testing. We have a PostgreSQL testing module for that. I just saw mention of PGObject in github email. What does that mean? I haven't had a chance to look in the LedgerSMB code at the spots where those modules are being used. Otherwise, I've done a lot of work getting the modules ready. Submitted some and I've got several more ready to submit. I do have one problem. Several of the modules don't have DESCRIPTIONS. I already have one Plack that I have been asked to give a better description before it can be accepted (the encoding one). Also, the various PGObject-* are really bad on that. Is there any way to come up with something more official for the group? Perhaps like an overall description for the group with a detail for how each one fits into the group? Maybe something like: The PGObject set does ... and this module carries out the ... That would be extremely helpful. Once in the ports tree, no problems. -- Chris Bennett

1 0

LedgerSMB 1.7.8 released
by Erik Huelsmann 22 Jan '20

22 Jan '20

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.8 * Upgrade Dojo dependency to 1.15.1 * Load the template from the database when printing receipts * Prevent dead-locks in response to request from timed out session * Add monetary formatting to payments/receipts screen and report For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.8/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.8 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.8 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.8 These are the sha256 checksums of the uploaded files: 59a7ad10d8da1b28f298239c93ea4ca15fd348ff5d1517253dfe6a4b51d099a4 ledgersmb-1.7.8.tar.gz c91c4b3af21ac0ad8d6d5809678ed8e537596e15899d3142e196ac2a724f9876 ledgersmb-1.7.8.tar.gz.asc

1 0

LedgerSMB 1.6.18 released
by Erik Huelsmann 22 Jan '20

22 Jan '20

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.6.18 * Upgrade Dojo dependency to 1.13.5 (Erik H) * Prevent dead-locks in response to request from timed out session (Erik H) Erik H is Erik Huelsmann For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.18/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.18 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.18 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.18 These are the sha256 checksums of the uploaded files: e07f6afc54c33f30d5b914c7e28635640e5c246826f7f5054d0742c2f2214f62 ledgersmb-1.6.18.tar.gz 828c87904b13617f60f5011a97767dcf073be0534bb529363f28387c289ae51c ledgersmb-1.6.18.tar.gz.asc

1 0

New reconciliation rules in relation to payment changes?
by Erik Huelsmann 22 Jan '20

22 Jan '20

Hi, Over the past weeks, I've implemented a change in the way payments are being recorded: batch payments are now recorded explicitly (instead of implied) and payments entered into the invoice screen are now recorded (as opposed that they were not recorded as payments, but "just" lines on the invoice transaction). The next step in my improvement plan is to use the new payment information in Reconciliation. To understand the problem domain, there's a bit of context to be explained: technically, every invoice being paid in a payment causes its own line in the Bank GL account. These lines are grouped using a payment identification. Now that all payments are being correctly recorded in the database, we can tap into that information to summarize the bank reconciliation view: We can show payments as a single line. Where we're coming from is different: we used to aggregate lines on the Bank GL account by various fields (reference, counterparty, source reference, date, transaction type, mostly). The method we used to use, caused two payments by the same customer - entered without a source reference number - to be aggregated into a single reconciliation line. On the other hand it was impossible to post small corrections to payments through the GL: because the aggregation takes the transaction type into account, GL transactions and payment transactions (AR/AP) can't be aggregated into a single reconciliation line. I was thinking that the reconciliation could be changed to use this business rule: Aggregate into single reconciliation lines (so as to reconcile with a single bank transaction): * Payments and GL transactions on the same date with the same 'reference' * GL lines with the same date and same 'source' (source reference number) -- if the gl lines couldn't be merged with a payment This business rule allows reconciliation - as single reconciliation lines - of: * Reconciliation of payments *with their GL corrections* as a single payment line * Reconciliation of payments (without GL corrections) * Reconcilation of GL-entered lines with the same source code reference * Reconciliation of GL-entered lines individually (when no source code reference is entered) Is this what we want? It's wildly different from the criterion we currently use, where we aggregate all lines on the bank account, into lines where the differentiator is: * Date * Transaction type (ar/ap/gl) * Reference (AR/AP: internal eca ID; GL: transaction's "Reference" field) * Voucher number * Source reference number (Source field of transaction line) * Memo field content (transaction line Memo field) Note however, that in the current situation, there isn't a concept of "payment" in the database at the moment; transactions posted using regular and batch payments receive the same values for Date, Transaction type, Reference, Source reference number and optionally voucher (for bulk payments). Concluding: the old rule mostly aligns with payments, but on a different basis and may aggregate multiple payments into one. When we hash out the question above, I have a follow-up question of how the reconciliation process should work from a business process perspective. Let's try to hash this one out first. -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 2

