• About Me

    • Patrick Burma

  • Polls

    Would You Ever use .NET with Mono on Mac or Linux?


    View Results

    Loading ... Loading ...

Tomcat Ate My CGI

Posted by pat on March 14th, 2007

I was working on configuring Apache Tomcat for the better half the day yesterday. I am Tomcat noob, and mostly plan to stay that way, but on occasion there are customers with Tomcat installed into convenient places who want to use TestTrack. The TestTrack Web UI is powered by a C-style binary CGI and Tomcat is designed for Java servlet applications. While Tomcat does offer support for CGI its not the supported by default so you have to know what you are doing to get it to work. The instructions also change for different versions Tomcat.

The last time I struggled to configure Tomcat was maybe two years ago on Tomcat 5.0. The main issue I ran into is that the CGI was being executed as a Perl script. I guess this is the default behavior for executables in the CGI directory? It was very strange to me since the TestTrack CGI “ttcgi.exe” has neither a .cgi or .pl extension. But, I never got it figured out and the Tomcat mailing list did not provide any additional help. This means your MIME mappings do not apply to the CGI directory that you have configured, so even though .exe is listed as application/octet-stream Tomcat still will try to run as a Perl script.

Fast forward to yesterday and I fire up Tomcat again. This time I come across the instructions on how to execute the script properly, and not as a perl script. I needed to add an init param “execute” option which ended up looking like this in my web.xml file.

<servlet>

<servlet-name>cgi</servlet-name>

<servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>

<init-param>

<param-name>debug</param-name>

<param-value>0</param-value>

</init-param>

<init-param>

<param-name>cgiPathPrefix</param-name>

<param-value>WEB-INF/cgi</param-value>

</init-param>

<init-param>

<param-name>executable</param-name>

<param-value>cmd /c</param-value>

</init-param>

<load-on-startup>5</load-on-startup>

</servlet>

The key being the “cmd /c” param value. Once that was done the CGI was properly executed and I could see the TTPro login page OK.

So at this point I stop Tomcat 5.0, thinking I solved the problem, and fired up Tomcat 6.0 after making the same changes to the web.xml file in my Tomcat 6.0 directory. Now I have a bunch of exceptions in my Catalina log “class org.apache.catalina.servlets.CGIServlet is privileged “. A few google searches later and I figured out the problem. In Tomcat 5.0 there was a servlets-cgi.jar file which provided the CGI support which is now in the catalina.jar file for Tomcat 6.0 (the lib directory also moved, but that is a minor issue). The privileged part I did not understand but found on a user forum that I can modify the context.xml file so that

<context privileged=”true”>

which worked. I also had to modify my server.xml file to use the old authentication means, I am not sure how to setup “UserDatabaseRealm” properly so I switched to “MemoryRealm” which uses the tomcat-users.xml file and its easy enough to define users and roles that way. 

Now the ttcgi.exe runs OK when I access it through a Web browser and everything seems happy. And of course its too good to be true. Tomcat is apparently eating the CGI connection attempt to the TestTrack server on localhost:99. I am sure it is blocking the TCP/IP request because I still have IIS running and the CGI is connecting using the same registry entities, and I can use a CGI test “ttcgi.exe?selftest=1″ that shows me that the program is reading the registry and executing properly. I can also slip on a packet sniffer and see the blackhole for myself, requests go in…nothing comes out.

I assume this is standard Tomcat policy setting. But so far I have been unable to resolve it, I am sure its a combination of bad security setup and not understanding the catalina.policy file, though I did try multiple combinations of entries to grant “permission java.net.SocketPermission” to the port 99 on localhost, but so far nothing has worked.

Maybe in another two years I will try and figure out my security policy issue, in the meantime Apache or IIS will be a lot easier to run a binary CGI. Afterall this is not what Tomcat was built for, but jeez is it a pain to try and setup if you do want to use it to run CGI.

Coding Bug

Posted by pat on March 5th, 2007

I was recently in Atlanta for about 3 weeks doing some consulting. I spent a lot of nights bored in my hotel room until I caught a coding bug. I decided to start learning C# a few weeks before and decided to try my hand building some custom C# applications that can be used with Surround SCM. I’ve created five different programs but only three are ready for use. You can find them here.

