Planet Ubuntu https://ubuntu-community-team.github.io/terra/ Fresh posts from the Planet Ubuntu en json-to-rss (GitHub Actions) Tue, 14 Apr 2026 02:51:06 GMT 60 What’s new in security for Ubuntu 26.04 LTS? https://ubuntu.com//blog/ubuntu-26-04-lts-security-updates https://ubuntu.com//blog/ubuntu-26-04-lts-security-updates Fri, 10 Apr 2026 14:44:36 GMT Ubuntu 26.04 LTS is one of our most securely-designed LTS releases. Instead of just adding features, Ubuntu 26.04 LTS got stronger everywhere at once, by raising the security floor across every layer of the system simultaneously – and it did so without breaking deployments or demanding manual intervention. By focusing on the heart of security, the defaults , we were able to reinforce Ubuntu’s security in new ways. In this article, we’ll walk you through what’s new in security for Ubuntu 26.04 LTS, including: 

  • Hardware-backed encryption that’s genuinely production-ready 
  • Cryptographic defaults that are post-quantum aware
  • Enterprise grade support for all leading confidential computing technologies on both the guest and host sides
  • Web servers that reject legacy TLS
  • Continued effort to “oxidise” security-sensitive parts and making memory-safe implementations of rust-coreutils and sudo-rs the default.
  • Identity services that refuse to run as root
  • Firmware and secure boot hardened end to end
  • A control plane that makes all of it visible, manageable, and auditable long after deployment

Ubuntu 26.04 LTS sets a materially higher default security floor for the next decade of Linux deployments across desktops, servers, confidential VMs, cloud images, and edge systems. For organizations standardizing on Ubuntu as a secure foundation, this is the release they will want to build on.

Security is no longer installer-time only: Security Center becomes a control plane

Historically, key security decisions (such as disk encryption or secure boot posture) were made at installation and rarely revisited. Ubuntu 26.04 LTS changes that.

The Security Center now surfaces critical platform protections in a way that makes them inspectable and manageable after deployment. Administrators can review and manage:

  • TPM-backed Full Disk Encryption state
  • Recovery mechanisms
  • Secure Boot status
  • Disk protection configuration

This is a shift in philosophy, where security is not a checkbox during setup. It is a lifecycle responsibility. Ubuntu 26.04 LTS makes that responsibility visible and actionable. For managed desktop fleets and enterprise environments, that reduces blind spots and increases auditability.

TPM-backed Full Disk Encryption is ready for real-world deployment

TPM-backed FDE enters general availability with Ubuntu 26.04 LTS.  We had already introduced this capability in  earlier releases, behind an experimental flag, and with Ubuntu 26.04 LTS, we are making it  operationally robust and enterprise ready. The work in this release focuses on the failure modes that matter in production:

  • Recovery-key handling during firmware updates is predictable and surfaced before a potentially breaking reboot
  • Known incompatibilities, such as Absolute/Computrace, are explicitly documented and must be accounted for
  • Kernel module requirements for certain storage configurations are clearly defined

This is what production readiness looks like: fewer undefined states, fewer surprises during updates, and clearer hardware boundaries. With this, hardware-anchored encryption is no longer experimental; On Ubuntu 26.04 LTS, it is a first-class security mechanism.

Confidential computing: host and guest support for SEV-SNP and TDX

Ubuntu 26.04 LTS ships fully integrated host and guest support for both AMD SEV-SNP and Intel TDX, the two technologies defining the future of confidential cloud infrastructure.

This is a capability with great potential, as it means you can now run virtual machines whose memory is encrypted and integrity-protected by the CPU itself. 

Other distributions offer only pieces of this. In contrast, Ubuntu 26.04 LTS delivers the full stack: kernel, firmware, and tooling, integrated and ready to deploy. For public cloud providers, regulated industries, AI workloads, and anyone serious about data sovereignty, Ubuntu offers a comprehensive platform for confidential computing.

Strengthening the security core with memory-safe foundations

Ubuntu 26.04 LTS continues Canonical’s deliberate effort to strengthen the system by “oxidising” security-sensitive components, replacing legacy implementations with memory-safe alternatives written in Rust where they are sufficiently mature. This transition follows a staged approach, with key tools first validated in interim releases before being promoted into the LTS once they meet strict readiness criteria. 

In this release, rust-coreutils provides the system’s core utilities and sudo-rs becomes the default sudo implementation, while the traditional GNU coreutils and original sudo remain available for compatibility and fallback.

Modern cryptography by default

Ubuntu 26.04 LTS ships OpenSSH 10.2 and continues the deliberate removal of legacy cryptography, alongside updates to the broader system cryptography stack (including OpenSSL).

Key changes include:

  • Hybrid post-quantum key exchange (mlkem768x25519-sha256) available by default
  • Complete removal of DSA support
  • DSA host keys are no longer generated
  • The SSH server no longer reads ~/.pam_environment, reducing environment injection risks

There is no migration toggle required to benefit from modern key exchange. Instead, these features are now default. 

Identity and directory services run with less privilege

Some of the most meaningful security changes in Ubuntu 26.04 LTS are not visible in screenshots, they are visible in process tables.

  • SSSD now runs as the dedicated sssd user instead of root
  • OpenLDAP runs in AppArmor enforce mode
  • Password hashing configuration in OpenLDAP is improved with tunable PBKDF2 iteration control

In addition, Ubuntu 26.04 LTS introduces authd as a supported authentication framework, enabling integration with cloud identity providers using modern standards such as OpenID Connect.

This allows Ubuntu systems, across both Desktop and Server, to adopt modern authentication methods, including multi-factor authentication (MFA) and conditional access policies, aligned with enterprise identity platforms.

Identity services are high-value targets. Running them with reduced privilege and enforced confinement meaningfully reduces blast radius in the event of compromise.Get Add-ons

Secure Boot and firmware hardening

Ubuntu 26.04 LTS updates firmware components and tightens Secure Boot posture:

  • NX (No-Execute) is enabled across Secure Boot variants
  • Legacy strictnx variant removed in favour of consolidated hardened builds
  • OVMF firmware packages are aligned to virtualization security technologies such as AMD SEV and Intel TDX

Boot integrity is foundational. Hardening at this layer strengthens the chain of trust from firmware to user space.

Web and TLS defaults move forward

Ubuntu 26.04 LTS updates its core web stack while continuing the distribution’s long-running move away from legacy TLS. It ships with Apache 2.4.66 and Nginx 1.28.2, and aligns their packaged defaults with modern security standards: Apache disables TLS 1.0 and 1.1 by default, and Nginx defaults to TLS 1.2 and TLS 1.3. 

This change builds on the TLS hardening introduced in previous LTS releases, ensuring that both the underlying crypto libraries and out-of-the-box web server configurations consistently follow RFC 8996, which deprecated TLS 1.0 and 1.1.

A modern kernel and container baseline

Ubuntu 26.04 LTS aligns with a modern upstream Linux kernel baseline 7.0 and the latest container runtimes. Security-relevant changes include:

  • Strengthened cgroup mount options (nsdelegate, memory_recursiveprot, memory_hugetlb_accounting)
  • Updated container stack:
    • containerd 2.2.1
    • runc 1.4.0
    • docker.io 29 with nftables backend support and containerd image store defaults

This ensures that isolation semantics and container boundaries are built on a contemporary substrate. This is especially important for cloud-native workloads.

Evolving application confinement with AppArmor

Ubuntu continues to strengthen application isolation through ongoing enhancements to AppArmor, the system’s mandatory access control framework. A key area of development is user-facing permission prompting for snapped applications, designed to provide more granular and transparent control over how applications access sensitive system resources such as files, devices, and network interfaces.

By making these access decisions more visible and explicit, AppArmor prompting aims to improve both security and user awareness of application behavior. This capability is available as an experimental feature and is not yet part of the default security posture in Ubuntu 26.04 LTS, reflecting a broader direction towards tighter application sandboxing and more accountable permission models in future Ubuntu releases.

What makes Ubuntu 26.04 LTS strong

Ubuntu LTS releases define the security baseline that enterprises, governments, cloud providers, and device manufacturers build on for years. Ubuntu 26.04 LTS is no different.

Over the past several cycles, Ubuntu has been rearchitecting its security model from the ground up: modernizing cryptography, anchoring trust in hardware, stripping privilege from core services, and moving security out of the installer and into surfaces where it can actually be managed. 

With Ubuntu 26.04 LTS, those changes become the new normal. Deploy it with confidence.

]]> Ubuntu Blog E376 O Oráculo Do Cenáculo https://podcastubuntuportugal.org/e376/ https://podcastubuntuportugal.org/e376/ Thu, 09 Apr 2026 00:00:00 GMT Santa Páscoa a todos, crentes e não crentes na Palavra do Software Livre, abençoado seja o NextCloud e as pastas partilhadas que deviam ser fáceis em Ubuntu…e todavia… Desta vez conseguimos insultar várias comunidades e pessoas em particular, o que não é de somenos. Insultámos a Oracle, quase toda a comunidade de utilizadores de Mint (que o Diogo foi ajudar, na sua modesta magnanimidade); trouxémos más notícias sobre Ubuntu Mate; rimos muito com Virtualbox, uma verdadeira matrioska de porcarias; e conseguimos insultar gratuitamente pessoas que são portadoras de Snapofobia. Mas também recomendámos um youtuber português interessante (Hat Rat) e promovemos o NextCloud como o canivete Suíço que resolve tudo. E encontrámos mais uma situação para fazermos queixinhas à CNPD.

Já sabem: oiçam, subscrevam e partilhem!

Atribuição e licenças

Este episódio foi produzido por Diogo Constantino, Miguel e Tiago Carrondo e editado pelo Senhor Podcast. O website é produzido por Tiago Carrondo e o código aberto está licenciado nos termos da Licença MIT. (https://creativecommons.org/licenses/by/4.0/). A música do genérico é: “Won’t see it comin’ (Feat Aequality & N’sorte d’autruche)”, por Alpha Hydrae e está licenciada nos termos da CC0 1.0 Universal License. Os separadores de péssima qualidade foram tocados ao vivo e sem rede pelo Miguel, pelo que pedimos desculpa pelos incómodos causados. Este episódio está licenciado nos termos da licença: Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), cujo texto integral pode ser lido aqui. Estamos abertos a licenciar para permitir outros tipos de utilização, contactem-nos para validação e autorização. A arte de episódio foi criada por encomenda pela Shizamura - artista, ilustradora e autora de BD. Podem ficar a conhecer melhor a Shizamura na Ciberlândia e no seu sítio web.

]]> Podcast Ubuntu Portugal Quote #75514 https://mako.cc/copyrighteous/quote-75514 https://mako.cc/copyrighteous/quote-75514 Tue, 31 Mar 2026 21:13:00 GMT Although I never submitted to it, I made several appearances in the now-defunct quote database on bash.org (QDB). I’m dealing with a broken keyboard now, and went to dig hard to find this classic in the Wayback machine. I thought I would put it back on the web:

<mako> my letter "eye" stopped worng
<luca> k, too?
<mako> yeah
<luca> sounds like a mountain dew spill
<mako> and comma
<mako> those three
<mako> ths s horrble
<luca> tme for a new eyboard
<luca> 've successfully taen my eyboard apart and fxed t by cleanng t wth alcohol
<mako> stop mang fun of me
<mako> ths s a laptop!

It was, in fact, horrble.

]]> Benjamin Mako Hill Ubuntu Weekly Newsletter Issue 938 https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-issue-938/79450 https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-issue-938/79450 Mon, 30 Mar 2026 21:55:13 GMT

header

Ubuntu Weekly News

UWN Issue 938 March 29-April 4, 2026.

Welcome to the Ubuntu Weekly Newsletter, Issue 938 for the week of March 29 - April 4, 2026.

In this Issue

  • Ubuntu Summit 26.04 is coming: Save the date and share your story!
  • Welcome New Members and Developers
  • Ubuntu Stats
  • Hot in Support
  • Other Meeting Reports
  • Upcoming Meetings and Events
  • Ubuntu Circles! (LoCo) News
  • Santiago de Chile será el corazón de UbuConLA 2026
  • Call for Papers – UbuConLA 2026
  • Ubuntu Circles! (LoCo) Events
  • Ubuntu Server Gazette - Issue 13 - The balance of innovation and reliability
  • Rust on Ubuntu - April 2026
  • Other Community News
  • Ubuntu Cloud News
  • Canonical News
  • In the Press
  • In the Blogosphere
  • Featured Audio and Video
  • Updates and Security for Ubuntu 22.04, 24.04, and 25.10
  • And much more!

General Community News

Ubuntu Summit 26.04 is coming: Save the date and share your story!

Mauro Gaspari announces the coming of Ubuntu Summit 26.04. We’re briefly reminded what Ubuntu Summits are, before the topic moves to submitting a talk, which includes a link to the ‘Call for Papers’. Next is the the Ubuntu Summit Extended advisory with a link to register your Ubuntu Summit Extended event. We’re reminded the ‘clock is ticking’ and given a link to the Ubuntu Summit website for more.

https://ubuntu.com//blog/ubuntu-summit-26-04-is-coming-save-the-date-and-share-your-story

Welcome New Members and Developers

Congratulations to this contributor!

Ubuntu Stats

Bug Stats

  • Open: 142683 (-2257)
  • Critical: 311 (+3)
  • Unconfirmed: 73492 (-1076)

As always, the Bug Squad needs more help. If you want to get started, please see: https://wiki.ubuntu.com/BugSquad

Translations

  • Swedish: 100.00% (1/1360)
  • Albanian: 98.87% (3977/0)
  • Ukrainian: 89.21% (37880/1710)
  • German: 87.17% (45060/405)
  • French: 85.78% (49944/7607)

Hot in Support

Ubuntu Community Discourse Trending Top 5 Threads

Find more support at: https://discourse.ubuntu.com/c/support-and-help/306

Ask Ubuntu Top 5 Questions

Ask (and answer!) questions at: https://askubuntu.com/

Other Meeting Reports

Upcoming Meetings and Events

Times shown are UTC unless otherwise specified. For more details and further dates please visit: https://ubuntu.com/community | https://discourse.ubuntu.com/upcoming-events

Ubuntu Circles! (LoCo) News

Santiago de Chile será el corazón de UbuConLA 2026

Naudy Villarroel Urquiola (naudyvu) announces, in Spanish, that the eleventh edition of UbuConLA - 2026 is set. We are told “…the Latin American Ubuntu community will gather at the Central University of Chile…”. Naudy gives us the location, address, date (September 29 and 30), and a glimpse for the expected activities.

https://discourse.ubuntu.com/t/santiago-de-chile-sera-el-corazon-de-ubuconla-2026/78266

Call for Papers – UbuConLA 2026

Naudy Villarroel Urquiola invites us to be a “speaker or workshop facilitator” in this ‘Call for Papers’ for UbuConLA 2026. Some details and a link are provided.

https://discourse.ubuntu.com/t/call-for-papers-ubuconla-2026/79613

Ubuntu Circles! (LoCo) Events

The following LoCo team events are currently scheduled in the next two weeks:

Looking beyond the next two weeks? Visit the respective Circles!/LoCo Team calendar to browse upcoming events.

Please also see:

The Hub

Ubuntu Server Gazette - Issue 13 - The balance of innovation and reliability

Christian Ehrhardt has published Issue 13 of the Ubuntu Server Gazette. In this issue the upcoming Ubuntu 26.04 LTS Server is covered, which includes many of the changes from prior 24.10, 25.04 & 25.10 releases that users of the prior Ubuntu 24.04 LTS may not yet know about. This is a rather extensive post, covering security differences - still with prized stability - kernel choice, and kernel stack choices and more for users of Ubuntu Server.

https://discourse.ubuntu.com/t/ubuntu-server-gazette-issue-13-the-balance-of-innovation-and-reliability/79627/

Rust on Ubuntu - April 2026

Richard Scott McNew discusses “how we are using the Rust programming language on Ubuntu”. This is an overview of various areas where Rust is used within Ubuntu, with links for each of the areas for those needing to learn more.

https://discourse.ubuntu.com/t/rust-on-ubuntu-april-2026/79651

Other Community News

Ubuntu MATE’s founder is stepping back after 12 years

Joey Sneddon reminds us that Martin Wimpress is seeking a new maintainer for Ubuntu MATE; revealing he is stepping down (see UWN 937). Joey reminds us of some of the story of Ubuntu MATE, briefly covering the 26.04 qualification, and that lacking contributors is a rather common issue. He gives us a quick overview of the work required in maintaining a Ubuntu flavor and asks if we’re able to offer our own skills. He tells us we can reach out to Martin Wimpress if we’re able to contribute.

https://www.omgubuntu.co.uk/2026/03/ubuntu-mate-needs-new-maintainer

Ubuntu MATE Community is moving to Ubuntu Discourse

Luke Horwell gives notices that the ubuntu-mate.community site will be archived, and users are asked to join “the rest of the Ubuntu Family over on Ubuntu Discourse”. We’re reminded the site was independently hosted with sponsorship provided by Bytemark. Luke reminds users that Ubuntu Discourse has its own rules and differences in organization, before moving to the specifics of what will happen to the data of this site. The dates of the various stages are given, before Luke moves to releases.ubuntu-mate.org which will also be shutdown. The posts ends with a “big thank you” to all for being part of this community site over the last ten+ years.

https://ubuntu-mate.community/t/ubuntu-mate-community-is-moving-to-ubuntu-discourse/31342

Kubuntu 26.04 LTS — what went into the release, and how you can help

Scarlett Gately Moore reports that “Kubuntu 26.04 LTS Resolute Raccoon is shaping up nicely”. She writes about what it takes to produce a release from the developer’s perspective. Kubuntu has new contributors this cycle; of note is collaboration with the KFocus team. Testers are requested now to find and fix bugs; a coordination link is provided.

https://www.scarlettgatelymoore.dev/blog/kubuntu-26-04-lts/

Ubuntu Cloud News

Canonical News

In the Press

What Is New in APT 3.1 on Ubuntu 26.04

Lubos Rendek writes about Apt’s 3.1 version package manager that will ship with Ubuntu 26.04 LTS. We’re told is includes “a smarter default dependency solver, new diagnostic commands, repository-level package filtering, and tightened cryptographic policies” over older versions. This is a guide that will show users how to take advantage of the newer features, and will benefit users most if using older releases such as Ubuntu 24.04 LTS or earlier. A FAQ is also provided that may answer some of your questions too.

https://linuxconfig.org/what-is-new-in-apt-3-1-on-ubuntu-26-04

ImageMagick Zero-Day Enables RCE on Linux and WordPress Servers

Deeba Ahmed tells us of a potential security issue affecting ImageMagick that could allow attackers to achieve remote code execution (RCE). We’re given details, and told it impacts many OSes, including Ubuntu 22.04 LTS. A fix was noted back in November 2025 and this notice serves as a reminder it wasn’t marked as a security update; thus not all systems may have installed the fixes.

https://hackread.com/imagemagick-zero-day-rce-linux-wordpress-servers/

Also relating to ImageMagick:

In the Blogosphere

Ubuntu 26.04 LTS no longer offers Google Drive access in Nautilus

Joey Sneddon talks about GNOME Online Accounts (GOA) in GNOME 50, and tells us that the toggle to provide file access is gone. We’re told the feature is still seen in Ubuntu 26.04 LTS beta, but it no longer works; and told of package updates that will prevent the non-working feature from showing. We’re told of the GNOME developer who confirmed it won’t work, and we are given details on why it was removed; including the calls for a maintainer back in December 2022. Joey says the most “straightforward alternative” is ‘rclone’ and tells us about it.

https://www.omgubuntu.co.uk/2026/03/google-drive-not-working-nautilus-ubuntu-26-04

Ubuntu quietly raises its minimum system requirements

Joey Sneddon tells us we’ll need at least 6GB of RAM to run Ubuntu 26.04 LTS comfortably, due to raised minimum memory requirements. Joey gives us a comparison of minimum requirements since 12.04 [LTS releases only; some changes actually occurred in the interim releases with Joey only comparing LTS releases after an actual change]. Next Joey gives us his opinion on whether or not this requirement is because the OS itself needs more RAM, or to what Joey calls an “honesty bump” due to app (including web browser) demands.

https://www.omgubuntu.co.uk/2026/04/ubuntu-2604-system-requriments

Featured Audio and Video

Linux Unplugged: Episode 660 - Boots and Breakups

“Ubuntu wants a leaner, stricter GRUB, and your favorite setup may not survive the cut. We break down what’s really changing, and the practical ways to adapt. Plus, Chris moves on from one of his favorite open source apps.”

https://linuxunplugged.com/660

Canonical Ubuntu: Open source - Passing the baton to the next generation

“Open source, Linux, and Ubuntu all have a way of changing lives in unexpected ways. In this video, Aaron Prisk, Community Engineer at Canonical, shares his journey with open source. Learn how discovering Linux as a teenager led Aaron to support a transformative Ubuntu deployment, which saved a school district $1.5 million, and gave students real-world IT skills. This story covers Ubuntu in education, getting started with open source, student tech apprenticeships, and how to start contributing to open source – even if your code isn’t perfect. If you’re interested in Linux careers, STEM education, community-driven software, or sustainable IT solutions, this conversation is for you.”

https://www.youtube.com/watch?v=XLBpr-0f4Gw

Updates and Security for Ubuntu 22.04, 24.04, and 25.10

Security Updates

Ubuntu 22.04 Updates

End of Standard Support: April 2027

Ubuntu 24.04 Updates

End of standard support: April 2029

Ubuntu 25.10 Updates

End of Life: July 2026

Subscribe

Get your copy of the Ubuntu Weekly Newsletter delivered each week to you via email at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-news

Or follow us via our various social media presences:

Archives

For recent issues of the Ubuntu Weekly Newsletter Issue 786 & later please visit our Discourse page: or our Portal page: that is easier to read. The older WIKI issues (809 and earlier) are available at: UbuntuWeeklyNewsletter/Archive.

Further News

As always you can find more Ubuntu news and announcements at:

Conclusion

Thank you for reading the Ubuntu Weekly Newsletter.

See you next week!

Credits

The Ubuntu Weekly Newsletter is brought to you by:

  • Krytarik Raido
  • Bashing-om
  • Chris Guiver
  • Wild Man
  • irihapeti
  • And many others

Glossary of Terms

Other acronyms can be found at: https://discourse.ubuntu.com/t/glossary-uwn/42405

Get Involved

The Ubuntu community consists of individuals and teams, working on different aspects of the distribution, giving advice and technical support, and helping to promote Ubuntu to a wider audience. No contribution is too small, and anyone can help. It’s your chance to get in on all the community fun associated with developing and promoting Ubuntu. More on this at: https://community.ubuntu.com/contribute/

Or get involved with the Ubuntu Weekly Newsletter team! We always need summary writers and editors, if you’re interested, learn more at: https://discourse.ubuntu.com/t/joining-the-ubuntu-weekly-newsletter-team/40929

Feedback

This document is maintained by the Ubuntu Weekly News Team. If you have a story idea or suggestions for the Weekly Newsletter, join the Ubuntu News Team mailing list at https://lists.ubuntu.com/mailman/listinfo/Ubuntu-news-team and submit it. Ideas can also be added to the wiki at https://discourse.ubuntu.com/t/ubuntu-weekly-newsletter-ideas/40053/ . If you’d like to contribute to a future issue of the Ubuntu Weekly Newsletter, please feel free to edit the appropriate wiki page. If you have any technical support questions, please check https://community.ubuntu.com/help-information/ for more information on where to get help.

Except where otherwise noted, this issue of the Ubuntu Weekly Newsletter is licensed under a Creative Commons Attribution ShareAlike 3.0 License.

CCL

1 post - 1 participant

Read full topic

]]> Ubuntu Weekly News Announcing Incus 6.23 https://stgraber.org/2026/03/30/announcing-incus-6-23/ https://stgraber.org/2026/03/30/announcing-incus-6-23/ Mon, 30 Mar 2026 16:48:46 GMT The Incus team is pleased to announce the release of Incus 6.23!

This release is going to be our last 6.x release before Incus 7.0 LTS which is due out on April 30th.

It’s also quite a busy release with a good mix of security issues (mostly thanks to an ongoing analysis by 7asecurity), bug fixes and performance improvements and then a very good selection of features from expanding our OS support for VMs to adding more flexible instance storage with dependent volumes!

This fixes the following security issues:

On the feature front, the highlights for this release are:

  • Dependent storage volumes
  • FreeBSD VM support
  • Reworked CLI parser
  • Support for disabling DHCP announcement of the gateway
  • Support for ipv4.dhcp.gateway on OVN networks
  • Support for io.bus on OVN NICs
  • VM agent lifecycle events
  • Reworked incus file pull and incus storage volume file pull
  • Project related metrics
  • Instance low-level repair API

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

]]> Stéphane Graber Lubuntu Resolute Beta Released! https://lubuntu.me/lubuntu-resolute-beta-released/ https://lubuntu.me/lubuntu-resolute-beta-released/ Fri, 27 Mar 2026 22:24:52 GMT Lubuntu Blog Ubuntu Studio 26.04 LTS Beta Released https://ubuntustudio.org/2026/03/ubuntu-studio-26-04-lts-beta-released/ https://ubuntustudio.org/2026/03/ubuntu-studio-26-04-lts-beta-released/ Thu, 26 Mar 2026 23:45:55 GMT

The Ubuntu Studio team is pleased to announce the beta release of Ubuntu Studio 26.04 LTS, codenamed “Resolute Raccoon”.

While this beta is reasonably free of any showstopper installer bugs, you will find some bugs within. This image is, however, mostly representative of what you will find when Ubuntu Studio 26.04 LTS is released on April 17, 2026.

As an LTS release, Ubuntu Studio 26.04 will be supported for 3 years until April 2029. We encourage everyone to try this image and report bugs to improve our final release.

Special Notes

The Ubuntu Studio 26.04 LTS disk image (ISO) exceeds 4 GB and cannot be downloaded to some file systems such as FAT32 and may not be readable when burned to a DVD. For this reason, we recommend downloading to a compatible file system. When creating a boot medium, we recommend creating a bootable USB stick with the ISO image or burning to a Dual-Layer DVD.

Images can be obtained from this link: https://cdimage.ubuntu.com/ubuntustudio/releases/26.04/beta/

Full updated information, including Upgrade Instructions, are available in the Release Notes.

Please note that upgrading from 24.04 LTS before the release of 26.04.1, due August 2026, is unsupported.

Only Install What You Need

A common piece of feedback we hear is that people prefer to start with a lean base and install only the tools they actually use, rather than getting an overwhelming number of pre-installed packages. We hear you.

Ubuntu Studio includes a minimal install option in the installer, and has since 24.10! This gives you the Ubuntu Studio desktop experience: the theme, the audio configuration and the optimized settings without the full suite of creative applications. From there, you can use Ubuntu Studio Installer to add exactly the workflows you want: audio, graphics, video, photography, or publishing; à la carte.

Alternatively, if you’re already running Kubuntu, Ubuntu, Lubuntu, Xubuntu, or any other official Ubuntu flavor, you don’t have to reinstall at all. Just install the Ubuntu Studio Installer package and pick the components you need. This has always been an option, but we want to make sure everyone knows about it.

The full install remains available for those who want a complete creative workstation out of the box, and that’s a perfectly valid choice too.

New Features This Release

This is an LTS release, which means stability and polish have been the primary focus. That said, there’s a lot that’s new and improved since 24.04 LTS.

  • Three Desktop Layouts: As previously announced, Ubuntu Studio 26.04 LTS now ships with three selectable desktop layouts: the classic Ubuntu Studio top panel, a macOS-like layout with a global menu and bottom dock, and a new Windows 10-like bottom panel layout. This gives users coming from any platform a familiar starting point.
  • By Popular Vote: Our community decided in a vote on Ubuntu Discourse to make the bottom panel (traditional) layout the default. The classic top panel remains as an alternate look-and-feel theme.
  • Ubuntu Studio Installer and Audio Configuration completely rewritten: Both tools have been rewritten from scratch in Python with dual GTK4 and Qt6 UI backends. The application automatically detects your desktop environment and launches the appropriate interface. Ubuntu Studio Audio Configuration now includes FFADO support for FireWire audio devices and PipeWire buffer/sample-rate configuration via dropdown menus instead of text entry. Both tools include translations for 21 languages.
  • New Borealis sound theme replaces the Ocean sound theme. This is the sound theme Ubuntu Studio used clear back in the early (7.10 Gutsy Gibbon) days, and now it’s back!
  • Live session improvements: The screensaver and lock screen are now inhibited during the entire live session, fixing a long-standing annoyance where the screen would lock and prompt for a non-existent password.
  • Loopino is a new lightweight audio sampler plugin (LV2/CLAP/VST2) for loading, trimming, and looping audio files with drag-and-drop support and on-the-fly recording.
  • Plasma PipeWire Settings is a new Plasma applet for managing PipeWire configuration directly from the system tray.
  • snd-hdspe is a new DKMS kernel driver for RME HDSPe MADI, AES, RayDAT, AIO, and AIO Pro PCIe sound cards, available in the repositories for those who need it.
  • DistroAV (formerly OBS-NDI) is now available in the repositories for network audio/video in OBS Studio using NDI technology.
  • PipeWire continues to improve with every release and remains the default audio server.

Major Package Upgrades

  • OBS Studio version 32.1.0
  • FreeShow version 1.5.9 (snap)
  • QPrompt version 2.0.1
  • RaySession version 0.17.4
  • Patchance version 1.3.2
  • Geonkick version 3.7.0
  • BChoppr version 1.12.8
  • harpwise version 6.34.4
  • blender version 5.0.1

There are many other improvements, too numerous to list here. We encourage you to look around the freely-downloadable ISO image.

Known Issues

How You Can Help

Please test using the test cases on https://iso.qa.ubuntu.com. All you need is a Launchpad account to get started.

