=== Ursinha_ is now known as Ursinha === chihchun_afk is now known as chihchun [07:14] good morning [08:34] morning [08:34] can one have apt parallel to snappy? [08:50] Good morning all; happy Wednesday, and happy Frappe Day! 😃 [08:56] good morning [09:02] Chipaca: hello, I came back on Bug #1496319 :) [09:02] bug 1496319 in Snappy "Could not create symlink to hw device with udev rules" [Undecided,New] https://launchpad.net/bugs/1496319 [09:04] Chipaca: problem was adding custom Udev string as hw-assign parameter. Is there a way to check whether Udev is tested enough for this? [09:05] Hi all, we are still trying to execute Snappy on parallella board. Based on porting guilde, we have take beagebone rootof and our own kernel. After some configuring u-boot, we have managed to load system. [09:05] But after that we failed to login by “ubuntu/ubuntu”, because of system after first boot sets /var/lib/extrausers/shadow like ubuntu:!$6$tOIJ… [09:06] After removing “!” we can successfully login into system. But mount command shows that root mounted in “rw” mode. And seems like not all mount points mounted properly. [09:10] ogra2, ogra_ : you are our last chance :) [09:15] lool: you around? [09:16] mwhudson: did you see pitti's reply on bug 1487010? [09:16] bug 1487010 in golang (Ubuntu) "please upload new package to reenable go's race detector on wily" [Undecided,In progress] https://launchpad.net/bugs/1487010 [09:16] Chipaca: yup [09:16] clobrano: i'd ask security people [09:16] lool: you've ported snappy to some odd places :) [09:16] lool: any hints for soffokl here? [09:16] Chipaca: thanks [09:17] soffokl: are you using our initrd snippets? [09:18] soffokl: http://kernel.ubuntu.com/git/rtg/snappy-tools.git/ has a tool to create the device tarball from kernel .debs [09:18] clobrano: most of 'em are at something like utc-5 though [09:19] * clobrano checking UTC-5 [09:19] Chipaca: it's not a problem, I can wait :) [09:25] soffokl, and you used ubuntu-device-flash to create this image ? [09:25] an ogra! [09:25] * Chipaca faints [09:25] well, inofficial still :) [09:25] :) [09:26] (but bored as hell) [09:26] lool, we have tried to use beagleboneblack initrd, but then our kernel failed to load. [09:26] then youur kernel is likely missing bits that snappy needs [09:27] soffokl: you need to have the right modules and options, either builtin modules or in the initrd [09:27] nah [09:27] you shouldnt need modules [09:28] ogra_: either builtin or as modules :-) [09:28] if you use the same config we use on the beagle or on the rpi images you will have everything you need to mount the readonly root and the overlays [09:28] ogra_, yes, we have created image with "sudo ubuntu-device-flash core 15.04 -o my-snappy.img --size 4 --channel edge --oem beagleblack --enable-ssh --device-part=./device.tar.xz" [09:28] i have booted both with module-less initrds [09:29] ogra_, which config you mean? [09:29] soffokl, well, you need to create your onwn oem snap ... with the right bootloader, vmlinuz and initrd [09:29] biezpal, the kernel config :) [09:30] ogra_, where can we get the "correct" kernel config? [09:32] we are using our own kernel for parallella and seems like it doesn't have required for snappy bits.. [09:32] ppisati, ^^ doo you have a link for biezpal [09:33] biezpal: kernel version? [09:33] 3.10, 3.14 or 3.18? [09:34] or perhaps 4.2 ? [09:34] :) [09:34] *drums* [09:34] 4.2 would be awesome [09:34] ppisati, 4.2.0 :D [09:35] soffokl, note that a readonly root is normal ... only a few selected bits are writable via bind mounted dirs and files, that is what the initrd is needed for [09:35] (it sets up the bind-mount-farm) [09:36] biezpal: http://kernel.ubuntu.com/git/ppisati/ubuntu-vivid.git/log/?h=snappy_packaging [09:36] biezpal: look at the UBUNT: [Config] commits [09:36] biezpal: they all touch files in [09:36] ogra_, thanks, we are keep reading about oem snap [09:37] biezpal: http://kernel.ubuntu.com/git/ppisati/ubuntu-vivid.git/tree/arch/arm/configs/snappy?h=snappy_packaging [09:37] biezpal: cherry-picks these commits [09:37] biezpal: then [09:37] biezpal: $ ARCH=arm ./scripts/kconfig/merge_config.sh arch/arm/configs/YOURCONFIG_defconfig arch/arm/configs/snappy/*.config [09:38] biezpal: and you should get a config able to boot snappy [09:38] soffokl, note that we switched to use a uboot.env file for the environment, but the old uEnv.txt and snappy-system.txt stuff should still work to get something to do a first boot (just rollback and update wont, but thhats a second step for porting) [09:40] ppisati, ok, thanks for helping.. [10:17] yesterday i tried updating one of my test boxes to stable 6, it failed with the message that ubuntu-core was sideloaded. Is that expected? [10:23] ogra_: Hey, are you using predictable network interface names with rpi2 image? If so, how did you enable it, kernel parameter only? [10:23] longsleep, i'm actually suppressing them via kernel cmdline option corrently [10:24] net.ifnames=0 [10:25] that keeps the old naming scheme [10:25] ogra_: Ah - but that is the default