=== bigcat_ is now known as bigcat === chihchun_afk is now known as chihchun [06:56] good morning [07:17] good morning === kickinz1 is now known as kickinz1|lunch [10:26] "However, you can still switch channels at a later point using command line tools." from https://developer.ubuntu.com/en/snappy/guides/channels/ - how does that happen and shouldn't that page tell it? [10:29] Mikaela, i'm not sure that is still true ... usually the channel is defined in /etc/system-image/client.ini (or some such, writing from the top of my head) [10:30] having it only choosable during installation or image creation sounds a little difficult to me [10:31] it will definitely become easier to switch once we moved away from system-image ... [10:31] I see [10:31] ubuntu-core will just become a normal snap package [10:32] currently we use a mix of the phone technology and snaps ... once we fully moved to snaps a switch is easier ... [10:33] on the phone you would run: system-image-cli --switch=your/target/channel ... i'm not sure this works on snappy [10:37] dholbach, do you knwo where that line comes from ? i guess we should either provide the command how to switch channels or we should remove the line til we can [10:46] ogra_, no idea [10:56] ok, on the RPi2 i have a hack that works apparently :) [10:56] sudo system-image-cli --switch=ubuntu-core/rolling/edge [10:56] sudo fw_setenv snappy_ab b [10:57] sudo reboot ... [10:57] that gets me into a rolling edge wily install [10:57] not sure how to manipulate the bootloader settings for grub to do the same on x86 though [11:03] do I understand correctly that rolling/ don't exist yet? I find only edge at http://cloud-images.ubuntu.com/snappy/rolling/core/ [11:07] rolling/alpha exists but has no images [11:07] http://system-image.ubuntu.com/ubuntu-core/rolling/ [11:07] ok [11:14] http://cloud-images.ubuntu.com/snappy/rolling/core/edge/current/core-edge-amd64-vagrant.box doeesn't seem to be working at the moment or at least I don't get terminal with vagrant, it gives warnings about connection timeouting after telling ssh address, username and password [11:15] utlemming, ^^^ any idea ? [11:17] https://paste.mikaela.info/view/d9157ee2 the warning repeats every few seconds [11:19] ogra_: Mikaela on ubuntu core it would eventually be 'snappy set [snap] channel=blah' [11:19] or something like that [11:20] ok [11:20] sergiusens, right, until then we should either provide a hack in the doc or remove that sentence though [11:21] interesting, after i force-switched my RPi to rolling/edge running snappy rollback hangs [11:21] ogra_: in theory, rolling/edge is not a channel [11:21] ogra_: the channel is edge [11:22] ogra_: and the release is rolling or 15.04 [11:22] ogra_: and switching between releases is not supported anymore [11:22] we have diverged [11:22] yeah, seems like ... [11:22] top shows a hanging cp process [11:23] serthe above seems to work fine though [11:23] sudo system-image-cli --switch=ubuntu-core/rolling/edge; sudo fw_setenv snappy_ab b; reboot [11:24] and i bet i can update it tomorrow too [11:24] just rollback seems to hang ... i dont get what it copies around there though [11:27] OH !!! [11:27] it actually worked, it just took ages [11:27] * ogra_ tries to reboot === kickinz1|lunch is now known as kickinz1 [11:46] hi, trying to figure out why a service is not automatically starting when I install a snap package, when running systemctl start myservice I see: Failed to start myservice.service: The name org.freedesktop.PolicyKit1 was not provided by any .service files [11:46] any ideas where to look for the root cause? [11:47] well, does your package ship policykit and run it ? [11:48] there is definitely no such thing in the rootfs [11:48] ogra_, hi I didn't add it explicitely no, but I didn't think it'd need it [11:48] the binary itself runs fine, it's only when starting the systemd service that's provided by snappy that it fails [11:50] grepping for PolicyKit brings no hits anywhere [11:51] well, something tries to use a dbus service it seems ... policykit usually manages permissions for that [11:53] ogra_, nothing in the binary uses dbus [11:53] but the binary tries to access a device [11:53] no, but the systemd service most likely [11:53] ah [11:53] /dev/lp0 [11:53] actually, /dev/usb/lp0 [11:53] did you enable that with hw-assign ? [11:53] but I shipped an apparmor policy