Additionally, we need financial contributions. Our project lead, Erich Eickmeyer, is working long hours on this project and trying to generate a part-time income. Go here to see how you can contribute financially (options are also in the sidebar).

Frequently Asked Questions

Q: Does Ubuntu Studio contain snaps? A: Yes. Mozilla’s distribution agreement with Canonical changed, and Ubuntu was forced to no longer distribute Firefox in a native .deb package. We have found that, after numerous improvements, Firefox now performs just as well as the native .deb package did.

Thunderbird is also a snap in order for the maintainers to get security patches delivered faster. This is done by the Thunderbird team in cooperation with Canonical.

Additionally, FreeShow is an Electron-based application. Electron-based applications cannot be packaged in the Ubuntu repositories in that they cannot be packaged in a traditional Debian source package. While such apps do have a build system to create a .deb binary package, it circumvents the source package build system in Launchpad, which is required when packaging for Ubuntu. However, Electron apps also have a facility for creating snaps, which can be uploaded and included. Therefore, for FreeShow to be included in Ubuntu Studio, it had to be packaged as a snap.

Also, to keep theming consistent, all included themes are snapped in addition to the included .deb versions so that snaps stay consistent with our themes.

We are working with Canonical to make sure that the quality of snaps goes up with each release, so we please ask that you give snaps a chance instead of writing them off completely.

Q: If I install this Beta release, will I have to reinstall when the final release comes out? A: No. If you keep it updated, your installation will automatically become the final release.

Q: Will you make an ISO with {my favorite desktop environment}? A: To do so would require creating an entirely new flavor of Ubuntu, which would require going through the Official Ubuntu Flavor application process. Since we’re completely volunteer-run, we don’t have the time or resources to do this. Instead, we recommend you download the official flavor for the desktop environment of your choice and use Ubuntu Studio Installer to get Ubuntu Studio — which does not convert that flavor to Ubuntu Studio but adds its benefits.

Q: What if I don’t want all these packages installed on my machine? A: See the “Only Install What You Need” section above. Use the minimal install option and then add only the workflows you want with Ubuntu Studio Installer.

]]> Ubuntu Studio ntpd-rs: it's about time! https://jnsgr.uk/2026/03/ntpd-rs-its-about-time/ https://jnsgr.uk/2026/03/ntpd-rs-its-about-time/ Thu, 26 Mar 2026 00:00:00 GMT

This article was originally posted on the Ubuntu Discourse, and is reposted here. I welcome comments and further discussion in that thread.

Introduction #

I am thrilled to announce the next target in our campaign to replace core system utilities with memory-safe Rust rewrites in Ubuntu. In upcoming releases, Ubuntu will be adopting ntpd-rs as the default time synchronization client and server, eventually replacing chrony, linuxptp and with any luck, gpsd for time syncing use-cases.

ntpd-rs is a full-featured implementation of the Network Time Protocol (NTP), written entirely in Rust. Maintained by the Trifecta Tech Foundation as part of Project Pendulum, ntpd-rs places a strong focus on security, stability, and memory safety.

To deliver on this goal, we’re building on our partnership with the Trifecta Tech Foundation who are behind sudo-rs, zlib-rs and more. We will be funding the Trifecta Tech Foundation to build new features, enhance security isolation, and ultimately deliver a unified, memory-safe time synchronization utility for the Linux ecosystem. This work meshes well with the Trifecta Tech Foundations goals to improve the security of time synchronization everywhere.

NTP, NTS, and PTP #

Before diving into the mechanics and reasoning behind the transition, I wanted to give some background on the protocols at play, and the problems we’re hoping to solve. Keeping accurate time is a critical system function, not least because it involves constant interaction with the internet and forms the basis for cryptographic verification in protocols such as Transport Layer Security (TLS).

NTP (Network Time Protocol) is the foundational protocol that most operating systems implement to accurately determine the current time from a network source.

NTS (Network Time Security) is to NTP what HTTPS is to HTTP. Historically, the Network Time Protocol was used unencrypted, like many of the early web protocols. NTS introduces cryptographic security to time synchronization, ensuring that bad actors cannot intercept or spoof time data. We already pushed to make NTS the default out-of-the-box in Ubuntu 25.10, which we accomplished by migrating away from ntpd to chrony as the default time-syncing implementation.

PTP (Precision Time Protocol) is used for systems that require sub-microsecond synchronization. While the precision offered by a standard NTP deployment is sufficient for general-purpose computing, PTP is often used for complex, specialized deployments like telecommunications networks, power grids, and automotive applications.

Proven at Scale #

Transitioning core utilities in Ubuntu comes with a responsibility to ensure that replacements are of high quality, resilient and offer something to the platform. We may be the first major Linux distribution to adopt ntpd-rs by default, but we aren’t the first to recognize the readiness of ntpd-rs - it has already been proven at scale by Let’s Encrypt.

While Let’s Encrypt’s core Certificate Authority software has always been written in memory-safe Go, their server operating systems and network infrastructure historically relied on memory-unsafe languages like C and C++, which routinely led to vulnerabilities requiring patching.

Following extensive development, ntpd-rs was deployed to Let’s Encrypt’s staging environment in April 2024, and rolled out to full production by June 2024, marking a major milestone for ntpd-rs.

The fact that one of the world’s most prolific and security-conscious certificate authorities trusts ntpd-rs to keep time across its fleet should provide us, and our enterprise customers, with tremendous confidence in its resilience and suitability.

A Single, Memory-Safe Utility for NTP and PTP #

We want to provide a single utility for configuring both NTP/NTS and Precision Time Protocol (PTP) on Linux. The Trifecta Tech Foundation is concurrently developing Statime, a memory-safe PTP implementation that delivers synchronization performance on par with linuxptp, but with the goal of being easier to configure and use.

The goal is to integrate Statime’s PTP capabilities directly into ntpd-rs, improving the user experience by bringing all time synchronization concerns into one utility with common configuration and usage patterns, obviating the need for complex manual configuration (and troubleshooting) that users of linuxptp may be familiar with.

Timelines and Goals #

As with our transition to sudo-rs and uutils coreutils, leading the mainstream adoption of foundational system utilities comes with responsibility. We want to ensure that ntpd-rs matches the security isolation and performance standards our users expect from chrony.

Canonical is funding the Trifecta Tech Foundation’s development efforts toward these goals over the coming cycles. This work will take place between July 2026 and January 2027 in several major milestones. Our current timeline and targeted goals are:

  • Ubuntu 26.10: If all goes well, we aim to land the latest version of ntpd-rs in the archive, making it available to test.
  • Ubuntu 27.04: By 27.04, ntpd-rs should have integrated statime, and we will ship the unified client/server binary for NTP, NTS and PTP in Ubuntu by default, with the aim of providing a smooth migration path for those who already manage complex chrony configs.

To get us there, the Trifecta Tech Foundation will be working on the following items:

  • Feature Parity & Hardware Support: Adding gpsd IP socket support, multi-threading support for NTP servers, and support for multi-homed servers.
  • Security & Isolation: chrony is isolated via AppArmor and seccomp. We’ll be working on robust AppArmor and seccomp profiles for ntpd-rs to ensure we don’t buy memory safety at the cost of system-level privilege boundaries. We are also ensuring rustls can use openssl as a crypto provider to satisfy strict corporate cryptography policies.
  • PTP & Automotive Profiles: Adding support for gPTP, which will allow us to support complex deployments like the Automotive profile directly from nptd-rs (via Statime). Additionally, experimental support for the proposed Client-Server PTP protocol (CSPTP, IEEE 1588.1) will be added.
  • Benchmarking & Testing: Comprehensive benchmarking of long-term memory, CPU usage, and synchronization performance against chrony to give our cloud partners and enterprise users complete confidence in the transition.
  • User-experience: Logging improvements and enhancements to configuration that help users configure the time synchronisation target to optimise network usage, as well as improvements to the ntp-cli

About the Trifecta Tech Foundation #

Trifecta Tech Foundation is a non-profit and a Public Benefit Organisation (501(c)(3) equivalent) that creates open-source building blocks for critical infrastructure software. Their initiatives on data compression, time synchronization, and privilege boundary, impact the digital security of millions of people. If you’d like to support their work, please contact them via https://trifectatech.org/support.

Summary #

I am really excited to deepen our already productive relationship with the Trifecta Tech Foundation to make these transitions viable for the wider ecosystem. We’ll be working hard on testing and integration to ensure seamless migration paths, and heavily document the changes ahead of the 26.10 and 27.04 releases.

Stay tuned!

]]> Jon Seager Ubuntu installer selects a single keyboard layout, cannot type English during installation https://blog.simos.info/ubuntu-installer-selects-a-single-keyboard-layout-cannot-type-english-during-installation/ https://blog.simos.info/ubuntu-installer-selects-a-single-keyboard-layout-cannot-type-english-during-installation/ Sat, 21 Mar 2026 17:52:23 GMT Ubuntu uses a new installer that is based on Flutter. Ubuntu 24.04 is the first Long Term Support (LTS) to use the new installer, and now Ubuntu 26.04 is the second LTS. Ubuntu 26.04 is currently being developed, and currently any bugs/issues, big or small, are being resolved.

All is fine when you rewrite software. However, when you re-implement, you can miss some features. The issue here is that if you type in a non-Latin script (i.e. Cyrillic, Greek and more), then your keyboard layout during the installation, does not type English. That is, you cannot switch your keyboard layout between your language and English. This is an issue that affects you for the duration of the installation. After the installation, the correct dual keyboard layouts are enabled.

Why would you need to type English during the installation? Because you need to create a default user account. You need to type your name (it’s OK to type this in your own language), the name of the computer and your username (both must be in English) and your password (preferably in English).

Identifying the issue

The Ubuntu installer detected the language and automatically suggests to use the local keyboard layout.

When you run the following command to show what keyboards layouts have been configured by the installer, you only get the local language. 

$ gsettings get org.gnome.desktop.input-sources sources
[('xkb', 'gr')]
$

However, the proper output should have been the following. This would allow to switch between an English and the local keyboard layout, using the default keyboard shortcut.

$ gsettings get org.gnome.desktop.input-sources sources
[('xkb', 'us'), ('xkb', 'gr')]
$

Identifying the source of the issue

The new installer configures the keyboard layout at this location. And it configures a single keyboard layout.

https://github.com/canonical/ubuntu-desktop-provision/blob/d8f1f74242f27b6f3928e745fa2375fa18bae8ef/apps/ubuntu_bootstrap/lib/services/keyboard_service.dart#L55

It appears that the installer does not have knowledge of the preferred default keyboard layouts.

Workarounds

This has been happening in Ubuntu 24.04 LTS and apparently I did not notice a report from a user complaining about it. I had to install Ubuntu myself with the local language to figure this out.

There are several workarounds. One of them is to give up and keep English as the default language. It would require effort to setup later the localization. I suspect many just gave up and kept using the English environment.

Another option is to manually fix the keyboard layout after it gets set by the installer. You just go into the settings and configure to write in English and the local language.

Another workaround is to open up some text file and then copy and paste the necessary letters.

Conclusion

There are three bug reports on this issue, https://github.com/canonical/ubuntu-desktop-provision/issues/408 and https://bugs.launchpad.net/ubuntu-desktop-provision/+bug/2018943 and https://github.com/canonical/ubuntu-desktop-provision/issues/1103

The issue is still open.

]]> Simos Xenitellis Documentation office hours: launchpadlib tutorial https://blog.launchpad.net/general/documentation-office-hours-launchpadlib-tutorial https://blog.launchpad.net/general/documentation-office-hours-launchpadlib-tutorial Wed, 18 Mar 2026 09:05:24 GMT The Launchpad team will be hosting its fourth public documentation office hour this Friday, March 20th, from 1330 UTC. In this office hour, we will start by discussing a launchpadlib tutorial we are working on. Whether you are an expert or novice on the topic, we welcome your input so we can help others to get started using launchpadlib.

As always, feel free to drop in at any time from 1330 to 1430 UTC with other Launchpad documentation ideas and issues.

Launchpad community documentation office hour (Public)
Friday, 20th March 1330 – 14:30 UTC
Google Meet joining info
Video call link: https://meet.google.com/gcd-hnxo-sce

]]> Launchpad News SCaLE 23x https://princessleia.com/journal/2026/03/scale-23x/ https://princessleia.com/journal/2026/03/scale-23x/ Mon, 16 Mar 2026 20:47:36 GMT Last week I had the pleasure of attending SCaLE 23x in Pasadena, California. I love SCaLE, it’s probably my favorite conference. It’s big, but it still feels so local, and I always walk away having met new, exceptional people, and with the warmth of connection I feel from seeing some of my closest friends in the open source world. The weather is almost always gorgeous around this time of year, and there are a ton of places that are easy to walk to for lunch and dinner. My arrival ritual these days it taking a walk south to the Whole Foods nearby to pick up some breakfast foods and coffees to enjoy each morning before the conference kicks off at 10AM. 10AM! What a glorious time to start!

The flight down from San Francisco was a quick regional flight into Burbank, my go-to airport for this conference so I can avoid LAX. And then I spent Wednesday evening getting settled in and putting some finishing touches on my talk based on some feedback I had requested from some community members working on projects I had an interesting in learning about.

Thursday is when the magic began! I spent the morning picking up my badge and immediately seeing several familiar faces. It didn’t take long to meet up long time friends from our time in the Ubuntu community Jorge and Amber, and we all went out to lunch.

Talk-wise on Thursday I found myself attending several AI talks as part of the Kwaai Summit.

So, AI. We are in the middle of an AI revolution in the tech industry and things are moving fast. A year ago a lot of the AI being used in tech was being marketed as helpers for developers. At SCaLE I heard someone suggest that we treat AI like a junior developer. We’re now replacing junior developers. But I had an experience over the holidays where I was in the trenches with code these “AI junior developers” were spitting out, and it needs a lot of guidance. Without that, the code, documentation, and even commit messages can come out nonsensical and solving things in way that is not “clever”, they legitimately don’t make sense when viewed in the correct context. It also took away the thoughtful collaboration that I love of development: How do we solve this? Can you explain what I’m reviewing? Why did you make this decision? When you’re met with a series of shrugs and a finger pointed at the AI, the job of thinking ends up solely on the person reviewing the change, and that means more experienced developers doing the reviews are being buried in AI slop code.

The technology will get better, and I anticipate an absolute decimation of our industry job-wise. I’m not exempt from this. Plus, there are real environmental concerns about power consumption and resources being used to build out all the data centers to implement these AI solutions, and I worry that it will be painful for our society in a way that may not be ethical. But we aren’t going back, that’s not how technology works in our world.

Add in that so much of this space is flush with more money than the world has ever seen, and decisions driven by greed and a horrifying lack of consideration for humanity seem to winning.

So, why did I run off on this terrifying, negative AI rant? I wanted to share what head space I was in when I walked into SCaLE. I’ve used AI tooling, and I’m constantly learning, but I’m deeply worried about it.

Thankfully, there are still good people doing good things in AI and some of those people were speaking at SCaLE.

As I strolled into the Kwaai Summit it was refreshing to be reminded of some of the more optimistic views of AI, and how success doesn’t necessarily have to follow the money. AI can be used in ways that benefit us all. There are tedious tasks and “impossible” problems that are starting to be solved by AI. Can I actually get a good handle on a big chunk of open source projects on GitHub supporting s390x? Possibly! Can we finally cure some of the most dangerous forms of cancer? Maybe! And there are people building communities around things like Beneficial General Intelligence (BGI, a play on AGI, the Artificial General Intelligence that tends to be the holy grail of AI) where things like ethics and sustainability are considered. These are my people. These are the people who built the first online social networks and open source projects. This is the messaging that I found so inspiring when I first got into open source software and what made me so fully devote my life’s work to it. It was nice to be there.

On Friday I attended Guinevere Saenger’s talk on building out developer infrastructures, which brought up a lot of points one might not necessarily think about when doing so. From there I went to Jon “maddog” Hall’s talk on “Open Source In Computer Higher Education – Past, Present and Future” which was definitely a highlight for me. I don’t need to learn how to teach computer science in higher education, but I do love hearing whatever he has to talk about because he has so many wonderful stories. He took us on a tour of this career with an eye toward education, dropping references from everything to the IBM System/360 to learning assembly from difficult text books that he read solo and then went on to teach. He’s a strong proponent for learning topics deeply, and teaching students to learn how to learn so they can thrive in an industry that requires continuous learning. We’re all in agreement there.

That evening I joined a bunch of folks from The Software Freedom Conservancy for dinner and software freedom discussions. It was a lovely evening and I had the pleasure of meeting some new people, including a fellow from Oakland Privacy who told me about the StrayCap Multispace in Hayward that I’ll have to check out some time soon!

I’ve supported the Conservancy for many years, and have known several of their staff for even longer. Need a free software license violation acted upon? This is the group that does that. They get a remarkable amount done with the staff and budget they have, and I’m incredibly grateful for that. Please consider donating.

The keynote from Cindy Cohn, Executive Director of the EFF, on Saturday morning was wonderful. I’ve been a supporter of of the EFF for years, and am closely aligned with most of their views. It was fascinating to hear about her work in this space, and the fundamental protections that she’s worked to help pioneering technologists secure over the years. I vaguely knew that encryption was restricted by the US government in the earliest days of the internet, but I didn’t realize it was classified as munitions which ultimately meant that encryption algorithms couldn’t be shared and collaborated on online. Wow. Could you imagine the internet without encryption? Our world? Cindy, with an army of early free software hackers, argued in federal court in San Francisco and for over a decade beyond that to make sure encryption was freed from this classification. This story was the first of three that she dives into in her new book Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance which I promptly pre-ordered. Her call to action to us hackers today was to stay engaged in this fight so that we show up for all the future legal battles that have the potential to threaten the future of our world and lives with regard to digital freedom. I had the pleasure of running into her later in the conference to thank her for her talk, and I had the presence of mind to pull out a piece of paper to have her sign so I could put it in my book when it arrives; I’ll have a signed copy, kind of! Then I went to the EFF booth to do my annual contribution.

After the keynote I was able to meet up with Kaitlyn Davis, a new colleague at IBM who joined us from HashiCorp and I just started working with a couple weeks ago. She happens to live in southern California! So I made the case for her to come out to SCALE. She has some really helpful ideas around leveraging AI for open source contribution tracking and so we were able to sit down for about an hour and chat about IBM in general and drill down into some of the problems I’ve been focused on to see where she wants to jump in. It’s not every day that I have the pleasure of working with someone like her, so I’m really eager to see what we come up with together in the coming months. See? I’m not negative on all uses of AI.

From there, it was time for my talk on Open Source in Closed Ecosystems. Originally I was planning on just drawing from my experience in the mainframe world, but after a chat with John Mertic of The Open Mainframe Project I was convinced to draw from a broader pool of expertise and to look into Automotive and Motion Picture industry use cases. I was fortunate that Alison Chaiken of Automotive Grade Linux (AGL) and Emily Olin who has worked on both AGL and the Academy Software Foundation (ASWF) were able to get back to me quickly regarding questions I had about the initiatives. I was also thankful to get time with Nithya Ruff whose expertise in running open source software programs across the industry has been incredibly valuable to my own work, and the broader community through her extensive work in the community of the years, and direct contributions to the TODO Group.

The talk had some rough edges flow-wise, and I’d like to flesh it out with more examples and talk to more people in industries where open source hasn’t taken a firm hold yet to see what barriers they’re encountering in their organizations. But I had some great conversations after my talk and I think it generally went well. Slides from the talk are available here: /presentations/2026/Open_Source_in_Closed_Ecosystems_-_SCALE_23x.pdf (1.3M pdf)

It was nice to run into Dave Neary, whose Open Source in Business series on YouTube got me some clues I need for my talk too. He gave a couple multiarch talks, and though they were focused on ARM64 it was still nice to hear someone talk about multiarch manifests and containers, since I bump into some confusion from community members about them. He gave some nice demos using Argo CD and Argo Rollouts that I’d like to take a closer look at.

Speaking of multiarch, I then enjoyed a talk by Amy Parker whose talk focused on QEMU user mode. I’ve used QEMU on and off over the years, but honestly since I’ve shifted my focus to bare metal testing, I’ve used it a lot less. I don’t have a lot of experience with the user mode emulation that she covered, which made the talk a fascinating dive through binfmt_misc, ld_preload, and chroots to accomplish a lot of interesting work across architectures. She also talked about using FatELF to create universal binaries, which wasn’t even on my radar. So many fun things to dig into!

Saturday evening I had the pleasure of joining Nathan Handler for dinner at a sushi place nearby. I’ve now had my first sake bomb. But just one!

Happy Sunday! The opening keynote was presented by Mark Russinovich of Microsoft, who, poor guy, spent the first 15 minutes of his talk convincing us that in spite of being known for Windows Internals, both he and Microsoft have a lot of Linux credibility. With that taken care of, he dove straight into a great tour of open source security solutions and how they relate to the growing interest in secure supply chains today. I was happy to see the security components of my own talk from the previous day reiterated, but more broadly, I’m glad SCaLE brought someone in to talk about all of this. Open source has made tremendous strides in recent years related to security, but it doesn’t get as much attention as I believe it deserves, both in terms of usage and awareness, and having more people to work on it, and its importance is only increasing.

The expo hall at SCaLE is always a delightful place to walk through, and this year was no exception. They have a wonderful mix of big, paid booth areas for larger companies, and smaller booths for non-profits, so it always brings a great assortment of people. I had a lovely time catching up with my friends from the Ubuntu community. It’s always a pleasure to catch up with Nathan Haines and George Mulak who’ve been quite involved in the Los Angeles computing scene for years. It was nice to get some time to chat with Erich Eickmeyer, lead for Ubuntu Studio, and I was pleased to learn that his wife, Amy Eickmeyer, is a professional educator and actually got the Edubuntu flavor off the ground again back in 2022! I had planned on a DIY lockdown of Ubuntu for our kids this year, but I’ll have to take a look at Edubuntu now.

And the RISC-V booth was on my list too, as I’m always eager to learn the latest (you know me and architectures!). That’s where I met a fellow IBMer who was involved with the Works with RISC-V community which I didn’t even know existed. Cool. I was able to ask about HDMI support on my VisionFive 2 and learn that there should be mainline kernel support soon, and learned that people are saying good things about the latest RISC-V mainboard for the Framework laptop. My kids like to remind me I have a lot of laptops, so I’ve held off on Framework for now, but I’ll have to take a closer look at this one.

I also went to a talk by Brendan O’Leary on From COBOL to Claude: What Hopper Knew (actually, his slides swapped “Claude” for “Cursor” (the AI coding environment). Things in AI move fast). I enjoyed this talk and his premise, given all I’ve said above about the inevitability of AI in our industry. He began by talking about Rear Admiral Grace Hopper’s desire to make “programming” computers a more human-language driven endeavor, and how that began with her FLOW-MATIC and ultimately COBOL, which is still widely used today. His belief is that she’d be happy that anyone today can vibe code their own application, and made the same comparison I tend to do with evolution of coding. AI does have very, very important things that differentiate it from the previous major evolutionary steps of computer programming, but I just don’t believe that things like being nondeterministic are enough to so forcefully push back on it. Most of this talk continued by talking about how software engineering practices that professionals are using will simply need to be adjusted to have a lot more planning and a lot less hands-on coding, and with these research, plan, and implement frameworks in place we’ll be able to trust the results AI comes up with a lot more. I think he’s right.

The conference concluded with a walk down network memory lane with Professor Douglas Comer. I love computer history, so I was familiar with a lot of the general touch points he discussed, but since his focus was on networking there were a few things I’ve missed along the way. He talked about magentic tape mailers, how Endianness caused problem with computers communicating in the early days, and how a technology like TCP/IP or even the client/server model were not obvious. His stories around how phone companies charge for transit and the sorted path to get households connected to internet was really insightful, especially when paired with the observations from Cindy Cohn the day before.

Huge thanks to all the volunteers who makes SCaLE happen, I’m really happy I could make it down this year, and after seeing how many kids where there, I’m going to make plans to at least bring our eldest down for the weekend next year.

]]> Elizabeth K. Joseph Security-only OpenSSL tarball releases for CVE-2026-2673 http://blog.surgut.co.uk/2026/03/security-only-openssl-tarball-releases.html http://blog.surgut.co.uk/2026/03/security-only-openssl-tarball-releases.html Mon, 16 Mar 2026 02:11:00 GMT On Friday May the 13th OpenSSL project has published advisory details for CVE-2026-2673. The CVE is treated as non-important by the project. The patches are only provided as commits on the stable branches. No git tag, no precise fixed version, and no source tarballs provided.

The patches that were merged to openssl-3.5 and openssl-3.6 branches were not based on top of the last stable point release and did not split code changes & documentation updates. It means that cherry-picking the commits referenced in the advisory will always lead to conflicts requiring manual resolution. It is not clear if support is provided for snapshot builds off the openssl-3.5 and openssl-3.6 branches. As the builds from the stable branches declare themselves as dev builds of the next unreleased point release. For example, in contrast to projects such as vim and glibc, with every commit to stable branches explicitly recommended for distributors to ship and is supported.

I have requested OpenSSL upstream in the past for the security fixes to branch off the last point release, commit code changes separate from the NEWS.md / CHANGES.md updates, and then merge that into the stable branches. This way the advisory that recommends cherry-picking individual commits, would actually apply conflict free - at no additional maintenance burden to the OpenSSL project and everyone who has to cherry-pick these updates. There is a wide support voiced for such strategy by the OpenSSL distributors and the OpenSSL Corporation. But this is not something that OpenSSL Project is yet choosing to provide.

To avoid duplication of work, I am starting to provide stable OpenSSL re-releases of the last upstream tagged stable point release with security only patches split into code-change only; documentation update; version update to create security only source tarball releases that are easy to build; easy to identify by the security scanners; and which cherry-pick changes without conflicts. The first two releases are published on GitHub as immutable releases with attestations:

If there are any other branches, CVEs, point releases that would be useful for similar style releases, do open discussion on the GitHub Project.

If you find these releases useful, do star the project and download these releases. If this project gets popular, I hope that OpenSSL upstream will reconsider their releases strategy for all security releases. If you have support contracts with OpenSSL - please request OpenSSL corporation to release tagged releases and versioned tarballs.

]]> Dimitri John Ledkov Calculating a rolling average without keeping all the numbers around https://www.kryogenix.org/days/2026/03/14/calculating-a-rolling-average-without-keeping-all-the-numbers-around/ https://www.kryogenix.org/days/2026/03/14/calculating-a-rolling-average-without-keeping-all-the-numbers-around/ Sat, 14 Mar 2026 23:23:00 GMT OK, if you know anything about maths you will read this and shake your head in dismay because it's just obvious and why did I even need to think about it? But... I was quite pleased to think this through, so I thought I'd write it down in case anybody else finds it useful.

So. Your job is to calculate the average of a set of numbers. This is not hard: the average value1 is the sum of the numbers divided by the count of the numbers. So the average of 2, 7, 8 is

2+7+8   17
----- = -- = 5.666…
  3      3

You know that bit already. But now I say: ok, here's a new number to add to the end of the list: 12. What's the average now?

One obvious way is to say, well, we know the numbers are 2, 7, 8, so I'll just re-do the calculation with 2, 7, 8, 12:

2+7+8+12   29
-------- = -- = 7.25
    4       4

But that means that you have to keep all the numbers around forever. What if the list of numbers is big? That seems like hassle. It would be nice if we were able to calculate the average just from knowing what the previous average was, wouldn't it? So you know 5.666… and you get told that the new number to add is 12: how do you get the new average of 7.25 just from that?

I needed to do this and didn't know how, so I sat and thought about it for a short time and it's actually not hard, which was good; I'd just never considered it. So, as long as you know the "current" average number, and you know how many numbers there were in the list, you're all good. Consider: we know the current average is 5.666… and that there were 3 numbers in the list that made that up. We don't need to know what the 3 numbers were (2, 7, 8) because if the three numbers we'd been given before were all 5.666… -- that is, the list of numbers up to now was 5.666…, 5.666…, 5.666… then when we took the average of that list, it would still be 5.666…, because that's what an average means. So, even though we don't know what the 3 numbers were, we can pretend that we do, and now say that our new list is 5.666…, 5.666…, 5.666…, 12. And we can work out the average of that! Or, put another way, we know that the average is

         sum of all numbers
5.666… = ------------------
          count of numbers

and because we can pretend that all the numbers were the average, we can say that the sum of all numbers is just the current average multiplied by the count:

         5.666…, 5.666…, "count" times
5.666… = -----------------------------
                   count

and so the new average is:

              (5.666…, 5.666…, "count" times) + 12
new average = -----------------------------
                       count + 1

which is

              (current average × count) + new number
new average = --------------------------------------
                          count + 1

So if you know the current average a, how many numbers there have been so far c, and the new number n, then the new a = ((a*c)+n)/(c+1). And you only need to keep a and c around, rather than the whole list of numbers.

Simple? Yes. But it was a useful thought for me that I could actually do this without having to keep the list around, which was handy in order to be able to calculate pi very inefficiently with coin flips on a BBC Micro, a perfectly reasonable thing to do on your Saturday evening in my opinion.

  1. maths people, I mean mean, obvs ↩
]]> Stuart Langridge Right to repair AND repurpose https://bryanquigley.com/posts/mindshare/right-to-repair.html https://bryanquigley.com/posts/mindshare/right-to-repair.html Wed, 11 Mar 2026 21:20:49 GMT I wrote up a quick proposal for a right to repair system like the EPA sticker when buying a car. The original requestor isn't going to use it so I'm posting here hoping someone runs with it.

]]> Bryan Quigley Running RISC-V in a VM to test my snaps https://blog.popey.com/2026/02/running-risc-v-in-a-vm-to-test-my-snaps/ https://blog.popey.com/2026/02/running-risc-v-in-a-vm-to-test-my-snaps/ Sat, 21 Feb 2026 15:00:00 GMT tl;dr: I wanted to test one of my snaps on riscv64. I don’t own any RISC-V hardware. I set up a QEMU VM on my ThinkPad, installed Ubuntu desktop inside it, and it actually worked. Slowly. Very slowly. But it worked.

