Why eggs?

Because they are a great way to distribute Python software and declare its dependencies. Zope 3.4 is completely distributed as individual eggs and will from now on be developed as such.

What's zc.buildout?

It's a tool for repeatable deployments that's configuration-file driven. You tell it "install these eggs for me, create this script and let me develop packages in this directory" and it will go ahead and do all that. Over and over again, if necessary, and for everybody who wants the same setup as you (which is great for teams).

What are WSGI and Paste?

WSGI is a Python standard for web applications and web servers. It defines how they communicate so that potentially any WSGI application can run on any WSGI gateway (server). Zope has had support for WSGI for a while now, but it has never really been exposed, even though it offers great possibilities such as middlewares.

Paste is a collection of related to WSGI. One of its tools, PasteDeploy, is of particular interest. It allows you to plug WSGI applications, middlwares and gateways together using a simple configuration file.

zopeproject vs. instances

Apart from all the flashy technology that zopeproject brings us, it also implies a big conceptual change in the way we develop web applications with Zope.

In the world of regular instances, Zope is the server and the application. Your code is just like a plug-in:

 +------------+         +---------+
|    Zope    |  runs   |your code|
|server & app|  ---->  | (plugin)|
+------------+         +---------+ 

Even though we've been doing it for years ("Products" ring any bells?), I think this is backwards and accounts for much of the irritation people coming to Zope have.

With zopeproject's approach, your code is the application. The web application, to be precise. And it happens to use Zope. As a library:

 +------------+           +-------------+          +---------+
|WSGI gateway|  serves   |  your code  |   uses   |  Zope   |
|  (server)  |  ------>  |(application)|   ---->  |libraries|
+------------+           +-------------+          +---------+ 

Zope isn't the center of attention anymore, your application is. Even better, you can choose how much of Zope you'd really like to use. You may compare this approach to a GUI application that happens to use some sort of GUI framework to get some widgets on the screen, but otherwise it's just like any other, real application.

So how does it work?

It's pretty easy. All you need to do is install zopeproject first. You don't need to install Zope for this, zopeproject will do that for you later. Note that you will have to have setuptools installed for this to work (it provides the easy_install script):

 $ easy_install zopeproject 

Depending on where and how you installed Python, you may have to prefix this command with "sudo" to gain privileges for installing packages globally.

Now you can create a new web application:

 $ zopeproject WebApp 

Much like with mkzopeinstance, you'll be asked a couple of questions. The last question concerns the central download location for eggs (which will include the Zope eggs). After the questions, zopeproject will create a 'WebApp' directory with some initial directory structure, as well as download and install the Zope eggs.

To start the application, go to the newly created directory and invoke the server:

 $ cd WebApp
$ bin/paster serve deploy.ini 

You may also use the webapp-ctl script which works much like zopectl:

 $ bin/webapp-ctl fg 

You will then be able to go to http://localhost:8080 and see the default Zope screen. (The standard boilerplate simply uses the Zope 3 default, after all. It is now up to you to change that.)

More information and feedback

For more information, please refer to zopeproject's homepage on PyPI: http://pypi.python.org/pypi/zopeproject

I'm very much interested in getting your feedback. Please direct questions that are of public interest to the zope3-users@zope.org list. Bugs may be reported in Launchpad: https://launchpad.net/zopeproject.

It's unconstitutional

From my point of view, this is by far the strongest argument. "Naturally we have to change the constitution to allow them," the supporters of online searches say. The problem with this is that this touches essential civil rights (Americans will know this as the Bill of Rights) that every Western democracy holds up so high. Once we start giving these up, we might just as well get out of the U.N. and stop telling the world that we're so better at treating people. I can already hear China saying "Told you so, Germany".

Lack of proportionality

Authorities claim that they can only conduct (and afford) 5 to 10 online searches a year. Is it really too much trouble getting a judge to sign a search warrant for such few incidents? Is it worth changing our constitution for this? It's not like the police isn't going to collect some evidence on the guy they're going to put under surveillance in the first place. After all, hacking into another guy's computer takes time and money, you better make sure it's worth it. So you might just as well get a judge involved.

Have they actually thought this through?

The means by which the authorities want to conduct these online searches aren't well known. The press obviously likes to speculate wildly (and usually gets it all wrong due to their lack of understanding the details).

The most obvious choice seems to be to buy a zero-day exploit for whichever operating system the person in question is using. I've heard these sell for a couple hundred thousand dollars. So the whole thing sure is pricey. Then you install a trojan (dubbed "Federal Trojan"). According to the press, this has been done already in an investigation (unconstitutionally, I might add).

The problem with the trojan is that if the police can get in that way, so can anybody else, especially if the system isn't well maintained (security updates, virus scanner, etc.). So in the end, an online search is like catching two cars on a speed camera. You know at least one of them has been speeding but you can't tell which one. That's why I doubt they'll hold up in court.

Politicians realized that too, of course, and backpedaled. Now they wouldn't use a trojan but rather fall back to more conventional methods of gaining access to the computer: breaking into the suspect's house and install the software or hardware (e.g. a keylogger) locally. Well, I sure hope that those terrorist have no laptops, otherwise them cops are goin' be real mad when they find out the terrorists always take that computer with them when they leave the house...

To me, all of this doesn't look like this has been thought through properly. Those who want it seem to think it's a silver bullit. Those who actually know a little bit about this stuff can't seem to see that it would be. I sure hope that parliament will be wise enough not to let this one slide by.