with it, granting access to that file [11:54] mhh, no, but shouldn't the policy file be enough for that? [11:54] i dont think so [11:54] https://developer.ubuntu.com/en/snappy/guides/appliance-builder-guide-webcam/ [11:54] see that guide [11:55] ack, thx [12:56] jdstrand: hey [12:56] jdstrand: I'm wondering if something I have works okay by accident [12:56] jdstrand: or by desing [12:56] jdstrand: have a look at this strace please: [12:56] jdstrand: http://paste.ubuntu.com/12061478/ [12:56] jdstrand: there's a netlink socket and a ioctl that are allowed in the default security template [12:56] jdstrand: is that by desing? [12:56] design [13:09] If I understood askubuntu correctly, snappy has only one reporitory and you cannot add more. Will you be able to do that in the future? Thinking it more I also started wondering about mirrors, will everything always be downloaded from one server or will there be mirrors in every country like currently? Will snappy also have something to always decided the nearest mirror such as [13:09] http://mirrors.ubuntu.com/mirrors.txt or http://httpredir.debian.org/ [13:10] sergiusens, mterry: do you have links to the slides of your snappy talks? [13:11] dholbach, https://docs.google.com/presentation/d/1qT2lrZkb7KA_CLyEGsKdE8U6AeGuhe_meakAeDHL2tQ/edit [13:12] Mikaela, as i understand it you will be able to have sub-stores in the main store, not sure what exactly the story is for local stores currently ... the prob here is that you cant really guarantee integrity if you allow decentralized stores ... the whole model revolves around the ability to do all security checks in a centra place [13:12] *central [13:13] what you can definitely do is have a central server that uses snappy-remote to push packages to all your systems in a LAN via scripts [13:13] and sub-stores are mirrors or PPAs? [13:14] snaps are PPAs ;) [13:14] (kind of) [13:15] i would see sub-stores more like topic based things for a certain product ... i.e. i sell a home wlan router with a snappy base and that router only sees my sub-store so i cant offer very specific apps that are tailored for my device [13:15] it doesn't sound like a good idea that you are only locked to Ubuntu's repositories to me, it reminds me a little of OS X and Windows. Will you still be able to install packages outside of repositories? And compiling is probably always surely possible? [13:16] yes to both of the latter :) [13:16] ok [13:16] as i said, you can already set up a push server that installs your local snaps to all your machines [13:16] just by using snappy-remote and havin the ssh keys on that machine [13:16] but I didn't get clear answer to the mirrors, do they still exist or is everything installed from (potentially) other side of the world? [13:17] no, i dont think there are store mirros pülanned [13:17] and mirrors.ubuntu.com and httpredir.debian.org what happens if I go abroad, will nearest mirror be automatically given to me? [13:17] beuno, might be able to elaborate [13:18] but my understanding is that there wont be any mirrors [13:19] note that the deb based ubuntu will never go away, the old infrastructure stays as is [13:20] is there some other solution like p2p which was also introduced in Windows 10 from what I understood or how is the downloading handled? Some countries still have slow connectivity abroad and connection to another continent isn't like on the same continent. [13:20] From what I understood there will be two editions at first, the deb-based and snappy, but later users are possibly tried to be migrated to snappy? [13:22] i doubt the deb based install goes away ... snappy is built from debs ... enterprise customers have installs that use debs etc etc [13:23] thanks mterry! [13:24] so snappy is intented towards home users and debs to enterprises? [13:24] and there are the flavour distros (kubunt, xubuntu, edubuntu. lubuntu and whatnot) that all rely on debs ... we wont force anyone into snappy [13:24] Mikaela, hi [13:24] hi [13:24] Mikaela, no, i wouldnt say that :) [13:25] we will, over time, add a CDN to distribute in many regions [13:25] enterprises will likely see the massive security advantage and maintainability of snappy ... [13:25] but we wont force them into it [13:25] oh, I see [13:28] more on those repositories, I can think of Virtualbox and WeeChat having their own repositories. How would those