Notepad Next built for riscv processors, running in an Ubuntu VM

I maintain nearly 50 snaps in the Snap Store. Most of the time I test things on my ThinkPad running Ubuntu 24.04 (amd64), or my MacBook Air running Ubuntu Asahi (arm64). That covers the two architectures most people care about. But some of my snaps are built for more… exotic architectures. Things like s390x, ppc64el, and riscv64.

Now, I don’t care massively about s390x or ppc64el – my wife (and UK house construction) has made it abundantly clear that an IBM mainframe in the spare room is a non-starter – but I do care about RISC-V. It feels like the future. Or at least, a very exciting chunk of the future.

The problem? I don’t own any RISC-V hardware.

The hardware question

I recently updated Notepad Next to the latest upstream release and, as I was feeling smug about shipping the update, a tiny voice in the back of my head asked: “Did you actually test this on riscv64?”

Reader, I had not.

Notepad Next is a bit different from some of my other snaps. A lot of what I publish is essentially repackaged upstream .deb files – I only build for the architectures the upstream project builds for. But Notepad Next is built from source, which means I can (and do) target riscv64. Same story for ppc64el and s390x, actually.

Some of my other snaps need specific build tooling or components that haven’t made it to those architectures yet – I haven’t done a proper audit of which ones and why, but it’s on the list. Point is: the Notepad Next riscv64 snap exists and is in the store. Whether it works was the question I’d never answered.

So I started a thread on the Ubuntu Discourse asking whether there was a reasonably priced RISC-V board I could buy that’d run Ubuntu desktop well enough to do basic snap testing. Even just “does the window paint?” would do me.

The response from Heinrich (@xypron) was quick and genuinely excellent. The short version: don’t buy hardware quite yet. Here’s why, and it’s actually quite interesting.

A quick detour into ISA profiles

RISC-V is an open instruction set architecture, which means chip designers have a lot of latitude in what they implement. That’s great for flexibility, but software portability requires some agreement on a baseline. Enter the RVA profiles – essentially standardised bundles of RISC-V extensions that application processors must support.

Up to Ubuntu 24.04 (Noble) and core24, Ubuntu targets RVA20 – a relatively minimal baseline. With Ubuntu 25.10 (Questing) and core26, the requirement jumps to RVA23, which mandates a much richer set of features including the Vector extension (handy for AI/ML workloads and generally going faster) and the Hypervisor extension. RVA23 was only ratified in October 2024.

Here’s the fun bit: as of right now, there are essentially zero RVA23-compliant RISC-V boards you can actually buy. They’re coming – a handful of promising-looking boards from Sipeed, Milk-V, Banana Pi and others are expected around April/May 2026 – but they’re not on shelves yet. Even the Orange Pi RV2, released in March 2025, is RVA20 only, which means it already can’t run Ubuntu 25.10. Ouch.

So buying hardware right now feels like bad timing. A VM, on the other hand, is free and available immediately.

Getting the VM running

Heinrich pointed me at the Canonical docs for running Ubuntu RISC-V in QEMU, which are pretty solid. I hit one snag immediately: the docs reference a -cpu rva23s64 flag in the live server image section, but when I tried it on my Ubuntu 24.04 ThinkPad, QEMU spat back:

qemu-system-riscv64: unable to find CPU model 'rva23s64'

Turns out the version of QEMU in Ubuntu 24.04 is too old to know about RVA23. You need Ubuntu 25.10 or later for that. Since I’m firmly in the LTS camp and have no intention of running a non-LTS release on my daily driver just to get a newer QEMU, I dropped the -cpu flag and carried on with the default CPU emulation – which gives you RVA20, perfectly fine for testing core24-based snaps.

The docs do mention this, to be fair, but the caveat is tucked away in a callout box earlier in the page. If, like me, you navigate directly to the “live server image” section using the right-hand nav, you’ll miss it entirely. I’ve fed that back; hopefully it’ll get bumped up to the prerequisites section where it belongs.

Anyway! Here’s the install script I ended up using, with a couple of tweaks (I bumped the RAM up to 16GB and gave it 4 CPUs because I’m impatient and have RAM to burn):

#!/bin/bash
# https://canonical-ubuntu-hardware-support.readthedocs-hosted.com/boards/how-to/qemu-riscv/
qemu-system-riscv64 \
  -machine virt,acpi=off -m 16G -smp cpus=4 \
  -nographic \
  -kernel /usr/lib/u-boot/qemu-riscv64_smode/u-boot.bin \
  -netdev user,id=net0 \
  -device virtio-net-device,netdev=net0 \
  -device virtio-rng-pci \
  -drive file=disk,format=raw,if=virtio \
  -drive file=ubuntu-24.04.4-live-server-riscv64.iso,format=raw,if=virtio

The server installer runs headlessly (no GUI during install, which is fine). Once Ubuntu Server was installed on the virtual disk, and rebooted, I installed the desktop with sudo apt install ubuntu-desktop. That took a while, but when it finished, I rebooted with a slightly different launch script that adds a virtual GPU and input devices so I can actually get a desktop:

#!/bin/bash
qemu-system-riscv64 \
  -machine virt,acpi=off -m 16G -smp cpus=4 \
  -kernel /usr/lib/u-boot/qemu-riscv64_smode/u-boot.bin \
  -netdev user,id=net0 \
  -device virtio-net-device,netdev=net0 \
  -device virtio-rng-pci \
  -device virtio-gpu-pci \
  -device virtio-keyboard-pci \
  -device virtio-tablet-pci \
  -display gtk \
  -serial mon:stdio \
  -drive file=disk,format=raw,if=virtio

The key additions for desktop use are virtio-gpu-pci (so you get a display), virtio-keyboard-pci, virtio-tablet-pci, and -display gtk to open a window on the host. After a bit of fiddling – and a lot of waiting, because this thing is not quick – I got a working Ubuntu GNOME desktop running inside a RISC-V VM on my ThinkPad.

I was genuinely quite chuffed.

Did the snap work?

Yes! See screenshot at the top of this blog.

I just snap install‘ed Notepad Next (it’s a classic snap, so --classic needed), it launched, the window painted, and I could use it. I’m not going to pretend the experience was snappy (pun very much intended) – it’s CPU emulation all the way down, so every riscv64 instruction is being translated in software by QEMU running on my Intel i5. It’s impressively sluggish. But for the purposes of “does this thing actually run on riscv64”, it absolutely does the job.

This isn’t something I’d use as a daily development environment. It’s more like an on-demand sanity check: spin it up, install the snap, verify it launches, move on with your life.

Aside: I guess I could add some automation here, to spin up a machine and test each of these during the build in a GitHub action…

What about my other snaps?

Honestly, this whole exercise made me realise I should do a proper audit of my snap portfolio and riscv64 support. My current understanding is roughly:

  • Most of my snaps are amd64 only – either because the upstream doesn’t build for other architectures, or because I’m repackaging .deb files and only publishing what upstream provides.
  • telegram-asahi is arm64 only – that one exists specifically for the Apple Silicon Linux crowd.
  • Some build from source and may target riscv64 (and ppc64el and s390x) just fine.
  • Various others are somewhere in between – I suspect some are missing riscv64 builds due to missing build dependencies or tools that haven’t been ported yet, but I haven’t actually investigated.

The plan is to go through each snap and understand why it does or doesn’t build for the interesting architectures, and fix what I can. I’ll report back in another blog post.

What’s next for RISC-V hardware?

If you’re thinking about picking up a RISC-V board right now: it’s complicated. Anything currently available is RVA20, which means it’ll run Ubuntu 24.04 but not Ubuntu 25.10. The genuinely exciting RVA23 hardware (with proper vector support, better performance, etc.) is expected to land around April-May 2026. The DeepComputing Framework laptop mainboard in particular looks very interesting – a RISC-V chip in a Framework 13. Yes please.

For now though, QEMU is your friend. It’s a bit like going to the gym – tedious, slow, not something you’d do for fun – but you come away knowing your snap actually works on the architecture it claims to support. And that’s got to count for something.

Thanks to Heinrich Schuchardt (xypron) from Canonical for the fast and helpful response on Discourse, and for pointing me at the docs.

]]> Alan Pope Introducing pass-exporter - Export your passwords from pass to bitwarden csv format https://foursixnine.io//blog/security/software/2026/02/19/exportingyourpasswordsfrompasstobitwardencsvformat.html https://foursixnine.io//blog/security/software/2026/02/19/exportingyourpasswordsfrompasstobitwardencsvformat.html Thu, 19 Feb 2026 00:00:00 GMT This is a rudimentary attempt (that surprisingly works) to export passwords from pass to Bitwarden csv format

As a requisite you need to have the private key that protects the passwords, exported as an ASCII armored key (Or whatever the nomenclature is), the important bit is that you export it:

gpg --export-secret-keys --armor $YOURFINGERPRINT > private-key.asc

To run simply run, you need to clone the sources from the git repo and inside the directory run:

go run . --private-key private-key.asc --identity alice@example.com

Alternatively you can build it and then run it (Sky is the limit)

You can check usage too by passing --help, It runs fairly fast, and in the end up with a pass_exported_passwords.csv (again see program help for defaults).

A feature that I’d like to add is a support for user plugins, to i.e check if an otp token is duplicated, or if a password is being reused, but that’s for the future

As usual PRs are welcome, specially for adding tests.

PS: “Maybe” I fix the program to be able to be installed via go install $foo (or somebody submits a PR :D)

https://github.com/foursixnine/pass-exporter

]]> Santiago Zarate Python Mutable References with Caching https://soumyadghosh.github.io/website/blog/python-mutable-reference-caching/ https://soumyadghosh.github.io/website/blog/python-mutable-reference-caching/ Sat, 14 Feb 2026 18:08:23 GMT So, while working with caching and scrapping, I understood the difference between immutable and mutable objects/datatypes very clearly. I had a scenario, where I am webscraping an API, the code looks like this.

from aiocache import cached

@cached(ttl=7200)
async def get_forecast(station_id: str) -> list[dict]:
 data: dict = await scrape_weather(station_id)
 # doing some operation
 return forecasts

and then using this utility tool in the endpoint.

async def get_forecast_by_city(
 param: Annotated[StationIDQuery, Query()],
) -> list[UpcomingForecast]:
 forecasts_dict: list[dict] = await get_forecast(param.station_id)
 forecasts_dict.reversed()

 forecasts: deque[UpcomingForecast] = deque([])
 for forecast in forecasts_dict:
 date_delta: int = (
 date.fromisoformat(forecast["forecast_date"]) - date.today()
 ).days
 if date_delta <= 0:
 break
 forecasts.appendleft(UpcomingForecast.model_validate(forecast))

 return list(forecasts)

But, here is the gotcha, something I was doing inherently wrong. Lists in python are mutable objects. So, reversing the list modifies the list in place, without creating a new reference of the list. My initial approach was to do this

]]> Soumyadeep Ghosh Smart DCA Strategy – Meet DCAi That Times the Dip The Open Source Machine Learning https://utappia.org/2026/02/13/smart-dca-strategy-machine-learning-dcai/ https://utappia.org/2026/02/13/smart-dca-strategy-machine-learning-dcai/ Fri, 13 Feb 2026 17:57:58 GMT Is your Dollar Cost Averaging strategy “blind”? Buying on the 1st of the month is disciplined, but buying during a crash is profitable. Here is how the open source Smart DCA Strategy, based on K-Nearest Neighbors (KNN) algorithm can help you aggressively buy the dips and preserve cash when the market is overheated.

A few months ago, I analyzed a research paper on “Smart DCA Strategy” and developed a TradingView PineScript indicator to implement it. The original concept was useful—it calculated the ideal investment amount based on price levels—but it lacked a crucial element: Timing.

I didn’t just want to know how much to buy with my DCA strategy;

I needed to know when to deploy that capital for maximum, long term impact.

By integrating Machine Learning into the Smart DCA Strategy, I programmed the indicator to identify “fair value” based on historical price action. The result? A system that signals exactly when to enter and how much to commit, giving you the psychological confidence that you aren’t just buying at random.

I call it DCAi (DCA + AI)…. yeah I know right… what a name 😛

DCAi – The Machine Learning Strategy That Times the Dip

What is DCAi?

Think of DCAi as an intelligent Ai assistant that scans market history inside TradingView.

  • When the market rallies: The assistant warns you: “Do not buy now. The price is overextended. Keep your cash in the ‘Savings Pot’ and wait for the next correction.”
  • When the market drops: It scans historical data to see if similar price structures in the past led to a recovery. If the algorithm identifies a high statistical probability of a bounce, it signals a Buy.

Why DCAi Smart DCA Strategy Outperforms Traditional DCA

The fact is that the standard DCA builds discipline. However, it is a static strategy — you buy the same amount on the same day, regardless of whether the market is crashing or “mooning“. DCAi is a Smart DCA Strategy that introduces three dynamic concepts to optimize your returns:

1. Dynamic Sizing (The Rho Parameter)

In your standard monthly DCA, you invest $100 whether Bitcoin is at $100,000 or $20,000.

In contrast, the DCAi the Rho parameter to adjust your exposure.

  • How it works: instead of a fixed amount, the DCAi measures the deviation of the current price from its historical average.
    • Flat Market: It invests your base budget.
    • Market Crash: If the price drops significantly (e.g., -40%), the algorithm aggressively increases the buy amount, allowing you to lower your average entry price faster.

2. Statistical Confidence (KNN Algorithm)

The DCAi system doesn’t “predict” the future; it compares the present to the past using the K-Nearest Neighbors (KNN) algorithm.

  • How it works: KNN looks for historical moments where technical indicators (like volume and volatility) mirrored today’s price action. If the majority of those historical instances resulted in an uptrend, the system generates a signal with a “Confidence Score.”

3. The “Savings Pot” in the DCAi – Smart DCA Strategy

If the market is in a parabolic uptrend (“Mooning”) and there are no safe entry points, DCAi will try to prevent you from buying the top.

  • How it works: If the Machine Learning model detects low confidence for the month, it halts trading. Your monthly budget is moved to a virtual Savings Pot.
  • The Advantage: This cash accumulates. When a major correction finally occurs, you have a stockpile of “dry powder” ready to deploy at the bottom.

The Limitations: No Algorithm is Magic so is the DCAi Smart DCA Strategy

DCAi is a powerful tool, but it has limitations you must understand and accept:

  • False Signals: Historical probability does not guarantee future performance. The market can signal a buy, yet the price may continue to fall.
  • Overfitting: The algorithm learns from known history. If a “Black Swan” event occurs (a scenario never seen before), the model may misinterpret the data.
  • Lag: DCAi confirms signals on candle closes (e.g., Daily close). In a rapid V-shape recovery, you might buy slightly higher than the absolute bottom.
  • Platform Limits: TradingView limits the script’s “memory” to about 3,000 candles. For this reason, Daily (D) or Weekly (W) timeframes are highly recommended.

Recommendation: Always backtest and forward-test using Paper Trading for 1-3 months before using real capital.

Step-by-Step Installation Guide

Ready to automate your analysis? Follow these steps to set up DCAi on TradingView.

1. Install the Script

Open your chart on TradingView and locate the Pine Editor tab at the bottom.

Clear any existing code in the editor.

DCAi pine script

Copy the official DCAi code:

dcai.pine

Paste the code, click Save, and then select “Add to chart”.

dcai add to the chart

Once you add it, it will start the training to past price action data and it will look like :

Smart DCA Strategy DCAi Strategy Indicator

2. Asset Configuration

DCAi requires different settings for Crypto versus Stocks. You must configure it for the asset you are trading.

DCAi indicator Smart DCA Strategy
  1. Click the Settings (gear icon) on the DCAi indicator.
  2. Select your Asset Class (Crypto, Stocks, Indices, or Commodities).
  3. Set your Start Date (e.g., the 1st of the current month).
  4. Set your Base Monthly Budget (e.g., $100). This is the amount you would spend in a standard DCA strategy.
  5. Crucial: Ensure your chart is on the Daily Timeframe.
  6. Select the ticker based on the Asset Class you choose

3. Smart DCA Strategy Execution

Once set up, patience is key.

  • No Signal? If a month passes without a signal, do not spend your budget. Keep it in your “account”. The script will automatically add the months amount to your “Savings Pot” on the dashboard.
  • Buy Signal? The chart will display a label with the exact amount to invest.
    • Example: If the label says $124, it means the algorithm is using your $100 monthly budget plus $24 from your accumulated savings to buy the dip.
Smart DCA Strategy DCAi settings

Where to Execute Your Trades

Once DCAi gives the signal, you need a platform with low fees and flexible execution. Here are two recommendations with signup bonuses:

For Bitcoin (The “Bitcoin Only” Strategy):

Strike is the superior choice for pure Bitcoin accumulation due to its minimal fees.

For ETFs & Stocks (e.g., S&P 500):

If you are building a diversified portfolio, Trading 212 is ideal for fractional investing (you can invest as little as €1).

  1. 👉 Open a Trading 212 account and get a free share (Promo valid until March 4, 2026).
  2. Create a free virtual Visa card and add it to Apple/Google Wallet (Earn 1.5% cashback on investments. Promo ends in 02/28 ).
  3. Instant, fee-free deposits via Google/Apple Pay.

Conclusion

The goal of any robust investment strategy is to remove emotion from the equation. DCAi achieves this by adding a layer of algorithmic intelligence to the proven discipline of Dollar Cost Averaging. Whether you are stacking Sats or accumulating ETFs, having a machine learning model tell you when to be aggressive and when to sit on your hands is the ultimate portfolio upgrade.

Next Step: Download the code, run your own backtests, and see how much lower your average entry price could be!

Join the Community:

Did you find settings that work perfectly for a specific asset? Share your results in our GitHub Discussions:

Disclaimer: Investments involve risk. DCAi is a technical analysis tool, not financial advice or a guarantee of profit. Always conduct your own due diligence.

The post Smart DCA Strategy – Meet DCAi That Times the Dip The Open Source Machine Learning appeared first on Utappia.

]]> Salih Emin REST API Development with Qt 6 https://steveire.wordpress.com/2026/01/14/rest-api-development-with-qt-6/ https://steveire.wordpress.com/2026/01/14/rest-api-development-with-qt-6/ Wed, 14 Jan 2026 11:58:06 GMT This post describes an experiment using Qt 6.7’s REST APIs to explore Stripe’s payment model, and what I learned building a small desktop developer tool.

Recent Qt releases have included several conveniences for developing clients of remote REST APIs. I recently tried it out with the Stripe payments REST API to get to grips with the Qt REST API in the real world. The overloading of the term API is unhelpful, I find, but hopefully not too confusing here.

As with almost everything I try out, I created Qt desktop tooling as a developer aid to exploring the Stripe API and its behavior. Naming things is hard, but given that I want to put a “Q” in the name, googling “cute stripes” gives lots of hits about fashion, and the other too-obvious-to-say pun, I’ve pushed it to GitHub as “Qashmere“:

setAlternatingRowColors(true);

Developers using REST APIs will generally be familiar with existing tooling such as Postman and Bruno, for synthesizing calls to collections of REST APIs. Indeed, Qashmere uses the Stripe Postman JSON definition to present the collection of APIs and parameters. Such tools have scripting interfaces and state to create workflows that a client of the REST API needs to support, like “create a payment, get the id of the payment back from the REST API and then cancel the payment with the id”, or “create a payment, get the id of the payment back from the REST API and then confirm it by id with a given credit card”.

So why create Qashmere? In addition to REST APIs, Stripe maintains objects which change state over time. The objects remain at REST until acted on by an external force, and when such an action happens a notification is sent to clients about those state changes, giving them a chance to react. I wanted to be able to collect the REST requests/responses and the notified events and present them as they relate to the Stripe objects. Postman doesn’t know about events or about Stripe objects in particular, except that it is possible to write a script in Postman to extract the object which is part of a JSON payload. Postman also doesn’t know that if a Payment Intent is created, there are a subset of next steps which could be in a workflow, such as cancel, capture or confirm payment etc.

Something that I discovered in the course of trying this out is that when I confirm a Payment Intent, a new Charge object is created and sent to me with the event notification system. Experimental experiences like that help build intuition.

Stripe operates with real money, but it also provides for sandboxes where synthetic payments, customers etc can be created and processed with synthetic payment methods and cards. As Qashmere is only useful as a developer tool or learning aid, it only works with Stripe sandboxes.

Events from Stripe are sent to pre-configured web servers owned by the client. The web servers need to have a public IP address, which is obviously not appropriate for a desktop application. A WebSocket API would be more suitable and indeed the stripe cli tool uses a WebSocket to receive events, but the WebSocket protocol is not documented or stable. Luckily the stripe cli tool can be used to relay events to another HTTP server, so Qashmere runs a QHttpServer for that purpose.

Implementation with Qt REST API

The QRestReply wraps a QNetworkReply pointer and provides convenience API for accessing the HTTP return code and for creating a QJsonDocument from the body of the response. It must be created manually if using QNetworkAccessManager directly. However the new QRestAccessManager wraps a QNetworkAccessManager pointer, again to provide convenience APIs and overloads for making requests that are needed in REST APIs (though some less common verbs like OPTIONS and TRACE are not built-in). The QRestAccessManager has conveniences like overloads that provide a way to supply callbacks which already take the QRestReply wrapper object as a parameter. If using a QJsonDocument request overload, the “application/json” Content-Type is automatically set in the header.

One of the inconveniences of QRestAccessManager is that in Qashmere I use an external definition of the REST API from the Postman definition which includes the HTTP method. Because the QRestAccessManager provides strongly typed API for making requests I need to do something like:

if (method == "POST") {
    rest.post(request, requestData, this, replyHandler);
} else if (method == "GET") {
    rest.get(request, this, replyHandler);
} else if (method == "DELETE") {
    rest.deleteResource(request, this, replyHandler);
}

There is a sendCustomRequest class API which can be used with a string, but it does not have an overload for QJsonDocument, so the convenience of having the Content-Type header set is lost. This may be an oversight in the QRestAccessManager API.

Another missing feature is URL parameter interpolation. Many REST APIs are described as something like /v1/object/:object_id/cancel, and it would be convenient to have a safe way to interpolate the parameters into the URL, such as:

QUrl result = QRestAccessManager::interpolatePathParameters(
    "/v1/accounts/:account_id/object/:object_id/cancel", {
        {"account_id", "acc_1234"},
        {"object_id", "obj_5678"}
    }
);

This is needed to avoid bugs such as a user-supplied parameter containing a slash for example.

Coding Con Currency

In recent years I’ve been writing and reading more Typescript/Angular code which consumes REST services, and less C++. I’ve enjoyed the way Promises work in that environment, allowing sequences of REST requests, for example, to be easy to write and read. A test of a pseudo API could await on requests to complete and invoke the next one with something like:

requestFactory.setBaseURL("http://some_service.com");
async testWorkflow(username: string, password: string) {
    const loginRequest = requestFactory.makeRequest("/login");
    const loginRequestData = new Map();
    loginRequestData.setParam("username", username);
    loginRequestData.setParam("password", password);
    const loginResponse = await requestAPI.post(
        loginRequest, loginRequestData);
    const bearerToken = loginResponse.getData();
    requestAPI.setBearerToken(bearerToken);
    const listingRequest = requestFactory.makeRequest("/list_items");
    const listingResponse = await requestAPI.get(listingRequest);
    const listing = JSON.parse(listingResponse.getData());
    const firstItemRequest = requestFactory.makeRequest(
        "/retrieve_item/:item_id", 
        {
            item_id: listing[0].item_id
        }
    );
    const firstItem = await requestAPI.get(firstItemRequest);
}

The availability of async functions and the Promise to await on make a test like this quite easy to write, and the in-application use of the API uses the same Promises, so there is little friction between application code and test code.

I wanted to see if I can recreate something like that based on the Qt networking APIs. I briefly tried using C++20 coroutines because they would allow a style closer to async/await, but the integration friction with existing Qt types was higher than I wanted for an experiment.

Using the methods in QtFuture however, we already have a way to create objects representing the response from a REST API. The result is similar to the Typescript example, but with different ergonomics, using .then instead of the async and await keywords.

struct RestRequest
{
    QString method;
    QString requestUrl;
    QHttpHeaders headers;
    QHash<QString, QString> urlParams;
    QUrlQuery queryParams;
    std::variant<QUrlQuery, QJsonDocument> requestData;
};
struct RestResponse
{
    QJsonDocument jsonDoc;
    QHttpHeaders headers;
    QNetworkReply::NetworkError error;
    QUrl url;
    int statusCode;
};
QFuture<RestResponse> makeRequest(RestRequest restRequest)
{
    auto url = interpolatePathParameters(
        restRequest.requestUrl, 
        restRequest.urlParams);
    auto request = requestFactory.createRequest(url);
    auto requestBodyDoc = extractRequestContent(restRequest.requestData);
    auto requestBody = requestBodyDoc.toJson(QJsonDocument::Compact);
    auto reply = qRestManager.sendCustomRequest(request,
                                                restRequest.method.toUtf8(),
                                                requestBody,
                                                &qnam,
                                                [](QRestReply &) {});
    return QtFuture::connect(reply, &QNetworkReply::finished).then(
        [reply]() {
            QRestReply restReply(reply);
    
            auto responseDoc = restReply.readJson();
            if (!responseDoc) {
                throw std::runtime_error("Failed to read response");
            }
    
            RestResponse response;
            response.jsonDoc = *responseDoc;
            response.statusCode = restReply.httpStatus();
            response.error = restReply.error();
            response.headers = reply->headers();
            response.url = reply->url();
    
            return response;
        }
    );
}

The QRestAccessManager API requires the creation of a dummy response function when creating a custom request because it is not really designed to be used this way. The result is an API accepting a request and returning a QFuture with the QJsonDocument content. While it is possible for a REST endpoint to return something else, we can follow the Qt philosophy of making the most expected case as easy as possible, while leaving most of the rest possible another way. This utility makes writing unit tests relatively straightforward too:

RemoteAPI remoteApi;
remoteApi.setBaseUrl(QUrl("https://dog.ceo"));
auto responseFuture = remoteApi.makeRequest(
    {"GET",
     "api/breed/:breed/:sub_breed/images/random",
     {},
     {
         {"breed", "wolfhound"}, 
         {"sub_breed", "irish"}
     }});
QFutureWatcher<RestResponse> watcher;
QSignalSpy spy(&watcher, &QFutureWatcherBase::finished);
watcher.setFuture(responseFuture);
QVERIFY(spy.wait(10000));
auto jsonObject = responseFuture.result().jsonDoc.object();
QCOMPARE(jsonObject["status"], "success");
QRegularExpression regex(
    R"(https://images\.dog\.ceo/breeds/wolfhound-irish/[^.]+.jpg)");
QVERIFY(regex.match(jsonObject["message"].toString()).hasMatch());

The result is quite similar to the Typescript above, but only because we can use spy.wait. In application code, we still need to use .then with a callback, but we can additionally use .onFailed and .onCanceled instead of making multiple signal/slot connections.

With the addition of QtFuture::whenAll, it is easy to make multiple REST requests at once and react when they are all finished, so perhaps something else has been gained too, compared to a signal/slot model:

RemoteAPI remoteApi;
remoteApi.setBaseUrl(QUrl("https://dog.ceo"));
auto responseFuture = remoteApi.requestMultiple({
    {
        "GET",
        "api/breeds/list/all",
    },
    {"GET",
     "api/breed/:breed/:sub_breed/images/random",
     {},
     {{"breed", "german"}, {"sub_breed", "shepherd"}}},
    {"GET",
     "api/breed/:breed/:sub_breed/images/random/:num_results",
     {},
     {{"breed", "wolfhound"}, 
     {"sub_breed", "irish"}, 
     {"num_results", "3"}}},
    {"GET", "api/breed/:breed/list", {}, {{"breed", "hound"}}},
});
QFutureWatcher<QList<RestResponse>> watcher;
QSignalSpy spy(&watcher, &QFutureWatcherBase::finished);
watcher.setFuture(responseFuture);
QVERIFY(spy.wait(10000));
auto four_responses = responseFuture.result();
QCOMPARE(four_responses.size(), 4);
QCOMPARE(four_responses[0].jsonDoc.object()["status"], "success");
QVERIFY(four_responses[0].jsonDoc.object()["message"].
    toObject()["greyhound"].isArray());
QRegularExpression germanShepherdRegex(
    R"(https://images.dog.ceo/breeds/german-shepherd/[^.]+.jpg)");
QCOMPARE(four_responses[1].jsonDoc.object()["status"], "success");
QVERIFY(germanShepherdRegex.match(
    four_responses[1].jsonDoc.object()["message"].toString()).hasMatch());
QRegularExpression irishWolfhoundRegex(
    R"(https://images.dog.ceo/breeds/wolfhound-irish/[^.]+.jpg)");
QCOMPARE(four_responses[2].jsonDoc.object()["status"], "success");
auto irishWolfhoundList = 
    four_responses[2].jsonDoc.object()["message"].toArray();
QCOMPARE(irishWolfhoundList.size(), 3);
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[0].toString()).
    hasMatch());
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[1].toString()).
    hasMatch());
QVERIFY(irishWolfhoundRegex.match(irishWolfhoundList[2].toString()).
    hasMatch());
QCOMPARE(four_responses[3].jsonDoc.object()["status"], "success");
auto houndList = four_responses[3].jsonDoc.object()["message"].toArray();
QCOMPARE_GE(houndList.size(), 7);
QVERIFY(houndList.contains("afghan"));
QVERIFY(houndList.contains("basset"));
QVERIFY(houndList.contains("blood"));
QVERIFY(houndList.contains("english"));
QVERIFY(houndList.contains("ibizan"));
QVERIFY(houndList.contains("plott"));
QVERIFY(houndList.contains("walker"));

setAutoDeleteReplies(false);

I attempted to use new API additions in recent Qt 6 versions to interact with a few real-world REST services. The additions are valuable, but it seems that there are a few places where improvements might be possible. My attempt to make the API feel closer to what developers in other environments might be accustomed to had some success, but I’m not sure QFuture is really intended to be used this way.
Do readers have any feedback? Would using QCoro improve the coroutine experience? Is it very unusual to create an application with QWidgets instead of QML these days? Should I have used PyQt and the python networking APIs?

