Yaal Coop - FOSS

Spring 2026 FOSS contributions by the Yaal Coop team

2026-06-21T00:00:00+02:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

Contributions

ZShell

Powerful shell

Add -r parameter to zcalc completion

auth-playground

Demonstration OAuth2 / OIDC client

Support for rpinitiated-logout

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.

flask-dramatiq

Plug Dramatiq task queue in your Flask web application.

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

CSRF meta tag helper

maildump

A python-based mailcatcher clone

Replace pkg_resources with importlib.metadata

scim2-client

Pythonically build SCIM requests and parse SCIM responses

scim2-models

SCIM resources serialization and validation with Pydantic

scim2-server

Lightweight SCIM2 server prototype

Fix multi-value attributes patch

scim2-tester

SCIM RFCs server compliance checker

Attribute inclusion/exclusions checks

wtforms

A flexible forms validation and rendering library for Python.

wtforms-alchemy

Tools for creating wtforms from sqlalchemy models

Prepare for wtforms 3.3 support

wtforms-sqlalchemy

WTForms integration for SQLAlchemy

Support for py310-314, GHA improvements

Canaille

Lightweight identity and authorization management software

periodiq

Simple Scheduler for Dramatiq Task Queue

Winter 2026 FOSS contributions by the Yaal Coop team

2026-03-20T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

Contributions

A long time ago in Python

A Pull Request to cpython adding a context manager to Mailbox has been merged after a long period of inactivity. It was created in 2017 and was the 27th oldest opened PR for cpython.

Pygments

Pygments is a generic syntax highlighter written in Python

Improve architecture parsing in 'Debian control' lexer

Debian Documentation

Reference for Debian developers: Replace sources.list by debian.sources file format
Release notes: Replace .gpg paths for package signatures by .pgp ones

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.

Canaille

Lightweight identity and authorization management software

flask-cors

*Cross Origin Resource Sharing ( CORS ) support for Flask *

Support callable origins for dynamic validation

scim2-cli

SCIM application development CLI

Implement a pyinstaller tox env

scim2-client

Pythonically build SCIM requests and parse SCIM responses

scim2-models

SCIM resources serialization and validation with Pydantic

scim2-server

Lightweight SCIM2 server prototype

Use scim2-models native exceptions

scim2-tester

SCIM RFCs server compliance checker

Use scim2-models native path management

webtest

Wraps any WSGI application and makes it easy to send test requests to that application, without starting up an HTTP server.

Migrate the project to uv

wtforms

A flexible forms validation and rendering library for Python.

Support Python versions from 3.10 to 3.14

Autumn 2025 FOSS contributions from by the Yaal Coop team

2025-12-21T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.
Libretic is organizing a fundraising campaign to finance the DéMAILnagement campaign initiated by the Chatons collective. The goal of this campaign is to provide workarounds for the web giants.

git-manpages-l10n

GIT Documentation Translations

Fix missing branch name translations and spellcheck branch name translations
Add missing translations for git-switch: 1 et 2

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.

faker

Faker is a Python package that generates fake data for you.

Implement localized UniqueProxy

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

joserfc

Implementations of JOSE RFCs in Python

pydanclick

Add click options from a Pydantic model

Resolve validation aliases

pydantic-settings-export

Export your Pydantic settings to documentation with ease!

scim2-client

Pythonically build SCIM requests and parse SCIM responses

Add support for Python 3.14 and remove support for Python 3.9

scim2-models

SCIM resources serialization and validation with Pydantic

Add support for Python 3.14 and remove support for Python 3.9

scim2-tester

SCIM RFCs server compliance checker

Add support for Python 3.14

smtpdfix

A SMTP server for use as a pytest fixture that implements encryption and authentication.

Speed-up ssl connections

Canaille

Lightweight identity and authorization management software

Canaille beta is out

2025-11-13T00:00:00+01:00

Our recent work on Canaille funded by NLNet Foundation brings us to release a beta version. Let's have a look on what changed.

Recent Work

Task Manager

We implemented a task manager that allows Canaille to perform long-running tasks asynchronously. This is notably used to propagate SCIM requests or send emails. The implementation uses dramatiq, and we published the dramatiq-eager-broker package which allows maintaining synchronous behavior in the test suite, and when the task manager is not configured.

OpenID Connect Certification

As we mentioned recently, Canaille obtained OpenID Connect Foundation certification last September. This guarantees that Canaille behaves in compliance with most common OpenID Connect operations.

The certification process revealed many interpretation errors, often minor but sometimes significant. We fixed most issues directly in Authlib, the underlying library implementing the standards.

Security

We implemented the remaining recommendations from the Radically Open Security audit. Most were minor recommendations following best practices, but there was a high threat finding. Now everything is now in place. You can have a look at the report. We also documented the ANSSI recommendations regarding authentication and password management, which Canaille implements. Most recommendations are implemented, the main remaining task is to support WebAuthn.

Documentation

We continuously work on documentation, aiming to follow Diátaxis recommendations. We wrote chapters for getting started with Canaille and configuring the first OpenID Connect client. These initial steps indirectly led us to work on pydantic-settings-export, which notably allows users to export a configuration file with all default values commented and described, providing a good starting point to begin adapting the configuration. We're still using a custom implementation while we upstream all the changes we need to the original project.

What's Next

Canaille aims for simplicity and its functional scope is therefore quite limited. We thus limit the number of features we want to implement, however a few remain:

WebAuthn support as an authentication factor. This will allow us to implement the last missing ANSSI recommendations.
Captcha method support. At first glance it's surprising to include this feature at a time when the relevance of Captchas is diminishing with the emergence of AIs. However, we note that this is an essential feature for some users, as evidenced by the very thorough comparison of open source SSO solutions published by La Contre-Voie last year.
Implementation of a custom plugin system for Canaille. This is on a more distant horizon, but we would like to offer an API so developers can implement their own authentication factor for Canaille, or their own database connector.

Besides these visible features, most upcoming developments will be under the hood:

Improving the SCIM stack, notably to bring support for SCIM filters.
Improving the OIDC stack to bring support for new standards. Particularly those related to centralized logout or security.

Summer 2025 FOSS contributions from by the Yaal Coop team

2025-09-21T00:00:00+02:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.
Bronze tier sponsoring for the PyConFR convention.

Magic-Wormhole

Get files from one computer to another, safely

Remove warnings about invalid escape sequence in strings
Replace formatted strings to f-strings for the mailbox server and the relay server
Git ignores files generated when the tests run
Update syntax to 3.9+ Python versions, done with pyupgrade-directories, for the client, the mailbox server and the relay server
Replace deprecated pkg_resources.resource_string() call by importlib.resources.file() for the mailbox server and the relay server
Set environment variable to fix a test by having the same stdout output

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

pytest-iam

A lightweight and fully functional OAuth2 / OpenID Connect (OIDC) / SCIM server to be used in test suites.