Seapine Labs

Creating these apps kept me pretty well occupied after hours. I haven’t done a lot of programming since college so I was a little rusty at first, but thankfully C# is very easy. The SSCM Bug Merge application I wrote was the most challenging as it required using Regex statements multiple times to parse through long strings being spit out of the Surround SCM command line client.

Now that I have officially caught the C# coding bug I am going to keep creating little applications like this for Surround and hopefully get into some SOAP programming with TTPro.

Tips on Shopping for SCM Tools

Posted by pat on January 11th, 2007

Having been integrated into the SCM shopping and buying experience for hundreds of different companies I thought I could share some helpful tips on what to look for when embarking on this type of task. Here are my top five tips.

I. Review the SCM fundamentals

If you have never used an SCM product before, or have only used one or two programs like VSS or CVS, it maybe a good idea to brush up on software configuration management. There are a lot of books and web sites that provide information on methodology which can really bolster the SDLC process itself. I find that a lot of people have only used CVS or VSS a limited knowledge of SCM concepts beyond the basic capabilities that these tools provide.

A found a good introduction to SCM in the book Practical Software Configuration Management. After reading these book which provided a good background on SCM in general I also went on to read Software Product Management Essentials which deals with the management aspect of the SDLC. This important because the SDLC process will be tightly woven into the SCM product, and it is important to know what type of SDLC process that will be used before selecting the appropriate SCM tool. The next bit of recommended reading came in a more advanced document from IEEE. We feature this document on the Seapine web site and its called The Importance of Branching Models in SCM. This document is so popular you can now find it on dozens of web sites included other SCM vendor pages. This was an excellent document on how to make the development process much more effective.

If you do not have a very solid background in SCM and SDLC management fundamentals these resources will be a very big help and allow you to better define the scope of your SCM needs.

II. Determine the scope of your SCM needs

There are a lot of SCM tools on the market, open source and commercial. They all work somewhat the same, in that they provide versioning of files, but can have many important differences. These differences can be given attributes that are applied to need. A lot of times the more expensive tools like IBM’s ClearCase are designed for larger scale high risk environments. The less expensive and open source tools like CVS are intended for smaller groups and focus on speed and simplicity. The number of people in the organization who will use the SCM tool can be used as one of the factors to determine what type of tool you need. A group of 300 users working on a hundred million dollar projects using RUP might opt for a high end product, while a group of 3-5 users working on customized web applications using lightweight and Agile may opt for a more low end product. The former has high capability but also high overhead in cost, training and time to install and maintain the product while the later will boast quicker setup and lower overhead but less capability.
A sample list of primary attributes might be:

Number of users – How many people will use the system
Size of Database – Scale of the source code repository
LAN or WAN user access – How will performance for external users be effected
Risk/Security Management – How critical is the source code repository

A small list of initial requirements can then be used to isolate some SCM candidates whose price points and feature set match. Tools that are designed for 100’s of users should not be considered for smaller groups. Tools with database size limitations can be eliminated if they appear not to support your estimated needs. Products without external access or risk management features can also be removed from consideration for larger projects.

This initial requirements gather is fairly basic and short, but essential. In a relatively short period of time, perhaps one meeting with your team for 30 minutes, you can define the basic scope of your need. This initial need can be used to determine what type of tool you are looking for. There are all manner of large, small and any number of in-between sized tools to choose from so consider this the first step to honing in on your ideal candidates list. Like most things in life you get what you pay for, large cost often comes with greater number of features and higher end functionality. Later on we will focus on feature requirements.

III. Product Comparisons
At this stage two things should be fairly clear. How you want to implement your software development process, and what your basic level of requirements are. Using these two guidelines you’ll be able to select and evaluate different SCM products to look for more specific features you may be interested in like Email notifications, reporting, merging, diffing and more. There is an excellent article on CMCrossroads which talks about making this an organized project.