repositories work with snappy? Do they submit all new releases to the store and they appear to users some time (days?) after that? And when new software versions are released, will snappy get updates faster than the deb-based, I can think of ZNC which is very slow to be updated on Ubuntu [13:28] repositories? [13:28] days ? [13:28] minutes rather ;) [13:29] I am too used to the deb-system being a little slow, so I thought days might be more reasonable time than minutes, but sounds good :) [13:29] the nature of snaps is that their security policy makes store submissions and checks completely automatable [13:29] my snaps are usually available 10-20 mins after upload ... (same goes for my click packages on phones) [13:30] if you break the security and still insist your snap needs to go in, that might take time though [13:30] manual reviews and all [13:31] we are trying to design snappy in a way that all the issues we have seen with debs obver the last decare when having to deal with them get solved by design ;) [13:31] after all dpkg is 30 years old and shows its age :) [13:31] *decade [13:32] will there still be packages packaged by Ubuntu Packagers and will they be made from the debs causing them to be as slow to update as currently? [13:33] Mikaela, snappy doesn't ship with dpkg or apt [13:33] well, our rootfs is assembled from debs from the archive ... so that bit will stay [13:34] and it is up to the packager if he does want to use debs as input for his snap [13:34] So snaps can be made separately and that is possibly even encouraged? [13:35] yes [13:35] you can even use plain upstream sources and compile them statically if you feel like [13:36] ok. thanks, I think all my questions are answered now :) [13:36] snappy itself only applies some metadata to binaries ... how/where you get these binaries from is totalyl up to you [13:36] this is what i meant by snaps are PPAs btw ;) [13:36] if i want to provide a special libreoffice build today, i set up a PPA and build a binary with my patches [13:37] oh, so if I install package outside of store it has information where to update itself when update is available? [13:37] in the snappy world i put all my binaries into one snap and push it to the store as libreoffice.ogra [13:37] so you as user can chose to install libreoffice.canonical or you can try my package just by installing libreoffice.ogra instead [13:38] no mangling of sources.list, gpg key shuffling etc ... my hacked package will just be available like any other to you [13:39] if you install a package via snappy install on cmdline or via snappy-remote there is no upgrade path if the package isnt in the store [13:40] I see. So everyone can get their app to store easily? [13:40] yes [13:40] its five clicks in a webform :) [13:41] sounds a lot more simple than how I imagine the deb-repos and PPAs [13:42] for the enduser it definitely is ... for the developer the build process is not as easy currently ... at least if your brain is still thinking deb-src :) [13:43] for the latter part we are working on tools to make your life super easy (there is just a sprint where people are designing the further development of the snapcraft tool that will enable you to easily turn anything into a snap [13:43] oh, deb-src gives me another question, how will changelogs and getting build-depedencies work? [13:44] this is totally up to you as developer [13:45] zyga: apparmor doesn't currently mediate ioctls. seccomp mediates the call but we have to allow it for shell scripts. however, you still need the capability and access to the device before you can use an ioctl [13:45] nor sure about changelog support in the store, you ave a field to provide one but i'm not sure how it will be presented in i.e. webdm to the user [13:45] I mean from the user point of view. Currently there are "apt-get build-dep" and "apt-get changelog" which require deb-src lines in sources.list. Is that information stored as metadata directly [13:46] well, as a user you only see/get binaries [13:46] zyga: we only have coarse-grained mediation for netlink, and you get that (cause you need it) when you specify a network-* cap [13:46] the develoer can and should provide a support contact and can also point to a website ... that should then have build instructions and/or links to source etc [13:47] jdstrand: thanks! [13:47] I see [13:47] zyga: same thing