If the components you are adding can be validated in a terminal, you can use podman-bootc to run the

If the components you are adding can be validated in a terminal, you can use podman-bootc to run the image from your local containers storage
https://github.com/containers/podman-bootc

I also tend to run a local OCI registry, push a new image there and bootc switch to it in a VM.

RRobert If the components you are adding can be validated in a terminal, you can use pod...

cablespaghetti•4/4/25, 10:03 PM

Ok that’s a very cool approach. I’ll be playing with this stuff tomorrow! Thanks!

Zoid•4/4/25, 11:06 PM

@Robert how is the SBOM stuff with syft/grype going? It seems you've gone back and forth a couple times on it in the repos

RobertOP•4/4/25, 11:12 PM

It's working well in Bluefin LTS - we just need to switch it back on.
Generating the SBOM fails in Bluefin for some reason. I've not had a chance to investigate yet. I think M2 said we need to create a large swap file for it to succeed.
Once Bluefin is fixed, we can copy and paste the code over to main, Aurora and uCore

Zoid•4/4/25, 11:15 PM

That's interesting but exciting news! I'm looking at doing the same in my repos. I can take a look as well. You think there's any benefit in putting this in the image template as well? So everyone can get them as artifacts?

RobertOP•4/4/25, 11:16 PM

Once the issues are ironed out, it's definitely something we should put in the template!

M2•4/5/25, 12:09 AM

If we're going to use packages repo... we need to actually keep it up to date

RobertOP•4/5/25, 12:10 AM

Can we add all approvers as reviewers? I don't get notified about any of these

MM2 If we're going to use packages repo... we need to actually keep it up to date

j0rge•4/5/25, 5:49 AM

yeah it's our biggest pain point right now, agreed.

j0rge•4/5/25, 5:49 AM

the devpod flatpak is almost done

j0rge•4/5/25, 11:50 AM

@Robert this sbom run on lts took like 3 minutes?

j0rge•4/5/25, 11:50 AM

that was way slower before

RobertOP•4/5/25, 11:57 AM

GDX took 7 minutes... Think this was the main one causing problems

j0rge•4/5/25, 11:58 AM

ah right!

j0rge•4/5/25, 11:58 AM

well, other than that this is smoooooooth.

RobertOP•4/5/25, 11:58 AM

But if by "before", you're referring to 6 months ago, when we first tried SBOMs, then yes! It was 30ish minutes

j0rge•4/5/25, 11:58 AM

heheh

j0rge•4/5/25, 11:58 AM

I think once we have a semi permanent ampere box to ssh to that we should be fine

M2•4/5/25, 12:56 PM

Right now attestation is the next challenge. I'm wondering if there is a limit to the sbom size for attaching?

M2•4/5/25, 12:57 PM

My smaller images are working fine. But the larger ones the push to the registry is failing

j0rge•4/5/25, 1:36 PM

Can we start an sbom/attestatoin thread? I got a few nibble at kubecon for people looking to help

RobertOP•4/5/25, 1:37 PM

💾ublue-devSBOMs

j0rge•4/5/25, 1:54 PM

ok so instead of using the github board when I get back I'm going to just write the update in hackmd and we'll put all of those items in there so we can double up

j0rge•4/5/25, 1:54 PM

then that will be our transparecy report for the cycle

j0rge•4/5/25, 3:23 PM

https://github.com/ublue-os/bluefin/pull/2294/files

j0rge•4/5/25, 3:23 PM

can I get a review?

j0rge•4/5/25, 3:24 PM

https://github.com/ublue-os/packages/pull/314 lol go home github, you're drunk