in ubuntu isnt it? [10:25] not sure if we use it elsewhere [10:26] ogra_: net.ifnames=1 is working to some level for me, but i was wondering if the interfaces should still be eth0 and wlan0 [10:26] well.... snappy config ubuntu-core defaults to eth0 currently [10:27] right, but aside from that, i was kind of expecting crazy interface names with that change [10:27] yeah [10:27] depends on your HW [10:28] mhm ok, USB wifi is getting wlan0 names, works fine as long as you do not replace the USB device with another one [10:29] http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/ [10:29] seems you are lucky and fall inot category 5 on that 1-5 list [10:30] mhm [10:31] this means the hardware does not provie 1, 2 or 3 or i am doing something wrong [10:31] right ... or you have a udev rule in place already [10:31] i did at least expect it to use 3 [10:32] ogra_: why do you not use it on the rpi2? just because ubuntu-core defaulting to eth0? [10:32] yeah, and i get a really weird name based on the mac address (4) [10:32] oh [10:32] yeah 4 would be bad [10:33] (which i shouldnt according to that doc) [10:33] well, maybe it is enabled in the systemd build somwhere [10:33] iirc Chipaca said all that works fine in rolling ... never tried that [10:34] i added this hack to rpi specifically for 15.04 images [10:34] mmh? [10:34] i was probably lying, whatever it was [10:34] 's a good bet [10:34] lol [10:34] anyways, i am basically fine with getting 5 - but i have some issues when an active USB wifi is removed and replaced, something is not released then and then [10:35] mhm, from my testing setting the kernel parameter to 0 is the same as the default behavior without the parameter [10:35] (stable channel though) [10:35] funny [10:36] is that on a first boot ? [10:36] yes [10:36] (wont work on subsequent ones since the udev rule exists) [10:37] when i remove the udev rule and reboot without the parameter it creates it again [10:37] same is when booting with 0 as value [10:37] when booting with 1, the udev rule is not created [10:38] yeah [10:38] but your kernel simply provides the old naming [10:40] is this about the creation of the file for the first ethernet card? [10:40] ogra_: oh, so this thing depends on the kernel as well, i thought it would be systemd only [10:40] well, that is what the wikipage says [10:41] Chipaca: it is about the interface names and the udev rule stores all ethernet devices ever connected to the host [10:41] * longsleep checks the wiki again [10:41] 5. Classic, unpredictable kernel-native ethX naming (example: eth0) [10:41] kernel-native [10:41] ah [10:42] but i had nothing to do with that :) [10:42] all i did touching that was creation of the first-boot file for the first ethernet device [10:42] ogra_, we are successfully loaded with initrd, thanks again :) [10:42] ogra_: right, but any kernel should be the same right? [10:42] which just looks for eth* and en* [10:42] i'm pretty sure you worked on a snappy specific bug for it :) [10:42] right [10:42] Chipaca: what file is that? [10:42] soffokl, \o/ [10:42] longsleep: /etc/networ/interfaces.d/{ethname} [10:43] Chipaca: ah, well you should probably extend this to also support wl* [10:43] in the course where we discussed that bug it turned out that rolling and 15.04 behaved differently [10:43] which led me to use the kernel cmdline option on rpi stable [10:44] i see [10:44] mhm funny that i do not seem to be required to use the cmdline option though [10:44] i agree abouth the wl* thing though [10:44] longsleep: wl is wifi, sin't it? [10:44] Chipaca: yeah [10:44] yep [10:45] isn't that more complicated? [10:45] buut if you are unluckly it could also be wifi0 [10:45] :P [10:45] * ogra_ has seen such devices before [10:45] really [10:45] oh my [10:45] * Chipaca <- il ne sais rien [10:45] sait* [10:45] rm -fr .... [10:45] lol [10:45] * ogra_ removes the french [10:46] :D [10:46] or, D: [10:46] let me get our friends out of france first! [10:46] heh [10:46] wifi is more complicated true, i am currently providing wpa config in /etc/writable/wpa_supplicant.conf [10:46] did not find any better writable mount to put it [10:47] there might be a network-manager framework at some point in the future [10:47] that should make it easier to just supply a snappy confg yaml for your setup [10:47] longsleep: you can't configure it via the interfaces.d thing in config? [10:48] only to a certain extend [10:48] Chipaca: not if you want to be able to configure multiple networks [10:48] wifi config works fine via /e/n/i ... but not for the higher level encryptions [10:48] longsleep: i don't think multiple networks blocks this [10:48] i.e. enterprise WPA and such [10:48] ogra_: yeah, those always tripped me up :) [10:49] Chipaca: what is not blocked by multiple networks? [10:49] normal personal WPA2 works fine via the file [10:49] only for a single ssid [10:49] i never tried multiple :) [10:49] if you want roaming or have it auto pick the stronges signal it will not [10:50] ah [10:50] =t [10:50] so, let's call it "basic support" [10:50] :) [10:50] and