]]> Stephen Kelly Free software activity in November 2025 https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2025-11.html https://www.chiark.greenend.org.uk/~cjwatson/blog/activity-2025-11.html Thu, 04 Dec 2025 17:55:59 GMT My Debian contributions this month were all sponsored by Freexian. I had a bit less time than usual, because Freexian collaborators gathered in Marseille this month for our yearly sprint, doing some planning for next year.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

I began preparing for the second stage of the GSS-API key exchange package split (some details have changed since that message). It seems that we’ll need to wait until Ubuntu 26.04 LTS has been released, but that’s close enough that it’s worth making sure we’re ready. This month I just did some packaging cleanups that would otherwise have been annoying to copy, such as removing support for direct upgrades from pre-bookworm. I’m considering some other package rearrangements to make the split easier to manage, but haven’t made any decisions here yet.

This also led me to start on a long-overdue bug triage pass, mainly consisting of applying usertags to lots of our open bugs to sort them by which program they apply to, and also closing a few that have been fixed, since some bugs will eventually need to be reassigned to GSS-API packages and it would be helpful to make them easier to find. At the time of writing, about 30% of the bug list remains to be categorized this way.

Python packaging

I upgraded these packages to new upstream versions:

I packaged django-pgtransaction and backported it to trixie, since we plan to use it in Debusine; and I adopted python-certifi for the Python team.

I fixed or helped to fix several other build/test failures:

I fixed a couple of other bugs:

Other bits and pieces

Code reviews

]]> Colin Watson Think you can’t interpose static binaries with LD_PRELOAD? Think again! https://balintreczey.hu/blog/think-you-cant-interpose-static-binaries-with-ld_preload-think-again/ https://balintreczey.hu/blog/think-you-cant-interpose-static-binaries-with-ld_preload-think-again/ Thu, 20 Nov 2025 20:56:17 GMT

Well, you are right, you can’t. At least not directly. This is well documented in many projects relying on interposing binaries, like faketime.

But what if we could write something that would take a static binary, replace at least the direct syscalls with ones going through libc and load it with the dynamic linker? We are in luck, because the excellent QEMU project has a user space emulator! It can be compiled as a dynamically linked executable, honors LD_PRELOAD and uses the host libc’s syscall – well, at least sometimes. Sometimes syscalls just bypass libc.

The missing piece was a way to make QEMU always take the interposable path and call the host libc instead of using an arch-specifix assembly routine (`safe_syscall_base`) to construct the syscall and going directly to the kernel. Luckily, this turned out to be doable. A small patch later, QEMU gained a switch that forces all syscalls through libc. Suddenly, our static binaries started looking a lot more dynamic!

$ faketime '2008-12-24 08:15:42'  qemu-x86_64 ./test_static_clock_gettime
2008-12-24 08:15:42.725404654
$ file test_static_clock_gettime 
test_clock_gettime: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, ...

With this in place, Firebuild can finally wrap even those secretive statically linked tools. QEMU runs them, libc catches their syscalls, LD_PRELOAD injects libfirebuild.so, and from there the usual interposition magic happens. The result: previously uncachable build steps can now be traced, cached, and shortcut just like their dynamic friends.

There is one more problem though. Why would the static binaries deep in the build be run by QEMU? Firebuild also intercepts the `exec()` calls and now it rewrites them on the fly whenever the executed binary would be statically linked!

$ firebuild -d comm bash -c ./test_static
...
FIREBUILD: fd 9.1: ({ExecedProcess 161077.1, running, "bash -c ./test_static", fds=[0: {FileFD ofd={FileO
FD #0 type=FD_PIPE_IN r} cloexec=false}, 1: {FileFD ofd={FileOFD #3 type=FD_PIPE_OUT w} {Pipe #0} close_o
n_popen=false cloexec=false}, 2: {FileFD ofd={FileOFD #4 type=FD_PIPE_OUT w} {Pipe #1} close_on_popen=fal
se cloexec=false}, 3: {FileFD NULL} /* times 2 */]})
{
    "[FBBCOMM_TAG]": "exec",
    "file": "test_static",
    "// fd": null,
    "// dirfd": null,
    "arg": [
        "./test_static"
    ],
    "env": [
        "SHELL=/bin/bash",
 ...
        "FB_SOCKET=/tmp/firebuild.cpMn75/socket",
        "_=./test_static"
    ],
    "with_p": false,
    "// path": null,
    "utime_u": 0,
    "stime_u": 1017
}
FIREBUILD: -> proc_ic_msg()  (message_processor.cc:782)  proc={ExecedProcess 161077.1, running, "bash -c 
./test_static", fds=[0: {FileFD ofd={FileOFD #0 type=FD_PIPE_IN r} cloexec=false}, 1: {FileFD ofd={FileOF
D #3 type=FD_PIPE_OUT w} {Pipe #0} close_on_popen=false cloexec=false}, 2: {FileFD ofd={FileOFD #4 type=F
D_PIPE_OUT w} {Pipe #1} close_on_popen=false cloexec=false}, 3: {FileFD NULL} /* times 2 */]}, fd_conn=9.
1, tag=exec, ack_num=0
FIREBUILD:   -> send_fbb()  (utils.cc:292)  conn=9.1, ack_num=0 fd_count=0
Sending message with ancillary fds []:
{
    "[FBBCOMM_TAG]": "rewritten_args",
    "arg": [
        "/usr/bin/qemu-user-interposable",
        "-libc-syscalls",
        "./test_static"
    ],
    "path": "/usr/bin/qemu-user-interposable"
}
...
FIREBUILD: -> accept_ic_conn()  (firebuild.cc:139)  listener=6
...
FIREBUILD: fd 9.2: ({Process NULL})
{
    "[FBBCOMM_TAG]": "scproc_query",
    "pid": 161077,
    "ppid": 161073,
    "cwd": "/home/rbalint/projects/firebuild/test",
    "arg": [
        "/usr/bin/qemu-user-interposable",
        "-libc-syscalls",
        "./test_static"
    ],
    "env_var": [
        "CCACHE_DISABLE=1",
...
        "SHELL=/bin/bash",
        "SHLVL=0",
        "_=./test_static"
    ],
    "umask": "0002",
    "jobserver_fds": [],
    "// jobserver_fifo": null,
    "executable": "/usr/bin/qemu-user-interposable",
    "// executed_path": null,
    "// original_executed_path": null,
    "libs": [
        "/lib/x86_64-linux-gnu/libatomic.so.1",
        "/lib/x86_64-linux-gnu/libc.so.6",
        "/lib/x86_64-linux-gnu/libglib-2.0.so.0",
        "/lib/x86_64-linux-gnu/libm.so.6",
        "/lib/x86_64-linux-gnu/libpcre2-8.so.0",
        "/lib64/ld-linux-x86-64.so.2"
    ],
    "version": "0.8.5.1"
}

The QEMU patch is forwarded to qemu-devel. If it lands, anyone using QEMU user-mode emulation could benefit — not just Firebuild.

For Firebuild users, though, the impact is immediate. Toolchains that mix dynamic and static helpers? Cross-builds that pull in odd little statically linked utilities? Previously “invisible” steps in your builds? All now fair game for caching.

Firebuild 0.8.5 ships this new capability out of the box. Just update, make sure you’re using a patched QEMU, and enjoy the feeling of watching even static binaries fall neatly into place in your cached build graph. Ubuntu users can get the prebuilt patched QEMU packages from the Firebuild PPA already.

Static binaries, welcome to the party!

]]> Balint Reczey It's NOT always DNS. https://notes.pault.ag/its-not-always-dns/ https://notes.pault.ag/its-not-always-dns/ Mon, 27 Oct 2025 17:15:00 GMT I’ve written down a new rule (no name, sorry) that I’ll be repeating to myself and those around me. “If you can replace ‘DNS’ with ‘key value store mapping a name to an ip’ and it still makes sense, it was not, in fact, DNS.” Feel free to repeat it along with me.

Sure, the “It’s always DNS” meme is funny the first few hundred times you see it – but what’s less funny is when critical thinking ends because a DNS query is involved. DNS failures are often the first observable problem because it’s one of the first things that needs to be done. DNS is fairly complicated, implementation-dependent, and at times – frustrating to debug – but it is not the operational hazard it’s made out to be. It’s at best a shallow take, and at worst actively holding teams back from understanding their true operational risks.

IP connectivity failures between a host and the rest of the network is not a reason to blame DNS. This would happen no matter how you distribute the updated name to IP mappings. Wiping out all the records during the course of operations due to an automation bug is not a reason to blame DNS. This, too, would happen no matter how you distribute the name to IP mappings. Something made the choice to delete all the mappings, and it did what you asked it to do

There’s plenty of annoying DNS specific sharp edges to blame when things do go wrong (like 8.8.8.8 and 1.1.1.1 disagreeing about resolving a domain because of DNSSEC, or since we’re on the topic, a DNSSEC rollout bricking prod for hours) for us to be cracking jokes anytime a program makes a DNS request.

We can do better.

]]> Paul Tagliamonte Sound Removals https://blog.jak-linux.org/2025/10/18/sound-removals/ https://blog.jak-linux.org/2025/10/18/sound-removals/ Sat, 18 Oct 2025 19:37:17 GMT Problem statement

Currently if you have an automatically installed package A (= 1) where

  • A (= 1) Depends B (= 1)
  • A (= 2) Depends B (= 2)

and you upgrade B from 1 to 2; then you can:

  1. Remove A (= 1)
  2. Upgrade A to version 2

If A was installed by a chain initiated by Recommends (say X Rec Y, Y Depends A), the solver sometimes preferred removing A (and anything depending on it until it got).

I have a fix pending to introduce eager Recommends which fixes the practical case, but this is still not sound.

In fact we can show that the solver produces the wrong result for small minimal test cases, as well as the right result for some others without the fix (hooray?).

Ensuring sound removals is more complex, and first of all it begs the question: When is a removal sound? This, of course, is on us to define.

An easy case can be found in the Debian policy, 7.6.2 “Replacing whole packages, forcing their removal”:

If B (= 2) declares a Conflicts: A (= 1) and Replaces: A (= 1), then the removal is valid. However this is incomplete as well, consider it declares Conflicts: A (< 1) and Replaces: A (< 1); the solution to remove A rather than upgrade it would still be wrong.

This indicates that we should only allow removing A if the conflicts could not be solved by upgrading it.

The other case to explore is package removals. If B is removed, A should be removed as well; however it there is another package X that Provides: B (= 1) and it is marked for install, A should not be removed. That said, the solver is not allowed to install X to satisfy the depends B (= 1) - only to satisfy other dependencies [we do not want to get into endless loops where we switch between alternatives to keep reverse dependencies installed].

Proposed solution

To solve this, I propose the following definition:

Definition (sound removal): A removal of package P is sound if either:

  1. A version v is installed that package-conflicts with B.
  2. A package Q is removed and the installable versions of P package-depends on Q.

where the other definitions are:

Definition (installable version): A version v is installable if either it is installed, or it is newer than an installed version of the same package (you may wish to change this to accomodate downgrades, or require strict pinning, but here be dragons).

Definition (package-depends): A version v package-depends on a package B if either:

  1. there exists a dependency in v that can be solved by any version of B, or
  2. there exists a package C where v package-depends C and any (c in C) package-depends B (transitivity)

Definition (package-conflicts): A version v package-conflicts with an installed package B if either:

  1. it declares a conflicts against an installable version of B; or
  2. there exists a package C where v package-conflicts C, and b package-depends C for installable versions b.

Translating this into a (modified) SAT solver

One approach may be to implement the logic in the conflict analysis that drives backtracking, i.e. we assume a package A and when we reach not A, we analyse if the implication graph for not A constitutes a sound removal, and then replace the assumption A with the assumption A or "learned reason.

However, while this seems a plausible mechanism for a DPLL solver, for a modern CDCL solver, it’s not immediately evident how to analyse whether not A is sound if the reason for it is a learned clause, rather than a problem clause.

Instead we propose a static encoding of the rules into a slightly modified SAT solver:

Given c1, …, cn that transitive-conflicts A and D1, …, Dn that A package-depends on, introduce the rule:

A unless c1 or c2 or ... cn ... or not D1 or not D2 ... or not Dn

Rules of the form A... unless B... - where A... and B... are CNF - are intuitively the same as A... or B..., however the semantic here is different: We are not allowed to select B... to satisfy this clause.

This requires a SAT solver that tracks a reason for each literal being assigned, such as solver3, rather than a SAT solver like MiniSAT that only tracks reasons across propagation (solver3 may track A depends B or C as the reason for B without evaluating C, whereas MiniSAT would only track it as the reason given not C).

Is it actually sound?

The proposed definition of a sound removal may still proof unsound as I either missed something in the conclusion of the proposed definition that violates my goal I set out to achieve, or I missed some of the goals.

I challenge you to find cases that cause removals that look wrong :D

]]> Julian Andres Klode Why I Won’t Be Attending or Speaking at Ubuntu Summit 25.10 https://ericheickmeyer.com/2025/10/09/why-i-wont-be-attending-or-speaking-at-ubuntu-summit-25-10/ https://ericheickmeyer.com/2025/10/09/why-i-wont-be-attending-or-speaking-at-ubuntu-summit-25-10/ Thu, 09 Oct 2025 22:01:09 GMT Ubuntu Summit’s decision to go exclusively online, with the exception of those speaking at the Summit in London, UK, is anti-collaborative and turns its back on the very people who make Ubuntu what it is: its community of volunteers and developers. Ubuntu Summit was created from the dust of the Ubuntu Developer Summit in 2022 to recognize the community. It no longer serves that purpose.

As many know, I have been the lead of Ubuntu Studio for more than 7 years. I’m the longest-tenured Ubuntu Studio lead. I owe much of the foundation that was built to my predecessors: Luke Yelavich (founder), Scott Lavender, Kaj Ailomaa, and Set Halstrom. It is a true labor of love for me, and is the foundation for much of what I do.

I have worked myself through the ranks of Ubuntu, becoming a small-time packager for a small set of Ubuntu packages, then the Ubuntu Studio packageset, moving up to MOTU (Master of the Universe). I also served on the Ubuntu Community Council and am a current Discourse moderator.

Community and the love of people is a huge motivation for me. Granted, for those first four years, I hadn’t ever met the people I was collaborating with to make Ubuntu Studio what it is.

Then in August 2022, I was invited to attend the first ever Ubuntu Summit 2022 in Prague, Czechia. Having never travelled abroad before and never having even been off the continent of North America, itself a challenge as getting a U.S. passport is neither cheap nor easy, I was reluctant at first. Then I managed to get my passport, as well as the funds and passports to bring my wife and son to Ubuntu Summit.

That experience changed my life and the life of my entire family. My son, 10 at the time, was the youngest registered attendee. My wife was inspired to bring back Edubuntu, which had been defunct for nine long years by the time it was revived that following spring.

These are the things that happen when you have personal connections with people. If you’ve never read the book before, I encourage you to read Hardwired to Connect, which is a research paper published by a bunch of scientists. In essence, it says that people’s brains are wired, from birth, to engage in communities in for personal, in-person connections. It’s a scientific study that took years and is an excellent introduction to why we are the way we are.

Much of my education revolves around the very idea of building personal communities, which is one reason I was appalled when Ubuntu Summit, starting with 25.10, while it would be twice a year, it would be online-only except for the speakers. Having spoken at the past three, I was planning to take a year off from speaking, while still being there to represent as an Ubuntu Flavor Lead with my wife, also a now Flavor Lead.

If it weren’t for that initial Ubuntu Summit, in person, my wife and son would not have been as interested or as involved as they are today. The subsequent years only strengthened that involvement.

Now, it’s going to be an online-focused approach. I get it. It’s cheaper and easier. Also, those attending online were just watching a livestream anyhow. The Local Communities (LoCos) can get together on their own if they want to do a big event. It’s easier to reach more people if you do everything online.

Except it’s not.

For instance, the nearest active LoCo to me, in the Seattle-Tacoma area, is the Southern California LoCo. Meetups with them are logistically impossible. Same if I were to go to the Arizona LoCo; it’s just not possible. Most of the states in the United States are huge, so if there were one LoCo per state, it wouldn’t be correct. To be honest, I have no desire, time, or energy left to start and lead a LoCo in my area. Besides that, there used to be one for my state, but it’s long gone.

Furthermore, with the exception of me and my wife, us flavor leads are scattered to the globe. It used to be that we would meet online throughout the year every other month and then meet together once a year at Ubuntu Summit. That’s gone now.

Again, I get it. Canonical is a company that is and always has been majority remote work. Except for one thing: they get together twice a year in-person, and are even given T-Shirts to celebrate the immediately-prior release which was partially built by volunteers. Those of us who give our time, energy, and effort to the Ubuntu community aren’t given that in-person experience, let alone a T-Shirt. The very lifeblood of what makes Ubuntu so great isn’t given the ability to meet in-person. That’s been stripped from us, and it came as a complete surprise.

I’m not without ideas for solutions to problems, though. Rather than be completely destructive in this post, I can be constructive. My solution to this would be a compromise:

  • Have the Summit be in-person once a year following the yy.04 release
    • Have that one go back to being what it was. It can either have booths like 2024 did or go back to being talk/workshop-focused like years prior. It doesn’t matter, it just needs to be in-person.
  • Have the Summit be online once a year following the yy.10 release

I don’t think this is too much to ask. The reward of personal connections when doing something remote for most of the year is a small price to pay, no matter the cost. Personal connections are tantamount to a healthy community.

I think my compromise would prevent the Summit from dying just like the Ubuntu Developer Summit did once it went online-only. The way I see it is with the current status-quo, history is repeating itself.

I’m sure people at Canonical don’t see it this way because they meet with the people they work with the most twice a year. Those of us from the Ubuntu community that are developers aren’t given that luxury. We’re not even given that luxury once a year now. We’re not even given a T-Shirt!

Am I angry? A little. Do I feel betrayed by the very community I have given so much to over the years? Absolutely. Either way, I believe an online-only Summit is anti-collaborative in that it removes personal connections from the equation, which goes against the very fiber of my being.

Thank you for reading this, and I hope this reaches the people I’m trying to reach and have it speak for those who either won’t speak-up or don’t think they can make a difference.

]]> Erich Eickmeyer Ubuntu Budgie 25.10 release notes https://ubuntubudgie.org/2025/10/ubuntu-budgie-25-10-release-notes/ https://ubuntubudgie.org/2025/10/ubuntu-budgie-25-10-release-notes/ Wed, 08 Oct 2025 17:26:51 GMT Ubuntu Budgie 25.10 (Questing Quokka) is a Standard Release with 9 months of support by your distro maintainers and Canonical, from Oct 2025 to July 2026. These release notes showcase the key takeaways for 25.04 upgraders to 25.10. Please note – there is no direct upgrade path from 24.04.3 to 25.10; you must uplift to 24.10 first or perform a fresh install. In these release notes the areas…

Source

]]> David Mohammed Testing crash recovery features in a CI environment https://andrea.corbellini.name/2025/09/09/testing-crash-recovery-features-in-ci/ https://andrea.corbellini.name/2025/09/09/testing-crash-recovery-features-in-ci/ Tue, 09 Sep 2025 00:05:00 GMT About two years ago I wrote a Rust crate to fulfill this promise:

If a crash occurs while updating a file, the file either contains the old contents, or the new contents, nothing in between.

This crate essentially solves the following problem: when you update a file, generally you open it, truncate it, write to it block-by-block, and eventually close it. The problem with this process is that if a crash occurs at any point during this process (the program segfaults, the kernel panics, the machine loses power, …), your file will be left in an intermediate state where the old contents are completely lost, and the new contents are only partially written (if at all). My crate solves this problem by making file updates atomic.

This crate is publicly available as atomic-write-file and you can read its description for more details (sorry, I’m very bad at naming things).

The way the crate works is simple:

  1. Instead of opening the target file directly, the crate opens a temporary file.
  2. You write to the temporary file.
  3. Once all changes are in, the temporary file contents are synced to the storage, and it is atomically renamed so that it replaces the target file.

This is not by any chance a new technique that I invented, and it’s a very common strategy to solve the problem. This technique guarantees that if a crash occurs at or before step 3, then the file will have the old contents, unchanged. If a crash occurs after step 3, then the file will have the new contents.

There’s a small caveat with this technique: if a crash occurs between steps 1 and 3, then the crate will leave behind a temporary file that occupies some space on the storage device with no purpose.

This is where Linux anonymous temporary files come into play: this Linux-specific feature allows you to create temporary files that are written on the filesystem, but are not given a path in the filesystem. If a crash occurs between step 1 and 3, the temporary file will simply be forgotten into oblivion.

Meet the opponent: btrfs

Using Linux anonymous temporary files seemed very appealing for atomic-write-file to avoid leaving leftovers behind, although I knew that they’re not the perfect solution: there’s limited support (they’re supported only on Linux, and only on some filesystems), they require the use of Linux features that may not be available all the time (the /proc filesystem), and they also have the problem that, sooner or later, they will need to be given a name if we want to be able to replace the target file, and this leaves a small time window during which we could leave some cruft behind.

But none of these are huge problems, and in fact atomic-write-file is able to do a best effort attempt at using anonymous temporary files, and reverting to regular files if that doesn’t work.

One day I was notified about an issue on using my crate on the btrfs file system: after a crash, my crate could break its promise and leave the file contents empty. I did some investigation on the issue that you can read about if you’re interested, and then fixed it.

This problem was specific to btrfs, and I argue that it’s actually caused by a btrfs bug, rather than a bug in the crate itself, but nonetheless this issue had revealed a critical flaw of my crate: I did not have any tests to check if my crate was fulfilling its promise or not!

Therefore I decided to create a small test suite for Linux to simulate crashes and inspect the contents of files after those crashes occurred on a variety of filesystems, which is what this blog post is about. This test suite now runs on my laptop and on GitHub Actions, and potentially any other CI environment.

Testing strategy

Here’s the idea I came up with: I can create a virtual machine, with a virtual storage device attached to it, and a filesystem initialized with a file. The virtual machine updates the file using atomic-write-file, and then triggers a kernel panic. After that, the file is inspected for consistency.

So here is how it works in practice: there are 3 main pieces: 1. A test binary that is responsible for updating the test file using atomic-write-file. 1. An init.sh script that runs inside the virtual machine. 1. The run-tests.sh script that puts everything together and starts up the virtual machine.

The test binary

The test binary that is a short Rust program that I can paste here:

use atomic_write_file::AtomicWriteFile;
use std::io::Write;

fn main() {
    let mut file = AtomicWriteFile::open("/test/file").expect("open failed");
    file.write_all(b"hello").expect("write failed");
    file.commit().expect("commit failed");
}

Nothing special to see here: this is the minimal code required to use atomic-write-file.

The init.sh script

The init.sh script is more interesting: this script in fact is meant to run twice. The first time it runs, init.sh will run the test binary above and trigger the kernel panic. The second time, it will read the test file contents and report them back run-tests.sh script for inspection.

Let’s take a closer look at what it does: first, it mounts the /proc and /sys virtual filesystems. These are needed for some basic system functions, and also to enable the Linux anonymous temporary file feature.

mount -t proc none /proc
mount -t sysfs none /sys

Then it mounts the filesystem containing the test file. Before it can do that, however, it needs to load the correct kernel module for the filesystem. Nothing too fancy here: the filesystem type is simply specified on the kernel command line (read through /proc/cmdline):

fstype=$(grep -Eo 'test.fs=\w+' /proc/cmdline | cut -d= -f2)
modprobe "$fstype" || true
mount -t "$fstype" /dev/sdb /test

Then, if this script is run for the first time, it will run the test executable and quit:

echo 'Running test binary'
atomic-write-file-test

init.sh (as the name suggests) is run as the init script of the virtual machine. In Linux, if the init script quits without invoking the proper shutdown sequence, the kernel will panic. So we don’t actually need to do anything special to trigger a panic. I could have inserted a echo c > /proc/sysrq-trigger line to make it more explicit, but then I figured that having that line wouldn’t be nice for people who want to test the script on their system.

You might ask: how does init.sh know if it’s the first time it gets called or the second? Again, nothing fancy here: run-tests.sh gives that hint using a kernel command line argument:

if grep -q test.verify /proc/cmdline; then
  # ...
fi

If test.verify is specified on /proc/cmdline, then it means this is the second time this script is run. In that case, the file contents are just printed on the console:

if grep -q test.verify /proc/cmdline; then
  echo 'Verifying test file contents'
  echo '-----'
  xxd /test/file
  echo '-----'
  poweroff -f
fi

This uses xxd so in case there are garbled characters on screen, we can comfortably analyze the output and figure out what happened. At the end, the system is more gracefully shut down using poweroff to avoid another kernel panic (this is not really necessary).

The run-tests.sh script

And then there’s the run-tests.sh script that crates the virtual storage, launches the virtual machine, and inspects the file contents. This is where most the complexity is, so let’s go step-by-step (the code below has been simplified from the original for readability):

The first thing it does is compiling the test binary above. The virtual machine runs in a very barebone environment, so I used static linking to avoid having to copy additional libraries like libc:

target=$(uname -m)-unknown-linux-gnu
RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --features "$cargo_features" --target "$target"

Then run-tests.sh creates a minimal initramfs for the virtual machine. The initramfs is a filesystem that gets mounted by Linux early at boot. It’s generally used by Linux distributions to load the main operating system, but in my case the initramfs contains everything needed for the test. In particular, it contains:

  • The test binary.
  • The init.sh script.
  • BusyBox, to get the needed utilities like xxd and poweroff.
  • The kernel modules to mount filesystems and their dependencies.

The first 3 items are easy to set up:

cp "init.sh" -T "$initramfs_build_dir/sbin/init"
cp "atomic-write-file-test" -t "$initramfs_build_dir/bin"
cp "$(which busybox)" -t "$initramfs_build_dir/bin"
"$busybox" --install -s "$initramfs_build_dir/bin"

The kernel modules are a bit more complicated. First of all: where can we get them from? Ideally, I would have liked to download them from some minimal Linux distribution, but this turned out to be more complicated than expected. In the end, I decided to just steal them from the host operating system:

modules=/usr/lib/modules/$(uname -r)
cp -a "$modules" -t "$initramfs_build_dir/lib/modules"

while read -r mod_path; do
  if [[ "$mod_path" = *.ko.gz ]]; then
    gunzip "$mod_path" -o "$mod_path.uncompressed"
  elif [[ "$mod_path" = *.ko.xz ]]; then
    unxz "$mod_path" -o "$mod_path.uncompressed"
  elif [[ "$mod_path" = *.ko.zst ]]; then
    unzstd "$mod_path" -o "$mod_path.uncompressed"
  else
    continue
  fi
  mv "$mod_path.uncompressed" "$mod_path"
done < <(modprobe --dirname "$initramfs_build_dir" --show-depends "$filesystem_type" | grep ^insmod | cut -d' ' -f2)

What this does is copying all the module files from the host, getting all the dependencies for the filesystem module using modprobe, and then uncompressing those modules if they’re compressed (I found this much easier than adding compression support in the virtual machine). An alternative approach would be to simply decompress all the modules, but that’s much slower.

Once everything has been copied over and uncompressed, the initramfs is created:

initramfs=rootfs.img
mksquashfs "$initramfs_build_dir" "$initramfs"

Now it’s time to create the virtual storage device with the filesystem, which is a trivial task:

testfs=testfs.img
dd if=/dev/zero of="$testfs" bs=1M count=300
"mkfs.$filesystem_type" "$testfs"

Finally, we can start our VM using QEMU:

qemu=qemu-system-$(uname -m)
kernel=/boot/vmlinuz-$(uname -r)

"$qemu" \
  -kernel "$kernel" \
  -append "root=/dev/sda ro panic=-1 console=ttyS0 quiet test.fs=$filesystem_type" \
  -drive "index=0,media=disk,format=raw,file=$initramfs" \
  -drive "index=1,media=disk,format=raw,file=$testfs" \
  -no-reboot \
  -nographic

Again we’re stealing the kernel from the host operating system, which is also where the kernel modules come from. The drive with index=0 is the initramfs and will be visible as /dev/sda in the guest; the other drive with index=1 is our test storage and will be visible as /dev/sdb.

root=/dev/sda tells the kernel to boot from our initramfs image. panic=-1 tells the kernel not to reboot in case of a panic (panic=N specifies the number of seconds to wait before rebooting in case of kernel panic; specifying a negative value blocks that behavior). console=ttyS0 allows us to capture the output printed by the init script. test.fs=... is the option that init.sh is going to look for to understand what filesystem type to use.

Once that runs, the virtual machine is expected to do its job and crash with a kernel panic. We then need to restart it to verify the file contents. The QEMU command is exactly the same except for the additional test.verify option:

output=output.txt

"$qemu" \
  -kernel "$kernel" \
  -append "root=/dev/sda ro panic=-1 console=ttyS0 quiet test.fs=$filesystem_type test.verify" \
  -drive "index=0,media=disk,format=raw,file=$initramfs" \
  -drive "index=1,media=disk,format=raw,file=$testfs" \
  -no-reboot \
  -nographic \
  | tee "$output"

The output from this command is captured in a file that can be analyzed. If you remember how init.sh is written, you might have noticed that it writes the test file contents between two markers:

echo '-----'
xxd /test/file
echo '-----'

So what we have to do to verify the contents of the file is simply look for those two ----- markers, get the content in between, and parse it through xxd -r:

if [[ $(sed -n '/-----/, /-----/p' "$output" | xxd -r) = hello ]]; then
  echo "Success"
else
  echo "Failure"
  exit 1
fi

And that’s it!

