* version up
 * ssh keys support
 * mod_auth_web support

See merge request nexedi/slapos!993

This is a workaround to avoid the UnicodeDecodeError that occurs
when installing wheel, in particular during compilation of ERP5.

The previous way to initialize ~/srv/mariadb relied on /bin/mv, so that
it's atomic, making [template-mysqld-wrapper] idempotent (think of a
crash in the middle mysql_install_db). However, mv only works if
~/srv/mariadb is a simple directory: it fails if it's a symlink,
a mount point, or a subvolume (btrfs).

When using extra storage devices for some data, one may prefer to only
put the data (e.g. ~/srv/mariadb) and not the whole slapos partition.
Then if we want a resilient ERP5 with catalog's datadir on a separate
storage device, the importer script must be able to reinitialize
~/srv/mariadb whatever its type.

The web service will receive a application/x-www-form-urlencoded POST request,
with login and password arguments and must respond with a
`X-Proftpd-Authentication-Result: Success` header to signal successful
authentication.

The sftp server will map all logins to the same user.

This software uses xml

Switch to using official repository, now that the pull request have been
finally merged.

See merge request nexedi/slapos!983

Previous version caused a segmentation fault when running git

See merge request !906

With tesseract v4.0.0-beta.3 we often observe crashes with:

```
contains_unichar_id(unichar_id):Error:Assert failed:in file ../../src/ccutil/unicharset.h, line 511
```

This seems to have been fixed by https://github.com/tesseract-ocr/tesseract/pull/1954

Still, even after updating to 4.1.1, text recognition from PDF in ERP5 is too expensive. We also update Ghostscript to 9.54.0, because this version has built-in OCR, which does not need to convert the PDF to PNG then TIFF as we currently do in ERP5.

See merge request !985

This tessdata path will be included in cpp code by pre-processor macros
https://github.com/ArtifexSoftware/ghostpdl/blob/gs9.54.0/base/tessocr.cpp#L188-L193
Since // is the marker for a comment in cpp and as documented in
https://gcc.gnu.org/onlinedocs/cpp/Stringizing.html "Comments are replaced by
whitespace long before stringizing happens, so they never appear in stringized
text", the STRINGIFY/STRINGIFY2 approach of including a path does not work
when the path contain // , because anything after // is considered a comment
and is not included, causing errors like this when using ghostscript with OCR
in webrunner:

    $ strace -e open -o open.strace /srv/slapgrid/slappart42/srv/runner/shared/ghostscript/4387fe7a8d2034ac5691d43b58134248/bin/gs -sDEVICE=ocr
    GPL Ghostscript 9.54.0 (2021-03-30)
    Copyright (C) 2021 Artifex Software, Inc.  All rights reserved.
    This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
    see the file COPYING for details.
    Error opening data file ./eng.traineddata
    Please make sure the TESSDATA_PREFIX environment variable is set to your "tessdata" directory.
    Failed loading language 'eng'
    Tesseract couldn't load any languages!
    **** Unable to open the initial device, quitting.
    $ grep eng open.strace
    open("./eng.traineddata", O_RDONLY)     = -1 ENOENT (No such file or directory)
    open("/srv/slapgrid/slappart42/srv/eng.traineddata", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("eng.traineddata", O_RDONLY)       = -1 ENOENT (No such file or directory)

eng.traineddata is looked up in /srv/slapgrid/slappart42/srv/ because
ghostscript was configured with:

   --with-tessdata=/srv/slapgrid/slappart42/srv//runner//shared/ghostscript/4387fe7a8d2034ac5691d43b58134248/share/tessdata/

and everything after // was stripped.

This was reported upstream as https://bugs.ghostscript.com/show_bug.cgi?id=703905

More about the case of // in slaprunner paths was on commit eb544196
(slparunner: document the reasons why we keep srv//slaprunner, 2019-10-10)

Before this commit, instance parameters that have a default null value
in JSON format were rendered as 'None' string in instance-theia.cfg.

In particular, Theia frontends were always requested with unsolvable
SLA parameters that prevented a frontend from ever being allocated:
```
sla-instance_guid = None
```

proxy.config.snapshot_dir is unavailable since TrafficServer 8.

See 9c5d25cb; sorry for missing to update the duplicate in that patch.

In commit 48b24182 I passed 'wcfs_enable' to instance-zope.cfg as string
instead of an object. As the result, even if it was wcfs_enable=False, in
instance-zope.cfg in

    ---- 8< ---- https://lab.nexedi.com/nexedi/slapos/blob/8d3af101/stack/erp5/instance-zope.cfg.in#L68-72)
    {% if slapparameter_dict['wcfs_enable'] %}
      WENDELIN_CORE_VIRTMEM=r:wcfs+w:uvmm
    {% else %}
      WENDELIN_CORE_VIRTMEM=rw:uvmm
    {% endif %}

it was always taking the first branch, becuse slapparameter_dict['wcfs_enable']
was giving 'False' - a string - whose boolean value is True

    In [1]: bool('False')
    Out[1]: True

-> Fix it by passing slapparameter_dict['wcfs_enable'], similarly to most other
keys, as object.

Due to the typo in 6572375c the revision was not unset and so it was
wendelin.core 1 that was still being built and installed.

All data related to the instance shall be in the instance itself, and as
temporary files are crucial for caucase, force the macro user to set the
location.

This is required for example to preview images (ie. open a .png file from the
editor). Without the default value of {{uuid}}.mini-browser.{{hostname}} is used
but we don't have anything in place to resolve such domain names.

See merge request nexedi/slapos!990

Going Go1.15.11 -> Go1.15.12 brings in fixes to compiler, runtime and stdlib
including security fix to net/http package:

https://golang.org/doc/devel/release.html#go1.15.minor

Tested on helloworld SR (by adjusting it to use go1.15 instead of go1.16).

Going Go1.16.3 -> Go1.16.4 brings in fixes to compiler, runtime and stdlib
including security fix to net/http package:

https://golang.org/doc/devel/release.html#go1.16.minor

Tested on helloworld SR.

Before this commit, the Go workspace was always activated before
launching the Theia shell and starting the embedded supervisord.

This in turn added the gcc installed by Theia to the PATH, meaning
that nested instances would be compiled with Theia's gcc instead of
the system gcc, making the compilation outcome dependant on Theia.

With this commit, the gcc resolved by PATH is now the system one.

See merge request nexedi/slapos!987