my WIFI APs here can properly use ESSID for roaming [10:50] hehe all right [10:51] (using the same SSID for all and have them send roaming info to the client about strenght etc) [10:51] ogra_: mhm so you say i should avoid using a wpa config file mhm - not sure - then i need a way to store multiple ssid/password combinations some place else and apply them from some place else [10:51] but thats sadly an AP feature you dont find in the home user HW [10:52] right, and only works for a single logical network [10:52] yeah [10:52] * longsleep thinks wpa-confi option is the way to go for everyone [10:52] nah [10:52] snappy even shipts wpa_passphrase to create it [10:52] :) [10:52] -t [10:52] nmcli via snappy config from your oem snap is the way to go [10:53] nmcli oh my [10:53] * longsleep was hoping to avoid that [10:53] once there is a NM framework we ship by default [10:54] NM offers evereything we need for GSM, LAN and WLAN [10:54] and whatever else [10:54] does NM also offer link detection? I added a new comment to https://bugs.launchpad.net/snappy/+bug/1498631/comments/10 yesterday, as dhcp is running forever even if there is no link on eth0 [10:54] Launchpad bug 1498631 in Snappy "Snappy waits 2 minutes while booting if eth0 is not connected" [High,In progress] [10:54] yes, it should [10:55] Now the waiting is fixed with the release from yesterday but the dhcp keeps running and running [10:55] (plug a cable into your laptop ... it will DTRT) [10:55] oh, i did some brief research about ifplugd and and did not like it very much [10:55] is that dhclient ? [10:55] yes dhcclient is started for eth0 [10:56] no matter if plugged or not [10:56] that should have a timeout option we can add i think [10:56] mhm but what when you plug it after that timeout was reached? [10:56] i think -1 ... [10:56] that is there [10:56] but that will only make it try once [10:57] oh [10:58] it should try only once for the duration of the timeout that was defined in dhclient.conf [10:58] mhm it does have some kind of interval [10:59] (RaspberryPi2)ubuntu@localhost:~$ grep ^time /etc/dhcp/dhclient.conf [10:59] timeout 300; [10:59] so it should stop after 5min [10:59] No working leases in persistent database - sleeping. [10:59] and after some time it will try again [10:59] ok maybe i was not patient enough [11:00] nope its not me [11:00] it just started again [11:01] ogra_: 10:54:53 sleeping [11:01] ogra_: 11:00:33 DHCPDISCOVER [11:01] uhm [11:01] i did nothing with that device in the meantime [11:01] just journalctl [11:02] pitti, any idea why that happens ? "dhclient -1 " should not make it restart, no ? [11:02] or i'm reading the manpage wrong ... sounds like a bug [11:03] ogra_: well then i am reading the manpage wrong as well [11:03] ogra_: exit with code 2 :) [11:03] right [11:03] hi, anyone with some snappy/Ubuntu Core presentations ? [11:04] i am out for lunch now, i will dig more on this later [11:04] daker, i know sergiuens held a talk, but i dont know where his slides are ... (and he is off until tomorrow) [11:05] ogra_: ok, i will ask him tomorrow [11:05] http://summit.ubuntu.com/ubuconla-2015/meeting/22539/hola-snappy/ [11:06] ogra_: ^ that one? [11:06] oh, right [11:07] you might need to pipe it through skype though to get it in a sane language [11:07] *g* [11:07] Chipaca: thanks [11:08] daker: depending on your language, here's another one in not-english: https://speakerdeck.com/svij/snappy-ubuntu-core [11:08] svij: thanks! [12:09] ppisati, err ... why do we default to "powersave" in the kernel config, thats really bad ... (first: that makes booting slow, second: we have a userspace job that forces it to ondemand after boot) [12:10] can we please set this back to performance by default so the boot doesnt get slowed down = [12:10] ? [12:11] (we can discuss making the usespace job configurable to then default to powersave after boot or some such) [12:19] * Chipaca goes to lunch, while pondering the genius of http://bennyhillthis.com/ [12:30] ogra_: so the dhclient is still trying to get an address for the not connected eth0, so i think we can say that it does not stop [12:32] longsleep, right, i think thats a bug .... seems pitti didnt see my ping above :) [12:32] ogra_: I didn't get to it yet; sorry, being flood-pinged [12:32] i would expect it to stop doing that if -1 is used and a timeout is set in dhclient.conf [12:32] ok let me add it to the tracker then [12:33] perhaps something external restarts dhclient and doesnt respect "exit 2" though [12:33] ogra_: no, the pid of that dhclient did not change since 2 hours [12:34] wow [12:34] yeah, then it sounds like dhclient doesnt even exit [12:34] I didn't follow scrollback, but -1 doesn't (seem to) be "try once and immediately exit", just "try once" (as documented) [12:34] so it might stay around until it actually succeeds? [12:35] yet it stays around and flodding logs all 5 minutes with DHCPDISCOVER on eth0 lines [12:35] s/yet/yes [12:36] pitti, well, the manpage says it does try once for the duration of the timeout thats defined in