Fix fake_users and fake_groups exceptions

scim2-client

Pythonically build SCIM requests and parse SCIM responses

scim2-models

SCIM resources serialization and validation with Pydantic

scim2-server

Lightweight SCIM2 server prototype

scim2-tester

SCIM RFCs server compliance checker

Canaille obtains the OpenID Connect certification

2025-09-12T00:00:00+02:00

Since version 0.0.82, Canaille obtained the OpenID Connect certification by the OpenID for the Basic and Dynamic profiles It is now listed among the official implementations.

This development is part of our grant by the NLNet foundation, and required that we improve the Authlib library on which Canaille relies upon.

There is only a few things to achieve before we can leave the Alpha versions!

Spring 2025 FOSS contributions from by the Yaal Coop team

2025-06-21T00:00:00+02:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

django-sesame

Frictionless authentication with “Magic Links” for Django project

Use f-string for exception messages

Magic-Wormhole

Get files from one computer to another, safely

Remove 'u' prefix to strings for the client and the relay server
Use classes directly instead of type() calls for the client and the mailbox server
Update documentation (remove details about python2 types, update minimal Python version in README.md and update tox URL)
Replace formatted strings to f-strings

PSPSDK

Collection of tools and libraries written for Sony's Playstation Portable (PSP) gaming console

Fix CMake deprecation warnings
Search improvement and link to constants in documentation generated by Doxygen
Fix obsolete tags warnings in documentation generated by Doxygen
Move generated documentation in dedicated directory to avoid to delete a file involuntary
Add Code of Conduct in generated documentation in documentation generated by Doxygen
Delete unused macros (1 and 2) and unused variables (1 et 2)
Only one constant definition
Replace a statement by an assigment
Fix goal of the file in the header comment

dramatiq

A fast and reliable background task processing library for Python 3.

Make the Prometheus dependency optional

pytest-scim2-server

SCIM2 server fixture for Pytest

We released 3 new versions during this season.

Option to disable server logging

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

We released 2 new versions during this season.

joserfc

Implementations of JOSE RFCs in Python

pytest-iam

A lightweight and fully functional OAuth2 / OpenID Connect (OIDC) / SCIM server to be used in test suites.

We released 3 new versions during this season.

Implement an embedded test client

otpauth

Implements two-step verification of HOTP/TOTP. Also known as one time password.

Handle non-ascii characters

webtest

Wraps any WSGI application and makes it easy to send test requests to that application, without starting up an HTTP server.

Strip HTML option tag text

scim2-filter-parser

A customizable parser/transpiler for SCIM2.0 filters

Fix a typo in the README

Canaille

Lightweight identity and authorization management software

We released 8 new versions during this season.

New features and latest news on Canaille

2025-03-28T00:00:00+01:00

Our latest news

2024 ended with a lot of new developments on Canaille, funded by NLNet. You can read it all on our dedicated blog post. We went through another round of developments, still under the same fund. You can read it all on this page!

Security audit and improvements

Canaille started 2025 with a security audit, conducted by Radically Open Security. Our main objectives were to know the weaknesses of our product and implement fixes before the end of march.

Better password reset security

The implementation of the flask TRUSTED_HOSTS (see documentation here) configuration variable prevents our "magic links" at user registration and password reset to be falsified and hijacked by a malicious host.

We also improved the way these links are generated to make them more secure and introduce a time limit in their validity.

Logo retrieval vulnerability

We removed a vulnerability that could theoretically permit a server-side request forgery (SSRF) when retrieving the logo of the application.

Better user URL validation

We improved the validation of the user website's URL to make it more restrictive.

Implementation of Content Security Policy

Content Security Policy (CSP) has been implemented on Canaille via Flask-Talisman. CSP makes it harder to disrupt our application, for example with cross-site scripting (XSS) attacks.

OIDC Certification

The OpenID Certification process was expected to be much less trouble than it was. We made a lot of progress on making the certification tests pass but still have a lot to do in order to be certified. We implemented features and fixes as well as raised issues and contributed to Authlib to get better support of the OpenID Specification.

Part of the progress done was:

Match OIDC specification on redirect URIs validation.
Update our models to implement attributes required by OIDC.
Displaying Terms of Service and Privacy policy links if the client requesting authorization issues them.
Displaying most request errors as JSON error pages.
Responding with JSON web tokens when requested by the client.
Improvement on Canaille's handling of JWTs and JWKS.

Packaging: Docker image

Canaille can be tested more easily thanks to a docker image hosted on a public hub docker repository. Users can discover Canaille via an administrator profile.

The creation of this docker image was made possible by building a nix package.

Accessibility audit and improvements

Canaille benefited from an Accessibility audit as well, conducted by HAN accessibility lab. The results provided underlined several contrast issues and lack of differentiation of links from regular text, and a few keyboard navigation issues.

Accessibility improvements

Most color contrast issues have been fixed.
Most link differentiation and visual changes on focus and hover have been fixed.
A skip link has been added at the top of every page.

SCIM Provisioning

Canaille already provided a SCIM server implementation since our last security update. It now also supports SCIM client features, allowing a Canaille instance to automatically broadcast changes on users and groups to client applications. This should make it easier for all applications to remain synchronized without needing additional user intervention.

Thanks for reading, we will keep you updated on our next progress, and you can still read about our other free software contributions on our *seasonal contributions* blog posts.

Winter 2025 FOSS contributions from by the Yaal Coop team

2025-03-20T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

MarkdownMail

Library to send e-mails with generated HTML content

Fix screenshot picture, then release 0.11.1.

Ergo-L

Keyboard layout optimised for French, English and programming

sphinxcontrib-screenshot

Generate dynamic screenshots in Sphinx documentation

python-libfaketime

A fast time mocking alternative to freezegun that wraps libfaketime.

authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

We published 2 releases during this season.

mutmut

Mutation testing system

scim2-cli

SCIM application development CLI

We published 1 release during this season.

Implement --no-verify to avoid perform certificate checks

scim2-models

SCIM resources serialization and validation with Pydantic

We published 1 release during this season.

Canaille

Lightweight identity and authorization management software

We published 8 releases during this season.

