<-- must have these improvements lol

Jj0rge <-- must have these improvements lol

B

bsherman•7/23/23, 4:57 PM

i just realized i probably should have incremented the version and done a changelog entry for the containers policy thing, but oh well

E

EyeCantCU•7/23/23, 6:47 PM

The horror of a spec file not having a changelog! What will we ever do

G

Gerblesh•7/23/23, 7:14 PM

@j0rge sorry, you merged a broken PR, I fixed it in my new one. Should've made it a draft, that was my bad

G

Gerblesh•7/23/23, 7:15 PM

basically it fixes jq not having inplace editing, variable substitution, and renames cosign,yaml and cosign.pub to match the repo name

G

Gerblesh•7/23/23, 7:16 PM

{
  "default": [
    {
      "type": "reject"
    }
  ],
  "transports": {
    "docker": {
      "registry.access.redhat.com": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "registry.redhat.io": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "ghcr.io/ublue-os": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ],
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ],
      "ghcr.io/gerblesh": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/usway.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ]
    },
    "docker-daemon": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "atomic": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "containers-storage": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "dir": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "oci": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "tarball": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    }
  }
}

{
  "default": [
    {
      "type": "reject"
    }
  ],
  "transports": {
    "docker": {
      "registry.access.redhat.com": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "registry.redhat.io": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "ghcr.io/ublue-os": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ],
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ],
      "ghcr.io/gerblesh": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/usway.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ]
    },
    "docker-daemon": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "atomic": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "containers-storage": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "dir": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "oci": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "tarball": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    }
  }
}

{
  "default": [
    {
      "type": "reject"
    }
  ],
  "transports": {
    "docker": {
      "registry.access.redhat.com": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "registry.redhat.io": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "ghcr.io/ublue-os": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ],
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ],
      "ghcr.io/gerblesh": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/usway.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ]
    },
    "docker-daemon": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "atomic": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "containers-storage": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "dir": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "oci": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "tarball": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    }
  }
}

{
  "default": [
    {
      "type": "reject"
    }
  ],
  "transports": {
    "docker": {
      "registry.access.redhat.com": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "registry.redhat.io": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
        }
      ],
      "ghcr.io/ublue-os": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ],
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ],
      "ghcr.io/gerblesh": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/usr/etc/pki/containers/usway.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ]
    },
    "docker-daemon": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "atomic": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "containers-storage": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "dir": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "oci": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    },
    "tarball": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    }
  }
}

GGerblesh ``` { "default": [ { "type": "reject" } ], "transports": { ...

G

Gerblesh•7/23/23, 7:16 PM

idk if this is right, is it fine that the custom repo comes after the blank string?

G

Gerblesh•7/23/23, 7:17 PM

anyhow I gotta get going, sorry for making a broken PR and not marking it as draft

J

j0rgeOP•7/23/23, 8:26 PM

ok I reverted, there's a conflict you need to resolve

GGerblesh anyhow I gotta get going, sorry for making a broken PR and not marking it as dra...

J

j0rgeOP•7/23/23, 8:48 PM

no need to apologize, that's what git is for. walters just responded to my email, he's hoping to document the situation better this week, they were dealing with a higher priority issue last week.

GGerblesh idk if this is right, is it fine that the custom repo comes after the blank stri...

G

Gerblesh•7/24/23, 2:48 AM

does anyone know if the order matters?

J

j0rgeOP•7/24/23, 2:53 AM

@bsherman @KyleGospo hey rando idea

J

j0rgeOP•7/24/23, 2:54 AM

conceptually, since we're building akmods in that repo, couldn't we build nvidia there and then have the nvidia images build out of main?

R

Robert•7/24/23, 5:40 AM

That's what I've been doing for a while now, and it works great.

The only thing I am wanting to do is split the builds to be grouped by Fedora version. E.g. make sure 38-Nvidia does not depend on 37 builds

Jj0rge conceptually, since we're building akmods in that repo, couldn't we build nvidia...

K

Kyle Gospo•7/24/23, 6:12 AM

I'm not super familiar with how nvidia is built, but certainly we could host the kmod portion there

K

Kyle Gospo•7/24/23, 6:31 AM

@bsherman build errors on akmods are from Kernel 6.4, Gasket driver needed an update

K

Kyle Gospo•7/24/23, 6:31 AM

that's building now

G

Gerblesh•7/24/23, 6:38 AM

https://github.com/ublue-os/startingpoint/pull/121
@j0rge the PR is up and i've resolved the conflicts

also what do you think of naming the repo file and public key the name of the repo?
Would that be the best choice or is there something else you have in mind?

GitHub

refactor: fix jq, rename cosign.yaml and cosign.pub by gerblesh · P...

