Busy-signal deprication

[vol4ikman]

Hello
I have a notice about busy-signal deprecation:
HTMLDocument.registerElement - file:///C:/Users/Volkov-WIN10/AppData/Local/Programs/pulsar/resources/app.asar/static/index.js:99:12 Object.<anonymous> - [C:\Users\Volkov-WIN10\.pulsar\packages\busy-signal\lib\element.js:82:26](file:///C:/Users/Volkov-WIN10/.pulsar/packages/busy-signal/lib/element.js:82:26) Object.<anonymous> - [C:\Users\Volkov-WIN10\.pulsar\packages\busy-signal\lib\element.js:88:3](file:///C:/Users/Volkov-WIN10/.pulsar/packages/busy-signal/lib/element.js:88:3) Module._compile - [C:\Users\Volkov-WIN10\AppData\Local\Programs\pulsar\resources\app.asar\src\native-compile-cache.js:120:30](file:///C:/Users/Volkov-WIN10/AppData/Local/Programs/pulsar/resources/app.asar/src/native-compile-cache.js:120:30) Object..js - [C:\Users\Volkov-WIN10\AppData\Local\Programs\pulsar\resources\app.asar\src\compile-cache.js:252:23](file:///C:/Users/Volkov-WIN10/AppData/Local/Programs/pulsar/resources/app.asar/src/compile-cache.js:252:23) Module.load - [internal/modules/cjs/loader.js:935:32](https://github.com/orgs/pulsar-edit/discussions/internal/modules/cjs/loader.js:935:32)

Win11x64
Pulsar Beta version: 1.100.0-beta
Node: v14.16.0
Chrome: 89.0.4389.128
Electron: 12.2.3

[confused-Techie]

@vol4ikman Thanks so much for contributing and reporting this issue!

Since busy-signal is a community package there's only so much we can do to fix an issue in their code.

It looks like this issue specifically is due to the Electron bumps that we, and upstream Atom have both done.

What this means is it'd be best to look for support from that packages maintainer, and if needed we could look into if there's any way to bake in some compatibility (Which isn't a sure thing, and to be honest isn't super likely that we will be able to)

But to look further into this issue, it seems several users have already reported this error on busy-signals GitHub which you can follow for updates here:

• PR90
• PR91
• PR93

Again thanks for reporting the issue!

[kaosine]

Looks like 91 gives us the answer we need which is someone else needs to patch it and the maintainer will approve it. Which I think someone in the discord may be doing eventually?

[garrettboone]

https://github.com/steelbrain/busy-signal/releases/tag/v2.0.2
busy-signal is now updated. I've imported the zip of v2.0.2 and it loads without issues.

[confused-Techie]

Thanks for updating here. With the PR now in that resolves this issue, busy-signal can be installed manually to get this update.

Unfortunately, the author hasn't updated the package on Pulsar itself. Busy-Signal on the PPR does no reflect the fact that it should be installed via the terminal, and includes a link to commands needed to do so.

[savetheclocktower]

I'm glad to see @steelbrain update such a widely used package. I'm hoping he's interested in publishing this update to Pulsar.

[Lonniebiz]

I've never manually installed a package in Pulsar before.

In Linux, to manually install the busy-signal update, I discovered these steps:

1) Backup and remove the contents of the folder located at ~/.pulsar/packages/busy-signal.

2) Download and open the compressed archive, and navigate inside of the busy-signal-2.0.2 folder it contains.

3) Copy the contents from step two into the location from step 1.

4) Open a terminal and navigate to the folder in step 1, type cd ~/.pulsar/packages/busy-signal.

5) Run this command: npm install.

After this, Pulsar launched without the Depreciation Cop complaining about busy-signal. I hope this helps someone.

[savetheclocktower]

@steelbrain, That is news to me. When you get a chance, can you try again and let us know if this is still true? I can't imagine we'd need that level of access, so I'd be eager to fix that.

[steelbrain]

After clicking on signup with Github on https://web.pulsar-edit.dev/login

[savetheclocktower]

@steelbrain, that's astonishing to me. I looked up my authorization in GitHub, and it claims to use much more granular permissions:

But I don't expect you to take my word for it.