PSPSDK

Collection of tools and libraries written for Sony's Playstation Portable (PSP) gaming console

Add description to libraries

Autumn 2024 FOSS contributions from by the Yaal Coop team

2024-12-21T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

Pygments

Pygments is a generic syntax highlighter written in Python

Add a lexer to highlight *.sources files. This format will replace the sources.list format in Debian and derivatives.
An issue written by a pygments maintainer about the use of the wrong lexer for syntax highlighting in Sphinx, some fixes have been pushed to Kivy, Bokeh (linked issue) and Paddle.

Pluralizefr

Python library to get plural word from singular one

Remove of u prefix before strings
Remove of setup.py, remplaced by pyproject.toml
Add a command to send package to pypi.org
Add metadata in pyproject.toml
Fix 'oeil' case
Publish releases on pypi.org

PSPSDK

Collection of tools and libraries written for Sony's Playstation Portable (PSP) gaming console

Make analog stick values more readable in basic control sample in main repository and in website
Fix a comment about sprite in example code

apt-setup

Part of Debian-Installer. Generate an /etc/apt/sources.list for the installed system

Delete unused ubuntu generator script

bmg

It moves a file (or directory) for 3 minutes. At the time out, the file (or directory) comes back.

Mainly:

get it works
...and add additional desktop notifications for kdialog, zenity and xmessage

Canaille

Lightweight identity and authorization management software

We published 1 release during this season.

scim2-models

SCIM resources serialization and validation with Pydantic

We published 11 releases during this season.

scim2-server

Lightweight SCIM2 server prototype

We published 1 release during this season.

scim2-client

Pythonically build SCIM requests and parse SCIM responses

We published 12 releases during this season.

scim2-tester

SCIM RFCs server compliance checker

We published 8 releases during this season.

Migrate from Poetry to uv

scim2-cli

SCIM application development CLI

We published 3 releases during this season.

wtforms

A flexible forms validation and rendering library for Python.

We published 2 releases during this season.

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

We published 1 release during this season.

wtforms-sqlalchemy

WTForms integration for SQLAlchemy

We published 1 release during this season.

click

Python composable command line interface toolkit

Add a catch_exceptions parameter to CLIRunner

jinja-autodoc

Automatically document your Jinja templates with Sphinx

We published 3 releases during this season.

Fork from sphinxcontrib.jinjadomain, and hosting under the sphinx-contrib organization umbrella

New security features implemented in Canaille

2024-12-19T00:00:00+01:00

We have been working recently on key security features for Canaille, as parts of our NLNet grant.

Security

During this sprint we focused on implementing security recommandations advised by the French cybersecurity public agency "ANSSI".

Multi-factor Authentication

In the old days, asking for a password was considered sufficient to verify the identity of a person on the internet. However, there are multiple ways to guess a password or steal it from someone, and users quickly began to form less than ideal habits around them - like using the same password on every websites. But it's not just passwords. Software developers came to the realization that, especially for sensitive applications, you can't get away with using a single authentication method: every one of them has its weaknesses, and can eventually be cracked.

The solution was found in asking users to authenticate themselves using two or more authentication methods, or factors - hence the name multi-factor authentication.

For an identity management software like Canaille, this was a key feature to have, and we implemented it for four different methods:

The HOTP/TOTP methods require the user to download and set up an authenticator mobile app or software (like FreeOTP), which will in turn produce one-time passwords. These passwords change periodically (each time you press the button in your authenticator for HOTP, or after a fixed period for TOTP), which makes it harder for attackers to get their hands on a password and use it in time. These are probably the most secure authentication factors available now for Canaille.

The remaining two factors (codes via email or SMS) are more basic but still offer a better security when combined with the password. They might be adapted for use cases where ease of use appears more important than security. The email method requires the administrators of the Canaille instance to have configured a SMTP server. Likewise, a functioning SMPP server is needed for the SMS method.

These factors can be stacked, up to 3 different factors (HOTP and TOTP, using the same authenticator app, are mutually exclusive) in addition to the traditional password. The user will then need to fill out all the required codes in order to log in to their account. The MFA feature can also be deactivated completely - in that case the user will only need their password to login.

Intruder lockout

To prevent brute-force attacks on Canaille accounts, we added a delay between each failed login attempt. The delay doubles each time someone enters a wrong password. We also considered locking accounts after a given number of failed attempts, but this would have made it too easy for attackers to lock all user accounts.

Security events logging

In order to facilitate the detection of a potential attack on a Canaille instance, we added logging for sensitive events. Those logs are marked with a special "security" tag for easy retrieval. They can be configured to be written in a separate file than usual log entries.

Logged security events include authentication attempts, password or email updates, emission or revokation of OAuth tokens, and more.

Password compromise investigation

Since users tend to reuse the same passwords (with some small variations in the best case), it is now possible to check if each new password is not in a compromised passwords database, thanks to the Have I Been Pwned's API.

HIBP offers a free API endpoint that can be consulted for compromised passwords.

Password expiry policy

In order to increase the security of user accounts, it is now possible to determine a lifetime for passwords. When a password expires, users are forced to update their password on their next login, or during their session if already logged in.

Provisioning with SCIM

Canaille provides a SCIM server implementation, that can be used by client applications to manage users and group directly in Canaille (given the rights permissions). In the future we would love to build a small service subscription management application, and SCIM is a well suited protocol for such an application to communicate with Canaille.

Thanks to our recent work on SCIM we had almost everything ready to add a server-side implementation of SCIM. It was also a way to test our SCIM libraries in a real-world situation. In the end, this integration made us fix a lot of things both in our SCIM toolbox and in Canaille.

Documentation

Internationalization

To make Canaille more accessible, we spent some time to make our translation translatable. The translation interface is available on Weblate. We also translated the documentation in French to validate the mechanism. This was also an opportunity for us to review all the existing documentation and fix wording errors and typos.

Theming

We also have worked on the theming documentation to help users customize how their Canaille instance looks. We wanted to reference and document all our templates, to help designers modify them. To achieve this we had to fork an old unmaintained library into a new library jinja-autodoc for automatic template documentation generation. We cleaned it, made a few improvements, and pushed it under the sphinx-contrib organization.

Python SCIM toolbox

2024-12-05T00:00:00+01:00

Our friends from IndieHosters provide a rich catalog of services to their users. They are specialized in infrastructure management of those services, and one of the major aspects of their work is the management of user accounts.

When a new user account is created against an identity server, most of the time the access token that the users provide to the services contains information about the user. This information is generally enough to create the users account on the service provider. Let us study an example with the Keycloak identity provider and a the Nextcloud file management service.

the users create their account against Keycloak (for instance by filling a subscription form),
they try to access Nextcloud, but they have no open session, so they get redirected to Keycloak,
they log in, Keycloak generates a token containing their personal information,
this token is forwarded to Nextcloud,
Nextcloud reads the personal information from the token. If the user account does not exist on Nextcloud, then it is created. Otherwise, the personal information is updated on Nextcloud.
Nextcloud finally gives access to the user.