applies though wrt capabilities. Ie, there are some netlink sockets that might require cap_net_admin [13:47] in the snappy works we rather provide the infrastructure ... the actual snaps are up to the developer [13:48] effectively as a developer i can have all my stuff on github and just point the urls in my snap there ... [13:48] uploads to the store are completely binary [13:49] that makes me think of yet another thing, bug reporting, does it move to whereever the developer pointed or is apport/ubuntu-bug still there reporting to launchpad? [13:50] also up to the developer ... i'm not sure what our plans wrt apport are and if/how much we want ti to work with snaps [13:51] after all the source can live anywhere ... while in the deb based distro it has to live in some archive we control [13:51] ok, thanks for all the explanation, now I think I undertand everything I was wondering [13:52] well, thaks for asking ... it is kind of hard trying to assemble a FAQ if nobody asks questions ;) [13:52] so just go on :) [13:52] :) [14:01] ogra_: Question - is there some open source server implementation for the snappy store api or do i have to write this from scratch if i wanted my snappy installation load snaps from another place? [14:01] right now the URL to the store is hardcoded, so i think this has not been aked much yet :) [14:01] you'd have to write it from scratch i think [14:02] ok - should not be complicated - i just asked your sales guys what the plan is on that matter [14:03] ah, what did they tell you ? [14:03] ogra_: just wrote the mail - so no answer yet :) [14:03] * ogra_ guesses "sub-store" :) [14:04] dholbach: yeah, I tweeted them :-P [14:04] right [14:04] yes i guess that will be the answer - though for security devices it might not be good enough to get security updates from a entity governed by UK law [14:05] thanks, found [14:05] sergiusens, do you have some notes for them as well? :) [14:05] longsleep, werll, there beuno's mentioned CDN might come into play [14:06] not sure if he has taken local laws into account with the planning though :) [14:07] ogra_: well - the problem is that in certain countries companies or even people can be forced to insert backdoors into their code / distributions - even wore they are forced by law to not tell about it [14:08] yeah, i get you [14:08] just wondering if we take that into account with our store plans [14:08] we likely won't be able to help those countries [14:08] inserting backdoors into the distribution [14:08] just like we don't today [14:09] well i am not sure about UK laws - but i think they could force you (Canonical) already [14:09] beuno, well, but if you have local laws that require encryption bits to come from local servers .... [14:09] i think thats a valid concern [14:10] well - i think people might want to have self controlled sources only for updates [14:10] i think that should be possible with snappy as well eventually [14:10] dholbach: https://twitter.com/sergiusens/status/630061431317229568 [14:10] dholbach: https://twitter.com/sergiusens/status/630061036910084096 [14:10] yep, found the slides [14:10] ogra_, sure, and we'll serve content locally as time goes by [14:10] thanks [14:11] dholbach: notes are in the notes section of the slides, but they are more of a memory catalyst than anything else (as in unintelligible to anyone but me) [14:11] beuno, right, i think thats the answer longsleep needed ;) [14:11] ok ok :) [14:12] ogra_, beuno well not really, if it is the same content then this does not help. Say the master for content is compromised, then all the children are as well when they are synced up no matter where the actuall download comes from. [14:12] longsleep, yes. Just like Ubuntu works today [14:13] (and every other distro) [14:13] beuno: no, with Ubuntu i have the choice to fetch and review all the stuff and have my machines only install and fetch stuff i previously reviewed. [14:15] beuno: with the store i get some binary blob. There is no way to verify that it has not been modified or was not modified after it was uploaded to the store as the store is essentially under control by Canonical. [14:16] It is fine to have it that way for most, but what i am saying is that there are users who want this level of control for themselves [14:17] longsleep, you can know it hasn't been modified after upload, as it's signed with the Canonical