Running in GitHub Actions

The next step for me was to set up some automation to make sure that my test script was run whenever I made any change to the crate. Because my project was already hosted on GitHub, I decided to go with GitHub Actions. I was a bit worried that I would have had to struggle to make it work because my script works by stealing the kernel from the host, and I thought that the GitHub runners could have some protections in place to prevent me from reading the kernel. To my surprise, there were no such restrictions. In fact, I did not have to modify a single line of code to make my tests work in GitHub Actions: check out the workflow file if you’re curious.

Result

In the end, the test suite was able to reproduce the issue with btrfs and anonymous temporary files, as well as show that the fix was working as intended. This is what it looks like (output in the screenshot was trimmed down a bit):

Output showing a failure from the test suite
Output from the run-test.sh script before applying the fix, showing a failure.
Output showing a success from the test suite
Output from the run-test.sh script after applying the fix, showing a success.

Future

I’m pretty satisfied with the general approach of running in a virtual machine and simulating a crash, but the implementation has a huge limitation: because it steals the kernel from the host, it cannot simulate crashes on other kernels, operating systems, or platforms.

I think in the future I’m going to take a look at cross-rs, a cross-platform tool for Rust crates. Cross-rs works kinda in a similar way as my test suite, in that it uses QEMU emulation to run tests. Maybe I can reuse their QEMU images and tweak them to run my crash tests. If that is feasible, then I will be able to extend my test suite to all major platforms and operating systems.

]]> Andrea Corbellini Debian 13 https://jonathancarter.org/2025/08/10/debian-13/ https://jonathancarter.org/2025/08/10/debian-13/ Sun, 10 Aug 2025 14:53:36 GMT Debian 13 has finally been released!

One of the biggest and under-hyped features is support for HTTP Boot. This allows you to simply specify a URL (to any d-i or live image iso) in your computer’s firmware setup and then you can boot to it directly over the Internet, so no need to download an image, write it to flash disk and then boot from the flash disk on computers made in the last ~5 years. This is also supported on the Tianocore free EFI firmware, which is useful if you’d like to try it out on QEMU/KVM.

More details about Debian 13 available on the official press release.

The default theme for Debian 13 is Ceratopsian, designed by Elise Couper. I’ll be honest, I wasn’t 100% sure it was the best choice when it won the artwork vote, but it really grew on me over the last few months, and it looked great in combination with all kinds of other things during DebConf too, so it has certainly won me over.

And I particularly like the Plymouth theme. It’s very minimal, and it reminds me of the Toy Story Trixie character, it’s almost like it helps explain the theme:

Plymouth (start-up/shutdown) theme.

Trixie, the character from Toy Story that was chosen as the codename for Debian 13.

Debian Local Team ISO testing

Yesterday we got some locals together for ISO testing and we got a cake with the wallpaper printed on it, along with our local team logo which has been a work in progress for the last 3 years, so hopefully we’ll finalise it this year! (it will be ready when it’s ready). It came out a lot bluer than the original wallpaper, but still tasted great.

For many releases, I’ve been the only person from South Africa doing ISO smoke-testing, and this time was quite different, since everyone else in the photo below tested an image except for me. I basically just provided some support and helped out with getting salsa/wiki accounts and some troubleshooting. It went nice and fast, and it’s always a big relief when there are no showstoppers for the release.

My dog was really wishing hard that the cake would slip off.

Packaging-wise, I only have one big new package for Trixie, and that’s Cambalache, a rapid application design UI builder for GTK3/GTK4.

The version in trixie is 0.94.1-3 and version 1.0 was recently released, so I’ll get that updated in forky and backport it if possible.

I was originally considering using Cambalache for an installer UI, but ended up going with a web front-end instead. But that’s moving firmly towards forky territory, so more on that another time!

Thanks to everyone who was involved in this release, so far upgrades have been very smooth!

]]> Jonathan Carter Streamline Root Filesystem Modifications with chimg https://toabctl.wordpress.com/2025/07/31/streamline-root-filesystem-modifications-with-chimg/ https://toabctl.wordpress.com/2025/07/31/streamline-root-filesystem-modifications-with-chimg/ Thu, 31 Jul 2025 18:15:36 GMT During the last year I developed as a side project a new tool called chimg . That tool is useful to modify a given rootfs chroot directory in a declarative way. It can replace a kernel within a chroot, preseed snaps, install debian packages, add PPAs and more (documentation is in git but not yet published).

The nice thing about this is, that this tool can be integrated into livecd-rootfs (the tool that is usually used to build Ubuntu images) or future tools which might use the craft framework to build images. chimg automatically detects already bind-mounted filesystems (eg. /sys, /proc, …), detects already preseeded snaps and usually does that same thing that livecd-rootfs currently does when eg. replacing an already installed kernel.

Install chimg with:

sudo snap install chimg --classic

An example configuration (eg. config.yaml) to modify a rootfs chroot directory looks like this:

---
kernel: linux-aws
debs:
  - name: shim-signed
  - name: grub-pc
  - name: grub2-common
  - name: ubuntu-cloud-minimal
snap:
  assertion_brand: canonical
  assertion_model: aws-classic
  snaps:
    - name: hello
      channel: latest/stable
files:
  -
    destination: /etc/default/grub.d/70-mysettings.cfg
    content: |+
      GRUB_TIMEOUT=0

cmds_post:
  -
    cmd: |
      echo "Everything done"

This config (stored in config.yaml in this example) can be applied to a newly created (or existing) root filesystem directory. Let’s create one in /tmp/chimg-noble:

sudo mmdebstrap --variant=apt --verbose noble /tmp/chimg-noble

Let’s apply the config changes now:

sudo chimg --log-console chrootfs config.yaml /tmp/chimg-noble

That’s it. The modifications are now applied to the /tmp/chimg-noble directory.

]]> Thomas Bechtold 2025: Finding a job, and the understanding the market https://joseeantonior.wordpress.com/2025/06/25/2025-finding-a-job-and-the-understanding-the-market/ https://joseeantonior.wordpress.com/2025/06/25/2025-finding-a-job-and-the-understanding-the-market/ Wed, 25 Jun 2025 21:39:35 GMT So, I’ve been in the job market for a bit over a year. I was part of a layoff cycle in my last company, and finding a new gig has been difficult. I haven’t been able to find something as of yet, but it’s been a learning curve. The market is not what it has been in the last couple of years. With AI in the mix, lots of roles have been eliminated, or have shifted towards where human intervention is needed to interpret or verify the data AI is interpreting. Job hunting is a job in an of itself, and may even take a 9 to 5 role. I know of a lot of people who have gone through the same process as myself, and wanted to share some of insights and tips from what I’ve learned throughout the last year.

Leveraging your network

First, and I think most important, is to understand that there’s a lot of great people around that you might have worked with. You can always ask for recommendations, touch base, or even have a small chat to see how things are going on their end. Conversations can be very refreshing, and can help you get a new perspective as how the industries are shifting, where you might want to learn new skills, or how to improve your positioning in the market. Folks can talk around and see if there’s additional positions where you might be a good fit, and it’s always good to have a helping hand (or a few). At the end of the day, these folks are your own community. I’ve gotten roles in the past by being referred, and these connections have been critical for my understanding of how different businesses may approach the same problem, or even to solve internal conflicts. So, reach out to people you know!

Understanding the market

Like I mentioned in the opening paragraph, the market is evolving constantly. AI has taken a very solid role nowadays, and lots of companies ask about how you’ve used AI recently. Part of understanding the market is understanding the bleeding edge tools that are used to improve workflows and day-to-day efficiency. Research tools that are coming up, and that are shaping the market.

To give you an example. Haven’t tried AI yet? Give it a spin, even for simple questions. Understand where it works, where it fails, and how you, as a human, can make it work for you. Get a sense of the pitfalls, and where human intervention is needed to interpret or verify the data that’s in there. Like one of my former managers said, “trust, but verify”. Or, you can even get to the point of not trusting the data, and sharing that as a story!

Apply thoughtfully

Someone gave me the recommendation to apply to everything that I see where I “could be a fit”. While this might have its upsides, you might also end up in situations where you are not actually a fit, or where you don’t know the company and what it does. Always take the time, at least a few minutes, to understand the company that you’re applying for, research their values, and how they align to yours. Read about the product they’re creating, selling, or offering, and see if it’s a product where you could contribute your skills. Then, you can make the decision of applying. While doing this you may discover that you are applying to a position in a sector that you’re not interested in, or where your skillset might not be used to its full potential. And you might be missing out on some other opportunities that are significantly more aligned to you.

Also take the time to fully review the job description. JDs are pretty descriptive, and you might stumble upon certain details that don’t align with yourself, such as the salary, hours, location, or certain expectations that you might feel don’t fit within the role or that you are not ready for.

Prepare for your interviews

You landed an interview – congratulations! Make sure that you’ve researched the company before heading in. If you’ve taken a look at the company and the role before applying, take a glimpse again. You might find more interesting things, and it will demonstrate that you are actually preparing yourself for the interview. Also, interviewing is a two-way street. Make sure that you have some questions at the end. Double-check the role of your interviewer in the company, and ensure that you have questions that are tailored to their particular roles. Think about what you want to get from the interview (other than the job!).

Job sourcing

There are many great job sources today – LinkedIn being the biggest of all of them. Throughout my searches I’ve also found weworkremotely.com and hnhiring.com are great sources. I strongly advise that you expand your search and find sources that are relevant to your particular role or industry. This has opened up a lot of opportunities for me!

Take some time for yourself

I know that having a job is important. However, it’s also important to take time for yourself. Your mental health is important. You can use this time to develop some skills, play some games, take care of your garden, or even reorganize your home. Find a hobby and distract yourself every now and then. Take breaks, and ensure you’re not over-stressing yourself. Read a bit about burnout, and take care of yourself, as burnout can also happen from job hunting. And if you need a breather, make sure you take one, but don’t overdo it! Time is valuable, so it’s all about finding the right balance.

Hopefully this is helpful for some folks that are going through my same situation. What other things have worked for you? Do you have any other tips you could share? I’d be happy to read about them! Share them with me on LinkedIn. I’m also happy to chat – you can always find me at jose@ubuntu.com.

]]> José Antonio Rey Attitudes on privacy and tracking https://s3hh.wordpress.com/2025/05/25/attitudes-on-privacy-and-tracking/ https://s3hh.wordpress.com/2025/05/25/attitudes-on-privacy-and-tracking/ Sun, 25 May 2025 13:00:15 GMT It’s amazing how quickly public opinion changes. Or, how quickly
people cave. Remember just 10 years ago, how people felt about
google glass?

Or how they felt when they found out target was analyzing their
purchases and perhaps knew them better than themselves or their
family?

People used to worry about being tracked by companies and government.
Today, they feel insecure unless they are certain they are being
tracked. For their own well-being of course. If an online store does
*not* send an email 10 hours after you’ve “left items in your cart,
don’t miss out!”, and another the next day, you feel disappointed. I
believe they’re now seen as sub-par.

]]> Serge Hallyn Rooming with Mark https://ograblog.wordpress.com/2025/05/16/rooming-with-mark/ https://ograblog.wordpress.com/2025/05/16/rooming-with-mark/ Fri, 16 May 2025 11:17:23 GMT Yesterday, exactly twenty years ago my mobile rang while I was walking the dog.

I had just returned from Sydney about a week ago (still battling with the last remains of my Jet-lag (I had never left Europe before!)) where I had attended the UbuntuDownUnder summit and had a 30min interview on the last day (that was literally rather like having a coffee with friends after lunch) with Mark Shuttleworth and Matt Zimmerman (back then Canonicals CTO) on a nice hotel terrace directly under a tree with a colony of flying foxes sleeping above our heads.

There was Jane Silber (CEO) on the phone, telling me: “I’m so happy to tell you you are hired! In your new role we want you to create an educational flavor of Ubuntu, there will be a debian-edu/skolelinux gathering in Bergen in Norway from the 10th to 12th of June, are you okay flying there with Mark?”

I rushed back home and told my girlfriend: “I’m hired, and I’ll fly Canonical One on my first business trip next month!” (Canonical One was the name of Marks plane). I learned the next weeks that Canonical had indeed booked a generic scheduled flight for me and we’d only meet at the venue 🙂

The flight was a disaster, after we were boarding that small 20-seater 2 prop plane that was supposed to get us from Cologne to Amsterdam and the pilot started the engine my window all of a sudden was soaked in oil. We had to stay in the plane out on the filed while the mechanics were fixing the engine for like 2-3h so indeed I missed the connection in Amsterdam and had to stay for the night instead of arriving in Bergen the evening before the event started.

When I arrived at the venue everyone was already busy hacking on stuff and I jumped right in alongside, finally meeting some users of LTSP (Linux Terminal Server Project) which I was upstream for at that time and working with them on the problems they faced in debian with it, tinkering with moodle as a teaching support system and looking at other edu software, meanwhile Mark was sitting on a bar-stool in a corner with his laptop hacking on launchpad code.

When we went to our hotel in the evening it turned out they did not have our booking at all and were completely overbooked due to a jewelry exhibition they had in the house for that week. I talked like 15min to the lady behind the counter, showed her my booking confirmation PDF on the laptop, begged and flirted a lot and eventually she told us “We do have an exhibition room that we keep as spare, it only has one bed but you can have it and we will add a folding bed”. The room was actually a normal hotel room but completely set up with wallpaper tables all around the walls.

Mark insisted to take the folding bed and I can tell you, he does not snore … (well, he didn’t back then)

This was only the first of a plethora of adventures that followed in the upcoming 20 years, that phone call clearly changed my life and the company gave me the opportunity to work with the brightest, sharpest and most intelligent people on the planet in and outside of Canonical.

It surely changed a lot over these years (when I started we were building the distro with 18 people in the distro team and did that for quite a few years before it actually got split into server, foundations, kernel and desktop teams) but it never lost its special spirit of having these exceptional people with such a high focus on bringing opensource to everyone and making it accessible to everyone.
Indeed, with growth comes the requirement to make more money to pay the people, the responsibility to give your employees a certain amount of security and persistence grows, but Canonical and especially Mark have always managed to keep the balance to not lose that focus and do the right thing in the end.

Ten years ago I said “onward to the next ten!!”, I won’t really say “onward to the next 20!” today, not because I ever plan to resign but simply because I doubt I still want to work full time when I’m 75 😉

Thank you Mark for dragging me into this adventure and thank you for still having me! I still love the ride!!

]]> Oliver Grawert Ubuntu MATE 25.04 Release Notes https://ubuntu-mate.org/blog/ubuntu-mate-plucky-puffin-release-notes/ https://ubuntu-mate.org/blog/ubuntu-mate-plucky-puffin-release-notes/ Tue, 15 Apr 2025 00:00:00 GMT Ubuntu MATE 25.04 is ready to soar! 🪽 Celebrating our 10th anniversary as an official Ubuntu flavour with the reliable MATE Desktop experience you love, built on the latest Ubuntu foundations. Read on to learn more 👓️

A Decade of MATE

This release marks the 10th anniversary of Ubuntu MATE becoming an official Ubuntu flavour. From our humble beginnings, we’ve developed a loyal following of users who value a traditional desktop experience with modern capabilities. Thanks to our amazing community, contributors, and users who have been with us throughout this journey. Here’s to many more years of Ubuntu MATE! 🥂

What changed in Ubuntu MATE 25.04?

Here are the highlights of what’s new in the Plucky Puffin release:

  • Celebrating 10 years as an official Ubuntu flavour! 🎂
  • Optional full disk encryption in the installer 🔐
    • Enhanced advanced partitioning options
    • Better interaction with existing BitLocker-enabled Windows installations
    • Improved experience when installing alongside other operating systems

Major Applications

Accompanying MATE Desktop 🧉 and Linux 6.14 🐧 are Firefox 137 🔥🦊, Evolution 3.56 📧, LibreOffice 25.2.2 📚

See the Ubuntu 25.04 Release Notes for details of all the changes and improvements that Ubuntu MATE benefits from.

Download Ubuntu MATE 25.04

Available for 64-bit desktop computers!

Download

Upgrading to Ubuntu MATE 25.04

The upgrade process to Ubuntu MATE 25.04 is the same as Ubuntu.

There are no offline upgrade options for Ubuntu MATE. Please ensure you have network connectivity to one of the official mirrors or to a locally accessible mirror and follow the instructions above.

]]> Ubuntu MATE I'm running for the OSI board... maybe https://blog.luke.wf/2025/02/im-running-for-osi-board-maybe.html https://blog.luke.wf/2025/02/im-running-for-osi-board-maybe.html Thu, 20 Feb 2025 17:31:00 GMT The Open Source Initiative has two classes of board seats: Affiliate seats, and Individual Member seats. 

In the upcoming election, each affiliate can nominate a candidate, and each affiliate can cast a vote for the Affiliate candidates, but there's only 1 Affiliate seat available. I initially expressed interest in being nominated as an Affiliate candidate via Debian. But since Bradley Kuhn is also running for an Affiliate seat with a similar platform to me, especially with regards to the OSAID, I decided to run as part of an aligned "ticket" as an Individual Member to avoid contention for the 1 Affiliate seat.

Bradley and I discussed running on a similar ticket around 8/9pm Pacific, and I submitted my candidacy around 9pm PT on 17 February. 

I was dismayed when I received the following mail from Nick Vidal:

Dear Luke,

Thank you for your interest in the OSI Board of Directors election. Unfortunately, we are unable to accept your application as it was submitted after the official deadline of Monday Feb 17 at 11:59 pm UTC. To ensure a fair process, we must adhere to the deadline for all candidates.

We appreciate your enthusiasm and encourage you to stay engaged with OSI’s mission. We hope you’ll consider applying in the future or contributing in other meaningful ways.

Best regards,
OSI Election Teams

Nowhere on the "OSI’s board of directors in 2025: details about the elections" page do they list a timezone for closure of nominations; they simply list Monday 17 February. 

The OSI's contact address is in California, so it seems arbitrary and capricious to retroactively define all of these processes as being governed by UTC.

I was not able to participate in the "potential board director" info sessions accordingly, but people who attended heard that the importance of accommodating differing TZ's was discussed during the info session, and that OSI representatives mentioned they try to accommodate TZ's of everyone. This seems in sharp contrast with the above policy. 

I urge the OSI to reconsider this policy and allow me to stand for an Individual seat in the current cycle. 

Upd, N.B.: to people writing about this, I use they/them pronouns

]]> Luke Faraone How to prevent TrackPoint or touchpad events from waking up ThinkPad T14 Gen 5 AMD from suspend https://nobuto-m.github.io/post/2025/how-to-prevent-trackpoint-events-from-waking-up-thinkpad-t14-gen-5-amd-from-suspend/ https://nobuto-m.github.io/post/2025/how-to-prevent-trackpoint-events-from-waking-up-thinkpad-t14-gen-5-amd-from-suspend/ Thu, 09 Jan 2025 14:50:38 GMT TL;DR

Try the following lines in your custom udev rules, e.g.
/etc/udev/rules.d/99-local-disable-wakeup-events.rules

KERNEL=="i2c-ELAN0676:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"
KERNEL=="PNP0C0E:00", SUBSYSTEM=="acpi", DRIVERS=="button", ATTRS{path}=="\_SB_.SLPB", ATTR{power/wakeup}="disabled"
Table of Contents

The motivation

Whenever something touches the red cap, the system wakes up from suspend/s2idle.
Whenever something touches the red cap, the system wakes up from suspend/s2idle.

I’ve used ThinkPad T14 Gen 3 AMD for 2 years, and I recently purchased T14 Gen 5 AMD. The previous system as Gen 3 annoyed me so much because the laptop randomly woke up from suspend even inside a backpack on its own, heated up the confined air in it, and drained the battery pretty fast as a consequence. Basically it’s too sensitive to any events. For example, whenever a USB Type-C cable is plugged in as a power source or whenever something touches the TrackPoint even if a display on a closed lid slightly makes contact with the red cap, the system wakes up from suspend. It was uncontrollable.

I was hoping that Gen 5 would make a difference, and it did when it comes to the power source event. However, frequent wakeups due to the TrackPoint event remained the same so I started to dig in.

Disabling touchpad as a wakeup source on T14 Gen 5 AMD

Disabling touchpad events as a wakeup source is straightforward. The touchpad device, ELAN0676:00 04F3:3195 Touchpad, can be found in the udev device tree as follows.

$ udevadm info --tree
...

 └─input/input12
   ┆ P: /devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
   ┆ M: input12
   ┆ R: 12
   ┆ U: input
   ┆ E: DEVPATH=/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
   ┆ E: SUBSYSTEM=input
   ┆ E: PRODUCT=18/4f3/3195/100
   ┆ E: NAME="ELAN0676:00 04F3:3195 Touchpad"
   ┆ E: PHYS="i2c-ELAN0676:00"

And you can get all attributes including parent devices like the following.

$ udevadm info --attribute-walk -p /devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12
...

  looking at device '/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/0018:04F3:3195.0001/input/input12':
    KERNEL=="input12"
    SUBSYSTEM=="input"
    DRIVER==""
    ...
    ATTR{name}=="ELAN0676:00 04F3:3195 Touchpad"
    ATTR{phys}=="i2c-ELAN0676:00"

...

  looking at parent device '/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00':
    KERNELS=="i2c-ELAN0676:00"
    SUBSYSTEMS=="i2c"
    DRIVERS=="i2c_hid_acpi"
    ATTRS{name}=="ELAN0676:00"
    ...
    ATTRS{power/wakeup}=="enabled"

The line I’m looking for is ATTRS{power/wakeup}=="enabled". By using the identifiers of the parent device that has ATTRS{power/wakeup}, I can make sure that /sys/devices/platform/AMDI0010:01/i2c-1/i2c-ELAN0676:00/power/wakeup is always disabled with the custom udev rule as follows.

KERNEL=="i2c-ELAN0676:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"

Disabling TrackPoint as a wakeup source on T14 Gen 5 AMD

I’ve seen a pattern already as above so I should be able to apply the same method. The TrackPoint device, TPPS/2 Elan TrackPoint, can be found in the udev device tree.

$ udevadm info --tree
...

 └─input/input5
   ┆ P: /devices/platform/i8042/serio1/input/input5
   ┆ M: input5
   ┆ R: 5
   ┆ U: input
   ┆ E: DEVPATH=/devices/platform/i8042/serio1/input/input5
   ┆ E: SUBSYSTEM=input
   ┆ E: PRODUCT=11/2/a/63
   ┆ E: NAME="TPPS/2 Elan TrackPoint"
   ┆ E: PHYS="isa0060/serio1/input0"

And the information of parent devices too.

$ udevadm info --attribute-walk -p /devices/platform/i8042/serio1/input/input5
...

  looking at device '/devices/platform/i8042/serio1/input/input5':
    KERNEL=="input5"
    SUBSYSTEM=="input"
    DRIVER==""
    ...
    ATTR{name}=="TPPS/2 Elan TrackPoint"
    ATTR{phys}=="isa0060/serio1/input0"

...

  looking at parent device '/devices/platform/i8042/serio1':
    KERNELS=="serio1"
    SUBSYSTEMS=="serio"
    DRIVERS=="psmouse"
    ATTRS{bind_mode}=="auto"
    ATTRS{description}=="i8042 AUX port"
    ATTRS{drvctl}=="(not readable)"
    ATTRS{firmware_id}=="PNP: LEN0321 PNP0f13"
    ...
    ATTRS{power/wakeup}=="disabled"

I hit the wall here. ATTRS{power/wakeup}=="disabled" for the i8042 AUX port is already there but the TrackPoint still wakes up the system from suspend. I had to do bisecting for all remaining wakeup sources.

The list of the remaining wakeup sources 

$ cat /proc/acpi/wakeup
Device	S-state	  Status   Sysfs node
GPP0	  S0	*disabled
GPP2	  S3	*disabled
GPP5	  S0	*enabled   pci:0000:00:02.1
GPP6	  S4	*enabled   pci:0000:00:02.2
GP11	  S4	*enabled   pci:0000:00:03.1
SWUS	  S4	*disabled
GP12	  S4	*enabled   pci:0000:00:04.1
SWUS	  S4	*disabled
XHC0	  S3	*enabled   pci:0000:c4:00.3
XHC1	  S4	*enabled   pci:0000:c4:00.4
XHC2	  S4	*disabled  pci:0000:c6:00.0
NHI0	  S3	*enabled   pci:0000:c6:00.5
XHC3	  S3	*enabled   pci:0000:c6:00.3
NHI1	  S4	*enabled   pci:0000:c6:00.6
XHC4	  S3	*enabled   pci:0000:c6:00.4
LID	  S4	*enabled   platform:PNP0C0D:00
SLPB	  S3	*enabled   platform:PNP0C0E:00

 Wakeup sources:
 │  [/sys/devices/platform/USBC000:00/power_supply/ucsi-source-psy-USBC000:001/wakeup66]: enabled
 │  [/sys/devices/platform/USBC000:00/power_supply/ucsi-source-psy-USBC000:002/wakeup67]: enabled
 │ ACPI Battery [PNP0C0A:00]: enabled
 │ ACPI Lid Switch [PNP0C0D:00]: enabled
 │ ACPI Power Button [PNP0C0C:00]: enabled
 │ ACPI Sleep Button [PNP0C0E:00]: enabled
 │ AT Translated Set 2 keyboard [serio0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] ISA bridge [0000:00:14.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] Multimedia controller [0000:c4:00.5]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.2]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:03.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:04.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c4:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c4:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.5]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:c6:00.6]: enabled
 │ Mobile Broadband host interface [mhi0]: enabled
 │ Plug-n-play Real Time Clock [00:01]: enabled
 │ Real Time Clock alarm timer [rtc0]: enabled
 │ Thunderbolt domain [domain0]: enabled
 │ Thunderbolt domain [domain1]: enabled
 │ USB4 host controller [0-0]: enabled
 └─USB4 host controller [1-0]: enabled

Somehow, disabling SLPB “ACPI Sleep Button” stopped undesired wakeups by the TrackPoint.

  looking at parent device '/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0E:00':
    KERNELS=="PNP0C0E:00"
    SUBSYSTEMS=="acpi"
    DRIVERS=="button"
    ATTRS{hid}=="PNP0C0E"
    ATTRS{path}=="\_SB_.SLPB"
    ...
    ATTRS{power/wakeup}=="enabled"

The final udev rule is the following. It also disables wakeup events from the keyboard as a side effect, but opening the lid or pressing the power button can still wake up the system so it works for me.

KERNEL=="PNP0C0E:00", SUBSYSTEM=="acpi", DRIVERS=="button", ATTRS{path}=="\_SB_.SLPB", ATTR{power/wakeup}="disabled"

In the case of ThinkPad T14 Gen 3 AMD

After solving the headache of frequent wakeups for T14 Gen5 AMD. I was curious if I could apply the same to Gen 3 AMD retrospectively. Gen 3 has the following wakeup sources active out of the box.

 Wakeup sources:
 │ ACPI Battery [PNP0C0A:00]: enabled
 │ ACPI Lid Switch [PNP0C0D:00]: enabled
 │ ACPI Power Button [LNXPWRBN:00]: enabled
 │ ACPI Power Button [PNP0C0C:00]: enabled
 │ ACPI Sleep Button [PNP0C0E:00]: enabled
 │ AT Translated Set 2 keyboard [serio0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] ISA bridge [0000:00:14.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.1]: enabled
 │ Advanced Micro Devices, Inc. [AMD] PCI bridge [0000:00:02.2]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:04:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:04:00.4]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.0]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.3]: enabled
 │ Advanced Micro Devices, Inc. [AMD] USB controller [0000:05:00.4]: enabled
 │ ELAN0678:00 04F3:3195 Mouse [i2c-ELAN0678:00]: enabled
 │ Mobile Broadband host interface [mhi0]: enabled
 │ Plug-n-play Real Time Clock [00:01]: enabled
 └─Real Time Clock alarm timer [rtc0]: enabled

Disabling the touchpad event was straightforward. The only difference from Gen 5 was the ID of the device.

KERNEL=="i2c-ELAN0678:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="disabled"

When it comes to the TrackPoint or power source event, nothing was able to stop it from waking up the system even after disabling all wakeup sources. I came across a hidden gem named amd_s2idle.py. The “S0i3/s2idle analysis script for AMD systems” is full with the domain knowledge of s2idle like where to look in /proc or /sys or how to enable debug and what part of the logs is important.

By running the script, I got the following output around the unexpected wakeup.

$ sudo python3 ./amd_s2idle.py --debug-ec --duration 30
Debugging script for s2idle on AMD systems
💻 LENOVO 21CF21CFT1 (ThinkPad T14 Gen 3) running BIOS 1.56 (R23ET80W (1.56 )) released 10/28/2024 and EC 1.32
🐧 Ubuntu 24.04.1 LTS
🐧 Kernel 6.11.0-12-generic
🔋 Battery BAT0 (Sunwoda ) is operating at 90.91% of design
Checking prerequisites for s2idle
✅ Logs are provided via systemd
✅ AMD Ryzen 7 PRO 6850U with Radeon Graphics (family 19 model 44)
...

Suspending system in 0:00:02
Suspending system in 0:00:01

Started at 2025-01-04 00:46:53.063495 (cycle finish expected @ 2025-01-04 00:47:27.063532)
Collecting data in 0:00:02
Collecting data in 0:00:01

Results from last s2idle cycle
💤 Suspend count: 1
💤 Hardware sleep cycle count: 1
○ GPIOs active: ['0']
🥱 Wakeup triggered from IRQ 9: ACPI SCI
🥱 Wakeup triggered from IRQ 7: GPIO Controller
🥱 Woke up from IRQ 7: GPIO Controller
❌ Userspace suspended for 0:00:14.031448 (< minimum expected 0:00:27)
💤 In a hardware sleep state for 0:00:10.566894 (75.31%)
🔋 Battery BAT0 lost 10000 µWh (0.02%) [Average rate 2.57W]
Explanations for your system
🚦 Userspace wasn't asleep at least 0:00:30
        The system was programmed to sleep for 0:00:30, but woke up prematurely.
        This typically happens when the system was woken up from a non-timer based source.