dhclient.conf [12:36] so that sounds like a bug then [12:36] and then it does an "exit 2" [12:37] let me add a new bug separate from 1498631 [12:37] * pitti runs "sudo dhclient -1 -v -i lxcbr0" (which can't succeed) and lets that sit for 5 mins [12:38] * pitti gets grumpy, changes timeout to 30s and re-runs [12:38] hehe [12:38] what kind of ridiculous default is "5 mins" anyway [12:39] we live in an impatient world :) [12:39] 5 mins == broken [12:39] No DHCPOFFERS received. [12:39] and exits with 0 (!) after 30 s [12:39] Maybe its only with a lease file? [12:39] After No DHCPOFFERS received it logs No working leases in persistent database - sleeping. [12:39] I do have a /var/lib/dhcp/dhclient.leases [12:40] right, I get the same [12:40] mhm [12:40] Old leases are kept around in case the DHCP server is unavailable when dhclient [12:40] is first invoked (generally during the initial system boot process). In that [12:40] event, old leases from the dhclient.leases file which have not yet expired are [12:40] tested, and if they are determined to be valid, they are used until either they [12:40] expire or the DHCP server becomes available. [12:40] ogra_: powersave is our default on every kernel/arch [12:40] so that sounds plausible [12:40] ogra_: how much do we gain in boot time going to performance? [12:41] mine does not exit - the pidfile got created at 10:25 utc and it still has that pid [12:41] longsleep: so does it log that it's re-using old leases then? [12:41] pitti: no there are no leases [12:41] (lease file is empty) [12:41] its the first boot actually, and it never had a link on eth0 [12:42] ppisati, a few seconds ! [12:43] ppisati, who decided to drop performance in our main kernels ?!? [12:43] thats an essential boot speed bit [12:43] (worked out around lucid by keybuk) [12:43] ogra_: let me check [12:44] CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y [12:44] phew ! [12:44] we still have that in wily's amd64 kernel at least [12:44] is that different on other kernels? [12:44] seems like [12:44] well, in snappy kernels [12:44] and /etc/init.d/ondemand should change it to something else after 1 min [12:44] yeah [12:45] we want full CPU and IO throughput until we are booted [12:45] and after that switch to ondemand [12:45] if we want to switch to something else in snappy thats fine, but only after booting please [12:45] FWIW, needing something like /etc/init.d/ondemand seems silly; I'd have thought the kernel's default scheduler would be clever enough by now [12:46] I mean, even with ondemand/powersave it should go to full CPU if there's load; doesn't it? [12:46] pitti: yep [12:46] pitti: it just tries to go down quicker [12:47] ppisati: right, I'm not advocating to keep "performance" all the time; I'm just asking why "ondemand" all the time is worse [12:47] if there is demand (and there obviously is during boot) it should certainly be as fast? [12:48] ogra_: i was wrong, the default is still PERFORMANCE [12:48] i think keybuk found that it takes a bit to scale up [12:48] ppisati, good [12:49] ogra_: tough in that rpi2 kernel was powersave [12:49] ogra_: let me check another thing [12:49] pitti, so you run without full performance for a second or two during boot [12:49] jdstrand: ping [12:49] here it is [12:49] arch/arm/configs/bcm2709_defconfig:CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y [12:50] which costs precious CPU throughput at a point where you dont want to lose it [12:50] ogra_: that was the default governor from the rpi config [12:50] ppisati, oh, please change that asap [12:50] we want ondemand after boot and performance during boot [12:50] ogra_: let me check 4.2 [12:50] now i understand why it boots so sluggish [12:50] ogra_: and i'll push a a new kernel for 3.19 [12:50] jdstrand: https://code.launchpad.net/~chipaca/snappy/auth/+merge/273683 [12:51] ppisati, why ? we dont use 3.19 anywhere anymore :) [12:51] snappy is 4.2 everywhere since last image [12:51] ogra_: i'm still using it :) [12:51] jdstrand: marked "work in progress" because i still need to add code that uses it, but that's the crypto bits done for your guys to take a look [12:51] ppisati, ogra_ : Added the dhcp issue as bug #1503680 [12:51] bug 1503680 in Snappy "dhclient for eth0 does never exit and retries dhcp foerever" [Undecided,New] https://launchpad.net/bugs/1503680 [12:52] oh, drat, prerequisites [12:52] and in snappy we run cloud-init during boot *before* the ondemand governor is used ... and cloud-init is python ... which is ultra slow on ARM in itself [12:52] longsleep, thanks ! [12:52] jdstrand: https://code.launchpad.net/~chipaca/snappy/auth/+merge/273684 <- fixed prereq's [12:56] CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y is the default on 4.2 rpi2 too [12:56] so it was just a 3.19 thing [12:57] ogra_: when you were referring to slowness, did it apply to 4.2 too? [12:57] ogra_: because it's correct there [12:58] ppisati, i didnt measure it recently ... in my initial images it was really slow (1-2min to boot) .... with the last image i mostly booted remote [12:58] i