key [14:17] longsleep, so why dont you host your stuff on a secure server and have code inside your snap to pull the secrets from there then [14:18] today, you download binaries as well [14:18] dholbach: we need youtube to auto translate my talk :-P [14:18] that woulld definitely give you full control [14:18] * sergiusens wll be back in a bit [14:18] so unless you re-compile everything, you're on the same boat [14:18] beuno: Canonical can modify at any time and sign it again [14:19] longsleep, sure [14:19] beuno: yes today we do not recompile everything, but some things + platches [14:19] patches === zyga is now known as zyga-afk [14:20] right [14:21] so snappy doesn't allow you to do that [14:21] OS updates need to be applied, unchanged [14:21] and when I say snappy, I mean using the distribution as-is [14:21] ogra_: there is also the concern about privacy and tracking - there probably is some sort tracking in the store not everyone might be happy with either [14:21] if you would like to take it, and manage it yourself [14:21] compile it, etc [14:22] beuno: yes what what i am resarching - if and why and under what circumstances i need a system image server or eventually build own -core snap. [14:23] beuno: And then as a consequence also have own server providing the snap downloads. [14:23] system-image will go away [14:23] dont rely on it [14:23] the rootfs will be turned to snap eventually [14:24] ogra_: yes - i have a couple of weeks more on this matter - right now system image and rootfs is the same for me [14:25] ogra_: i wanted to ask you on this matter how u-d-f builds an image then there is no system image any more. I guess it will connect to the store somehow and download one snap and the device snap? [14:26] or gadged snap for that matter [14:26] ogra_, beuno: Another matter is the naming, is something which goes that far to provide own rootfs and snap server still Ubuntu Snappy or something else? [14:27] longsleep, thats a question for sergiuens [14:27] (who just left :P ) [14:27] hehe [14:27] just giving you guys the idea what our enterprise customers ask me about [14:28] well, i dont think we want to allow self built rootfses [14:28] it goes even so far having no connection to the public internet [14:28] if there is something missing in customization options that should be fixed, but nobody should need to use a modified rootfs imho [14:29] ogra_: maybe not modified, but self compiled for sure [14:29] longsleep, it can't be called Ubuntu, no [14:29] longsleep, for enterprises, we will offer landscape [14:29] as a way to manage updates to devices [14:29] self-hosted landscape, that is [14:29] but that doesn't let you override updates [14:30] just control what gets updated and when [14:30] beuno: understood thanks [14:30] there are no plans to allow people to change the rootfs in any way [14:30] as that breaks confinement [14:30] longsleep, self compiled will surely work via ubuntu-device-flash ... but most likely only if you use --devloper-mode and such [14:31] so not really suitable for products [14:31] (but suitable for hacking) [14:31] ogra_: well one can also recompile ubuntu-device-flash, have their own keying and grab the stuff from own servers [14:32] indeed [14:32] but then you would have an insecure server [14:32] how would you ever make sure the same tests run ? [14:33] or guarantee the same quality in any way [14:33] i mean i am talking about specific use cases here - where Ubuntu snappy is used as open source software similar to what we do with normal ubuntu now. Modify it in any means thinkable and then provide services around it. [14:33] ogra_: true, that will be all different for sure. But it does not mean that it is worse. It just gives control. [14:33] including the power to fuck it up for sure [14:36] So essentially i might eventually need the transactional Ubuntu provided by snappy with the same level of freedom to create my own variant on top of it. [14:37] you can do that today (the on top of it part) [14:37] not when i want updates without public internet access or no third party connections [14:39] at the moment that requires patching rootfs config, patching snappy tool and patching u-d-f. [14:39] i suspect it will in the future as well [14:40] ogra_: yeah i am just starting on this - but i need to have the answers if we can use snappy or at least parts of it for our