This is convenient, but this does not cover all the use cases:

How to share a document with users that never logged in yet? For the moment it is needed to wait for a first user login on Nextcloud before its Nextcloud account is created.
Users edit their personal information on the identity server (for instance, their display name). How to instantly spread the modification on all the services? Currently, personal information are only updated when users log-in anew on the services.
How to delete or deactivate user accounts on all the services, once they have been created?

To achieve all those operations, it is needed to use a provisioning protocol. Provisioning is the action of forwarding objects (often user and groups) modifications between several services. These days, the industry standard is SCIM. IndieHosters started a nice presentation webpage about SCIM.

They obtained a NLNet grant to develop SCIM in the ecosystem of their tools, and hired Yaal Coop for a part of the project. We had several missions:

Provide a command line interface that would allow to easily communicate with a SCIM server, and test the conformity of a SCIM server towards the specifications. This project gave birth to several sub-projects:
- scim2-models, a SCIM resources validation and serialization Python library. It relies on Pydantic, provides native objects that implement the SCIM specification. It aims to be used as a building block for SCIM server and client applications.
- scim2-client, a Python library that creates and validates SCIM network requests. It uses httpx to handle the network part.
- scim2-server, a SCIM server prototype that uses scim2-models developped by CONTACT Software, and co-maintained by Yaal Coop.
- scim2-tester, a SCIM compliance testing Python library. It uses scim2-client to send various requests to a SCIM server, and check if it behaves as expected by the SCIM specifications.
- scim2-cli, a command line utility that uses scim2-client and scim2-tester, and provides an interface to perform various operations on SCIM servers.
Discuss the adoption of SCIM as the official provisioning protocol for the instant messaging protocol Matrix. We redacted an evolution request for the protocol (MSC4098), for which discussions are still opened. To this day the proposition has not been adopted, the main argument against is that provisioning is out of scope of the Matrix protocol.
In parallel, we developed a SCIM implementation in synapse, the most famous Matrix server currently. The implementation uses scim2-models.

SCIM appears to us a future standard for provisioning and we hope that the libraries developed will help its development, thanks to new Python tools and eventually without limiting this language. Provisioning is an useful technique for alternative online service providers, such as the ones in the CHATONS collective. They deploy heterogeneous sets of services, and specifications such as SCIM help those services to communicate. We hope that in the long run our work will have an impact on the quality of service of those little providers, and help them grow.

Summer 2024 FOSS contributions from by the Yaal Coop team

2024-09-22T00:00:00+02:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

Pygments

Pygments is a generic syntax highlighter written in Python

Add Changed-By field to debian control lexer
Fix parsing in quoted string containing comment character in IniLexer lexer

PSPSDK

Collection of tools and libraries written for Sony's Playstation Portable (PSP) gaming console

Documentation improvement: fix a link to the licence, delete an obsolete README file and fix typos

apt-setup

Part of Debian-Installer. Generate an /etc/apt/sources.list for the installed system

Documentation improvement: catch up the current behavior of 01setup

scim2-models

SCIM resources serialization and validation with Pydantic

scim2-client

Pythonically build SCIM requests and parse SCIM responses

Content-Type header charset support

scim2-tester

SCIM RFCs server compliance checker

scim2-cli

SCIM application development CLI

scim2-server

Lightweight SCIM2 server prototype

/v2 prefix is optional

authlib

Identity and Access management library for python

GHA action update

synapse

Matrix homeserver written in Python/Twisted

Pydantic import refactoring

pydanclick

*Add click options from a Pydantic model *

Exception catching refactoring

canaille

Lightweight identity and authorization management software

Stop support for Python 3.9

Spring 2024 FOSS contributions from by the Yaal Coop team

2024-06-21T00:00:00+02:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

Bat

A cat(1) clone with syntax highlighting and Git integration

Display which theme is the default one with --list-themes parameter and disabled colors. With this PR, bat has the same behaviour than with enabled colors (done in previous PR).
Improve code coverage for --list-languages parameter

canaille

Lightweight identity and authorization management software

ihatemoney

A simple shared budget manager web application

python-libfaketime

A fast time mocking alternative to freezegun that wraps libfaketime.

pytest-libfaketime

Prepare pytest for python-libfaketime

pytest-iam

A fully functional OAUTH2 / OpenID Connect (OIDC) server to be used in your testsuite

Debian

Extract BlastEm manpage because it does not existe anymore in the upstream repository
Update improved BlastEm manpage to the new manpage

scim2-models

SCIM resources serialization and validation with Pydantic

Initial releases and documentation

scim2-client

Pythonically build SCIM requests and parse SCIM responses

Initial releases and documentation

scim2-tester

SCIM RFCs server compliance checker

Initial releases and documentation

scim2-cli

SCIM application development CLI

Initial releases and documentation

Winter 2024 FOSS contributions from by the Yaal Coop team

2024-03-21T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

PyPI search

Firefox plug-in to search Python libraries hosted at PyPI (pypi.org)

Replace Pypi occurrences by PyPI one
Release a new version (1.0.1)

Bat

A cat(1) clone with syntax highlighting and Git integration

Display which theme is the default one with --list-themes parameter
Add a screenshot about the --list-themes parameter usage on screenshots.debian.net

HATop

An Interactive ncurses Client for HAProxy

Fix syntax warning occurring with Python 3.12, based on a Debian bug report

Virt-Manager

Desktop user interface for managing virtual machines

Fix and add french translations on https://translate.fedoraproject.org/projects/virt-manager/virt-manager/

wtforms

A flexible forms validation and rendering library for Python.

authlib

Identity and Access management library for python

RFC7523 documentation improvements

canaille

Lightweight identity and authorization management software

Matrix

A new basis for open, interoperable, decentralised real-time communication

MSC4098 proposal for SCIM support

Autumn 2023 FOSS contributions from by the Yaal Coop team

2023-12-21T00:00:00+01:00

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

canaille

Simplistic OpenID Connect provider over OpenLDAP

wtforms

A flexible forms validation and rendering library for Python.

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

django-anymail

Anymail: Django email integration for transactional ESPs

Update brevo.com provider (formerly Sendinblue)

ihatemoney

A simple shared budget manager web application

authlib

Identity and Access management library for python

Python 3.12 support

flask-webtest

Utilities for testing Flask applications with WebTest*
Documentation improvements

Canaille, a lightweight identity and authorization management software

2023-11-29T00:00:00+01:00

Since a while, the Yaal Coop team is working on Canaille, an identity and authorization management software (or IAM). At the occasion of the end of an endeavour that benefited the help of the NLNet foundation, we want to tell the history around Canaille.

