Alcatraz – Package manager for Xcode 5 | Hacker News Reader

Alcatraz – Package manager for Xcode 5

alcatraz.io

154 pointsmneorr65 comments

Um. Don't run the installation instructions.

While the download itself is served using https (from amazon), curl will contact the google url shortener using HTTP. Honestly, if I wanted to MITM one thing on any network, URL shorteners would come first.

Edit: The website switched from googles link shortener to git.io (http) and download to github downloads. git.io's https version seems to have certificate issues.

    > curl https://git.io/lOQWeA -vvv
    ...
    * SSL certificate problem: Invalid certificate chain
    ...

> While the download itself is served using https (from amazon), curl will contact the google url shortener using HTTP.

Whoever wrote the installation instructions here should take a page from Sublime Package Control's installation instructions:

> The download will be done over HTTP instead of HTTPS due to Python standard library limitations, however the file will be validated using SHA-256.

> WARNING: Please do not redistribute the install code via another website. [Because of the embedded SHA-256 digest, the installation code] will change with every release. Instead, please link to this page.

[1] https://sublime.wbond.net/installation

If someone is wondering, the short url points to the latest release tgz, at the moment to https://github.com/supermarin/Alcatraz/releases/download/1.0...

Yep. The original post contained the links, but fell through the spam filter ;).

The plan is to use github releases from now on, and shorten using git.io

Why does this link need to be shortened at all?

Since the original one is really long; would make the install script even less readable.

Also, git.io allows only shortening github repos; so there should be no harm

> Since the original one is really long; would make the install script even less readable.

Really?

Who do you think your target audience is? I'm sorry, but this is not "really long":

    https://github.com/supermarin/Alcatraz/releases/download/1.0.1/Alcatraz.tar.gz

If you're telling people to run random commands in their terminal that lead to local code execution, then you should trust that they can read a goddamn URL.

If you don't think your user base can read URLs, then you shouldn't be telling them to launch the terminal and run your code.

You are providing an HTTP link to git.io, so it cannot be verified whether I am connecting to the real git.io. This means an attacker can fake himself being git.io very easily (a classic man-in-the-middle attack).

It doesn't matter if git.io can only shorten git urls, as git.io will never be involved in a potential attack.

Using a link shortener is okay, but use one that supports HTTPS.

The first thing that stuck out to me was the name and logo. Alcatraz sounds cool (and I like the logo), but I'm not sure if something that evokes imagery of being confined and locked up is what you want associated with an open-source package manager.

I'm not sure if something that evokes imagery of being confined and locked up

Given that it's for Xcode, the one dev-tool to rule them all, in the walled garden where Apple has all the keys, I think it fits perfectly.

Yeah, I would agree except that AppCode does Xcodes job a lot better than Xcode.

I'm pretty sure it's more a reference to the fact that XCode extension management is rather painful and feels like you're stuck using that IDE sometimes.

I don't think it has any effect on me using the tool but I would say that Alcatraz has negative connotations for me.

There are Ruby "Gems" and Cocoa "Pods", I'm trying to think of a similar name that evokes something that can be slotted in to something else... Cubby?

Cubby - any of a group of small boxlike enclosures or compartments, open at the front, in which children can keep their belongings, as at a nursery school.

It's like jailbreak for Xcode, that's the metaphor

Er, isn't this the opposite of a metaphor? A metaphor would be the name of a famous prison escape, not a famous prison itself.

Maybe "Morris" would be a better name (Clint Eastwood in Escape From Alcatraz).

Very nice! I've been following this for some time and am very happy to see this stable release!

An aside: Has anyone tried the Clang Formatter plugin? I want to format property declarations like:

  @property (nonatomic, strong) NSString *string;

But setting 'ObjCSpaceAfterProperty' to true or false both output:

  @property(nonatomic, strong) NSString *string;

My format config is based off llvm's. Maybe some other configuration is stomping on the 'ObjCSpaceAfterProperty: true'?

(Does anyone have a .clang-format file that that matches Apple's style?)