LedgerSMB 1.7.7 released
by Erik Huelsmann 12 Jan '20

12 Jan '20

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.7.7 * Fix currency column not being available in the parts screen For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.7/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.7 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.7 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.7 These are the sha256 checksums of the uploaded files: 3509cfa379c5752206a464abc0b04c1beaff66ee7a6b2e49c338d7808de9e08b ledgersmb-1.7.7.tar.gz b00f2b01607822d862c5ef7446c3c4e1d887204123e90d4441bec4da6e1020fb ledgersmb-1.7.7.tar.gz.asc

1 0

LedgerSMB community overview 2019
by Erik Huelsmann 28 Dec '19

28 Dec '19

Hi, As the year-end approaches, it's time to provide an overview of what our community has achieved over the past year. At the beginning of the year, in last year's overview, the hope was expressed that the MC branch would be merged this year and that the 1.7 release cycle would turn out shorter again than the previous ones. == Community interest == The hits on our web site show a stable line month-on-month, although lower than last year. Consensus has it that traditional websites get lower numbers of hits than several years ago because of mobile and other (social) media. Hits seem to be pretty stable now. During the year, we've seen the number of Watchers, Stars and Forks on GitHub slowly but steadily increase. Traffic seems to be slightly up on our mailing lists, the users mailing list especially, with questions from new users installing and configuring LedgerSMB. The number of active developers is a bit lower, than last year; some hang around in our chat channel to help evaluate changes submitted by active members, though. All in all, the community seems to be on-boarding potential and new users and experiencing its regular in- and outflux of developers. == Releases == Last year we hoped to release 1.7 in the first half of the year. With the release of 1.6.0 on June 10 2018, we hoped to be able to start doing yearly releases. We also expressed the hope to land the MC branch on master. We ended up releasing 1.7 on October 4 2019, a little less than 16 months after 1.6.0. We did reduce the release cycle, but not by as much as we'd hoped. In part, the longer-than-hoped-for release cycle was caused by the fact that the MC branch did land on master, which warranted additional test effort, especially of the database migration scripts against real-world data. All in all we released around the same number of times as we did in 2018: * 10 stable releases: 1.7.0 - 1.7.6 & 1.6.10 - 1.6.12 * 11 old-stable releases: 1.6.13 - 1.6.17 & 1.5.25 -1.5.30 == Packaging and installation == In preparation for the 1.7 release, some work was done on the Docker images to run on Debian Buster. However, we found that Buster deprecated the ssmtp package which we depended on and it was too late in our own release cycle to do any fundamental changes to our e-mail functionality. We ended up going back to Stretch to run 1.7 on. Further work will be required to make sure 1.8 offers similar functionality without depending on ssmtp. The Debian ledgersmb package for 1.6 transitioned to Buster. Which is great as Debian Stable now has a non-deprecated version in its package repository. Last week we found that the package unfortunately misses a few files. We hope to fix that really soon. == Development progress == Over the course of 2019, 40 issues were created, 19 of which remain open at this point. All 19 issues were created by the development team, many in the process of doing code reviews or development work. A total of 73 issues were closed in 2019, including issues created in prior years. From these numbers, we can see that now that the MC branch has been merged, there's time or room to work on issues not directly related to MC or the creation of infrastructure to support MC development. The development work spun off 304 pull requests on the LedgerSMB repository. The number of pull requests is a lot lower than in 2018 when the number was around 480. The 304 PRs triggered nearly 1000 builds on Travis CI. During the first half of the year, we developed large numbers of new tests, push coverage up from 34% in last year's report to 41% now. Although 41% still is by far not enough, we started to run into the limits of what Travis CI was able to provide us (which is: maximum of 50 minutes of run-time on each test job). We evaluated a number of other CI providers, including the option to run our own. We ended up going for CircleCI; to their service we moved our longest running test job (we left the others at TravisCI), because they account the total time to be spent by a project differently. Areas that we're currently spending time on, include: * Selection of a new translation engine which supports more than 2 plural forms * Building on last year's separation between printed-document templates and UI templates, moving more printed documents into the framework * Gradual polishing of 1.7 through regular fixes of issues left to be polished after 1.7.0 release * Polishing of the technical implementation and user experience of payments and receipts The 334 issues that are open today summarize into these statistics: * 71 are marked bite-sized; this means they should be good places to start for new-comers * 188 are marked as desirable enhancements * 43 are marked as being in our queue of design work (Note that an issue may fall into more than one category.) == New functionality and improvements == A long-standing desire was to remove code duplication in templates to generate output tables. This year, we managed to move all code using the old report table infrastructure to the new code base. While doing so, we also cleaned up fixed assets code. Another topic that we spent time on, is research on how other PostgreSQL based projects structure their authentication. One project that drew our attention was Graphile (https://www.graphile.org/) From their approach, we've come up with an approach that may help us simplify setting up the database connections and managing / reporting password expiry on login. == Looking forward to 2020 == In 2020, we'll likely release 1.8 in the second half of the year. I personally hope that we can shorten the release cycle to get to yearly releases around the middle of the year. With that schedule it'll leave a number of patch releases until the end of the year, allowing users to migrate to a stable release after closing their books at the end of the year (if they didn't migrate earlier already). For 2020, I'm also hoping that the idea to work concentrate on specific topics, moving from topic to topic to improve the software, leads to an attractive 1.8 release. The various topics have been grouped into GitHub "projects" (https://github.com/ledgersmb/LedgerSMB/projects) Topics that have my personal priority are "Payment/payment_link support for all parts of the code base" and "Polish cash and payments". The first is rather technical in nature and a prerequisite to address the issues collected into the second. For 2020, I'm hoping to complete at least one, but hopefully both projects. For 2020, I'm hoping for 1 or 2 new contributors (not necessarily developers; translators, testers, documenters or UI artists are all greatly appreciated!). If you want to contribute, but don't know where to start, please contact me. Leaves me only to wish everybody in our community - and their loved ones - a very good, healthy and prosperous 2020! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