At first was the Single Sign On

At Yaal Coop (like anywhere else) we use a bunch of tools to work together as a team. Emails, files, address book, project management, time tracking, accountability, continuous integration, bug reporting… and the list goes on. For the comfort of use (and for security), those tools are generally plugged to a central software that manages user accounts and accesses. Usually, LDAP¹ is used for that, and this is called a directory. If a service is connected to a directory, you do not need to register to that service, you can just use your usual password, the one you set in the directory. It is convenient for you since you just have one single password to remember (or to forget). This is what is called Single Sign On (SSO). It is also convenient for people managing the user accounts in your organization, as they can create and revoke accounts for all the plugged services at a time.

LDAP is old and robust, and for software those are qualities. The few decades of experience behind LDAP make it a battle-tested technology compatible with a large selection of services. But unfortunately LDAP is also complicated and abstruse.

Its tree model looks like few other things you might know, the documentation is rare and obscure, conventions are intriguing, with a lot of distressing acronyms, tooling is sparse… Also, this was made for data often read but rarely written. The data models LDAP offers cannot easily evolve. Generally, the provided ones allow to handle basic attributes on users and groups. If you want to manage more advanced aspects like the favourite color of users, then you need to write your own data models². And you'd better be confident when you do it, because no update mechanism is provided for neither data nor data models³. Then, if you wish to share your data models with the world, it is advised that your register at the IANA⁴, and provide an online reference of your schemas.

When we took a close look at the LDAP universe, we had the impression that once set up, LDAP installation were left alone for years ; like if people who might had knowledge to share had flew the austerity of that technology without documenting their adventures, and without need to returning to it because it just works. I am barely exaggerating, if we have a look⁵ at the number of questions in stackoverflow, ldap has approximately 1000 questions, while postgresql or mongodb have around 14.000, and mysql has 45.000.

Then came the Single Log In

During our volunteer time at Supercoop⁶, among other tasks, we worked to install collaboration software, like we did for ourselves. Obviously, those tools were plugged on a LDAP directory. We noticed that the members management team of the supermarket was spending a certain amount of time dealing with user support, notably with password reset demands. People were failing to use the tools we deployed for them as soon as the first login step. This verdict pushed us to look for Single Login Identification (SLI) software (free and open-source, obviously), in replacement or in addition to our historical directory. What SLI brings, is that users can navigate between services without having to sign in every time. They can switch from the webmail interface to the calendar without having to make a step by the authentication screen, while with a simple directory, they would have to enter their password once for each service. For a non tech-savvy public, this is the opportinity to get rid of several technical screens, limit the error sources and the frustration.

Currently the predilection protocols for SLI are OAuth2 and OpenID Connect (OIDC)⁷. (There are other existing standards, more historical or more focused towards big organizations, like SAML or CAS.) The OAuth2 and OIDC specifications are recent but they still benefit from a decade of feedback. Tooling and documentation are numerous, the community is alive and active, and standards are still evolving at this day with the work of the IETF oauth workgroup. But here again, everything is not perfect and OIDC comes with its difficulties. First of all, OAuth2 and OIDC make about 30 different standards, some of which contradicting or bringing corrections upon prior standards. All of those are not pertinent for what we want to do, but simply understanding how work the few standards that actually interests us already requires a certain amount of time and work. The OIDC implementations – by the IAMs or the services connected to IAMs – are sometimes partial or bugged. To make nothing better, big industry actors sometimes deliberately take some liberties with the standards, and make some additional developments a requirements to be compatible with their software.⁸

Let's get back on topic. For Supercoop, we wanted to find a tool that would be utterly simple from several point of views:

for the final users: the volunteers of the shop. They must be able to use the tool without any prior technical knowledge, and without help;
for the members management team. We wanted a relatively simple tool where a little bit of learning would be acceptable but not desirable. As the cooperative supermarket operates with benevolent labour, we want to take care of the volunteer time and avoid disagreeable tasks.
for the IT team. Here again simplicity is at stake. If there is a too steep learning curve on the tools the supermarket uses, there will be an issue for recruiting competent people to help us. The nature of the benevolent participation of the shop make that volunteers are helping punctually, and rarely engage for years, so they do not always have the time to learn the whole technical stack. Ideally the IT team should be able to administrate the tool we are seeking with a superficial knowledge of the underlying protocols. And with the descriptions I made of LDAP and OIDC, you start to make an idea of the problem we have.

Our search showed us that there was a dozen of tools that could answer our needs. However, none was fitting all our expectations. Actually, by their very nature, the IAM software are intended to big organizations, that consequently can afford to hire competent people to administrate them, so complexity is not really an issue. Those are mostly big powerful software, with a large protocol compatibility not pertinent for us, and requiring some technical knowledge for installation, maintenance and administration. Pushed by our curiosity, we finally hacked something on our side.

Canaille

A few times later, our prototype had grown bigger and became Canaille.

The features

Canaille is a user and group management software that allows account creation, edition, administration, registration, forgotten password reset, user invitation etc. In addition, Canaille implements OIDC and provide a SLI layer for other services. Its interface is customizable and… that's all. We try to keep the functional scope tight so Canaille can stay simple to maintain and to operate.

Canaille can be used for:

bringing an account edition interface on top of a LDAP directory. The tooling around LDAP being quite sparse, Canaille can be a convenient option and allow utilities like password reset.
bringing a SLI layer on top of a LDAP directory. If your organization has a historical LDAP directory and you want to modernize your stack with SLI, Canaille can discretely integrate your existing stack (almost) without modifying anything, and let you the time to prepare (or not) a migration.
develop applications relying upon an OIDC server. If, like us, you are doing software development and regularly work on applications that needs to connect to a OIDC server, then you can use Canaille in your development environment. Canaille being very light, this is now our tool of choice to work on client applications.
test applications relying upon an OIDC server. We also use canaille in unit tests suites, with pytest-iam. This is a pytest plugin that configures and run a Canaille instance so your unit tests suite can achieve actual OIDC connections.

The technical choices

Canaille is written in Python, with Flask for the backend and fomantic-ui and htmx for the frontend. We like the simplicity of Python and Flask, and strongly believe those are arguments that make contributions easier and increase software longevity. We have been shocked by our discovery of HTMX earlier this year, that in short allows us to build dynamical pages without writing Javascript. One language less is as much less complexity in the project.

Under the hood, Canaille can be plugged to a LDAP directory or a SQL database.