There are many other considerations that can be made. Off-site, hosting of the SCM projects are available for some commercial and open source vendors. Compliance is a big ticket item right now and some products will have features designed to provide for these requirements. New process improvement and security methods like CMMI and ITIL
There are links you can find online that will provide feature charts for comparisons of various SCM products, usually open source one’s. These can be very good references guides, but be wary of such charts that exist on SCM vendor sites as they will be written with bias towards their own product. Wikipedia.org seemed to have some good references to such sites but unfortunately some of the better links appear to be dead at this time.

Putting Part II and Part III will provide a comprehensive list of requirements for your team needs, all you need to do then is match the requirements to the best suited vendor. Feature requirements can be hard to gather and are often broken in down into weighted categories like “Must have”, “Would like to have” and “Not important”. Only the show stopper items should be listed in the “Must have” category that way any vendor evaluating your requirements can tell you right away if they will meet your needs or not. Since a lot of products have different ways of accomplishing the same things keep the “Must have” list shortened down to the bare essentials. You can then score the vendors who have all the “Must have” items to determine who has the most “Would like to have” and “Not important” items in addition to weighting in other factors like cost, customer support, company history and mindhsare (information you can find out from friends, colleagues or on the net in user forums, blogs and other public spaces about the vendor and product).

IV. Product Evaluations

After the list of SCM vendors has been narrowed down to a list of 2-5 these products should be installed and tested locally for no less then 2 weeks. Most commercial products offer on-site evaluations, although some products such as IBM’s ClearCase do require a lot of time and effort to get going so usually a company representative or local partner will come to your offices to perform the setup for the evaluation. This should not be frowned on, your time is important why waste it trying to setup and install a new program when a company rep can come out and do it for you. It is a good idea to rely on the vendor for information on installation, configuration and getting started with the product. This will serve two purposes, it will save some of your time doing those things by working with the company and it will allow you a chance to evaluate the company’s customer service.

I’ve had potential customers call and ask random technical questions just to ‘test’ out our tech support services. I have no problem with this approach and encourage others to follow this example. When you make a decision and select an SCM product you are also selecting that company, or in the case of open source products the online user community (there are also commercial organizations that offer CVS/SVN support services), that represent the tool so it is important to know about both as you will be working with both.
When doing an evaluation of a product make sure to use real data, real situations and as many people who can spare the time to test drive the system. If you are planning to implement a new SDLC process this would be a good time to trial some of the key concepts of that process to make sure everyone will be comfortable with the changes and that they will result in a benefit for the team. For example the IEEE document references earlier refers to a specific way of managing code changes for defects, for someone considering thinking of switching to their Branch by Purpose method this would be a good time to setup an eval system using that approach and test the results.

V. Buying Decisions

There are a lot of things to consider when making the final buying decision. In many cases there are two or even more products which meet the SCM requirements and other attributes like price, nice-to-have features, and quality of the organization become intangibles that factor into the buying decision. The small 3-5 user group might be satisfied with free tools with are supported by extensive online user forums, while the large 300 user group may need, may even require, a professional services contract from a commercial vendor to solve problems when they arise.

Stakeholder buy-in to the project is very important. Getting everyone to agree to using an SCM tool at all can be a huge hassle but that is an article for another day. Getting everyone to use a new SCM tool will be easier if everyone who has to use the program has had a chance to evaluate it and provide feedback. Any objections to the application can then be addressed before a purchasing decision is made which in turn will make implementation of the new product a much smoother process.

There is nothing worse then buying a new tool only to have it collect dust on the shelf because the no one knows how to use the tool, or because no one wants to use the tool for one reason or another. Developing an implementation plan prior to making a purchase decision. Make sure that your users understand that an SCM tool is designed to make software development easier and not create more work for them. In many cases this can be proven during the product evaluation, when a user can try a product without having to commit to it first they maybe more open minded and it will be easier to showcase the benefits of an SCM system. (Amazingly, to me anyways, a lot of companies are not using any SCM system at all. See why you should here!)

Once everything has been factored in including user feedback you should be ready to select an SCM tool. Implementing a new SCM tool will take time and resources, and its not something you will want to do very often. Take your time in selecting the right tool. Use all the resources at your disposal, online resources, vendor resources, friends, family, coworkers. Build your requirements list to match your needs to the right product and let the members of your group test drive the products you selected for evaluation.