have to prepare a new rpi image this week (nobody told me we'd release a new stable one this week, i thought that was planned for teh 17th) [12:59] i'll do some stopwatching :) [12:59] ogra_: cool [13:00] any reason why opencryptoki is in ubuntu-core stable? I just added bug #1503681 [13:00] bug 1503681 in Snappy "opencryptoki.service fails to start" [Undecided,New] https://launchpad.net/bugs/1503681 [13:01] longsleep, weird, thats fixed [13:01] * ogra_ wonders if mvo did test on all ARM arches before doing that rushed release yesterday :/ [13:02] mhm the image i created yesterday has it installed [13:02] longsleep, its a duplicate in any case, let me find the bug [13:02] https://bugs.launchpad.net/snappy/+bug/1500020 [13:02] Launchpad bug 1500020 in Snappy "/var/lib/opencryptoki needs to be in /etc/system-image/writable-paths" [Undecided,New] [13:03] let me compare it [13:03] ah, and i didnt milestone it so that mvo could have found it because asac didnt create a milestone [13:03] Chipaca: ok, I added it to the card [13:03] i fixed it in wily [13:03] ogra_: I ran on bbb and did not touch raspi [13:03] s/to the/to a/ [13:03] jdstrand: g'morning :) [13:03] Chipaca: hi! [13:03] ogra_: oh, in a meeting right now, but I can check right after that [13:03] mvo, right, but there are plenty bugfixes missing seemingly ... i asked asac for a milestone and he missed creating one during the sprint [13:04] so the open bugs are all not milestoned [13:04] Chipaca: it will likely be a couple of days-- sarnold is swamped with other reviews [13:04] Chipaca: hey, do you know who implemented socket* and listen-stream? [13:04] mvo, but therer are some regressions due to stuff that was added for amd64 [13:04] jdstrand: the chipacacentric worldview is disappointed [13:05] jdstrand: mvo iirc [13:05] ok thanks [13:05] mvo: I know you're in a meeting. after the meeting when its convenient, can you ping me re socket* and list-stream? [13:05] listen* [13:06] ogra_: i see, well the comment says that the writable path should be added, it has not been added for ubuntu-core 6 - at least the one i got [13:06] longsleep, yeah, thats broken [13:07] ogra_: ubuntu-core 6 has 0.6.15 of ubuntu-core-config - thats why - fixed in 0.6.29 [13:07] longsleep, thats correct, as i said there is a bunch of regressions that werent fixed [13:08] (and vivid has 0.6.15, which is correct too) [13:08] ok good, so how can i close 1503681 as duplicate [13:09] ah found it [13:09] longsleep, done [13:09] ok thanks :) [13:17] ogra_: do you have bugs already for the regressions? [13:17] jdstrand: ok, I will ping you [13:17] mvo, i have to dig them up, bug 1500020 is definitely one [13:17] bug 1500020 in Snappy "/var/lib/opencryptoki needs to be in /etc/system-image/writable-paths" [Undecided,New] https://launchpad.net/bugs/1500020 [13:18] i had three, i think i closed two of them already [13:18] all regessions from the last additions of packages for the amd64 images [13:19] we definitely need to improve our milestone process for bugs ... perhaps just create ten in advance in LP or so so that doesnt get forgotten [13:36] jdstrand: back [13:36] mvo: hi! [13:37] ogra_: yeah, this time the sprint made the timing really awkward [13:37] mvo: I am writing up some documentation and noticed the new socket* and listen-stream directives for services. can you give me a two sentence summary of the feature? [13:38] (just so we are on the same page-- I think I know what's going on from the docs, but I have followup questions) [13:38] jdstrand: hm, it allows socket activated daemons with snappy [13:39] jdstrand: the patch comes from kickinz1 for docker [13:39] I see [13:39] jdstrand: I think its somewhat documented in meta.md [13:39] mvo: listen-stream says "The full path of the stream socket". is this a named socket? [13:39] * jdstrand was looking at https://developer.ubuntu.com/en/snappy/guides/package-metadata/ [13:40] uh, its poorly documented in docs/meta.md - but at least its mentioned [13:41] jdstrand: it can be both a path or a abstract socket with @foo [13:41] jdstrand: or a port (haven't tested that though) [13:42] mvo: are there any checks to make sure that a named path falls within the app-specific directories? does the abstract socket use namespacing? (eg, if pkgname is foo, check that abstract matches @foo_...) [13:42] jdstrand: its essentially what SYSTEMD.SOCKET(5) is doing [13:42] jdstrand: no checks currently, no [13:42] ok, so I can make some review tools checks for those [13:43] basically, I'll say its ok if it matches the app-specific TMPDIR or SNAP_APP_DATA_PATH [13:43] and I'll do what I suggested for the abstract socket [13:43] mvo: does that sound reasonable? [13:43] jdstrand: yes! [13:43] jdstrand: thanks a lot! [13:43] ok [13:44] now, for the bit that really concerns me: socket-user and socket-group [13:44] we don't assign UIDs or GIDs [13:44] how are these supposed to work? [13:45] jdstrand: welllllll they work for docker because there is a docker user on the image, but they don't work for anything else right now [13:45] right [13:45] ok [13:45] so maybe we should not expose that option while there is no way to add users ? [13:46] mvo: so I will just flag those if they are specified at all. when we support UID and GID per-snap (I was thinking this would be opt-in), we can check that it matches that [13:46] makes sense [13:46] mvo: clearly docker needs it. it is probably a doc change [13:47] either don't expose it in the doc at all, or mention that it will flag a manual review [13:48] mvo: how about I add a bug for the review tools and add a snappy task to update the docs so there is a little more information? [13:48] mvo: and I'll submit an MP for that [13:48] jdstrand: +1 [13:49] ok. it won't be until the end of the week/next week [13:49] mvo: thanks for walking me through this [13:49] thats fine! thank you! [13:52] mvo: can listen-stream to a relative path or just absolute path? [13:54] jdstrand: I think it has to be absolute (which makes it interessting) [13:54] I can use current/ [13:56] * mvo nods [14:03] mvo: btw, it seems that snappy build still doesn't run the tools by default [14:03] mvo: I thought we agreed they should? note, I think the tools ppa needs to have a review tools upload for the recent 'architectures' changes [14:04] jdstrand: let me check that, I was sure my branch got merged [14:05] mvo: maybe it is my local snappy that is out of date... [14:05] jdstrand: no, you are right [14:05] jdstrand: let me chase that [14:06] ok, I'll work to get the updated review tools into the ppa. again, it'll be a couple days (doc writing) [14:07] ok === rickspencer3_ is now known as rickspencer3 [15:16] elopio: mvo: https://en.m.wiktionary.org/wiki/husk [15:21] anyway, i suck at names, so i'm all ears [15:44] Chipaca: call them "meta", that fixes everything :) [15:44] meta. [15:45] I'm ok with husks actually (after the explanation of course). I would call that peel, but what do I know? [15:47] elopio: thinking about it, hollejo is not the right word. Hollejo is the white thing under the orange skin and before the "gajos", for example [15:48] elopio: you know what chala (as in "humita en chala") is? that's a husk [15:48] the outer, leafy covering of corn is the husk [15:49] and you remove a husk by husking, which would've made it more confusing in code so i called it 'load' :-p [15:49] umm, yes. I think my mother calls hollejos the calluses in the fingers. I'm sure I've heard that somewhere, but not entirely sure where. [15:49] no, chala makes it worst. I've only heard chala rasta. I think they are from argentina. Not sure either. [15:50] https://upload.wikimedia.org/wikipedia/commons/1/13/Humitas_en_chala_tipicas_de_Argentina8.JPG [15:50] mmmmmmmmm [15:50] now i want some [15:50] Chipaca: you should write a husker interface, and propose it for golang upstream. I'm sure you'll be famous. [15:51] * Chipaca mumbles incoherently and gets back to work [15:53] I think we call the "chalas of the corn" just "hojas". [15:53] and humita is something like tamal de elote. [15:53] * elopio goes for breakfast. [15:54] Chipaca, elopio I still like something about lighweightThing, that makes it realtively easy to parse (although its a bit long :/ [15:54] * mvo gets dinner [15:54] yep, long, is why i said maybe just use lightweight [15:55] elopio: re-review https://code.launchpad.net/~chipaca/snappy/systemimage-exported-consts/+merge/273479 if you get a moment please [15:56] exuvia [15:56] I doubt we can fix it, but I'm sure we can make it worst :) https://en.wikipedia.org/wiki/Exuvia#/media/File:Euscorpion_exuvia_2.jpg [15:57] exuvia works for me, but i thought it was a bit offbeat :) [15:57] love magicicada exuviae stuck to trees [15:57] Chipaca: approve, needs commit message. [15:58] on it [16:08] mvo: wrt https://code.launchpad.net/~chipaca/snappy/removed-pkg/+merge/273481, renamed it to RemoteManifestPath, want to take another look? [16:08] mvo: otherwise i'll top-approve :) [16:19] elopio: i didn't know exuviae is also another word for booty. +1 to exuvia. [16:20] I didn't know that either. I've learned so much today! [16:25] hi there! quick question, if I'd want to get some review outcome for a snap package (uploaded to store, triggered manual review during auto-review), who should I ping? [16:27] matiasb: I don't understand. You want to cause your snap to trigger a manual review? [16:28] elopio, nop, I submitted a package (a real one!), but it requires manual review, so I'm waiting for it (for a few days now) [16:29] matiasb: ah, generally it's Sergio who reviews them. [16:29] he's back tomorrow. [16:29] elopio, ah, ok, thanks :) [16:30] beuno: can you give me permissions to look at the review queue? [16:40] elopio, they are rarely handed out. What for? [16:42] beuno: is there a staging I can look at? I just want to understand the process, and do some exploratory tests with snaps that require manual review. [16:48] elopio, they are the same ACL list. The process is: run the security scripts (lp:click-reviewer-tools), if they fail they get rejected. You can re-request a manual review, and someone clicks a