Sorry, forgot to make the last PR a draft, jq wasn't working as intended as well as a couple other things, this should fix it all

J

j0rgeOP•7/24/23, 12:58 PM

yeah that seems to make sense

E

EyeCantCU•7/24/23, 1:39 PM

I was thinking... With the faster build times we can probably fine tune when builds are triggered to get releases out more synchronously

E

EyeCantCU•7/24/23, 1:42 PM

For instance, even though the build time for main is 10 minutes, we wait a while hour it looks like for Nvidia

J

j0rgeOP•7/24/23, 1:42 PM

what I'd like is to trigger builds via rss or a webhook mechanism or something

J

j0rgeOP•7/24/23, 1:43 PM

like when you push something into config it should trigger the rest of the stack

E

EyeCantCU•7/24/23, 1:43 PM

That would be awesome. Then we wouldn't really have to worry about scheduled build times. Expensive but awesome

EEyeCantCU That would be awesome. Then we wouldn't really have to worry about scheduled bui...

B

Bigpod•7/24/23, 1:43 PM

not that expensive, done it in past

E

EyeCantCU•7/24/23, 1:44 PM

That's good to hear

B

Bigpod•7/24/23, 1:44 PM

webhooks should require 0 infrastructure if i remember correctly

J

j0rgeOP•7/24/23, 1:45 PM

yeah but like we'd probably keep the paid builders for the cron jobs

B

Bigpod•7/24/23, 1:45 PM

you can have both for a while, to see that it works correctly(i mean using webhooks and timers)

EEyeCantCU That's good to hear

B

Bigpod•7/24/23, 1:50 PM

@j0rge crap i think they changed how they group the webhooks so you do need infrastructure. As they group workflow requested and workflow completed together.

J

j0rgeOP•7/24/23, 1:54 PM

there's a few webhook apps we could use, but haven't investigated recently

B

Bigpod•7/24/23, 1:55 PM

true

GGerblesh https://github.com/ublue-os/startingpoint/pull/121 @j0rge the PR is up and i've ...

B

bsherman•7/24/23, 2:27 PM

I like how you did that jq scripting to add a section to the policy.json

J

j0rgeOP•7/24/23, 4:36 PM

lol, of course it's not going to be easy

J

j0rgeOP•7/24/23, 4:36 PM

J

j0rgeOP•7/24/23, 4:43 PM

I don't have time to do this until after work but if someone has any ideas: https://github.com/ublue-os/bluefin/actions/runs/5647367267/job/15297332335?pr=342

GitHub

fix(framework): pin to kernel 6.3.11-200 · ublue-os/bluefin@efd5d04

An interpretation of the Ubuntu spirit built on Fedora technology - fix(framework): pin to kernel 6.3.11-200 · ublue-os/bluefin@efd5d04

K

Kyle Gospo•7/24/23, 4:45 PM

Why the old kernel version on framework?

KKyle Gospo Why the old kernel version on framework?

B

bsherman•7/24/23, 4:48 PM

context https://discord.com/channels/1072614816579063828/1074422586894712912/1133067312069623900

J

j0rgeOP•7/24/23, 4:54 PM

this new kernel isn't running awesome on my desktop either

B

bsherman•7/24/23, 4:55 PM

ruh roh

G

Gerblesh•7/24/23, 4:56 PM

uh oh

K

Kyle Gospo•7/24/23, 4:57 PM

may need to rpm-ostree override remove *every kernel package* --install *every lower-version kernel package*

K

Kyle Gospo•7/24/23, 4:57 PM

to get this to work

J

j0rgeOP•7/24/23, 4:59 PM

is it because the akmods stuff doesn't match?

K

Kyle Gospo•7/24/23, 4:59 PM

it's ostree being goofy, it really does not enjoy replacing core packages like this

Jj0rge this new kernel isn't running awesome on my desktop either

B

bsherman•7/24/23, 4:59 PM

what's noticably problematic there?

J

j0rgeOP•7/24/23, 5:00 PM

every few minutes or so the system bogs down, mouse stutters, I'm on an old version now

G

Gerblesh•7/24/23, 5:00 PM

it's TPM problem iirc so it might effect other systems with it enabled idk

Jj0rge every few minutes or so the system bogs down, mouse stutters, I'm on an old vers...

K

Kyle Gospo•7/24/23, 5:00 PM

sounds like the old TPM bug

G

Gerblesh•7/24/23, 5:00 PM

yeah

B

bsherman•7/24/23, 5:00 PM

oh, so if tpm is disabled it may be fine

<-- must have these improvements lol

Similar Threads

Similar Threads

Similar Threads