The development techniques

We use Canaille in production, at Supercoop where it is used to manage 1800 users, but also in our own stack in our Nubla mutualized cloud services, and on dedicated Nubla Pro instances. That large userbase allows us to collect user feedback, and we improve Canaille gradually in reaction to demands and according to our roadmap.

Cannaille development follows the principles of the Test Driven Development (TDD) when possible. The code coverage reaches 100% (including branches), and this is a prerequisite for new contributions. In addition to giving us confidence in our tests, this allowed us to simply delete unused pieces of code. Bugs are easier to find when there is less code to search them into.

Canaille uses all the modern Python source code linters and formatters, with pre-commit, and the unit tests are run on all the officially supported Python versions.

Finally, the translation of Canaille is done by the community with Weblate.

Contributions

Like most of modern software, Canaille relies on libraries so we don't have to re-invent what is already existing.

At Yaal Coop for all our projects, when we find bugs in libraries, we follow a strategy that consists in implementing fixes both in our code and the libraries at the same time. At first we patch our code with temporary but functional fixes. However all that code we write is a maintenance burden to come, so in parallel we discuss with the maintainers of those libraries, and propose better conceived long term fixes. This is for us a guarantee of the sustainability of those pieces of software we rely upon, and this is a way to contribute to that necessary FLOSS ecosystem. Once the upstream library is patched, we delete our quick fix.

In the same fashion when we wish additional features in libraries, we discuss our motivations with maintainers and sometimes provide implementations. We have for instance developed the OIDC specifications RFC7591 and RFC9068 in authlib, a library Canaille uses to deal with OIDC.

The results of those efforts can be seen in our seasonal blogposts about our FLOSS contributions.

The chance of the contributions brought us to share the maintenance of certain libraries we rely upon, like wtforms that is a form management tool, or nextcloud-oidc-login and the underlying OpenIDConnect-PHP that allow nextcloud (the file manager integrated in Nubla) to connect with Canaille.

We also modestly sponsor the maintainers of fomantic-ui and authlib on a monthly basis.

The help of the NLNet foundation

Canaille has been developed to answer specific needs we met: initially Canaille was only made to work with LDAP directories. Watching the ecosystem, we noticed that more and more software became compatible with OIDC in addition to LDAP. Ultimately, if no service we use directly rely upon LDAP, then we could consider a replacement database with which we feel more comfortable. In addition to this, it is more likely that people interested by the Canaille approach will have experience with things like SQL than with LDAP. To go towards this directory, we sollicitated the NGI Zero Entrust fund of the NLNet foundation in the late 2022, for a amount of 7.000€, to help us realize tasks on Canaille (and around):

database connection genericity. This was a mandatory preparatory step to plugging additional databases than LDAP;
SQL databases support. This allows Canaille to connect to a lot of widespread databases like postgresql, mariadb and sqlite, thanks to sqlalchemy.
pytest-iam. This is a tool that can prepare and run a Canaille instance in the purpose of unit testing Python applications with pytest.

Those developments have been achieved in november 2023, and have implied numerous refactoring, bugfixes, and better conception and reliability on Canaille. We are very grateful towards the NLNet foundation for having allowed us to work on our tool, and help at our scale to contribute to the free and open source ecosystem.

What's next?

Go in beta version

From the beginning we have kept Canaille in alpha, we are currently at version 0.0.35. We advise in the documentation that the software is still not suited for production environments. This was for us a way to experiment and break things without having to be worried about compatibility. We would like to break one last little thing by re-thinking the configuration files before we let Canaille go in bêta, and remove usage warnings.

We track the beta version tasks in this milestone.

Go in stable version

The work we intend to realize to go from a bêta version to a finale version will essentially consists in documentation efforts and ease of installation and usage of Canaille. The goal is to make Canaille really easy to access, in order to create usage and collect more user feedback.

We track the finale version tasks in this milestone.

And beyond…

In the future, we would like to work on provisioning, by implementing the SCIM specification. This will allow to decouple user authentication and account creation. Indeed, at the moment user accounts are created the first time users log in at our services. This can raise issues in some situations: for instance one cannot share files in Nextcloud with users who have not log in yet. SCIM also provides a mechanism to delete user accounts in those services, that is a thing we do more or less manually at the moment.

Among the things we look forward to implement, there are also the Single Log-Out (SLO) OIDC specifications. This will allow users to disconnect from all the services in a single action. SLO is a feature that will bring security and comfort of use. This will need to be developed in authlib in a first time.

At last, we would like to work on advanced group management and permissions, and on multi-factor authentication to bring even more flexibility and security in Canaille.

Canaille is open to contributions, if you want to help us in this endeavour, the door is open!

or more exactly, a software implementing the LDAP protocol ↩︎
that are called schemas ↩︎
at least with OpenLDAP ↩︎
what we did, our IANA number is 56207 ↩︎
OK, the comparison has limits since those different databases are not used for the same needs, but the magnitude of the numbers says something about the interest around those technologies ↩︎
a cooperative supermarket near Bordeaux, France ↩︎
for sake of simplicity, I will keep to OIDC ↩︎
They can also be a driving force for new features, like RFC7628 or RFC9068 that were commonly used before they became standards. ↩︎

Summer 2023 FOSS contributions by the Yaal Coop team

2023-09-23T00:00:00+02:00

This summer we decided to sponsor two authors of tools we are depending on. This is a small amount for the moment, but hopefully this will grow or we add more recipients to the list.

We spent a bit of energy on Canaille, and implementing the big part of our NLNet subsidy, that is the database backend genericity. The inmemory backend allowed us to use canaille in pytest-iam, a tool that bring a lightweight OpenID Connect provider to be used in your unit tests.

Sponsoring

Marco 'Lubber' Wienkoop for his work on Fomantic-UI, a nice CSS framework we use in canaille. Fomantic-UI is used on other tools we rely on, like Forgejo.
Hsiaoming Yang for his work on authlib, a python authentication library we use in canaille.

canaille

Simplistic OpenID Connect provider over OpenLDAP

wtforms

A flexible forms validation and rendering library for Python.

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

ihatemoney

A simple shared budget manager web application

python-slapd

Controls a slapd process in a pythonic way

LDAP tree initialization utility

authlib

Identity and Access management library for python

pytest-iam

A lightweight OAuth2/OIDC server to be used in your test suite

First releases and documentation

Debian

New style proposal for Sphinx documentations, which is currently used for debian-policy and could be used in the future for the release notes
Search on the Supervisor bug report

FOSS contributions from the Yaal Coop team during spring 2023

2023-06-21T00:00:00+02:00

htmlRFC

Firefox plug-in displaying a link for RFCs in plain text format to HTML one

Accept RFCs on rfc-editor.org website: plugin enabled on rfc-editor.org site and redirect to rfc-editor
Release v.1.2

Debian

Improve BlastEm manpage
During release notes migration from DocBook to Sphinx: highlight command line and configuration examples, hide 'Created using Sphinx' text in the footer, add CSS file to fit Debian style

Logrotate

Unix tool for administration of log files on a system which generates a lot of log files

Turn exit code to 0 when the raised error stops the execution. It fits expected behavior for Unix tools.
Minor documentation improvement.

smtpdfix

A SMTP server for use as a pytest fixture that implements encryption and authentication.