button [16:49] beuno: ok, that works. matiasb is your source public? I would like to see the click-reviewer-tools failure in your branch. [16:50] elopio, click-reviewer-tools is public, the rest isn't [16:51] elopio, I packaged transmission, so sources are public; re the errors, I can share a paste with them, but they are related to the fact that I had to tweak the default security profile [16:51] matiasb: w00t for transmission. [16:53] matiasb: yes, please paste the error. I'm just curious. I've just reviewed a branch with a test for the reviewer-tools and want to learn more about it to add more tests. [16:53] elopio, http://paste.ubuntu.com/12706117/ [16:53] thank you. [16:54] elopio, np, it doesn't say much, it complains I'm changing the sec profile :) [16:55] I couldn't find another way to work around that [16:58] matiasb: wrt tweaking security profile, that's usually a "talk with jdstrand" [16:59] matiasb: and he, too, can do manual reviews, specifically for this scenario :) [17:02] Chipaca, got it, thx; so, when jdstrand is around to take a look... :) [17:02] mvo: so, for when you return: 1. leave husk/Husk; 2. exuvia/Exuvia; 3. package lightweight, type PartList [17:04] mvo: husk.Byname -> lightweight.PartListByName, husks.All -> lightweight.AllPartLists [17:04] mvo: all others end up waaay too long imho :) === chihchun is now known as chihchun_afk [17:19] Chipaca, matiasb: fyi, unless the app comes from a trusted vendor, we don't allow security-override or security-policy in the public store (a private store could allow it). having the source open is great, but the snap may not have been built from that source [17:19] matiasb: how extensive are the policy edits? perhaps they are bugs in the templated policy? [17:20] jdstrand: dude, we don't do "bugs". [17:20] they're miscomprehended teenager features [17:20] jdstrand, understood; I had to add a few extras to the default templates, as specified in the comment there, happy to workaround if possible [17:22] matiasb: looking at what you put in the review, we could allow /proc/sys/kernel/random/uuid [17:22] matiasb: we can't allow mounts (info leak) [17:23] matiasb: and quotactl is potentially dangerous too. you should probably patch transmission to not need mounts and quatactl [17:24] jdstrand, ack, got it; I'll take a look and check if that's possible [17:24] jdstrand, silly question, how would transmission workaround usage of quotactl since it needs to know if there is free space in disk to keep (or not) downloading torrents? [17:25] jdstrand, so I guess I will let you know if I can fix that, thanks [17:26] ah, perhaps free disk space can be checked with other libraries [17:27] nessita: because snappy doesn't (yet? evar?) support quotas, just checking df is probably enough [17:27] would df work ? [17:28] (i guess it also needs access to /proc/mounts) [17:28] matiasb: the simplest would be to not perform that check at all. perhaps there is an actual alternative solution. [17:29] Chipaca, got it, thanks [17:29] (i mean, perhaps something like "df ." doesnt need it, never tired) [17:29] jdstrand, probably, didn't review the sources in detail, but I guess it should be possible to work something out [17:30] ogra_: df . does need it :( [17:30] ah, sad [17:30] [101896.479363] audit: type=1400 audit(1444238994.246:13): apparmor="DENIED" operation="open" profile="hello-world.canonical_env_1.0.18" name="/bin/df" pid=1531 comm="env" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [17:31] that is actually quite a drawback, i can imagine a lot usecases where apps would want to know the free space in SNAP_APP_DATA_DIR [17:31] maybe there's a way to allow just that? [17:32] i doubt any available tool can do that without /proc/mounts or at least without accessing info about the underlying disk SNAP_APP_DATA_DIR lives in [17:32] i could be wrong though [17:33] Log: apparmor="DENIED" operation="open" profile="hello-world.canonical_sh_1.0.18" name="/proc/3814/mounts" pid=3814 comm="df" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [17:33] yeah [17:33] we need an out of process service [17:33] then we could allow talking to it [17:33] snappy freespace [17:33] df isn't in the policy now cause it needs /proc/*/mounts [17:34] well, not snappy [17:34] "SNAP_APP_DATA_DIR has 1254MB free" [17:34] apps can't use snappy :) [17:34] oh, indeed [17:34] snapd maybe [17:34] anyhoo, something our of process [17:35] out* [17:35] ogra_: hey, I have a couple of questions while I have you [17:35] * jdstrand pulls them up [17:35] note that i'm not officially here :P ... but shoot [17:36] these are actually community type questions [17:36] ogra_: but please don't let me distract you from life :) [17:36] well, i'm on sick leave til tomorrow ... but pretty bored so just ask [17:38] jdstrand: that's ogra's way of saying, you've just got to make your questions more interesting that his alternatives [17:38] ogra_: do you know if there is a way or if we plan to enable via snappy config ubuntu-core to setup remove logging? ie, tell rsyslogd to send its logs to