TestTrack TCM Premier

Posted by pat on November 29th, 2006

The new Seapine TCM tool has been out now for about 3 weeks. The demand for demonstrations of the new product has been so high we had to schedule 2 a week presentations instead of our normal one. People seem to really like the product. I do not have a QA background so I rely on the comments of our existing and potential clients to tell me what they like and do not like about it. There are some additional features we do plan on adding that users want, but mostly people are very satisfied with the system concepts. The ability to manage individual tests instead of Word docs or Excel spreadsheets is an immediate benefit, but also the ability to plan and execute tests on a regular basis using the test runs and separating out the two records types (case vs runs) so you have a clear picture of what the test descriptions are in the form of cases, and what the active test execution plan/steps are in the form of runs attached to test sets.

The true benefit can be seen when a test case is executed multiple times for multiple product versions or environments. A single test case can be turned into 10 test runs to cover different OS’s, web browsers, hardware configurations, and ect. Then re-run, and re-run, for each new QA iteration and manage each run as an individual record, so that a test case might actually pass on an Intel system and fail on an AMD which will then be reported as unique results.

Workspaces

Posted by pat on October 26th, 2006

I had a lot of questions lately as to whether Surround SCM utilizes a user workspace model for managing SCM changes, or if it uses a shared repository model.

The answer is both.

Workspaces, often referred to as Sandboxes, are (depending on the SCM system) either server based or local client based copies of the source code that is separated from the main SCM repository. This allows users to work in individual isolated environments until changes are re-integrated on demand. Integration works in two directions, sending changes to the shared/common repository (integration) or updating the workspace with changes from the shared/common repository.

The Workspace model is manifested in different ways in different systems. In some SCM systems users are required to do all work in a workspace and integrate and update changes on a frequent basis to move around changes. Some system use a distributed repository model which requires updating changes by pushing or pulling them to and from the integration repository.

Other systems have no concept of private workspaces (see VSS) and everything is done on a shared repository.

Surround SCM can do either, and usually most people do a combination of both approaches. Individual users can be granted rights to create Workspace branches. This allows the programmer to create a private area that can be used to make changes isolated from other users. That user then reintegrates their changes into the common repositories when their changes are complete (Surround calls this a Promote). Additionally users can update the Workspace with the latest changes at any time, which is usually recommend before a Promote (Surround calls this a Rebase).

Some administrators prefer to use All Workspaces, which can be done in Surround SCM by using Group level privileges to remove check-in access to the integration branches (which in Surround are called Baseline’s or the Mainline). Then all changes made by users are done in integrated workspace branches.

Some administrator prefer not to allow the use of Workspaces, and want changes made directly to the integration branches so that changes are integrated together much faster. This can also be done at the group level in Surround SCM by removing the privilege to create and use Workspaces.

The advantage of a workspace is that users can check-in changes as frequently as they want. These changes are uploaded to the server where they are backed up, so if the user loses their machine they still have a server copy to restore from. Additionally the changes can be completed over a longer duration (a bigger change) and properly tested before integrated back into the shared repository.

The disadvantage is that if the users are slow to integrate their changes, or do not update the workspace frequently, you increase the risk of introducing unexpected bugs. A general rule of software development is to integrate changes as soon as possible so potential bugs can be flushed out more quickly. If a user does not integrate workspace changes back into the integration branch for several weeks, then their code is aging, and the older it gets the more likely it will cause problems when its reintegrated. These problems can be avoided by updated the workspace, but there are no guarantees that users will follow the process as often as needed. Someone may forget to update their workspace before integrating new changes.

Surround SCM is going to allow administrators to choose the best route. At Seapine the development group uses Workspaces infrequently. Users will create Workspaces to work on larger code changes that spans multiple days or weeks. It allows the user to make frequent check-ins (track their own changes, which has its own benefits) and then promoting the complete set of changes to the integration branch upon completion after doing an update of course to try and flush out integration problems from the concurrent development. But, a majority of changes are made directory to the integration branch, in our case the Mainline (using Branch-by-Purpose here), which means check-ins are instantly integrated into the codeline.