LedgerSMB 1.7.6 released
by Erik Huelsmann 26 Dec '19

26 Dec '19

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. Please note that this release fixes an important translation bug that was introduced in 1.7.0, where only the menu was translated, instead of the entire UI. This release contains the following fixes and improvements: Changelog for 1.7.6 * Disallow rate entry for the default currency (#4236) * Fix formatting on-hand (OH) column on orders to follow user settings (#3334) * Fix UI translation other than the menu, regressed from 1.6 (#4293) * Fix missing 'Entered At' date in contact notes (#2822) * Fix removal of lines from orders and vendor invoices on entry (#3703) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.7.6/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.7.6 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.7.6 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.7.6 These are the sha256 checksums of the uploaded files: 9faa2df90c9d91610b754ec2d716e222c81f88b3dec11bff63625b7a50f2fc3f ledgersmb-1.7.6.tar.gz 4866c96a3d2e293b2585e8a5b1d30efe4ec8d579b36b9a4f5428d7f24d80793a ledgersmb-1.7.6.tar.gz.asc

1 0

LedgerSMB 1.6.17 released
by Erik Huelsmann 26 Dec '19

26 Dec '19

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.6.17 * Allow uploading of attachments with unknown mime-types (Erik H) * Fix formatting on-hand (OH) column on orders to follow user settings (Erik H) * Fix migration of assembly data from SQL Ledger 3.2 (Yves L) Erik H is Erik Huelsmann Yves L is Yves Lavoie For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.6.17/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.6.17 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.6.17 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.6.17 These are the sha256 checksums of the uploaded files: 162c1acf684a2a207ddc2042e28e2db29793855d6e8f2755ba42247b97ebeb5f ledgersmb-1.6.17.tar.gz fa5ed1d5dbf5956924086daa0c40a897caa34fa9dcbb0c496972b88824433197 ledgersmb-1.6.17.tar.gz.asc

1 0