There's also the “Sign Up with PAT” option, but we should update the docs so that you'll know exactly which permissions are needed when creating it.

So we've got two things to fix. Thanks for letting us know! I'll ping you when we're able to address this.

[DeeDeeG]

@steelbrain the concern is understandable, honestly. I personally don't take giving things permissions lightly either.

I believe in some cases we are willing to manually update the package ourselves (publish the new version to our DB based on your latest github repo tag) if we have explicit permission from the current package owner, such as yourself for busy-signal.

If you are okay with that, I think we can manage to do it on our end once the main package DB folks get a chance to do it.

If not, then no problem. We wouldn't want to do it without express permission.

[DeeDeeG]

Also: In terms of the way to update a package yourself while trusting us the least:

• I believe you can generate a classic-style PAT with zero permissions on it, and use that to sign up here: https://web.pulsar-edit.dev/login (Anyone in possession of a PAT can look up which user generated the token, so a permission-less token is enough to prove you/your GitHub identity actually intended to make an account with us. This token is not stored on our server.)
• Then you can generate a separate PAT token with the actual permissions on it, for publishing the package. Use this to "sign in" to ppm or apm, then ppm publish/apm publish the new busy-signal version.
  • I don't recall how much we've had to change in our forked apm (our fork is called ppm), but I believe setting env var ATOM_API_URL = https://api.pulsar-edit.dev/api should allow publishing the package even from original apm?? We tried to make the package API basically the same. So one doesn't have to trust the Pulsar fork's ppm code for this part. Just use original apm.
  • Again, we do not store this token either. Users send it (over HTTPS) for every authenticated interaction with our server, we read it in memory on the server and make no deliberate attempt to persist the token.
• This still implies trusting our package server not to misuse your permission-having token, but you can delete the token immediately after the new package version gets published, if you want to minimize this risk. Also, our package server is open-source, so you can audit the code, though of course this trusts we are running the code we say we are. (And we are indeed! It's just that I don't know how an outside observer can prove that easily. So it is still a matter of trust there.)

So, while there would be some trust extended to us still (understandable if this is a deal-breaker), this method would be the way to have the least exposure of your credentials to any misuse.

(An actually malicious server could, of course, misuse the credential immediately, so this only makes sense if you're assured we are using the token appropriately, to which all I can say is: we only use the token to verify your permissions at the package's repo, and we don't hold onto the token past the individual transaction.)

Not trying to persuade as much as address any concerns I can with transparent info.

Regardless of whether you want to publish the updated package version to our DB, I will just say: thank you for considering, and thanks for authoring several important packages in the Atom package ecosystem!

[Lonniebiz]

Did installation directly from GitHub not work?

ppm install steelbrain/busy-signal

I didn't know to try that. Do you think I should undo what I did, and try that instead. I wouldn't want my steps to cause breakage for future updates. But, as is, my ignorant steps did seem to work; Pulsar launches without warnings. @savetheclocktower

[savetheclocktower]

Give installing from GitHub a shot. If it works, it'll also be able to offer you updates in the future if the author makes further commits.

[Lonniebiz]

I read the posts between you and steelbrain. Does that mean that the ppm install steelbrain/busy-signal method is not live yet?

[savetheclocktower]

@Lonniebiz It works fine. Installation from GitHub is always an option for a public repo.

[Lonniebiz]

Where do I type this command? Is there a builtin terminal within Pulsar for such commands? If not, where would I navigate in the Linux terminal to perform that command successfully. Keep in mind, I'm running Pulsar via Linux.Pulsar-1.111.0.AppImage. When I simply launch a terminal and type ppm install steelbrain/busy-signal, I get bash: ppm: command not found. @savetheclocktower

I think the odd way I updated it worked, because I do see the new version when I look at the package in Pulsar. That's some indication that my steps may not have broken anything:

However, I have a backup of how things were before. I'd gladly redo this the proper way ppm install steelbrain/busy-signal, if I could figure out how to get that command to work for an AppImage instance of Pulsar. ChatGPT said this.

[savetheclocktower]

Open the command palette (Ctrl-Shift-P) and invoke the Window: Install Shell Commands command.

If that seems to work, open a new shell and see if it recognizes the ppm command.