Universal Blue•9mo ago

We gotta do other things in here

CCappy Ishihara oem images being switched to taidan in my pr only

madomado•4/4/25, 2:35 PM

I see

Noel•4/4/25, 2:35 PM

Yup, move to Live ISO thread please.

Jj0rge We gotta do other things in here

tulip•4/4/25, 2:36 PM

heh the huge emoji

Cappy Ishihara•4/4/25, 2:36 PM

me when noto emoji

madomado•4/4/25, 2:36 PM

sorry for being a karen in your restaurant /hj

AfterStory•4/4/25, 3:49 PM

@j0rge I am following correctly? Current Universal Blue Initiatives Summary:

Immediate priorities center on bolstering infrastructure security through comprehensive SBOM (Software Bill of Materials) generation, image signing, and automated repository scanning. Concurrently, intensive Fedora 42 (F42) testing is underway to address stability.

Strategically, Universal Blue is being positioned as a manufacturing process rather than a monolithic product, empowering customized image creation. Reflecting this, the Bluefin image will adopt a pure image mode for F42, moving away from local package layering, and will utilize the Anaconda installer for official ISOs. Enhanced upstream collaboration with Fedora teams is formalized through regular meetings, focusing on atomic desktop advancements and tracking initiatives like the proposed F43 removal of Fedora Flatpaks.

Key technical developments involve evaluating uupd as a potential default update mechanism, standardizing on Titanoboa for liveCD builds, and prototyping Dragonfly for peer-to-peer (p2p) LAN updates. Ensuring rebase helper integrity between CentOS and Fedora streams is also crucial. Access to dedicated ARM hardware aims to accelerate GDX development.

Overall efforts focus on refining tooling, improving security posture, ensuring a stable F42 release, and strengthening upstream alignment.

j0rgeOP•4/4/25, 3:50 PM

what llm did you use lol

AfterStory•4/4/25, 3:50 PM

testing the new gemini

AfterStory•4/4/25, 3:51 PM

but damm that is a lot of things you guys are planning to do

j0rgeOP•4/4/25, 3:51 PM

dragonfly isn't f42 material

j0rgeOP•4/4/25, 3:52 PM

mostly we just gotta clamper down and fix bugs

j0rgeOP•4/4/25, 3:53 PM

if there's some f42 test week or something we could remind people to use the beta channel, etc.

AfterStory•4/4/25, 3:55 PM

Ttulip ``` pkexec bootc install to-disk \ --wipe \ --so...

Gerblesh•4/4/25, 6:15 PM

is there any way to "customize" the partition layout or FS or is it all automatic?

GGerblesh is there any way to "customize" the partition layout or FS or is it all automati...

Zeglius•4/4/25, 6:55 PM

You have to make it yourself. to-disk is not meant to be a fully fleshed installer

ZZeglius You have to make it yourself. to-disk is not meant to be a fully fleshed install...

Gerblesh•4/4/25, 6:56 PM

I see, so the partitioning is done before hand?

Zeglius•4/4/25, 6:56 PM

Yep

Gerblesh•4/4/25, 6:56 PM

nice

Gerblesh•4/4/25, 6:56 PM

so readymade is perfect then

ZZeglius You have to make it yourself. to-disk is not meant to be a fully fleshed install...

M2•4/4/25, 8:38 PM

It's a demo according to the documentation. It recommends to-filesystem with a bring your own partitioning

cablespaghetti•4/4/25, 9:59 PM

A question for you knowledgable folks; I’m working on figuring out how to get a couple of proprietary system level pieces of software to work nicely on Bluefin. Currently I’m building rpms and layering them for testing with view to build a custom image. In the new bootc world this approach won’t be possible, so what is the best way of tinkering before I commit to a long GitHub actions run?

Robert•4/4/25, 10:01 PM

If the components you are adding can be validated in a terminal, you can use podman-bootc to run the image from your local containers storage
https://github.com/containers/podman-bootc

I also tend to run a local OCI registry, push a new image there and bootc switch to it in a VM.

RRobert If the components you are adding can be validated in a terminal, you can use pod...

cablespaghetti•4/4/25, 10:03 PM

Ok that’s a very cool approach. I’ll be playing with this stuff tomorrow! Thanks!

Zoid•4/4/25, 11:06 PM

@Robert how is the SBOM stuff with syft/grype going? It seems you've gone back and forth a couple times on it in the repos

Robert•4/4/25, 11:12 PM

It's working well in Bluefin LTS - we just need to switch it back on.
Generating the SBOM fails in Bluefin for some reason. I've not had a chance to investigate yet. I think M2 said we need to create a large swap file for it to succeed.
Once Bluefin is fixed, we can copy and paste the code over to main, Aurora and uCore

Zoid•4/4/25, 11:15 PM

That's interesting but exciting news! I'm looking at doing the same in my repos. I can take a look as well. You think there's any benefit in putting this in the image template as well? So everyone can get them as artifacts?

Robert•4/4/25, 11:16 PM

Once the issues are ironed out, it's definitely something we should put in the template!

M2•4/5/25, 12:09 AM

If we're going to use packages repo... we need to actually keep it up to date

Robert•4/5/25, 12:10 AM

Can we add all approvers as reviewers? I don't get notified about any of these

MM2 If we're going to use packages repo... we need to actually keep it up to date

j0rgeOP•4/5/25, 5:49 AM

yeah it's our biggest pain point right now, agreed.

j0rgeOP•4/5/25, 5:49 AM

the devpod flatpak is almost done

j0rgeOP•4/5/25, 11:50 AM

@Robert this sbom run on lts took like 3 minutes?

j0rgeOP•4/5/25, 11:50 AM

that was way slower before

Robert•4/5/25, 11:57 AM

GDX took 7 minutes... Think this was the main one causing problems

j0rgeOP•4/5/25, 11:58 AM

ah right!

j0rgeOP•4/5/25, 11:58 AM

well, other than that this is smoooooooth.

Robert•4/5/25, 11:58 AM

But if by "before", you're referring to 6 months ago, when we first tried SBOMs, then yes! It was 30ish minutes

j0rgeOP•4/5/25, 11:58 AM

heheh

j0rgeOP•4/5/25, 11:58 AM

I think once we have a semi permanent ampere box to ssh to that we should be fine

M2•4/5/25, 12:56 PM

Right now attestation is the next challenge. I'm wondering if there is a limit to the sbom size for attaching?

M2•4/5/25, 12:57 PM

My smaller images are working fine. But the larger ones the push to the registry is failing

j0rgeOP•4/5/25, 1:36 PM

Can we start an sbom/attestatoin thread? I got a few nibble at kubecon for people looking to help

Robert•4/5/25, 1:37 PM

💾ublue-devSBOMs

j0rgeOP•4/5/25, 1:54 PM

ok so instead of using the github board when I get back I'm going to just write the update in hackmd and we'll put all of those items in there so we can double up

j0rgeOP•4/5/25, 1:54 PM

then that will be our transparecy report for the cycle

j0rgeOP•4/5/25, 3:23 PM

https://github.com/ublue-os/bluefin/pull/2294/files

j0rgeOP•4/5/25, 3:23 PM

can I get a review?

j0rgeOP•4/5/25, 3:24 PM

https://github.com/ublue-os/packages/pull/314 lol go home github, you're drunk

Jj0rge <https://github.com/ublue-os/packages/pull/314> lol go home github, you're drunk

tulip•4/5/25, 3:25 PM

its that damn safe-to-run tag

tulip•4/5/25, 3:25 PM

lets just remove that