        If you didn't intentionally wake it up, then there may be a kernel or firmware bug

I compared all the logs generated between the events of power button, power source, TrackPoint, and touchpad. But except for the touchpad event, everything else was coming from GPIO pin #0 and there was no more information of how to distinguish those wakeup triggers. I ended up with a drastic approach of ignoring wakeup triggers from the GPIO pin #0 completely with the following kernel option.

gpiolib_acpi.ignore_wake=AMDI0030:00@0

And I get the line on each boot.

kernel: amd_gpio AMDI0030:00: Ignoring wakeup on pin 0

That comes with obvious downsides. The system doesn’t wake up frequently any longer, that is good. However, nothing can wake it up after getting into suspend. Opening the lid, pressing the power button or any key is simply ignored since all are going to GPIO pin #0. In the end, I had to enable the touchpad back as a wakeup source explicitly so the system can wakeup by tapping the touchpad. It’s far from ideal, but the touchpad is less sensitive than the TrackPoint so I will keep it that way.

KERNEL=="i2c-ELAN0678:00", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTR{power/wakeup}="enabled"

I guess the limitation is coming from a firmware more or less, but at the same time I don’t expect fixes for the few year old model.

References

]]> Nobuto Murata C void return gotcha http://smackerelofopinion.blogspot.com/2024/12/c-void-return-gotcha.html http://smackerelofopinion.blogspot.com/2024/12/c-void-return-gotcha.html Wed, 18 Dec 2024 17:43:00 GMT Last week I was bitten by a interesting C feature. The following terminate function was expected to exit if okay was zero (false) however it exited when zero was passed to it. The reason is the missing semicolon after the return function.

 

The interesting part this that is compiles fine because the void function terminate is allowed to return the void return value, in this case the void return from exit().

 

]]> Colin King Waiting for a Linux system to be online https://blog.slyon.de/2024/10/15/waiting-for-a-linux-system-to-be-online/ https://blog.slyon.de/2024/10/15/waiting-for-a-linux-system-to-be-online/ Tue, 15 Oct 2024 07:33:10 GMT
Designed by Freepik

What is an “online” system?

Networking is a complex topic, and there is lots of confusion around the definition of an “online” system. Sometimes the boot process gets delayed up to two minutes, because the system still waits for one or more network interfaces to be ready. Systemd provides the network-online.target that other service units can rely on, if they are deemed to require network connectivity. But what does “online” actually mean in this context, is a link-local IP address enough, do we need a routable gateway and how about DNS name resolution?

The requirements for an “online” network interface depend very much on the services using an interface. For some services it might be good enough to reach their local network segment (e.g. to announce Zeroconf services), while others need to reach domain names (e.g. to mount a NFS share) or reach the global internet to run a web server. On the other hand, the implementation of network-online.target varies, depending on which networking daemon is in use, e.g. systemd-networkd-wait-online.service or NetworkManager-wait-online.service. For Ubuntu, we created a specification that describes what we as a distro expect an “online” system to be. Having a definition in place, we are able to tackle the network-online-ordering issues that got reported over the years and can work out solutions to avoid delayed boot times on Ubuntu systems.

In essence, we want systems to reach the following networking state to be considered online:

  1. Do not wait for “optional” interfaces to receive network configuration
  2. Have IPv6 and/or IPv4 “link-local” addresses on every network interface
  3. Have at least one interface with a globally routable connection
  4. Have functional domain name resolution on any routable interface

A common implementation

NetworkManager and systemd-networkd are two very common networking daemons used on modern Linux systems. But they originate from different contexts and therefore show different behaviours in certain scenarios, such as wait-online. Luckily, on Ubuntu we already have Netplan as a unification layer on top of those networking daemons, that allows for common network configuration, and can also be used to tweak the wait-online logic.

With the recent release of Netplan v1.1 we introduced initial functionality to tweak the behaviour of the systemd-networkd-wait-online.service, as used on Ubuntu Server systems. When Netplan is used to drive the systemd-networkd backend, it will emit an override configuration file in /run/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf, listing the specific non-optional interfaces that should receive link-local IP configuration. In parallel to that, it defines a list of network interfaces that Netplan detected to be potential global connections, and waits for any of those interfaces to reach a globally routable state.

Such override config file might look like this:

[Unit]
ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service

[Service]
ExecStart=
ExecStart=/lib/systemd/systemd-networkd-wait-online -i eth99.43:carrier -i lo:carrier -i eth99.42:carrier -i eth99.44:degraded -i bond0:degraded
ExecStart=/lib/systemd/systemd-networkd-wait-online --any -o routable -i eth99.43 -i eth99.45 -i bond0

In addition to the new features implemented in Netplan, we reached out to upstream systemd, proposing an enhancement to the systemd-networkd-wait-online service, integrating it with systemd-resolved to check for the availability of DNS name resolution. Once this is implemented upstream, we’re able to fully control the systemd-networkd backend on Ubuntu Server systems, to behave consistently and according to the definition of an “online” system that was lined out above.

Future work

The story doesn’t end there, because Ubuntu Desktop systems are using NetworkManager as their networking backend. This daemon provides its very own nm-online utility, utilized by the NetworkManager-wait-online systemd service. It implements a much higher-level approach, looking at the networking daemon in general instead of the individual network interfaces. By default, it considers a system to be online once every “autoconnect” profile got activated (or failed to activate), meaning that either a IPv4 or IPv6 address got assigned.

There are considerable enhancements to be implemented to this tool, for it to be controllable in a fine-granular way similar to systemd-networkd-wait-online, so that it can be instructed to wait for specific networking states on selected interfaces.

A note of caution

Making a service depend on network-online.target is considered an antipattern in most cases. This is because networking on Linux systems is very dynamic and the systemd target can only ever reflect the networking state at a single point in time. It cannot guarantee this state to be remained over the uptime of your system and has the potentially to delay the boot process considerably. Cables can be unplugged, wireless connectivity can drop, or remote routers can go down at any time, affecting the connectivity state of your local system. Therefore, “instead of wondering what to do about network.target, please just fix your program to be friendly to dynamically changing network configuration.” [source].

]]> Lukas Märdian git revert name and Akademy https://jriddell.org/2024/09/12/git-revert-name-and-akademy/ https://jriddell.org/2024/09/12/git-revert-name-and-akademy/ Thu, 12 Sep 2024 14:33:09 GMT I reverted my name back to Jonathan Riddell and have now made a new uid for my PGP key, you can get the updated one on keyserver.ubuntu.com or my contact page or my Launchpad page.

Here’s some pics from Akademy

]]> Jonathan Riddell Freedesktop Specs Website Update https://blog.tenstral.net/2024/08/freedesktop-specs-website-update.html https://blog.tenstral.net/2024/08/freedesktop-specs-website-update.html Sun, 04 Aug 2024 18:54:37 GMT The Freedesktop.org Specifications directory contains a list of common specifications that have accumulated over the decades and define how common desktop environment functionality works. The specifications are designed to increase interoperability between desktops. Common specifications make the life of both desktop-environment developers and especially application developers (who will almost always want to maximize the amount of Linux DEs their app can run on and behave as expected, to increase their apps target audience) a lot easier.

Unfortunately, building the HTML specifications and maintaining the directory of available specs has become a bit of a difficult chore, as the pipeline for building the site has become fairly old and unmaintained (parts of it still depended on Python 2). In order to make my life of maintaining this part of Freedesktop easier, I aimed to carefully modernize the website. I do have bigger plans to maybe eventually restructure the site to make it easier to navigate and not just a plain alphabetical list of specifications, and to integrate it with the Wiki, but in the interest of backwards compatibility and to get anything done in time (rather than taking on a mega-project that can’t be finished), I decided to just do the minimum modernization first to get a viable website, and do the rest later.

So, long story short: Most Freedesktop specs are written in DocBook XML. Some were plain HTML documents, some were DocBook SGML, a few were plaintext files. To make things easier to maintain, almost every specification is written in DocBook now. This also simplifies the review process and we may be able to switch to something else like AsciiDoc later if we want to. Of course, one could have switched to something else than DocBook, but that would have been a much bigger chore with a lot more broken links, and I did not want this to become an even bigger project than it already was and keep its scope somewhat narrow.

DocBook is a markup language for documentation which has been around for a very long time, and therefore has older tooling around it. But fortunately our friends at openSUSE created DAPS (DocBook Authoring and Publishing Suite) as a modern way to render DocBook documents to HTML and other file formats. DAPS is now used to generate all Freedesktop specifications on our website. The website index and the specification revisions are also now defined in structured TOML files, to make them easier to read and to extend. A bunch of specifications that had been missing from the original website are also added to the index and rendered on the website now.

Originally, I wanted to put the website live in a temporary location and solicit feedback, especially since some links have changed and not everything may have redirects. However, due to how GitLab Pages worked (and due to me not knowing GitLab CI well enough…) the changes went live before their MR was actually merged. Rather than reverting the change, I decided to keep it (as the old website did not build properly anymore) and to see if anything breaks. So far, no dead links or bad side effects have been observed, but:

If you notice any broken link to specifications.fd.o or anything else weird, please file a bug so that we can fix it!

Thank you, and I hope you enjoy reading the specifications in better rendering and more coherent look! 😃

]]> Matthias Klumpp Critical OpenSSH Vulnerability (CVE-2024-6387): Please Update Your Linux http://blog.harisfazillah.info/2024/07/critical-openssh-vulnerability-cve-2024.html http://blog.harisfazillah.info/2024/07/critical-openssh-vulnerability-cve-2024.html Thu, 04 Jul 2024 21:35:00 GMT  

Critical OpenSSH Vulnerability (CVE-2024-6387): Please Update Your Linux

A critical security flaw (CVE-2024-6387) has been identified in OpenSSH, a program widely used for secure remote connections. This vulnerability could allow attackers to completely compromise affected systems (remote code execution).

Who is Affected?

Only specific versions of OpenSSH (8.5p1 to 9.7p1) running on glibc-based Linux systems are vulnerable. Newer versions are not affected.

What to Do?

  1. Update OpenSSH: Check your version by running ssh -V in your terminal. If you're using a vulnerable version (8.5p1 to 9.7p1), update immediately.

  2. Temporary Workaround (Use with Caution): Disabling the login grace timeout (setting LoginGraceTime=0 in sshd_config) can mitigate the risk, but be aware it increases susceptibility to denial-of-service attacks.

  3. Recommended Security Enhancement: Install fail2ban to prevent brute-force attacks. This tool automatically bans IPs with too many failed login attempts.

Optional: IP Whitelisting for Increased Security

Once you have fail2ban installed, consider allowing only specific IP addresses to access your server via SSH. This can be achieved using:

  • ufw for Ubuntu

  • firewalld for AlmaLinux or Rocky Linux

Additional Resources

About Fail2ban

Fail2ban monitors log files like /var/log/auth.log and bans IPs with excessive failed login attempts. It updates firewall rules to block connections from these IPs for a set duration. Fail2ban is pre-configured to work with common log files and can be easily customized for other logs and errors.

Installation Instructions:

  • Ubuntu: sudo apt install fail2ban

  • AlmaLinux/Rocky Linux: sudo dnf install fail2ban


About DevSec Hardening Framework

The DevSec Hardening Framework is a set of tools and resources that helps automate the process of securing your server infrastructure. It addresses the challenges of manually hardening servers, which can be complex, error-prone, and time-consuming, especially when managing a large number of servers. The framework integrates with popular infrastructure automation tools like Ansible, Chef, and Puppet. It provides pre-configured modules that automatically apply secure settings to your operating systems and services such as OpenSSH, Apache and MySQL. This eliminates the need for manual configuration and reduces the risk of errors.


Prepare by LinuxMalaysia with the help of Google Gemini


5 July 2024

 

In Google Doc Format 

 

https://docs.google.com/document/d/e/2PACX-1vTSU27PLnDXWKjRJfIcjwh9B0jlSN-tnaO4_eZ_0V5C2oYOPLLblnj3jQOzCKqCwbnqGmpTIE10ZiQo/pub 



]]> Harisfazillah Jamel dhcpcd almost ready to replace ISC dhclient in Debian http://q-funk.blogspot.com/2023/11/dhcpcd-almost-ready-to-replace-isc.html http://q-funk.blogspot.com/2023/11/dhcpcd-almost-ready-to-replace-isc.html Thu, 16 Nov 2023 08:31:00 GMT A lot of time has passed since my previous post on my work to make dhcpcd the drop-in replacement for the deprecated ISC dhclient a.k.a. isc-dhcp-client. Current status:

  • Upstream now regularly produces releases and with a smaller delta than before. This makes it easier to track possible breakage.
  • Debian packaging has essentially remained unchanged. A few Recommends were shuffled, but that's about it.
  • The only remaining bug is fixing the build for Hurd. Patches are welcome. Once that is fixed, bumping dhcpcd-base's priority to important is all that's left.
]]> Martin-Éric Racine Ubuntu Summit 2023 https://rossgammon68.wordpress.com/2023/11/05/ubuntu-summit-2023/ https://rossgammon68.wordpress.com/2023/11/05/ubuntu-summit-2023/ Sun, 05 Nov 2023 16:01:16 GMT UbuntuSummit2023

I am currently attending the Ubuntu Summit 2023 in Riga, Latvia. This is the first time I have deliberately attended an Ubuntu event. Back in 2013, I accidentally walked through what I believe was the last Ubuntu Developers Summit in Copenhagen, when I was showing some friends around Bella Sky in Copenhagen.

This time I was asked by Erich Eickmeyer if I would like to join him as a member of the Ubuntu Studio team. It has been fantastic to meet him and Eylul Dogruel from the Ubuntu Studio team. It was also fantastic to meet or see in person other members of the Linux Audio community, and other Ubuntu and Canonical people that have helped me with my Ubuntu contributions along the way.

Here are the talks I attended and meetings I had related to Ubuntu Studio:

50 things you did not know you could do with Ardour , Dr Robin Gareus (Ardour, Linux Audio)
Making a standalone effects pedal system based on embed Linux, Filipe Coelho
Live Mixing with PipeWire and Ardour/Harrison Mixbus, Erich Eickmeyer (Ubuntu / Ubuntu Studio)
Art and ownership – the confusing problem of owning a visual idea, Eylul Dogruel (Ubuntu Studio)
Ubuntu Flavour Sync meeting, Aaron Prisk (Canonical), Ana Sereijo (Canonical), Daniel Bungert (Canonical), Mr Mauro Gaspari (Canonical), Michael Hudson-Doyle (Canonical), Oliver Smith (Canonical), Mr Tim Holmes-Mitra (Canonical)
I believe talks will be uploaded onto You Tube at some point, so look out for them!
]]> Ross Gammon OpenStack 2023.2 Bobcat for Ubuntu 22.04 LTS https://wrestlingpenguins.wordpress.com/2023/10/06/openstack-2023-2-bobcat-for-ubuntu-22-04-lts/ https://wrestlingpenguins.wordpress.com/2023/10/06/openstack-2023-2-bobcat-for-ubuntu-22-04-lts/ Fri, 06 Oct 2023 12:47:34 GMT The Ubuntu OpenStack team at Canonical is pleased to announce the general availability of OpenStack 2023.2 Bobcat on Ubuntu 22.04 LTS (Jammy Jellyfish). For more details on the release, please see the OpenStack 2023.2 Bobcat release notes.

The Ubuntu Cloud Archive for OpenStack 2023.2 Bobcat can be enabled on Ubuntu 22.04 by running the following command:

sudo add-apt-repository cloud-archive:bobcat

The Ubuntu Cloud Archive for 2023.2 Bobcat includes updates for:

aodh, barbican, ceilometer, ceph (18.2.0), cinder, designate, designate-dashboard, dpdk (22.11.3), glance, gnocchi, heat, heat-dashboard, horizon, ironic, ironic-ui, keystone, magnum, magnum-ui, manila, manila-ui, masakari, mistral, murano, murano-dashboard, networking-arista, networking-bagpipe, networking-baremetal, networking-bgpvpn, networking-l2gw, networking-mlnx, networking-sfc, neutron, neutron-dynamic-routing, neutron-fwaas, neutron-taas, neutron-vpnaas, nova, octavia, octavia-dashboard, openstack-trove, openvswitch (3.2.0), ovn (23.09.0), ovn-octavia-provider, placement, sahara, sahara-dashboard, senlin, swift, trove-dashboard, vitrage, watcher, watcher-dashboard, zaqar, and zaqar-ui.

For a full list of packages and versions, please refer to the Ubuntu Cloud Archive Tracker.

Reporting bugs

If you have any issues please report bugs using the ‘ubuntu-bug’ tool to ensure that bugs get logged in the right place in Launchpad:

sudo ubuntu-bug nova-conductor

Thank you to everyone who contributed to OpenStack 2023.2 Bobcat!

]]> Corey Bryant Understanding vm.swappiness: Improving Linux Performance and Memory Management https://coderstalk.blogspot.com/2023/07/understanding-vmswappiness-improving.html https://coderstalk.blogspot.com/2023/07/understanding-vmswappiness-improving.html Sun, 23 Jul 2023 23:13:00 GMT As a Linux user, you may have stumbled across the enigmatic 'vm.swappiness' setting when examining your system's configuration. The variable 'vm.swappiness' is important in Linux memory management because it affects how your system handles virtual memory and swap space. In this blog post, we'll debunk 'vm.swappiness' and look at how it affects system performance. So, let's plunge into the world of Linux memory management and expose the secrets of vm.swappiness.

]]> Muhammad Fauzilkamil Zainuddin Ubuntu debuginfod and source code indexing https://blog.sergiodj.net/posts/ubuntu-debuginfod-source-code-indexing/ https://blog.sergiodj.net/posts/ubuntu-debuginfod-source-code-indexing/ Sat, 13 May 2023 20:43:00 GMT You might remember that in my last post about the Ubuntu debuginfod service I talked about wanting to extend it and make it index and serve source code from packages. I’m excited to announce that this is now a reality since the Ubuntu Lunar (23.04) release.

The feature should work for a lot of packages from the archive, but not all of them. Keep reading to better understand why.

The problem

While debugging a package in Ubuntu, one of the first steps you need to take is to install its source code. There are some problems with this:

  • apt-get source required dpkg-dev to be installed, which ends up pulling in a lot of other dependencies.
  • GDB needs to be taught how to find the source code for the package being debugged. This can usually be done by using the dir command, but finding the proper path to be is usually not trivial, and you find yourself having to use more “complex” commands like set substitute-path, for example.
  • You have to make sure that the version of the source package is the same as the version of the binary package(s) you want to debug.
  • If you want to debug the libraries that the package links against, you will face the same problems described above for each library.

So yeah, not a trivial/pleasant task after all.

The solution…

Debuginfod can index source code as well as debug symbols. It is smart enough to keep a relationship between the source package and the corresponding binary’s Build-ID, which is what GDB will use when making a request for a specific source file. This means that, just like what happens for debug symbol files, the user does not need to keep track of the source package version.

While indexing source code, debuginfod will also maintain a record of the relative pathname of each source file. No more fiddling with paths inside the debugger to get things working properly.

Last, but not least, if there’s a need for a library source file and if it’s indexed by debuginfod, then it will get downloaded automatically as well.

… but not a perfect one

In order to make debuginfod happy when indexing source files, I had to patch dpkg and make it always use -fdebug-prefix-map when compiling stuff. This GCC option is used to remap pathnames inside the DWARF, which is needed because in Debian/Ubuntu we build our packages inside chroots and the build directories end up containing a bunch of random cruft (like /build/ayusd-ASDSEA/something/here). So we need to make sure the path prefix (the /build/ayusd-ASDSEA part) is uniform across all packages, and that’s where -fdebug-prefix-map helps.

This means that the package must honour dpkg-buildflags during its build process, otherwise the magic flag won’t be passed and your DWARF will end up with bogus paths. This should not be a big problem, because most of our packages do honour dpkg-buildflags, and those who don’t should be fixed anyway.

… especially if you’re using LTO

Ubuntu enables LTO by default, and unfortunately we are affected by an annoying (and complex) bug that results in those bogus pathnames not being properly remapped. The bug doesn’t affect all packages, but if you see GDB having trouble finding a source file whose full path starts without /usr/src/..., that is a good indication that you’re being affected by this bug. Hopefully we should see some progress in the following weeks.

Your feedback is important to us

If you have any comments, or if you found something strange that looks like a bug in the service, please reach out. You can either send an email to my public inbox (see below) or file a bug against the ubuntu-debuginfod project on Launchpad.

]]> Sergio Durigan Junior My Walk on the Portuguese Camino de Santiago, 2023 http://blog.dustinkirkland.com/2023/04/camino-de-santiago-2023.html http://blog.dustinkirkland.com/2023/04/camino-de-santiago-2023.html Sun, 07 May 2023 18:49:00 GMT
This is a long retrospective, organized into 3 parts, about my 2023 hike of the Portuguese Camino de Santiago.
  1. Part 1 is about my preparation, packing and gear
  2. Part 2 covers a retrospective of insights gained along the way, and advice for anyone else considering the Camino
  3. And Part 3 is a roll-up of the daily social media posts and accompanying photographs from my two weeks on the trail
Comments are disabled on Blogger due to relentless spam, but you reach me on LinkedIn and Twitter with questions.  You're also welcome to follow me on Google Maps, where I contribute frequently and reviewed many of the establishments we visited along this trip.  Enjoy!

Part 1: Preparation, Packing, and Gear

I love a good, long walk -- I've had some brilliant hikes across Scotland, New Zealand, Peru, Switzerland, and of course throughout Texas and the United States National Parks.  I know my limits -- I'm fit enough to easily walk 10-15 miles a day, with a pack, for multiple days in a row.  But I also know that I need to be very comfortable in my shoes, and with my pack, and with the right gear.  So I spent about 3 weeks walking around my hometown of Austin, Texas, with my pack, "training".  I walked about 5-7 miles in my (pretty hilly) neighborhood, almost every day, and did one 10 miler around Lady Bird Lake trail in downtown Austin.  I wouldn't call this "training" per se, but I do think it was pretty valuable acclimation to the mileage and additional weight of a backpack.

All in all, I felt very well prepared throughout the actual hike on the Camino.

More importantly, I was generally pleased with the light weight and balance of my pack.  With hindsight, are there a few things I would pack differently?  You bet.  Here's a spreadsheet I used when packing:


See below for a thorough retrospective on my packing and gear.  
Disclosure: As an Amazon Associate I earn from qualifying purchases.

Backpack

I decided to upgrade my vintage, 20+ year old Gregory Reality backpack, to a brand new, ultralight Osprey Exos 38L, and that was a great investment!  I kept my fully loaded pack to about 18 lbs with an empty water bladder, or 20 lbs with a fully loaded 2L water bladder.  That weight was perfect for me.  I hardly noticed it at all.  I mean, I couldn't "run", but at no point in the 160 miles did I ever even think about the backpack's weight or comfort.  It was just part of me.  I also brought the over-pack rain shell, which was useful and necessary a couple of times.  For what it's worth, my hiking partner used an Osprey Stratos 36L and he loved his, too.

Water

My Osprey backpack supported a water bladder, and I carried a 2L Camelbak bladder.  It was awesome.  I swear by it.  It was really nice to sip water along the way, any time, without stopping.

Shoes

In my early Camino prep, I also originally figured I'd take my beloved heavy duty leather Hanwag hiking boots.  However, doing a little bit of research and reading, it seems that all of the distance through hikers these days have moved to using trail running shoes, of which Hoka Speedgoat and Altra Lone Peak seem to be by far the most popular.  I tried both, and really liked the Altras better.  (I got a pretty good deal by buying last year's model).  I treated them with a couple of applications of Scotch Guard for a little bit of extra water resistance.


REI has both (and some others), and you should probably check them out, if you haven't already.  There were plenty of people on the Camino wearing both Hoka and Altra, as well as some Soloman's, a few Brooks, and others.  I was quite happy with the Altras, all things said.  I ended up with a few blisters on the 18 mile days, but I think that was more a matter of my socks.

Socks

Speaking of socks, I only brought my favorite Bombas ankle socks, which are my all-day, everyday socks at home.  (I'm a huge fan of Bombas, and generally buy direct from Bombas.com, as they donate socks for every direct purchase).  But in retrospect, I probably should have brought purpose made hiking socks instead.

Alternate Pair of Shoes

Without a doubt, you'll also need a second pair of shoes for the afternoon / evening, after you're done hiking.  I brought my Olukai flip flops (which I can easily walk/hike 6+ miles in, no question).  I liked flip flops because they were light, and could get wet (I used them in the occasional communal / prison-style showers).  My hiking partner used lightweight deck shoes as his 2nd pair and he was happy with that as well.  The key point is just that you'll absolutely need something to switch into, after a long day of hiking and you really need something that doesn't require socks.

Clothes

I packed 5 sets of socks, underwear, and shirts (3 long sleeves, 2 shortsleeves), and 3 sets of pants (two long hiking pants, one pair of shorts).  We did laundry every 4-5 days.  Basically I'd wash 4 sets of clothes, while wearing my last set.  Most accommodation has some form of laundry facilities.  We chose to use the ones that had both washers and dryers (to get everything done in 90 minutes or so), but most people just hang dry their clothes overnight.  Plenty of people travel with just 2 or 3 sets of clothes too, and they do laundry more frequently.

Shirts

The weather was really, really quite perfect for our hike in March/April.  Just a bit of chill in the air in the morning (mid 40s-50s Fahrenheit), and warm (high 70s Fahrenheit) most afternoons.  As such, I was able to wear long sleeves shirts every day (avoiding some sunscreen on the arms).  My go-to shirt for hiking are these Fjallraven Abisko wool shirts, and the Fjallraven sun hoodie version.  Light, breathable, extraordinarily comfortable.  I also brought one Nike Dri-fit long sleeve zip top, for some variety.

Pants

In terms of underwear, I brought 5 pairs of Reebok performance boxer briefs.  And for pants, I brought two pairs of Patagonia Quandry hiking pants, and one pair of Under Armour Match Play golf shorts.  And a simple Fjallraven Canvas belt to hold them up.

Layers, and Outerwear

I also brought 3 layers every one of which I used, almost every day -- a Fjallraven Abisko Trail fleece jacket, Fjallraven Buck Fleece vest, and a Fjallraven Keb Eco rain shell.  If you see a pattern, I'm a huge fan of all things Fjallraven for outdoor adventures.  Just a great brand, great quality, great comfort, lasts forever.

Most mornings (in March and April for us) were chilly (low 40s F), and the afternoons sunny and warm (high 70s F).  I'd start most mornings with 1, 2, or all 3 layers, and then stop about every hour to shed a layer.  I liked the long sleeves and long pants (albeit very thin and breathable), even the hottest part of the day, for sun protection.  I wore sunscreen on my face and neck every day.  

I also brought an pair of Frog Tog rain shell pants, which, thankfully I never actually used, as we had great weather.  I probably could have done without, but on the whole, I'm glad I brought as the weight and space required were negligible.

Hat / Cap / Sunglasses

I also brought a basic baseball cap and Oakley Frogskins Lite sunglasses.  My hiking partner swore by his full brim hiking hat, but I didn't like how the back of my full brim hat brushed the top of my backpack. So, instead I used a Fjallraven knit cap/beanie, which was nice a few mornings, but certainly not necessary at all.  I typically shed it within the first hour and could have done without it easily.

Tech and Electronics

Charing electronics (phone, watch) was far easier than I expected.  I carried a rechargeable power brick that I never really used and, in hindsight, I didn't need, at all.

My Google Pixel 6a phone and Google Pixel watch batteries (both proactively set to power save mode every day), had more than enough battery every day for each day's hike, even with full GPS tracking enabled, lots of pictures, a fair amount of Google maps for restaurant reviews, Google lens for translations, and Wikipedia for learnings.

I also brought a small, rechargeable Black Diamond headlamp that I totally didn't need either.  We only started hiking two days before dawn, and even then there were plenty of street lights.  And a phone flashlight would have been plenty enough light. Next time, I wouldn't bother bringing a headlamp.

I did bring a set of Airpods, planning to listen to music or audiobooks, but surprisingly, I never actually used them for even one minute of music or books!  Rather, I enjoyed the conversation with my hiking partner, and the peace and quiet and sounds of the trail.  That said, they were still handy for calling home and talking to the family, though, so no regrets on bringing them.

 Credit cards were good about 80% of the time (mostly NFC tap-to-pay, conveniently), though I did pull cash (about 100-150 euros, three times), with my M1 Finance debit card.

Additional Hiking / Camping Gear

The only important thing I neglected to bring, and actually purchased along the way was a hiking pole.  Of course I have great trekking poles at home, but I was unable to find out definitively if I could carry them onto the plane (we definitely did NOT check our backpacks).  It sounds like the TSA and airline rules against "blunt force weapons" are sometimes (but very inconsistently) applied to hiking poles and walking sticks?  So I did not bring my own, but should have.


As it turns out, I'm sure I totally could have, if I had collapsed it all the way down, and stuffed it entirely inside of the pack, rather than cinching it to the outside where it's visible and accessible.  While it's nice to walk with two poles, one is enough, when packing light.  After about day three, I was missing a walking stick, and I picked up a wooden one (as did my hiking partner), but it was awkward and hurt my wrist.  So I bought one for 15 euros at the first place I saw one for sale.  It was nice enough -- collapsible and spring loaded, but certainly not the highest end equipment.  It does say "Camino de Santiago" on it, so it's a nice souvenir, and it really helped with the up and down hills on the hike.  I had no trouble whatsoever bringing it home on the plane in my carry on backpack, so looking back, I'm sure I could have brought it on very easily.