This has allowed us to implement semi-continuous integration techniques, where we rebuild, smoke/unit and some regression test, our products each night (true continuous integration calls for rebuild after each and every change). By testing the effects of the day’s cumulative changes every day we can flush out problems early and correct them sooner.

Which method is the right one? Its situational of course, but the important thing is that Surround SCM gives you options to use a Workspace model, or partially use Workspaces or not to use Workspaces at all. When looking at SCM tools that offer Workspaces, make sure that they also support direct changes to the integration branches or streams as well or you will be handcuffed to only using Workspaces, which may result in untimely integration and ultimately a less stable codeline.

Why Seapine ALM tools are better then VSTS

Posted by pat on October 11th, 2006

Currently, our ALM suite (Surround SCM, TestTrack Pro, TCM and QA Wizard) are far superior then Microsoft’s Visual Studio Team System (VSTS) in many important ways.

SCM:

Surround SCM uses an intelligent project-level branching design that provides a basis for simplified concurrent development and intelligent 3-way merge operations even under the most complex of scenarios.

VSTS SCM system is based on an outdated Perforce model, which can be quickly described as, “VSS with changelists”. This architecture is an improvement over VSS (simply by being Client/Server based) but many of the user/administrator complexities associated with managing concurrent development codeline’s still persist.

Surround SCM uses a straight TCP/IP connection which can function over any internet connection. Communication can be compressed, and encrypted for security.

The VSTS system use Web Service API’s to handle all Client/Server communication, which makes the system slow and bandwidth heavy as it has to transport all the fat XML data back and forth between Clients and Server which does not make it ideal for remote users and even LAN based users will experience lag during many operations.

Issue Tracking:

TestTrack Pro is a overflowing with a tremendous amount of out of the box features, none of which require special scripting or programming knowledge to implement. An administrator will be able to use all the built in User Interface setup windows to configure the system and to setup projects. It would be a rare thing to find a dedicated full-time TestTrack Pro administrator.
VSTS requires a C# programmer with expertise in VSTS to even add a single custom field, which requires re-programming and re-compiling the TFS configuration file. Adding similar, and simple features, that TestTrack supports, such as customized workflow, automation in workflow, assignments, Email notification, custom fields, email import, required fields, default values, may take weeks or even months to program into VSTS. Different project templates do exist, but an organization is going to be hesitant to make even minor modification to a project which requires recompiling a project after coding changes which could lead to excessive downtime and overhead to do coding and testing.

TCM:

TestTrack TCM is full integrated into TestTrack Pro allowing not only comprehensive capability for test case management, test planning and test execution, but also a creates an established link between features, bugs, incidents and test cases. Failed test executions (test runs) can be used to generate new bug reports, and new bug reports can be used to generate new test cases all of which assists in creating better organized, more comprehensive testing.
VSTS supports test case management, which are extremely simple records management with none of the necessary features for planning and execution of tests.

Automated Testing:

QA Wizard is a robust, object oriented, automated testing tool with support for Web, Windows and Java applications. The QA Wizard UI is packed full of design and execution features such as the Preview screen to add or view new or current command steps in the script. The best part is it does not require any programming experts or specialists to use as the scripting language for QA Wizard is entirely English keyword based.

The VSTS automated testing tool amounts to issuing HTTP Post commands to a web browser. There is no support for Windows or Java applications and is currently unable to interact at the user level with the web program, although VSTS does provide Load Testing.

Conclusions:

When compared side-by-side there is no contest between Seapine’s ALM tools and Microsoft’s Team System. The VSTS has built in much capability to the product backend, with virtual no front end customization. Any user must also interact with the system using Visual Studio 2005 which means non-developers who want to interact with the system require installing the Visual Studio 2005 software, which is a massive monolithic application.

Seapine has provided, and will continue to provide, intelligently designed tools, with massive capability, but low administration overhead by building tools with simplified and intuitive user interface, providing Out of the Box support for many of the desired features and capabilities of an organization (like Email, like custom workflow) and by providing lightweight user interfaces, such as the TestTrack Web Client which allow users to easily interact with the system, without limitations, to perform their daily activities.