more secured environments as well [14:42] so at the moment for that i have to run my own system-image server and snap server, create own rootfs with patched tools and config and have patched u-d-f for image building. [14:42] well, i guess having a local upgrade from usb key (or SD card) upgrade abiliy mmight be a good thing for that usecase [14:43] ogra_: not if you have many devices [14:43] so you could give your customers an image they can just auto-flash by booting from it [14:43] or netbooting from it ;) [14:43] with a special boot mode [14:43] ogra_: well, netbooting would do it - but not all updates should force a reboot either [14:44] ogra_: right now customers have their own deb mirror for their specific variant on top of ubuntu [14:44] well, for that you can still have some push server scripted around snappy-remote [14:44] ogra_: mhm for that one central server needs to know all the servers and must have ssh access to them [14:45] yes, indeed [14:45] ogra_: very different from https access to a single ip from many locations [14:47] ogra_: so eventually we will have something - i would prefer to have a little changes to Snappy as possible for such use cases. I will keep you posted once ideas come up. [14:48] yeah, and dont forget, i'm only speculating as much as you ... the only one who can give authoritative answers about actual store implementation is beuno [14:49] sure - still it helps a lot to get some feedback from someone who is closer to source [14:50] eventually i might add some feature requests to the bug tracker if i am more clear on what we want to do how and then [14:50] +1 [14:52] Other question, snappy yaml port negotiable option, is that implemented and how do i get the port it might have chosen instead? [14:52] docs say (there is no implementation for this yet) [14:53] longsleep, it hasn't been implemented yet [14:53] still true i assume? [14:53] and i think the docs are right [14:53] yeah, i guess [14:53] ok thanks - so are there ideas how it will be implemented? [14:54] i want to add configuration to the spreed-webrtc snap and ports are one thing i want to have there [14:59] yeah [15:09] fgimenez: I can't ssh into 10.55.33.0 [15:09] elopio, maybe it's down, let me check [15:37] fgimenez: I just need the credentials. Maybe you can send them to me by mail, encrypted with my gpg key :) [15:38] elopio, http://10.55.60.183:8080/ seems to be working, https://code.launchpad.net/~fgimenez/snappy-tests-job/test1/+merge/267831 [15:38] elopio, i've just added your ssh keys there [15:39] fgimenez: cool, thanks. [15:39] fgimenez: it expanded the URL, wtf [15:39] elopio, you can try with MPs to snappy-jenkins-job [15:40] snappy-tests-job, sorry [15:40] elopio, all the config seems to be the same [15:41] fgimenez: I wasted my day and was so happy to have found a solution in the end. I hate computers. [15:42] elopio, let's see what's the difference, the user name and password for jenkins are the same as for the shared canonistack user === chihchun is now known as chihchun_afk [16:08] elopio, here are the first changes for the test output https://code.launchpad.net/~fgimenez/snappy/parseable-test-output/+merge/267838, let me know what do you think [17:47] hello there. Just checking to confirm, is WebDM written in "go programming language"? [17:48] seshu, it is, yes [17:49] Thanks! beuno. === c74d is now known as Guest91301 [19:52] * Chipaca peeks in [19:53] ogra_: you probably know these things: how's a "wan ethernet" different from a "lan ethernet"? is it just different broadcast domains? asking for http://igg.me/at/2ffEJUPWerU/x/4032581 [20:33] Chipaca, I'm betting they're configured differently on the routing chip. So the LAN ports are all automatically switched without hitting the CPU. [21:13] Chipaca, the same thing as your "uplink" port on a switch ... it can probably speak MPLS (https://en.wikipedia.org/wiki/Multiprotocol_Label_Switching) and other shiny stuff [21:14] shiny! [21:17] technically ethernet is ethernet though ... and normal lan ports can usually run MPLS as well ... i would expect there is some kind of optimization or so === lazyPower is now known as lp|conference-mo === lp|conference-mo is now known as lp|conference [22:01] ogra_, you still around? [22:04] elopio, how about you? === robert_ancell_ is now known as robert_ancell [22:13] ted, you still around? [22:52] kyrofa: hello