Regarding Accommodations on the Camino

There's no camping really (maybe just one or two spots), along the Camino, and lodging is readily available, so there's no need for a tent.  If you're flexible (quality and cost, in both directions, up and down), you'll never have a problem finding a place to sleep.  At the lowest end, there are plenty of first-come, first-serve, free (or nearly free, with a nominal "donation" of 10 euros or so), public "Albergues".  These are basically hostels, with 30 or more bunk beds in a room, and communal bathrooms and showers.  It's meager accommodations, usually in an old monastery or similar historic building.  This is the very "traditional" Camino experience.

Similarly, there are also "private" Albergues, which are very similar bunk beds and bath setups, but they do usually take reservations, and are a little newer (maybe cleaner?), and they are also quite affordable (12-20 euros per bed).  We poked our head into 3 or 4 public Albergues, and they were all serviceable, but we chose to stay in a couple of private Albergues, mainly because we could make our reservations a few hours or a day or two ahead of time, and have the peace of mind that we were "booked".  Some private Albergues also have "private rooms", which are a really good deal, if you're traveling in a small group of 2-4.

I was traveling with one other friend, and 9 of the 12 nights, we managed to book our own private room (usually two twin beds, and an en suite shower and toilet) for about 40 euros for the two of us -- which we always opted for, over say a 12 euro apiece bunk bed.  There are a few private apartments and hotels available too -- these are probably in the 50 euro - 80 euro per night range -- still very affordable.  For the region we were in, Booking.com (which has a pretty decent app), was absolutely the way to go.  It was easy to find availability, prices, features, addresses, ratings, and communicate with the hosts (with translation capabilities built into the messaging app).

The only thing we pre-booked before we left home, was our first night at the Hilton in Porto, and our last nights, at the Marriott in Santiago.  These were obviously much, much higher end accommodations, and we paid much more for those (nearly 200 euro a night).  The fancy digs were nice, but totally unnecessary.

Oh, and maybe two nights along the way, we stayed at "farmhouses".  These were my favorite accommodations by far.  One was at a vineyard, with the traditional home cooked, communal dinner, which we shared with 8 other pilgrims.  Truly unforgettable experiences.  If I were to do the Camino again, I would absolutely seek these out, though you do have to book these in advance (we just got lucky), as they are extremely limited and very popular.

Related to accommodations, I also brought my own lightweight Marmot 55F summer sleeping bag, and a very tiny Summit Aeros Down Inflatable Pillow.  This is a tough one.  Strictly speaking, these were not entirely necessary.  The sleeping bag was a lot of extra weight (1.5 lbs), and every single place we stayed provided sheets, pillows, and pillow cases.  I chose to use my own sleeping bag in the 3 bunk room setups, but I totally could have used the provided sheets.  All that said, having my own sleeping bag and pillow was an important piece of mind, in that I knew that I could sleep literally anywhere, as long as I had them.  On a subsequent Camino, though, I don't think I'd bring a sleeping bag at all, and instead would just plan on taking accommodations that provide sheets, or bring a very light sleep sack.

Cooking / Meals

I considered bringing my ultralight MSR camping stove (and buying fuel), but ultimately did not.  That was a good decision, as that would have been completely unnecessary.  There are plenty of cafes and restaurants along the way.  Most lunch and dinner spots have a "pilgrim menu" which is a basic package for 10 euros of a drink, appetizer, entree, and dessert -- so super cheap to eat.  Of course you can order anything you want on the full menu any time.  The wine across Galicia and Portugal is amazing!  The red wines are mostly Tempranillo (or similar) and the whites are Albarino (or similar) from the Douro valley, and delicious.  You'll rarely pay more than 3 euros per glass  Full bottles of red or white wine is readily available for under 10 euros -- and their top shelf super reserva is rarely more than 20 euro a bottle, and it's usually unbelievable stuff.

I did bring a Snow Peak cup and Snow Peak spork.  The cup was useful -- I used it every day, and I like to have a glass of water by my nightstand at night.  I never used the spork -- it's not needed.  I did however bring a tiny corkscrew, which came in handy a couple of times.

Coffee

Probably the one thing I considered bringing, but did not, but REALLY should have, was my Aeropress coffee maker.  For no good reason, I took it out of my pack at the very last minute, and I very much regretted it, almost every single day.

Excellent coffee (espressos, cortados, cafe con leche, etc.) is always available at every cafe along the way, and it's really cheap (1 euro typically).  But at the hostels and hotels, the coffee is universally awful.  There's always a kettle that can boil hot water, and there's usually tea.  But almost everywhere has that dissolvable Nescafe instant coffee.  I found it just undrinkable.

We found a drip coffee maker in just 1 of 12 of our lodgings, and a pod coffee maker (like a Keurig) in just 1 of 12 as well (and that was a private apartment / airbnb type thing).  So most mornings meant stumbling out of bed, packing your backpack, maybe choking down some Nescafe, and then bolting down the trail sans caffeine until the first cafe (which was sometimes packed with pilgrims doing the same thing).  The Aeropress would have taken very little space, very little weight, and coffee grounds were easily available at markets and kettles for hot water.  Seems like such a trivial thing, and maybe I'm more coffee-focused than most, but this was probably my only significant packing regret.

Towels / Laundry

I did bring a quick-dry camping towel, which I'm glad I had for those 2-3 communal showers, but almost everywhere else provided towels.  Strictly speaking, this probably isn't 100% necessary, but it was nice to have.

I had a little drawstring collapsible backpack, which I used as my laundry bag.  That was nice, and amounted to a negligible amount of extra weight and space.

First Aid

I also brought a very basic, pocket first-aid kit.  I used a couple of band aids, and popped a couple of Ibuprofen at the end of the longest days.  I also had a sewing kit, which I didn't use, but I did give the sewing needle away to a fellow pilgrim than needed to pop and drain a terribly infected toenail (gross, you can keep the needle, pal).  I popped and drained my own blisters just with my fingernails, which was fine (and provided a ton of relief!), and just wiped those down with alcohol wipes.  Oh, I also took some Dramamine for the bus ride back to Porto.  Thankfully, I didn't need any of the rest, but I had a couple of anti-diarrheal tablets, some antihistamine, bite and itch cream.  My hiking partner also brought some melatonin which came in handy on the plane and for that first night of weird jet lag sleep.

Other Things I Should Have Brought

Things I Really Could Have Left Behind

Part 2: Insights, Advice, and Retrospective

My Camino was truly an amazing experience!  If you're even remotely considering it, you'd almost certainly enjoy doing it.



History and Basics

Just some basic Camino history, before I dig in...
  • The Camino de Santiago (or, The Way of St. James) has been a religious pilgrimage for over a 1000 years, traveled by literally millions of people.
  • There are dozens of different popular starting points, though you can start your Camino anywhere you choose.
  • The only requirement to getting your "Compostela" (a parchment certificate that officially recognizes your completion), is that you walk the last 100km to the cathedral of Santiago.
  • The medieval Camino has its roots around the 900s, and then further popularized by a "guidebook" published in 1140, called the Codex Calixtinus.
  • Also, St. James (the apostle whose remains are believed to be held at the cathedral of Santiago), is the patron saint of Spain, one of the major sponsors of the crusades, and his popularity rose tremendously in medieval times.
  • The trail was mostly forgotten in the 20th century (just a few hundred pilgrims a year), until a guidebook was published in 1957, and since then, there has been a huge resurgence of interest.
  • Of course the 2010 film, The Way with Martin Sheen and Emilio Estevez (which is excellent, by the way), also helped bring the Camino to American audiences and interest has surged.  Now, several hundred thousand pilgrims make the trip every year.
  • Of the dozens of routes, the most popular is the "French Way", which is the Camino depicted in the movie The Way.  It's 422 miles, and takes about 5 weeks.
  • Perhaps the second most popular routes is the Portuguese Way, roughly 160 miles and takes about 2 weeks, which is the path we took.

Our Way

  • We started in Porto, Portugal, and took the "Central Route", which is inland among the hills and vineyards, but there's also the "Coastal Route", which of course hugs the coast (though the weather can be pretty rough, or so we heard).
  • Our Camino Portuguese Central was about 160 miles, and we did it in 12 days of walking, averaging about 13 miles (a half marathon) a day, with our longest days around 18 miles and our shortest about 9 miles.
  • There was some elevation to climb and descend every day, but it was all very reasonable.  I found it about the same difficulty as hiking around the Texas hill country near Austin.  Hilly, but certainly not mountainous.  Nothing like Colorado or Switzerland.  But also, it's not all just flat walking.
  • Most days, we walked for about 3-5 hours, typically starting between 7am and 9am, and finishing around Noon-2pm.
  • There were other pilgrims who left much earlier than us every day (probably either much slower, or going much farther, or both), and some who left later, or walked later.
  • When we really pushed, with no stops, our fastest miles were about 17 minutes per mile (as measured by my Pixel watch and my hiking partner's Garmin), though a much more comfortable pace, taking a few pictures, conversing, and relaxing a bit, was closer to ~20 minutes a mile.
  • Perhaps the most surprising, and maybe most disappointing part about the Camino, is how much of it is on asphalt, concrete, pavement, or cobblestones, and how very little of it is on dirt or rock trails.
  • There are probably some official numbers somewhere, but I'd estimate that less than 10-15% of our whole Camino was spent on trails, and 85-90% was spent walking on paved streets or cobble stones.
  • Also, I'd say that at least 65-70% was "urban", walking among buildings, towns, villages, and only about 30-35% in fields or the woods or within vineyards or farms.
  • That might be fine by you, but I think I was expecting something a little more remote.  My favorite trails all time are a little more remote treks through Scotland, New Zealand, Switzerland, along the Appalations or the Pacific Northwest -- the Camino is most certainly NOT that.
  • But what the Camino is, is a walk through history.  Many of those cobblestones I'm complaining about were laid by the Romans (and probably their slaves) literally 2000 years ago.
  • Most of the Portuguese Camino follows Roman Road XIX (yes, the Romans basically had a numbered interstate system throughout Europe).
  • There are stone mile markers (literally, "milestones"), carved in Latin, dating to the 1st century A.D.
  • We crossed probably 20 stone arch bridges built by the Romans over 1500 years ago, and another 20 stone bridges built (or re-built) in medieval times 1000 years ago.
  • There's just so, so, so much history.  Castles, keeps, cathedrals, chapels, aqueducts, olive trees, grape groves -- many over 1000 years old.  Let that sink in, and the hard asphalt and pavement do melt away.

Other Pilgrims on the Trail

  • Our first few days, the crowds were very light.  We just 1 other pilgrim on the first day, and less than a dozen per day, for the next 3-4 days.
  • But as of April 1st, things picked up tremendously.
  • Part of it, as we just got closer to Santiago, the trail got busier (back to the point that you must complete the last 100 km on foot to receive the Compostela).
  • The other consideration was that we kind of accidentally started our hike that would put us into Santiago for Easter weekend.  While that was an accident on our part, thousands of pilgrims traveling for more pious reasons were very deliberately covering the Camino over the course of Holy Week, and planning to land in Santiago specifically for Easter.
  • We only met perhaps 5 or 6 other Americans on the trail (a group of 60-something retirees from Rhode Island, and a small group of retired ladies from California).
  • From most-to-fewer, we met many Portuguese, Spaniards, Brazilians, Germans, and a smattering of French, Brits, Canadians, Taiwanese, Australians, Danes, Czechs, Swiss, and others I'm sure I'm missing.
  • Interestingly, almost no one ever asks your name -- just where you're from.  And from then on, you're mostly referred to by your country (or in our case, states, Texas and Colorado).  It's kind of a nice convention.
  • You end up seeing many of the same people every couple of days, roughly traveling in your cohort from stage to stage.  That's pretty fun.  Easy to engage, and get into a conversation with anyone, but also easy to keep your privacy and distance.
  • The vast majority of people we met on the Camino, have done it before, many of them multiple times (like 7 or 8 times or so), and often different routes each time.

Logistics Advice for the End of the Trail

We struggled to find much information about how we were supposed to "complete" our Camino.  Where do we go first?  The Cathedral?  The Pilgrims' Office?  Our hotel?  Where is the 0-km marker?  Thus, we made a few mistakes, and so we'll try to help you out here...

Here's what NOT to do....which is exactly what we did....

  • We got in line to visit the Santiago de Compostela Cathedral itself.
  • We waited about 45 minutes, to enter the cathedral and visit the tomb of St. James and get our passport stamped at the cathedral, which seemed like the sensible thing to do, for pilgrims on the Camino.
  • HOWEVER, the Cathedral does NOT allow backpacks inside.  Thus, we waited 45 minutes to be refused entry because of our backpacks.
  • So each of us took turns going inside (by ourselves, without a pack), while the other waited with the backpacks.
  • Unbelievably, there is NO passport stamp at the Cathedral itself!  Shocking, but true.  We asked all over.
  • The famous front doors are ONLY open during jubilee years (of which 2023 is not).  So instead you enter through the side doors.
  • If you want to see the front doors (which are roped off), you'll need to buy a ticket and a tour (which we did a day later).
  • The tomb of St. James is under the altar, and there's another 10-15 minute queue inside of the Cathedral to see that.

Here's what TO DO...

Rather, here's a much better plan...  Go straight to the Pilgrim's Office, get your Compostela, then check-in to your hotel or accommodations, drop your pack, clean up, and visit the Cathedral afterwards.
  • The traditional end of the Camino is an old, worn stone tile, with the scallop shell, right in the geometric center of the plaza in front of the cathedral.

  • After this, go straight to the Pilgrim's Office, where you'll scan a QR code, and complete a short form to register for your Compostela.

  • It'll ask you a few things -- your name, your nationality, the starting point of your Camino, and your reasons for embarking on this journey.
  • Once you've completed this form (it takes 60 seconds or less), you'll get a number on your phone (basically like pulling a paper ticket at the DMV).
  • In the event that there is a longer wait, there's a beautiful garden within the Pilgrim's complex, which would make for a lovely place to relax while waiting for your number.
  • Then, there's a line that forms inside the building, for the numbers being called.
  • We arrived at the Pilgrim's office at 2pm on Good Friday -- one of the busiest days of the year -- and we waited in line for less than 5 minutes.
  • When your number is called, you'll move into a very busy room that looks just like the DMV, with perhaps a dozen or more booths, each staffed by a helpful person who checks your Camino passport stamps briefly, gives you your "final" stamp, and then prints your compostela.
  • Optionally, you can also add a second "certificate of distance", and purchase a tube for safekeeping your certificates for a couple of euros.

Also, the website will say that there's a "Pilgrim's Mass" every day.  Which is true, except for when it isn't.  There was no Pilgrim's Mass on Good Friday or Holy Saturday (so we didn't get to attend one). 

    Would I do it again?

    Big question...would I do it again?  Complicated answer.

    I can say unequivocally that I enjoyed every minute of it -- the distance, the landscape, the clean air, the weather, the people, the food, the pain, the gain, the history, the bridges, the cobblestones, the churches, the cathedral, the vineyards, the orchards, the farm animals, the rivers, the streams, the waterfalls -- all of it.

    But, at the same time, I just feel that there's so much more to see in the world.  While I was raised Catholic and appreciate the history and solemnity, as mostly an apostate, the religious parts of the pilgrimage are perhaps a little lost on me.  The cathedral is an unbelievable feat of medieval architecture and the history is just mind blowing, but I don't think I get quite as much out of it as someone doing it for the religious act of pilgrimage.

    Moreover, personally, I'm a little more drawn toward the beauties of nature, maybe dotted with some architectural and historical storylines.  With limited opportunities to travel and hike for weeks at a time away from family and work, I think I'd probably tackle some other trails on my list first, before making another Camino.  But, I'd never say never...

    Part 3: Itinerary, Narrative, and Pictures

    March 25, 2023, Day -1: Travel

    Setting out toward Portugal to walk the Camino.  Big thanks to the ladies for taking care of everything back home!

    March 26, 2023, Day 0: Arrival in Porto

    Let's do this!  Made it to Porto, a little later than expected due to strikes in France (merci).  Picked up our passport and toured the Porto Se (Cathedral), c. 1100AD.  Dinner and beers and dessert port wines around town, and we're back at our hotel, ready to set out on our Camino tomorrow.

















    March 27, 2023, Day 1 of 13: Porto to Vilarinho, 18.4 miles

    Perfect weather on our first day, sunny and cool in the morning, slightly warm in the afternoon.  This will probably be one of our longest days, as it just took a while to get out of the city and suburbs of Porto.  The walk was nice, but very urban.  Mostly hard, cobblestone streets, lots of lots of vehicle traffic, so not ideal trail conditions.  We stopped at the 10 mile mark for beers and sandwiches, then kept moving.  We peeked in one aubergue (public hostel for pilgrims) and one other private one, before finding a good match here in Vilarinho.  It's not very crowded at all on the trail yet. We've only met 4 other pilgrims on the trail so far -- a young lady from Taiwan, an older couple from France (on their 15th Camino) and a guy from Brazil.  We seem to be very early in the season.























    March 28, 2023, Day 2 of 13: Vilarinho to Barcelos, 18.2 miles

    Another big day, 18.2 miles, some rolling hills, from Vilarinho to Barcelos.  It finally feels like we are out of the city and into the countryside.  About half of today was about 2/3 pavement, 1/3 trails.  We met about 10 other pellegrino's today -- a Brazilian, a Portuguese, 2 Czech, 2 Swiss, 2 Danes, and 2 Canadians.  We crossed three different stone bridges built about 1000 years ago (possibly incorporating structures from the Roman era 2000 years ago).  Barcelos is our destination for the night, a classic medieval village and home for weary pilgrims for a millennium.  Like them, we kicked off our shoes and enjoyed cold beers, delicious wine, and good food.  Bom cominho!
























    March 29, 2023, Day 3 of 13: Barcelos to Sao Simao, 13.5 miles

    13.5 miles, from Barcelos to tiny vineyard outside of Sao Simao.  Best day on the Camino so far, by far!  Much shorter day, we walked a little over 13 miles, mostly on dirt trails through farms and groves and vineyards.  We saw a few more pellegrino's today, perhaps a dozen, including a few of the same from the day before.  We've covered a few different miles with two different mother/daughter pairs, one Canadian and the other Danish.  All of us are more or less in the same cohort, on roughly the same schedule.  Our first choice of lodging was totally booked and so we walked an extra couple of miles to our second choice and grabbed the last room.  As it turned out, it was an awesome result, as we spent this evening at a hostel within a vineyard, drinking all the wine we could from this vineyard, and eating a communal meal with the other pilgrims here.  We shared a table with our Canadian friends, as well as some Brazilians, Germans, and Portuguese.  Wonderful day, even better night.























    March 30, 2023, Day 4 of 13: Sao Simao to Ponte de Lima, 8.5 miles

    About 8.5 easy miles to Ponte de Lima.  Absolutely wonderful day.  Seems like we're finally done with walking along high traffic motor highways and onto trails through fields, farms, vineyards, and orchards.  We crossed several stone bridges built by the Romans, reinforced and then widened in the middle ages.  These bridges are 1000 to 2000 years old.  Spectacular.  Nice, easy day, cool, fair weather, good breeze, cloudy and not too much sun.  The cork oak trees are beautiful, and some of these olive trees have been growing since Roman times.





























    March 31, 2023, Day 5 of 13: Ponte de Lima to Rubiaes, 12.3 miles

    Ponte de Lima to Rubiaes. Best day of walking so far!  A little over 12 miles but the most elevation gain we should see over the entire hike, all in all really not that intense though.  We were on beautiful trails and dirt roads for the vast majority of the day.  The pellegrino traffic has picked up considerably, now seeing a few dozen pilgrims per day, plus mountain bikers.  We've very quickly gone from walking up to our hotels and just getting a room at the end of a long day, to having to have a reservation a day or two in advance.  We met our first Americans all week -- a trio of retirees from Rhode Island.  There were some amazing waterfalls and mountain streams, and lush, moss and fern covered walls, in addition of course to the vineyards, olive trees, orchards, and cork oaks.  The ground was a little moist, but we generally missed the rain again today.  A few more Roman era (1st century AD) bridges and roads and water fountains, and a church built in 1295 that is a national monument in Portugal.



























    April 1, 2023, Day 6 of 13: Rubiaes to Tui, 13 miles

    Really, really nice day, about 13 miles, all the way across the border from Portugal into Spain.  We got our first taste of slightly damp weather. The forecast was 'rain' but it was more like a very light fog or light drizzle.  The last town at the border, Valenca, was a beautiful medieval town with a proper wall and castle and moat.  We walked the ramparts and stumbled on a Renaissance festival and/or passion of the Christ where I had the best crepe ever, cooked over an open flame.  We're staying in a hostel outside of town though we walked a few miles back into town to have drinks and dinner.  I played goalie for a couple of kids in a Saturday night futbol match and kept a clean sheet (like 9 saves or so, if I do say so myself)...











































    April 2, 2023, Day 7 of 13: Tui to O Porrino, 10.5 miles

    A little over 10 miles from Tui to O Porinño.  Really hard to believe, but the journey is well over half way over.  We gained a full day by walking extra our first 2 days, so we'll probably spend an extra day at the end in Santiago de Compostela.  Today's walk from Tui was very, very, VERY different.  There were over a hundred at least pellegrino's setting out from Tui for Santiago.  The Camino was packed with pilgrims.  Very different. It seems that the pellegrino traffic picks up considerably in the last 100km or so. This was also our first day out walking before sunrise, which made for some great pictures. In any case, we had a nice short walk today, along an ancient, 2000 year old Roman road, across a couple of Roman era bridges, into the town of O Porinño, where we had the best meals of our journey.  Because our distance was shorter (and the time change moving into Spain) we arrived much earlier, and enjoyed the best meals of our trip so far.  We did some laundry, had a nap and a siesta, and then a great evening too.  Hard to believe we are wrapping this up so soon.




















    April 3, 2023, Day 8 of 13: O Porrino to Redondela, 9.9 miles

    Just about 10 miles today, from O Porriño to Redondela, and then another 4 or so miles exploring the town and area.  The trail started out somewhat crowded but thinned out a bit mid morning.  We climbed about a 1000 foot hill and back down towards the end of today's walk, which afforded some beautiful views of the valley and the water.  Our hostel for the night is right next door to a small cheese and meat and meticulously curated bottle shop, where we enjoyed charcuterie plates twice today, plus a delicious Palo Cortado sherry, a tawny port, and a couple of interesting beers.  Very enjoyable day!














    April 4, 2023, Day 9 of 13: Redondela to Pontevedra, 14.2 miles

    From Redondela to Pontevedra, it was a solid 14 mile walk, with a few more hills than we were expecting.  Still, very fair weather and a really beautiful day.  We opt for a couple of slightly longer, slightly more scenic "complementario" routes, hoping to avoid some of the crowds.  Speaking of...it's crowded now.  The Camino is a highway of pilgrims trying to make it into Santiago for Easter.  Of course we walked along the ancient Roman XIX road (yes, the Romans numbered their major roads across Europe like Interstate highways in the US), and several Roman era bridges, including a beautiful one in Arcade.  We also had a magical experience at a bakery in Arcade recommended by our butcher friend a town or two back.  In Pontevedra, we visited an extremely well curated art museum with several Velasquez, Goya, and other Spanish masters.  But the antiquities really shine, with a couple of gold and silver hordes from the area, dated to almost 3000 years ago.  Lots of history and natural beauty today.


























    April 5, Day 10 of 13: Pontevedra to Caldas de Reis, 14.2 miles

    Roughly 14 miles, from Pontevedra to Caldas de Reis, mostly flat with a couple of minor hills, beautiful, fair weather, cold in the morning, warm in the afternoon.  The Camino for traffic is in full force from here on in.  Hundreds upon hundreds upon hundreds of pellegrino's now cover the trails.  Young, old, native, foreign, walking with kids, with dogs, with backpacks and without, and a few annoying groups who think that you want to listen to their Bluetooth speaker for 4 hours.  Everyone is on the trail now!  Most of today was spent on nice trails or small alleys and away from highways.  Caldas de Reis is an interesting little town, surrounding a network of hot springs which have been in continuous use since the time of Ptolemy and the Romans.  We dunked our feet a public hot spring that has served pilgrims for literally a millennia!



















    April 6, Day 11 of 13: Caldas de Reis to Padron, 12.2 miles

    Second to last day hiking, we covered a little over 12 miles from Caldas de Reis to Padròn today, mostly flat terrain, and very fair, favorable weather.  Crowds are heavy -- according to the Camino website, about 1500 pellegrino's are arriving per day.  We enjoyed some nice time in the forest, along trails and streams, the usual Roman roads and bridges of antiquity, and plenty of sunshine.  The food and drink of Galicia are most delightful, from the sweet pastries for breakfast, breads and meats and cheeses for lunch, and the many varieties of fermented beverages.  And the locals are just so incredibly friendly.  Every proprietor and shop owner and bar tender treats you like you are the single most important person in the world.  In fact, we had drinks this evening at Pepe's place in Padron, where every patron gets a giant bear hug and a kiss on the cheek from Pepe, after you sign his book.  This is timeless and precious.
















    April 7, 2023, Day 12 of 13: Padron to Santiago de Compostela, 17.5 miles

    A long, hard uphill final day of walking, 17+ miles from Padròn to Santiago de Compostela, our destination.  We left our albergue well before dawn, knowing that we had a tough day ahead of us, and a lot of pilgrims doing the same walk, expecting to arrive in Santiago on Good Friday in time for Easter.  Our earliest start of the whole trip, it was cold and dark when we started, but also quiet and beautiful and less crowded.  We saw both a full moon set and a sun rise, and zipped through trails and small towns.  We stopped once for a brief breakfast and picked up sandwiches to go, which came in handy 10 miles later.  Once the sun came up, it got hot quickly, and the crowds picked up too.  The last few miles into the city were less scenic and more urban, but ticked away pretty quickly.  Upon arriving, we weren't sure if the protocol, so we went straight to the cathedral where we waited in a line for a half hour and were turned away because backpacks aren't allowed in the church.  So we each took turns, watching one another's packs outside, and doing a quick tour of the church.  Then we went to the pilgrim's office a few blocks away and learned that we didn't even have to visit the cathedral to claim our certificate, the Compostela, but we did anyway, so..bonus points?  We paid a few euros to get our Latin inscribed parchment (pretty cool actually), and then checked into the hotel, and cleaned up.  Then we headed back to the cathedral to actually attend the "pilgrim's mass", which happens every day, and they read the names of all the pilgrim's that arrived that day.  Except when we got there, we were told that "every day" doesn't include "today" because today's Good Friday, and there's no mass. And every day doesn't include tomorrow either.  Or Sunday.  So come back on Monday, two days after you leave.  At this point, the religious part is lost on me, but it was a mind clearing, spiritual journey none the less. Anyway, amazing walk!  Spectacular weather.  Great company.  Delicious food. Good people.  I'm tired, but refreshed.  Challenging, but rewarding! Exhausted, but energized.  Appreciative of this experience, but also ready for home with my girls.  I'll have a bit more to say later in retrospect, but for now, "bom comiño!"


























    April 8, 2023, Day 13 of 13: Day of Rest in Santiago de Compostela

    This is the first day in over two weeks that we haven't had to pack our backpacks and check out of our lodgings and head to the next town.  Rather, we enjoyed a nice day touring the beautiful town of Santiago de Compostela, starting with the museum at the cathedral, which included 4 levels of history around the construction of the structure, art, and artifacts.  After that, I think I had the most unique tour I've ever experienced, period...  We took a guided tour (albeit entirely in Spanish), whereby we spent almost 90 climbing and crawling around THE ROOF OF THE CATHEDRAL.  Yes, you heard me... There's a tour where you basically climb out of a window and look at the cathedral from every possible angle, on the damn roof!  This was simple indescribable and incredible.  Maybe a little unnerving and uncomfortable at times, but a heck of a lot of fun and a one of a kind experience, never to be missed.  The roof was renovated in 2021 and this experience is only recently available.  Tomorrow morning is an early bus ride back to Porto, then I fly back through Amsterdam to my girls, and I'm very much looking forward to being home.  I'll post again a bit more about the logistics of the trip for those considering something like this, and maybe something a little more introspective about what I found along the way.  The way.



















    April 9, 2023, Day 14 of 13: Back in Porto for a day

    Just a short bonus post...we spent Easter Sunday commuting by bus from Santiago back to Porto.  It was kind of amazing to watch the 12 little towns we spent our night tick by, about every 15 minutes by the highway.  3 different times the highway touched the Camino and pellegrino's were obvious with their backpacks and very determined walks.  Porto was a buzz with Easter festivals and activities.  Corey and I had a nice meal and a couple of fantastic ports, which put a nice finish on a great trip.  We even made our way back to the Porto Cathedral, to the start of our journey and the mile marker that says "248 km to Santiago." To the next pilgrims, bom comiño...













    That's all, folks!  I'll leave you with this one...bom caminho, good way, buen camino!

    :-Dustin

    ]]>     Dustin Kirkland     Today I learned: set -e sucks even more. https://smoser.github.io//2023/04/27/set-e-bad.html https://smoser.github.io//2023/04/27/set-e-bad.html Thu, 27 Apr 2023 00:00:00 GMT Today I learned: set -e sucks even more.

    Summary: Just don’t use set -e.

    I’ve never been a fan “errexit” in shell. You’ve probably seen this as set -e, or set -o errexit or sh -e.

    People write lists of shell commands in a file and want the script to exit on the first one that fails rather than barreling on and causing damage. That seems sane.

    I’ve always strived to write “shell programs” rather than “shell scripts”. The difference being that the program will clean up after itself and give sane error messages. It won’t just exit when mkdir fails and leave the user to understand some message like:

     mkdir: cannot create directory ‘/tmp/work/bcd’: No such file or directory

    I’ve always felt that errexit makes “good error handling” in shell more difficult.