This addresses just the feature and capability comparisons of the products. Seapine is hands down a superior ALM product, while VSTS is capable, but only through backend customizations, and only through the Visual Studio 2005 client which is an excellent IDE for programmers but maybe not so good for QA testers, project managers, and other non-programmers.

Seapine will continue to add function and capability out of the box for its ALM tools, while Microsoft seems content to create highly complex, highly sophisticated systems that (much like the IBM tools) require specialists and consultants to manage the system full time.

Also consider the total cost of ownership, and Seapine’s ALM suite is a better solution.

Good Article on the Importance of SCM ;)

Posted by pat on October 2nd, 2006

Check out this article on Automation World. Some pretty quality quotes in there on the importance of Software Configuration Management and its importance as a business process.

Ubuntu on the Rise?

Posted by pat on September 7th, 2006

So I have seen a lot of articles over the past, guessing past year but who knows for sure, how great Ubuntu is. There are some articles online to correlate the various slashdottings and digg’s that describe a rise in Ubuntu popularity.

From eWeek
From DesktopLinux.com
From DistroWatch.com

DistroWatch is actually one of my favorite sites for Linux popularity stats, and while its not the end all be all, it is useful in looking at recent Linux trends. It is a reference for us as well here at Seapine. When a user downloads a Linux installation for our products they do not have to specify what flavor of Linux they use. This is important information which is needed to determine where to focus the majority of our Linux testing. We try to collect information in a number of different ways, looking at a lot of published data, polling our users, and trying to determine what the most popular distributions are.

But there is a big difference between desktop and server users. Which means you might see a lot of Gentoo or RedHat Enterprise server installations, but very few desktop one’s. Fedora, Ubuntu, Mandriva and other Debian clones may carry a much higher desktop population and these statistics are vital. If we know that 25% of our Linux desktop users use Ubuntu clients but only 2% use Ubuntu as a server then we can focus a higher percentage of test time to GUI testing on Ubuntu and more server testing time might go to RHEL or SUSE Enterprise.

In the future we might have better download tracking or polling for each distro, but I actually enjoy following Linux trends, and there are scant few sites that I have found which show actual trends and statistics about distributions, which makes it a difficult thing to keep tabs on.

Labor Day Haiku

Posted by pat on September 7th, 2006

Goodbye to summer

Blessed be the short work week

Hello to football

FireFox 2 Beta 1

Posted by pat on August 28th, 2006
I downloaded and installed the FireFox 2 beta. The download can be a little tricky to find on the Mozilla site, but here is a link.Many of the plug-ins are not yet compatible with the beta. Here is my list of working and non-working

Working -Adblock
FireFTP
FlashGot
Forecastfox
FoxyTunes
Gmail Notifier
IE Tab
IE View
NoScript

These do not yet work

Aspellfox
Box.net toolbar
Fasterfox
Gmail Space
Googlepedia
ImTranslator
NewsFox
PlainOldFavorites
User Agent Switcher
WengoPhone
Xinha Here

FireFox 2 has an integrated spell checker so the spell check extensions will no longer be needed. The beta 2 installation does not override the older FireFox 1.5x I have running so if I have problems with one I can always go back to the older version which is nice.

TestTrack Pro is looking good in the beta. The Surround SCM WebDAV looked good but ran a little bit slow. QA Wizard can open the FireFox 2 browsers but it is running real slow and I haven’t been able to playback any scripts yet. I am guessing QAW support on FF2 will have to wait until after beta.

We use Tenrox in my department for time tracking. I have had problems with it using IE 6.0, and even worse problems with IE 7.0. FireFox 1.5x works and so does the new 2.0 beta.

The popular browser debate will soon be between IE7 and FireFox 2.0. I use IE7 at home sometimes, I can’t use it at the office because it does not work with many applications and web sites. Right now I think FireFox 1.5 is better then IE7. The new integrated spell checking in FireFox 2 is really sweet. I haven’t looked at many of the other new features, here is a full list of them.