I actually wrote that patch! Are you sure you are using a version of clang with support for it? As far as I know a new release hasn't been cut with the included patch. At Facebook we use clang-format with that patch and it works.

I should note that Alcatraz's clang plugin looks to have a compiled version of an old clang-format in the tree...that's likely why this doesn't work with that plugin.

Thank you! That was causing my issue.

Thanks for adding that ObjC option.

What are your reasons for starting another package management system when we already have CocoaPods? What does this offer over CocoaPods beside the UI?

Alcatraz manages ‘Xcode packages’, e.g. Xcode plugins and color schemes. CocoaPods manages dependencies of your Objective-C project.

It's not competing with CocoaPods. Alcatraz gives you a nice UI for installing Xcode plugins, color themes, etc. to customize your editor, while CocoaPods is management of libraries for iOS and OS X development.

Think of Alcatraz as the Xcode equivalent of Will Bond's "Package Control" package for Sublime Text. Cocoapods is a dependency manager, more like PHP's composer.phar (or whatever your language of choice's current dependency-manager-of-choice happens to be).

This is not a replacement for Cocoapods, it manages plugins for Xcode itself, color themes, project templates. That kind of stuff :)

They're solving different problems. Marin Usalj (Alcatraz developer) is actually a member of the CocoaPods core team: http://cocoapods.org/about

I've been using this and it works great for the packages it has, I don't use too many but if you document your xcode methods I highly recommend VVDocumenter.

It allows you to generate a doc string for a method if you type '///'

This looks really cool, but I don't know what problem it's solving for me. Maybe I'm not an Xcode hacker/ninja/whatever, but it has constantly met my needs as-is. Sure, I've wanted to add a color scheme before, but these are a lot of hoops to jump through when Dusk is fine.

There are a lot of really great plugins for Xcode, you should browse the package repository to get an idea of what's out there :)

A huge congrats, I've been working with Alcatraz HEAD for a while, with helping out with the design, and occasionally wanting to make my own plugins.

I'm super excited to see it out and one-click installable again. Looking forwards to seeing what Marin/Delisa/Jurre do with the blog.

I use this regularly, it's not felt any less stable for the few plugins I use mainly; open in github, one in appcode & fuzzy string matcher. They really make Xcode easier for day to day life.

A colleague of mine wrote that Open in Github plugin when we worked together - it's incredibly useful if your code's hosted there and you do pull-request code reviews.

Xcode doesn't have a public plugin API. Every single one of these packages, including Alcatraz itself, is relying on undocumented and unsupported functionality. I would very strongly caution against installing any of it.

As a user of several of the packages available on Alcatraz, and Alcatraz itself, I strongly disagree with eridius.

If you do have issues with a particular package it is pretty simple to remove any/all of them. The only time I have had issues is when I've tried to run betas of Xvim on unreleased versions of Xcode.

Seriously, if you're interested at all in the packages made available through Alcatraz give it a shot.

This is a developer tool. FOR DEVELOPERS.

If the tools solve useful problems, who cares if they break later? We'll fix them.

I would very strongly caution against Apple continuing to provide such a boneheaded IDE.

Apple has reached out to plug-in developers and implemented a compatibility UUID system for plugins. What exactly are you worried might happen?

No, Apple gave up and implemented a compatibility UUID system to try and reduce crashes (since any Xcode crash is going to be reported to Apple and Xcode engineers have to figure out what happened, which means Xcode engineers get bug reports triggered by unsupported third-party plugins).

The existence of the compatibility UUID does not mean that Apple has blessed plugins. They're just trying to reduce their support load, and reduce their users' crashes at the same time.

I really want to use this, but I'm having a lot of trouble with the interface. It could just be me or my environment. I don't know.

Are you planning to have a forum somewhere for feedback and support? I suppose I could open an issue on Github, but I'd really rather just ask a question. Enough people seem to be using this that I suspect the problem is on my end.