Use a random port instead of 8025 by default

flask-themer

Simple theming support for Flask apps.

Extend a template from another theme

zodburi

Construct ZODB storage instances from URIs.

Remove support for ZODB4 and python<3.7

canaille

Simplistic OpenID Connect provider over OpenLDAP

django-anymail

Django email integration for transactional ESPs

Update domain used by the API, unit tests and documentation due to Sendinblue rebranding to Brevo

simple-svelte-autocomplete

Simple Autocomplete / typeahead component for Svelte

Call custom ordering functions when opening the menu with an empty input

FOSS contributions from the Yaal Coop team during winter 2023

2023-03-21T00:00:00+01:00

This winter we have mainly worked on Canaille in order to prepare the implementation of features sponsored by the NLNet foundation.

Documentation

Python : remove or update bitbucket.org links
Celery : URLs fixed (1 et 2)

Esup-Pod

Video sharing website aimed at education and research

Contributions funded by the Direction du Numérique pour l'Éducation (Formation Ouverte et A Distance service)

DSFR

French State design system

Fix Toggle component compatibility with vite+svelte

canaille

Simplistic OpenID Connect provider over OpenLDAP

nextcloud-oidc-login

Nextcloud login via a single OpenID Connect 1.0 provider

Avoid avatar download when unnecessary

flask-shell-ptpython

Ptpython shell for flask

(hopefully temporary) fork while the project is abandoned

authlib

Identity and Access management library for python

Useless code removal

wtforms

A flexible forms validation and rendering library for Python.

flask-wtf

Simple integration of Flask and WTForms, including CSRF, file upload and Recaptcha integration.

python-caldav

Python CalDAV library

aioimaplib

Python asyncio IMAP4rev1 client library

simple-svelte-autocomplete

Simple Autocomplete / typeahead component for Svelte

Menu stays closed when field is locked

python-slapd

Controls a slapd process in a pythonic way

supervisord

A Process Control System written in Python

Remove python3.3 case

Last FOSS contributions from the Yaal Coop team (automn 2022)

2022-12-21T00:00:00+01:00

pytest-httpserver

Http server for pytest to test http clients

dnserver

Simple development DNS server

canaille

Simplistic OpenID Connect provider over OpenLDAP

ZEO

ZODB Client-Server framework

Exit value is 1 if all connections fail

nextcloud-oidc-login

Nextcloud login via a single OpenID Connect 1.0 provider

authlib

Identity and Access management library for python

aioimaplib

Python asyncio IMAP4rev1 client library

Unit tests with pytest, tox and Github Actions

MessagePack

Efficient binary serialization format (python implementation)

New patches after code review

simple-svelte-autocomplete

Simple Autocomplete / typeahead component for Svelte

Fixed some accessibility warnings

dnspython

DNS toolkit for Python

Code cleaning: obsolete test and comment

Last FOSS contributions from the Yaal Coop team (summer 2022)

2022-09-22T00:00:00+02:00

squeekboard

An on-screen-keyboard input method for Wayland

French translation

libcall-ui

User interface for Linux phone calls

French translation

Mozilla Web Docs

Documentation about web technologies, including CSS, HTML, and JavaScript

Add a Warning about deprecated OpenSearch for Firefox add-ons

canaille

Simplistic OpenID Connect provider over OpenLDAP

Python

Documentation: replace domain names not managed by PSF by python.org et domain names with .example Top Level Domain (cf. issue) in the documentation

python-caldav

Debian Archive Kit (dak)

Programs used to maintain the Debian project's archives

Fix E123 flakes8 errors. E123 code means "closing bracket does not match indentation of opening bracket's line".

Python2 will disappear

Removal of a workaround for older releases than 2.6 in Webtest
Documentation: removal of an example based on python2 in Honcho
Removal of python2.7 specific cases in setuptools
Removal python2 support in msgpack

tracker-miners

Data collectors for GNOME tracker

Added CLI options for RSS feeds addition and deletion

poetry

Tool for dependency management and packaging in Python

Add a warning if credentials are written in lock file
Add private attribute to fit the implementation of the mocked class (needed for previous patch)

fhir-kindling

FHIR resource and synthetic data set creation and management tool

keyring_pass

Password Store (pass) backend for python's keyring

dnserver

Simple development DNS server

nextcloud-oidc-login

Nextcloud login via a single OpenID Connect 1.0 provider

Purism Librem 5 software review : our list to Santa

2022-06-02T00:00:00+02:00

After several years of waiting, we just received our Librem 5 phone from Purism. The Librem 5 phone is a privacy-oriented phone which notable features are:

it uses PureOS, a GNU/Linux distribution based on Debian, instead of Android or iOS;
the interface is based on GNOME with a few modifications;
it has kill switches to physically disable wifi, bluetooth, cellular data, camera and microphone.

Running a Linux on a cellular phone enables new uses, especially for tech savvy, but it comes with its lot of drawbacks. The main notable ones is that Linux phones is a brand new field, and a lot of apps are simply 'not ready'. Either because their UI is not adaptive, because they have not been adapted to mobile user interactions (swiping and other gestures), or just because they have not been tested enough by users, so some actions feels convoluted.

FOSS developers do their best, and a whole lot of great work has been done so far. However we are not yet at a point where Linux phones can be put in the hands of a larger audience. With our fresh eyes of new Linux mobile users, we want to list here the main things that we felt were really missing to provide a good user experience (at least for our biased geeky use). We focused on GNOME Core and Circle apps, and mobile/Librem5 specific apps developed by Purism. What we expect from a phone is to:

place calls
receive and send SMS
receive and send emails
be used as an alarm clock
manage contacts
manage tasks
be used as a geolocation navigation device
browse the internet
play music
take photos
take notes
display documents
share internet connection
be used as a torchlight
discuss with people

As patching has even more value than reporting, this list could be used by us (or you?) as a to-do list for some day if we get bored.

We have tested the phone running PureOS byzantium, and we updated all the apps through Flatpak when possible so we could get the latest GNOME 42 fixes.

Blockers

In this category we put the issues we feel are very discouraging for a daily use. This mainly concerns UX friction and stress, and missing or broken features.