another syslog server? /etc/rsyslog.d is not a writable-path and systemd's journal doesn't do rfc syslog [17:38] for me personally, making /etc/rsyslog.d a writable-path would be sufficient [17:38] lets do that theen [17:38] but it sounds mildly interesting as an ubuntu-core config option [17:38] ok, I'll file a bug [17:38] sounds like something thats helpful in IoT cases and such [17:39] (and the fix is easy enough) [17:39] ogra_: next question. I tried to setup a static ip via snappy config ubuntu-core, and was successful. however, I didn't know how to setup the resolver. is that possible? [17:40] there are /e/n/i options (dns-servers ?) you should be able to use [17:40] * ogra_ checks his static snappy server [17:40] oh, dns-servers are in there? I read the man page, I must've missed it [17:41] (amd64)ogra@aleph2:~$ grep dns /etc/network/interfaces.d/eth0 [17:41] dns-nameservers 8.8.8.8 [17:41] yeah, man interfaces doesn't have it [17:41] yeah, seems to work here [17:41] ok, awesome :) that probably needs a doc update for snappy config... [17:41] I'll file a bug on that too [17:41] well, thats not snappy specific ... i think it is resolvconf that uses it [17:42] right [17:42] but my point it, it wasn't in 'man interfaces' either [17:42] so I had no way to discover it [17:42] right, if we added it we should have patched the manpage [17:43] ah, wait [17:43] cause it wasn't there or a snappy example. there is a snappy example for static ip (which I used), but it doesn't include dns-nameservers [17:43] man resolvconf has it [17:43] which meant I got an ip address great, but couldn't do much [17:43] yeah [17:43] we should add it to the example [17:43] I'll file a bug [17:43] thx [17:44] next question: is there a way to setup the ntp servers? [17:44] hmm [17:44] they seem to try to reach out to the pool ones [17:44] with no way to point to an internal one [17:44] s/internal/another/ [17:44] * ogra_ reads /etc/network/if-up.d/ntpdate [17:45] * jdstrand doesn't have that file on latest snappy stable [17:46] /etc/default/ntpdate [17:46] oh ? [17:46] do we already have timedated ? [17:46] I don't have /etc/default/ntpdate either [17:46] systemd+ 488 0.0 0.0 100276 2532 ? Ssl Oct06 0:01 /lib/systemd/systemd-timesyncd [17:47] is that the same thing? [17:47] no, thats the new thing [17:47] which i dont know much about yet [17:47] ah [17:47] it has a -H option [17:48] now i'm not sure where to configure it ... [17:48] I guess that is /etc/systemd/timesyncd.conf [17:48] http://www.freedesktop.org/software/systemd/man/timesyncd.conf.html [17:48] but it is not a writable-path [17:48] so we need to add that one too [17:48] ok, I'll file a bug for that too [17:49] yeah, seems you can just set NTP= [17:49] pointing to a server [17:49] the last is sshd_config. it *is* a writable path. I'm just curious if there are plans to do more with it via snappy config [17:50] that i dont know :) [17:50] wouldnt be hard to add i guess [17:50] well, I'm not trying to create more work [17:50] it is riteable because cloud-init generates the keys in that dir [17:50] even though I did. though just barely :) [17:51] well, useful work ... everything you asked about is valid :) [17:51] cool and thanks-- this was quite helpful [17:51] :) [17:51] * Chipaca adds df to the rest api [17:51] ogra_: hope you feel better and try not to be too bored :) [17:52] i'm fine, i had drilled some screw anchors into my jaw last thu ... recovery is in the last stages [17:52] * Chipaca watches the rest api get in a race with systemd for what's left of posix [17:53] we should fork systemd to systemd-posix [17:53] ;) [17:53] seems forking is in fashion currently [17:53] * ogra_ just saw the news about mjg59 [18:00] * ogra_ goes back to icepack->cheek [21:15] jdstrand: ogra_ [21:15] (amd64)ubuntu@localhost:~$ hello-world.env [21:15] /writable has 368392 blocks of 4096 bytes available (~93.390998%) [21:16] jdstrand: ogra_: http://pastebin.ubuntu.com/12709065/ [21:16] oh, also matiasb ^ [21:17] nice! [21:17] Chipaca, how can I use that? [21:17] * matiasb looks the pastebin [21:17] matiasb: gcc -D_GNU_SOURCE -Wextra -Werror -o /tmp/fakedf /tmp/fakedf.c [21:18] Chipaca, awesome, will try it when I get a few [21:18] matiasb: then, fakedf $SNAPP_APP_DATA_PATH [21:19] or fakedf $SNAP_APP_USER_DATA_PATH [21:19] s/SNAPP/SNAP/ soz [21:19] and apparently that's enough :) [21:19] matiasb: also python has statvfs which is the same call, if you're doing python [21:20] Chipaca, this is for transmission, so C should be [21:20] matiasb: and man 3 statvfs for the fields in the struct if you need some other info [21:21] Chipaca, perfect, thx! [21:21] np [21:21] maybe we should ship this :) [21:37] hah! we already do [21:37] /usr/bin/stat [21:41] jdstrand: ogra_: (dunno if you're still interested in this, but) e.g. “/usr/bin/stat -f -c "%a * %s" /writable/” [21:43] Chipaca: oh, nice! :) [21:43] megabytes: echo $(($(/usr/bin/stat -f -c '%a * %s/1024/1024' /writable/))) [21:43] * jdstrand add a note to update snappy-security to recommend that [21:43] * Chipaca stops