Wow! Thank you for this. In 5 minutes I found 5 plugins I had no idea existed but truly brightens my day. Keep up the good work!

Just curious, how to implement the scrolling effect like this site? Does it require JavaScript or just CSS?

It's not an answer to you directly but more of an observation: The effect for this page is very laggy on a 1-year old MBP, and makes the text barely readable until a certain scrolling point is reached. I do not understand the purpose of using the effect here or in 9/10 cases I see it on sites. It introduces pointless visual candy with usually zero or negative practical benefit. Makes me think of the DHTML days.

unfortunately we wrote it on an Macbook Air, where it worked pretty good. It lags horribly on an MBP retina, we might fix that

You can have similar effects with CSS, but in this case it is JavaScript: http://alcatraz.io/javascripts/parallax.js

Interesting that just a little bit ago there was an article on software installation security (albeit from a different angle).

Theoretically speaking, is it safe to curl and install something via plain http:// and no checksum verification?

Very nice tool, though it seems the installation of ClangFormat[0] fails somehow. I guess I'll try to install it manually.

[0]: https://github.com/travisjeffery/ClangFormat-Xcode

As someone who spends most of their day in Xcode, Alcatraz is an invaluable tool to grooming my Xcode setup and keeping up with the latest plugins and what not.

Congrats on the launch Marin! Been following the repo for a few months now, I'm really digging the design.

Not sure why this was posted, when the pre-built version doesn't work on 10.9.1. It doesn't properly detect that command line tools are installed.

I think it's awesome. A part of me wishes there was a drop down summary of each plugin when you click on it, rather than heading to the github link.

How stable do people generally find Xcode plugins?

The few I've tried haven't been great (they've tended to crash a lot and break with Xcode updates)

I use a few of the Xcode 4 Fixins (https://github.com/davekeck/Xcode-4-Fixins), which despite their name are mostly compatible with Xcode 5. I use DisableAnimations, FindFix, InhibitTabNextPlaceholder, TabAcceptsCompletion, and UserScripts (which I wrote).

A bit of work was required when Xcode 5 came along but from minor version to minor version they haven't needed much in the way of maintenance.

I've been using XVim for over a year now and it's been reasonably stable. They have an issue with code folding but then I don't fold while the plugin is enabled.

Fwiw. Folding shouldn't (big shouldn't) crash it but navigation is not like vim is.(the cursor is hidden inside the fold while you do navigation stuff. It eventually moves out of the fold though. It's on my list of things to fix with xvim.

The KSImage one is absolutely fantastic. I've been using it for what feels like the better part of a year and I've yet to have a problem with it.

Is there a plugin to use vim mode or emacs mode comments? Tabs vs spaces and tab length consistency are big annoyances at my company.

Crashes XCode for me when entering the package manager.

I work for TheMan® (with Firewall) and assuming it is due to some non-http ports being used?

What OSX are you on? We're 10.9 only since we're using NSURLSession

Ah, doh! 10.8 :(

#EnterpriseLife

we will consider bringing it back to 10.8, just after this all launch thing is over

Are the plugins run in any kind of sandbox? Is there any security review performed on plugins other users submit?

Apple doesn't sanction Xcode plugins and I'm pretty sure Xcode itself isn't sandboxed once you enter your developer password. I'm not sure of the details though.

As to the security review or process, perhaps badging -- that sounds like a good feature request. I'll bet there's an issue tracker... ;-)

Of course not. It's open source, nobody would do anything malicious right?

Now, add a price field, and sir, you got yourself a sustainable business!

YES! It's back!

Great work, now the next big thing is to mix this with Cocoapods to that once you select a package, it does the pod install command for you automatically and you are good to go.

Alcatraz isn't a CocoaPods wrapper, it is an installer for Xcode customizations like plugins and color schemes. You can use it to install a CocoaPods Xcode plugin to handle installing and updating pods though: https://github.com/kattrali/cocoapods-xcode-plugin

OMG! It's like "XCode on Rails"!

At last!

Reply on news.ycombinator.com