Squeekboard - Alternate characters popovers: We Europeans use a lot of diacritics, the keyboard should offer us a way easily write any common accentuated character.
Librem5 - Translation have to be forced: At first launch, the welcome panel asks the user for their language, but this action is uneffective and the system is displayed in English after that. This is easy to fix with a command-line, but surprising for a first-launch.
Clocks - Alarms should ring even when the application is not launched: If an alarm has been set, it should ring on time, no matter what. Having to launch the application to get the alarm ring is unexpected.
Clocks - Alarms should wake the system up: If an alarm has been set, it should ring on time, no matter what. Alarms should wake the system up if needed.
Clocks - Custom alarm sound: At the moment, the only alarm sound is the default one.
Clocks - Interact with an alarm from the lock screen: Currently it is needed to enter the PIN code before we can stop the alarms. When you wake up, this is harsh.
Squeekboard - Input indicator: When a key is tapped, users should have a visual indication of which key is actually pressed.
Librem5 - Night light support: GNOME provide a night light feature that reddish the screen automatically depending on the hour. It seems there are some kernel thing to do to enable this. Without this, watching to the screen at night just kill your eyes.
Calls - Alphabet side bar: The application lacks an alphabet side bar to quickly jump to some letters in the contact list. With thousands of contacts this would become more than useful.
Contacts - Alphabet side bar: The application lacks an alphabet side bar to quickly jump to some letters in the contact list. With thousands of contacts this would become more than useful.
To-Do - Adaptive UI: The UI is not adaptive at the moment, so To-Do is not usable.
Weather - Adaptive UI: The application is not adapted to mobile UI.
Fractal - End-to-end encryption: At Yaal Coop we encrypt our conversations, so E2EE in Fractal is a blocker to us.
Maps - Adaptive UI: The side-menu is not usable on a Librem 5 at this point.
Maps - Navigation view: The application can calculate itineraries, but do not provide anything to follow the itineraries. Is is not usable in a car yet.
Maps - Long-press to open the contextual menu: Some actions are only accessible via right click on desktop, so on mobile they just cannot be done. A long press on the map should have the same effect as a right click.
Online Accounts - CarDAV & CalDAV provider support: This would allow to plug any contact, calendar and todo list provider to the system.
mobile-broadband-provider-info - TeleCoop support: This allows to use data with TeleCoop. The patch is applied but not yet deployed.
Software - UI is sluggish: When Flatpak in enabled, any actions takes decades to achieve, to the point that it is sometimes needed to restart the app.
Voicemail - There is no working voicemail app at the moment: Having the ability to easily listen to voicemails is a must-have on a 2022 phone.

Comfort

In this category we put the issues that would improve our comfort. This mainly concern mobile UX improvements.

Phosh - Automatic light and dark theme switch: Along with the screen warmness adaptation, switching from a light to a dark theme when the night comes is a bliss for the eyes. This is achievable with GNOME Shell with the Night Theme Switcher extension for instance.
Phosh - Swipe to open and close the menu: As of today, the application menu and the top menu can only be opened by tapping. However swiping to open the menu feels more natural on mobile. This have been implemented but not yet deployed.
Phosh - Automatically unlock the keyring: When opening a new session with a PIN, it is then asked a second time to unlock the GNOME keyring. This feels redundant.
Phosh - Hold the volume buttons to change volume: Currently, we have to press the buttons multiple times in order to change the volume.
Librem5 - Ask the encryption passphrase at first boot: At first boot, a (default) passphrase is asked to decrypt the disk, in English, with a qwerty keyboard. It would be friendlier to not ask it a the first boot and let the user choose it.
Librem5 - Disk decryption screen l10n: The disk decryption screen is in English, with a qwerty keyboard, so it is not adapted to other languages.
Phosh - Keep the time displayed when the top menu is opened: The time is hidden when the top menu is opened. Time is still an interesting information to display when the menu is opened, and without this the top bar appears strangely empty. This seems to be fixed but not yet deployed.
Phosh - Toggle geolocation from the top menu: In the top menu there are button to toggle wifi or bluetooth, but not to toggle geolocation.

Sparkles

In this category we put everything else that we met during our test, from nice-to-have features to slight mobile UX improvements:

Chatty - Swipe to return to the message list: When a message is displayed, there is an arrow button that allows to go back to the message list, but the more natural action on mobile would be to swipe left.
Geary - Swipe to return to the message list: When a message is displayed, there is an arrow button that allows to go back to the message list, but the more natural action on mobile would be to swipe left.
Calendar - Swipe to navigate between weeks or months: Swipe would be more adapted to mobile screens than the current arrows.
Calendar - Selection visual indicator: During a selection on touchscreen, users have no feedback until their finger is released.
Calendar - Adaptive UI: Calendar displays good enough on mobile, but some details are missing. For instance, the tooltips can be larger than the screen.
Clocks - Analog watch widget: Tapping multiple times on the screen to select hours and minutes is cumbersome. An analog watch widget could achieve the action in on two taps.
Disks - Adaptive UI: The encryption menu is not adaptive, but this is still usable.
Dialect - Slow performances at startup: The applications takes several seconds to start.
Dialect - Cannot close the preferences dialog: It has a close button on GNOME Shell, but not on phosh.
Dialect - Offline translations: Because we are not always connected.
Maps - Offline maps: To save mobile data, it would be better to pre-download maps and routes on a Wifi connection for instance.
Dictionary - Offline dictionary: Currently, an internet connection is needed to use the app.
Evince - Automatically switch to night mode: Evince allows to manually invert the background color at night. This should be done automatically depending on the system dark mode.
Maps - Double-tap to zoom: On desktop double-clicking zooms, as should do double-tapping on touchscreen.
Squeekboard - Bépo support: This one does only concerns a few nerds, but bépo (a French dvorak layout) support would be awesome.
Geary - Image banner is not adaptive: The image display banner does not display well on mobile.
Web - Password banner is not adaptive: The password banner does not display well on mobile.
Backups - Adaptive UI: The home screen does not display well on mobile.
Librem5 - Mobile data traffic counter: This would be a useful utility when data is limited.
Furtherance - Home screen is not adaptive enough: The French translation of the application provokes UX adaptivity issues.
Notes - Adaptive UI: Notes is not yet adaptive.
Settings - Bluetooth screen is not adaptive enough: As usual, some French content makes the panel too large.

Last FOSS contributions from the Yaal Coop team (winter 2022)

2022-05-12T00:00:00+02:00

Those last months we mainly worked on canaille, our identity server, as well as the autocompletion menu simple-svelte-autocomplete and nextcloud-oidc-login that allows nextcloud to connect to identity servers.