    The bash(1) man page has the following text:

    If a compound command or shell function executes in a context where -e is being ignored, none of the commands executed within the compound command or function body will be affected by the -e setting, even if -e is set and a command returns a failure status. If a compound command or shell function sets -e while executing in a context where -e is ignored, that setting will not have any effect until the compound command or the command containing the function call completes.

    Here’s an example of how painful it can be, and I took way too long today tracking down what was wrong.

    1. A Programmer starts off with a simple script make-lvs and uses set -e.

      #!/bin/bash -ex
lvm lvcreate --size=1G myvg -n mylv0
lvm lvcreate --size=1G myvg -n mylv1

      This looks fine for a “shell script”. The -x argument even makes shell write to standard error the commands it is running. At this point everyone is happy.

    2. Later the programmer looks at the script and realizes that he/she needs more flags to lvm lvcreate. So now the script looks like:

      #!/bin/bash -ex
lvm lvcreate --ignoremonitoring --yes --activate=y --setactivationskip=n --size=1G --name=mylv0 mylv0
lvm lvcreate --ignoremonitoring --yes --activate=y --setactivationskip=n --size=1G --name=mylv1 myvg

      I’m happy that the programmer here used long format flags as they are much more self documenting so readers don’t have to (as quickly) open up the lvm man page. It is easier to make sense of that than it is to read ‘lvm lvcreate --ignoremonitoring -y -ay -ky -L1G -n mylv’.

    3. After doing so, they realize that they can make this look a lot nicer, and reduce the copy/paste code with a simple function wrapper.

      #!/bin/bash -e
lvcreate() {
    echo "Creating lv $2 on vg $1 of size $3"
    lvm lvcreate "--size=$3" --ignoremonitoring --yes --activate=y \
        --setactivationskip=n --name="$2" "$1"
    echo "Created $1/$2"
}

lvcreate myvg mylv0 1G
lvcreate myvg mylv1 1G

      The improvements are great. The complexity of the lvm lvcreate is abstracted away nicely. They’ve even dropped the vile set -x in favor of more human friendly messages.

      Output of a failing lvm command looks like this:

      $ make-lvs; echo "exited with $?"
Creating lv mylv0 on vg myvg of size 1G
out of space
exited with 1

    4. The next improvement is where sanity goes completely out the window. [I realize you were questioning my sanity long ago due to my pursuit of shell scripting perfection].

      The programmer tries to add reasonable ‘FATAL’ messages that you might find in log messages of other other programming languages.

       #!/bin/bash -e
 lvcreate() {
     echo "Creating lv $2 on vg $1 of size $3"
     lvm lvcreate "--size=$3" --ignoremonitoring --yes --activate=y \
         --setactivationskip=n --name="$2" "$1"
     echo "Created $1/$2"
 }
 fail() { echo "FATAL:" "$@" 1>&2; exit 1; }
    
 lvcreate myvg mylv0 1G || fail "Failed to create mylv0"
    
 if ! lvcreate myvg mylv1 2G; then
     fail "Failed to create lylv1"
 fi
 echo "Success"

      Can you guess what is going to happen here?

      If the lvm command fails (perhaps the vg is out of space) then the output of this script will look like:

       $ make-lvs; echo exited with $?
 Creating lv mylv1 on vg myvg of size 1G
 error: out of space
 Created myvg/mylv1
 Creating lv mylv2 on vg myvg of size 1G
 error: out of space
 Created myvg/mylv2
 Success
 exited with 0

    The attempt to handle the failure of the lvcreate function with || on lines 10 and with if ! on line 12 made it a “compound command”. A compound command disables the error handling and shell exit that would have come from -e when the lvm command on line 4 failed.

    Above I’ve demonstrated with bash, but this is actually posix behavior, and you can just as well test the function with sh as well.

    Madness.

    If you’re interested in further reading, you can see this topic on the BashFAQ. I agree with GreyCat and geirha: “don’t use set -e. Add your own error checking instead.”

    If you’re still here, the following is the version of the script that I’d like to see. Of course there are other improvements that can be made, but I’m happy with it.

       #!/bin/bash
   info() { echo "$@" 1>&2; }
   stderr() { echo "$@" 1>&2; }
   fail() { stderr "FATAL:" "$@"; exit 1; }
   lvcreate() {
       local vg="$1" lv="$2" size="$3"
       info "Creating $vg/$lv size $size"
       lvm lvcreate \
           --ignoremonitoring --yes --activate=y --setactivationskip=n \
           --size="$size" --name="$lv" "$vg" || {
               stderr "failed ($?) to create $vg/$lv size $size"
               return 1
           }
       info "Created $vg/$lv"
   }
   
   # demonstrate both 'command ||' and 'if ! command; then' styles.
   lvcreate myvg mylv0 1G || fail "Failed to create mylv0"
   
   if ! lvcreate myvg mylv1 1G; then
       fail "Failed to create mylv1"
   fi
   
   info "Success"
    ]]>     Scott Moser     Selenium + AT-SPI = GUI Testing https://apachelog.wordpress.com/2022/12/14/selenium-at-spi-gui-testing/ https://apachelog.wordpress.com/2022/12/14/selenium-at-spi-gui-testing/ Wed, 14 Dec 2022 15:59:20 GMT At KDE we have multiple levels of quality assurance ranging from various degrees of a humans testing features to fully automated testing. Indeed automated testing is incredibly important for the continued quality of our software. A big corner stone of our testing strategy are so called unit tests, they test a specific piece of our software for its behavior in isolation. But for many aspects of our software we need a much higher level view, testing pieces of Plasma’s application launcher in isolation is all good and well but that won’t tell us if the entire UI can be easily navigated using the keyboard. For this type of test we require a different testing approach altogether. A couple months ago I’ve set set out to create a testing framework for this use case and I’m glad to say that it has matured enough to be used for writing tests. I’d like to walk you through the technical building blocks and a simple example.

    Let us start of by looking at the architecture at large. So… there’s Selenium which is an incredibly popular, albeit web-oriented, testing framework. Its main advantages for us are its popularity and that it sports a server-client split. This means we can leverage the existing client tooling available for Selenium without having to write anything ourselves, we only need to grow a server. The server component, called a WebDriver, implements the actual interaction with UI elements and is generic enough to also apply to desktop applications. Indeed so thought others as well: there already exists Appium – it extends Selenium with more app-specific features and behaviors. Something for us to build upon. The clients meanwhile are completely separate and talk to the WebDriver over a well defined JSON REST protocol, meaning we can reuse the existing clients without having to write anything ourselves. They are available in a multitude of programming languages, and who knows maybe we’ll eventually get one for writing Selenium tests in QML 😉

    That of course doesn’t explain how GUI testing can work with this on Linux. Enter: AT-SPI. AT-SPI is an accessibility API and pretty much the standard accessibility system for use on Linux. Obviously its primary use is assistive technologies, like the screen reader Orca, but to do its job it essentially offers a toolkit-independent way of introspecting and interacting with GUI applications. This then gives us a way to implement a WebDriver without caring about the toolkit or app specifics. As long as the app supports AT-SPI, which all Qt apps do implicitly, we can test it.

    Since all the client tooling is independent of the server all we needed to get GUI testing going was a WebDriver that talks to AT-SPI.

    That is what I set out to write and I’m happy to announce that we now have an AT-SPI based WebDriver, and the first tests are popping into existence already. There is also lovely documentation to hold onto.

    So, without further ado. Let us write a simple test. Since the documentation already writes one in Python I’ll use Ruby this time around so we have some examples of different languages. A simple candidate is KInfoCenter. We can test its search functionality with a couple of lines of code.

    First we need to install selenium-webdriver-at-spi, clone it, cmake build it, and cmake install it. You’ll also need to install the relevant client libraries. For ruby that’s simply running gem install appium_lib.

    Then we can start with writing our test. We will need some boilerplate setup logic. This is more or less the same for every test. For more details on the driver setup you may also check the wiki page.

      def setup
    @appium_driver = Appium::Driver.new(
      {
        'caps' => { app: 'org.kde.kinfocenter.desktop' },
        'appium_lib' => {
          server_url: 'http://127.0.0.1:4723',
          wait_timeout: 10,
          wait_interval: 0.5
        }
      }, true
    )
    @driver = @appium_driver.start_driver
  end

    The driver will take care of starting the correct application and make sure that it is actually running correctly. Next we’ll write the actual test. Let’s test the search. The first order of business is using a tool called Accerciser to inspect the AT-SPI presentation of the application. For more information on how to use this tool please refer to the wiki. Using Accerciser I’ve located the search field and learned that it is called ‘Search’. So, let’s locate it and activate it, search for the CPU module:

      def test_search
    search = driver.find_element(:name, 'Search')
    search.click
    search.send_keys('cpu')

    Next let us find the CPU list item and activate it:

        cpu = driver.find_element(:class_name, '[list item | CPU]')
    assert(cpu.displayed?)
    cpu.click

    And finally let’s assert that the page was actually activated:

        cpu_tab = driver.find_element(:class_name, '[page tab | CPU]')
    assert(cpu_tab.displayed?)

    To run the complete test we can use the run wrapper: selenium-webdriver-at-spi-run ./kinfocentertest.rb (mind that it needs to be +x). If all has gone well we should get a successful test.

    Finished in 1.345276s, 0.7433 runs/s, 1.4867 assertions/s.

1 runs, 2 assertions, 0 failures, 0 errors, 0 skips
I, [2022-12-14T13:13:53.508516 #154338]  INFO -- : tests done
I, [2022-12-14T13:13:53.508583 #154338]  INFO -- : run.rb exiting true

    This should get you started with writing a test for your application! I’ll gladly help and review your forthcoming tests.
    For more detailed documentation check out the writing-tests wiki page as well as the appium command reference.

    Of course the work is not done. selenium-webdriver-at-spi is very much still a work in progress and I’d be glad for others to help add features as they become needed. The gitlab project is the place for that. ❤

    The complete code of the example above:

    #!/usr/bin/env ruby
# frozen_string_literal: true

# SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
# SPDX-FileCopyrightText: 2022 Harald Sitter <sitter@kde.org>

require 'appium_lib'
require 'minitest/autorun'

class TestKInfoCenter < Minitest::Test
  attr_reader :driver

  def setup
    @appium_driver = Appium::Driver.new(
      {
        'caps' => { app: 'org.kde.kinfocenter.desktop' },
        'appium_lib' => {
          server_url: 'http://127.0.0.1:4723',
          wait_timeout: 10,
          wait_interval: 0.5
        }
      }, true
    )
    @driver = @appium_driver.start_driver
  end

  def teardown
    driver.quit
  end

  def test_search
    search = driver.find_element(:name, 'Search')
    search.click
    search.send_keys('cpu')

    cpu = driver.find_element(:class_name, '[list item | CPU]')
    assert(cpu.displayed?)
    cpu.click

    cpu_tab = driver.find_element(:class_name, '[page tab | CPU]')
    assert(cpu_tab.displayed?)
  end
end
    ]]>     Harald Sitter     Running Cockpit inside ALP https://losca.blogspot.com/2022/12/running-cockpit-inside-alp.html https://losca.blogspot.com/2022/12/running-cockpit-inside-alp.html Sat, 10 Dec 2022 13:07:00 GMT (quoted from my other blog at since a new OS might be interesting for many and this is published in separate planets)

    ALP - The Adaptable Linux Platform – is a new operating system from SUSE to run containerized and virtualized workloads. It is in early prototype phase, but the development is done completely openly so it’s easy to jump in to try it.

    For this trying out, I used the latest encrypted build – as of the writing, 22.1 – from ALP images. I imported it in virt-manager as a Generic Linux 2022 image, using UEFI instead of BIOS, added a TPM device (which I’m interested in otherwise) and referring to an Ignition JSON file in the XML config in virt-manager.

    The Ignition part is pretty much fully thanks to Paolo Stivanin who studied the secrets of it before me. But here it goes - and this is required for password login in Cockpit to work in addition to SSH key based login to the VM from host - first, create config.ign file:

    {
  "ignition": { "version": "3.3.0" },
  "passwd": {
    "users": [
      {
        "name": "root",
        "passwordHash": "YOURHASH",
        "sshAuthorizedKeys": [
          "ssh-... YOURKEY"
        ]
      }
    ]
  },
  "systemd": {
    "units": [{
      "name": "sshd.service",
      "enabled": true
    }]
  },
  "storage": {
    "files": [
      {
        "overwrite": true,
        "path": "/etc/ssh/sshd_config.d/20-enable-passwords.conf",
        "contents": {
          "source": "data:,PasswordAuthentication%20yes%0APermitRootLogin%20yes%0A"
        },
        "mode": 420
      }
    ]
  }
}

    …where password SHA512 hash can be obtained using openssl passwd -6 and the ssh key is your public ssh key.

    That file is put to eg /tmp and referred in the virt-manager’s XML like follows:

      <sysinfo type="fwcfg">
    <entry name="opt/com.coreos/config" file="/tmp/config.ign"/>
  </sysinfo>

    Now we can boot up the VM and ssh in - or you could log in directly too but it’s easier to copy-paste commands when using ssh.

    Inside the VM, we can follow the ALP documentation to install and start Cockpit:

    podman container runlabel install registry.opensuse.org/suse/alp/workloads/tumbleweed_containerfiles/suse/alp/workloads/cockpit-ws:latest
podman container runlabel --name cockpit-ws run registry.opensuse.org/suse/alp/workloads/tumbleweed_containerfiles/suse/alp/workloads/cockpit-ws:latest
systemctl enable --now cockpit.service

    Check your host’s IP address with ip -a, and open IP:9090 in your host’s browser:

    Cockpit login screen

    Login with root / your password and you shall get the front page:

    Cockpit front page

    …and many other pages where you can manage your ALP deployment via browser:

    Cockpit podman page

    All in all, ALP is in early phases but I’m really happy there’s up-to-date documentation provided and people can start experimenting it whenever they want. The images from the linked directory should be fairly good, and test automation with openQA has been started upon as well.

    You can try out the other example workloads that are available just as well.

    ]]>     Timo Jyrinki     Clipboard content to file. New app https://costales.github.io/posts/clipboard-to-file/ https://costales.github.io/posts/clipboard-to-file/ Sat, 22 Oct 2022 08:29:27 GMT Costales Ubuntu bug fix anniversary https://jeremy.bicha.net/2022/10/17/ubuntu-bug-fix-anniversary/ https://jeremy.bicha.net/2022/10/17/ubuntu-bug-fix-anniversary/ Mon, 17 Oct 2022 13:54:46 GMT I first installed Ubuntu when Ubuntu 6.06 LTS “Dapper Drake” was released. I was brand new to Linux. This was Ubuntu’s first LTS release; the very first release of Ubuntu was only a year and a half before. I was impressed by how usable and useful the system was. It soon became my primary home operating system and I wanted to help make it better.

    On October 15, 2009, I was helping test the release candidates ISOs for the Ubuntu 9.10 release. Specifically, I tested Edubuntu. Edubuntu has since been discontinued but at the time it was an official Ubuntu flavor preloaded with lots of education apps. One of those education apps was Moodle, an e-learning platform.

    When testing Moodle, I found that a default installation would make Moodle impossible to use locally. I figured out how to fix this issue. This was really exciting: I finally found an Ubuntu bug I knew how to fix. I filed the bug report.

    This was very late in the Ubuntu 9.10 release process and Ubuntu was in the Final Freeze state. In Final Freeze, every upload to packages included in the default install need to be individually approved by a member of the Ubuntu Release Team. Also, I didn’t have upload rights to Ubuntu. Jordan Mantha (LaserJock), an Edubuntu maintainer, sponsored my bug fix upload.

    I also forwarded my patch to Debian.

    While trying to figure out what wasn’t working with Moodle, I stumbled across a packaging bug. Edubuntu provided a choice of MySQL or PostgreSQL for the system default database. MySQL was the default, but if PostgreSQL were chosen instead, Moodle wouldn’t work. I figured out how to fix this bug too a week later. Jordan sponsored this upload and Steve Langasek from the Release Team approved it so it also was able to be fixed before 9.10 was released.

    Although the first bug was new to 9.10 because of a behavior change in a low-level dependency, this PostgreSQL bug existed in stable Ubuntu releases. Therefore, I prepared Stable Release Updates for Ubuntu 9.04 and Ubuntu 8.04 LTS.

    Afterwards

    Six months later, I was able to attend my first Ubuntu Developer Summit. I was living in Bahrain (in the Middle East) at the time and a trip to Belgium seemed easier to me than if I were living in the United States where I usually live. This was the Ubuntu Developer Summit where planning for Ubuntu 10.10 took place. I like to believe that I helped with the naming since I added Maverick to the wiki page where people contribute suggestions.

    I did not apply for financial sponsorship to attend and I stayed in a budget hotel on the other side of Brussels. The event venue was on the outskirts of Brussels so there wasn’t a direct bus or metro line to get there. I rented a car. I didn’t yet have a smartphone and I had a LOT of trouble navigating to and from the site every day. I learned then that it’s best to stay close to the conference site since a lot of the event is actually in the unstructured time in the evenings. Fortunately, I managed to arrive in time for Mark Shuttleworth’s keynote where the Unity desktop was first announced. This was released in Ubuntu 10.10 in the Ubuntu Netbook Remix and became the default for Ubuntu Desktop in Ubuntu 11.04.

    Ubuntu’s switch to Unity provided me with a huge opportunity. In April 2011, GNOME 3.0 was released. I wanted to try it but it wasn’t yet packaged in Ubuntu or Debian. It was suggested that I could help work on packaging the major new version in a PPA. The PPA was convenient because I was able to get permission to upload there easier than being able to upload directly to Ubuntu. My contributions there then enabled me to get upload rights to the Ubuntu Desktop packages later that year.

    At a later Ubuntu Developer Summit, it was suggested that I start an official Ubuntu flavor for GNOME. So along with Tim Lunn (darkxst), I co-founded Ubuntu GNOME. Years later, Canonical stopped actively developing Unity; instead, Ubuntu GNOME was merged into Ubuntu Desktop.

    Along the way, I became an Ubuntu Core Developer and a Debian Developer. And in January 2022, I joined Canonical on the Desktop Team. This all still feels amazing to me. It took me a long time to be comfortable calling myself a developer!

    Conclusion

    My first Ubuntu bugfix was 13 years ago this week. Because Ubuntu historically uses alphabetical adjective animal release names, 13 years means that we have rolled around to the letter K again! Later today, we begin release candidate ISO testing for Ubuntu 22.10 “Kinetic Kudu”.

    I encourage you to help us test the release candidates and report bugs that you find. If you figure out how to fix a bug, we still sponsor bug fixes. If you are an Ubuntu contributor, I highly encourage you to attend an Ubuntu Summit if you can. The first Ubuntu Summit in years will be in 3 weeks in Prague, but the intent is for the Ubuntu Summits to be recurring events again.

    ]]>     Jeremy Bicha     Save £23,265 with *one weird trick!* https://thepcspy.com/read/ten-years-23k-saved/ https://thepcspy.com/read/ten-years-23k-saved/ Wed, 20 Jul 2022 00:00:00 GMT Tobacconists hate him.

    It’s that time of the year. I never really know who this sort of post is for. Maybe it’s for you, maybe for it’s for me one dark day in the future, but…

    🎉  I stopped smoking ten years ago!

    If somebody as flimsy-willed as me can stop smoking, you can stop smoking too. I’m not going to labour the “it kills you” thing, but it is so here’s the financial breakdown for any fellow cheapskates.

      10 years =  3,652 days
       @13/day = 47,476 cigs
               =  2,374 packs

    2012 price =  £7.10 /pack
    2022 price = £12.50 /pack
    Mean price =  £9.80 /pack

    I’ve not smoked £23,265.20.

    If I’d regularly deposited that into an investment account, a 2% return that would be £25k and 5% would be almost £30k.

    I’d say I feel fantastic but I am also ten years older. I gained two children a dog, and everything hurts. But I don’t smoke. I don’t feel the urge to smoke, and haven’t for years. I never have to stand outdoors on cold, wet nights to smoke. I don’t panic when I’m running out of cigarettes. And that means a lot.

    It’s easier to just not smoke

    You might not be convinced and that’s because we’re all told it’s really hard to stop smoking. All the time. Even by people who want smokers to quit, as if it’s something that takes a run-up, an intake of bravery and team-cajoling. It’s not hard; just stop smoking the bloody things.

    The rest is understanding your body and addiction, that smoking never made you feel better, it only made not smoking feel worse. As soon as you cut that cycle, your body recalibrates. As soon as you realise that, the infinitesimal cost of quitting seems worth it.

    If you’re trying to quit and you’re not finding it easy, stick with it. If you need help understanding addiction, Allen Carr’s Easy Way to Stop Smoking has an eerily convincing narrative that plods through the feelings every smoker goes through. I never finished it —I convinced myself I didn’t want to quit— but it was absolutely the basis for the voice in my head that let me quit later on.

    ]]>     Oli Warner     finding binary differences https://outflux.net/blog/archives/2022/06/24/finding-binary-differences/ https://outflux.net/blog/archives/2022/06/24/finding-binary-differences/ Fri, 24 Jun 2022 20:11:48 GMT As part of the continuing work to replace 1-element arrays in the Linux kernel, it’s very handy to show that a source change has had no executable code difference. For example, if you started with this:

    struct foo {
    unsigned long flags;
    u32 length;
    u32 data[1];
};

void foo_init(int count)
{
    struct foo *instance;
    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
    ...
    instance = kmalloc(bytes, GFP_KERNEL);
    ...
};

    And you changed only the struct definition:

    -    u32 data[1];
+    u32 data[];

    The bytes calculation is going to be incorrect, since it is still subtracting 1 element’s worth of space from the desired count. (And let’s ignore for the moment the open-coded calculation that may end up with an arithmetic over/underflow here; that can be solved separately by using the struct_size() helper or the size_mul(), size_add(), etc family of helpers.)

    The missed adjustment to the size calculation is relatively easy to find in this example, but sometimes it’s much less obvious how structure sizes might be woven into the code. I’ve been checking for issues by using the fantastic diffoscope tool. It can produce a LOT of noise if you try to compare builds without keeping in mind the issues solved by reproducible builds, with some additional notes. I prepare my build with the “known to disrupt code layout” options disabled, but with debug info enabled:

    $ KBF="KBUILD_BUILD_TIMESTAMP=1980-01-01 KBUILD_BUILD_USER=user KBUILD_BUILD_HOST=host KBUILD_BUILD_VERSION=1"
$ OUT=gcc
$ make $KBF O=$OUT allmodconfig
$ ./scripts/config --file $OUT/.config \
        -d GCOV_KERNEL -d KCOV -d GCC_PLUGINS -d IKHEADERS -d KASAN -d UBSAN \
        -d DEBUG_INFO_NONE -e DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
$ make $KBF O=$OUT olddefconfig

    Then I build a stock target, saving the output in “before”. In this case, I’m examining drivers/scsi/megaraid/:

    $ make -jN $KBF O=$OUT drivers/scsi/megaraid/
$ mkdir -p $OUT/before
$ cp $OUT/drivers/scsi/megaraid/*.o $OUT/before/

    Then I patch and build a modified target, saving the output in “after”:

    $ vi the/source/code.c
$ make -jN $KBF O=$OUT drivers/scsi/megaraid/
$ mkdir -p $OUT/after
$ cp $OUT/drivers/scsi/megaraid/*.o $OUT/after/

    And then run diffoscope:

    $ diffoscope $OUT/before/ $OUT/after/

    If diffoscope output reports nothing, then we’re done. 🥳

    Usually, though, when source lines move around other stuff will shift too (e.g. WARN macros rely on line numbers, so the bug table may change contents a bit, etc), and diffoscope output will look noisy. To examine just the executable code, the command that diffoscope used is reported in the output, and we can run it directly, but with possibly shifted line numbers not reported. i.e. running objdump without --line-numbers:

    $ ARGS="--disassemble --demangle --reloc --no-show-raw-insn --section=.text"
$ for i in $(cd $OUT/before && echo *.o); do
        echo $i
        diff -u <(objdump $ARGS $OUT/before/$i | sed "0,/^Disassembly/d") \
                <(objdump $ARGS $OUT/after/$i  | sed "0,/^Disassembly/d")
done

    If I see an unexpected difference, for example:

    -    c120:      movq   $0x0,0x800(%rbx)
+    c120:      movq   $0x0,0x7f8(%rbx)

    Then I'll search for the pattern with line numbers added to the objdump output:

    $ vi <(objdump --line-numbers $ARGS $OUT/after/megaraid_sas_fp.o)

    I'd search for "0x0,0x7f8", find the source file and line number above it, open that source file at that position, and look to see where something was being miscalculated:

    $ vi drivers/scsi/megaraid/megaraid_sas_fp.c +329

    Once tracked down, I'd start over at the "patch and build a modified target" step above, repeating until there were no differences. For example, in the starting example, I'd also need to make this change:

    -    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
+    size_t bytes = sizeof(*instance) + sizeof(u32) * count;

    Though, as hinted earlier, better yet would be:

    -    size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1);
+    size_t bytes = struct_size(instance, data, count);

    But sometimes adding the helper usage will add binary output differences since they're performing overflow checking that might saturate at SIZE_MAX. To help with patch clarity, those changes can be done separately from fixing the array declaration.

    © 2022 - 2023, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
    CC BY-SA 4.0

    ]]>     Kees Cook     How much does my flight sponsor Vladimir? http://blog.markvdb.be/2022/04/how-much-does-my-flight-sponsor-vladimir.html http://blog.markvdb.be/2022/04/how-much-does-my-flight-sponsor-vladimir.html Thu, 07 Apr 2022 15:20:00 GMT  I regularly fly between Belgium and my second home country Latvia. How much am I sponsoring Vladimir when doing that? About 25€. Back of the envelope calculation.

    • CRL - RIX return = 330 kg CO2 (source)
    • 1 l jet fuel a1 = 2.52 kg CO2 (source)
    • 1 l jet fuel = 0.85€ (source, some currency and SI conversion required)
    • refinery and distribution margin ~ 15% (conservative ballpark guesstimate based upon price/barrel for crude and jet a1 fuel)
    • percentage of Russian crude in EU: 27% (source)
    • (330/2.52)*.85*.85*.27 = 25.55€

    P.S. More source countries have "interesting" policies. For example. 8% of EU imports are from Saudi Arabia.

    P.P.S. Our upcoming holiday will be by night train. Exciting!

    ]]>     Mark Van den Borre     All-remote workspace at home https://svij.org/blog/2021/12/05/all-remote-workspace-at-home/ https://svij.org/blog/2021/12/05/all-remote-workspace-at-home/ Sun, 05 Dec 2021 15:10:00 GMT It’s been a little over 1,5 years since I joined GitLab as my first all remote company. About half a year ago, I wrote about what I learned in one year at GitLab. In this blog post I will describe my setup how I work because I got several questions about it over the last time. I can also blame dnsmichi who published a similar post about his setup ;-).

    I can certainly recommend the page about “Considerations for a Productive Home Office or Remote Workspace“ in the GitLab Handbook about All-Remote.

    The Desk

    Even long before I worked from home full time I bought a standing desk. I own a IKEA Bekant which only has a “up” and “down” button which is a bit annoying since I always have to hold the button when I want to move the desk up or down. Back in 2017 I’ve written a blog post about my experiences with it in German.

    It’s also always good to have some sort of cable management hidden underneath the desktop. Otherwise, your legs will always touch the cables, and it will look ugly.

    As part of the desk, I do have three (or should I say four?) arms mounted. One for my 32” 4K Samsung Screen, one for my Notebook-Stand, one for my microphone and an additional cheap „magic arm“ for my Canon EOS 700D which I use as a Webcam.

    The Screen

    As mentioned above, I’m using a 32" Samsung 4K display. A lot of folks I know are using ultra-widescreen monitors, which I personally do not like that much because they most likely have a smaller resolution. I rather prefer to use a 4K screen without scaling so that I have more space available for my windows.

    I used to have a 28" 4K screen, which was a bit small when you want to use it without (much) scaling. Moving forward I hope I will not need to scale it though. For now, my glasses are a good “bugfix” for my eyes, so I can work without scaling on the system side.

    The Laptop and The Dockingstation

    I used to have Thinkpads in the past, but I recently switched to Dell XPS. I have two Dell XPS 13. One for work (in white) and one private (in black).

    While I personally prefer to run ArchLinux (btw I use Arch!) I’m running the latest Ubuntu LTS on my work laptop.

    The laptop is connected to a CalDigit TS3-Plus which is my docking station. This was one of the few docking station which supported 4K@60Hz back when I bought this. I would prefer a docking station with more USB-ports. Right now I have another USB-Hub (hidden under the desktop) because the ports provided by most of the docking stations out there are not really enough for me.

    Audio and Video

    As already mentioned above, I use my Canon EOS 700D as my webcam. I’ll mostly use an 18-55mm lens. The camera is connected to an elgato Cam Link 4k. The biggest downside of this setup currently is that the format is not perfect, as the HDMI-output has two black bars on the left and right side of the video.

    I try to keep my background as boring as possible, that’s why all of you will mostly only see my yellow wall behind me.

    As a microphone, I use an M-Audio Uber-Mic. It’s being used in meetings and also for my (German) podcast TILpod which I record remotely with Dirk Deimeke. For listening in meetings and also for videos/music, I’m using my Sony WH-1000X3.

    Lighting

    I do not have a perfect lighting solution yet. I do have a small desk light which is okay for the desk itself but not for video calls. The main light in my office is an IKEA Floalt which can be dimmed.

    What else is on the desk?

    • Stream Deck, mostly for changing audio settings
    • a mechanical keyboard (HyperX with brown Cherry MX switches)
    • a boring Logitech mouse
    • a big mouse pad
    • a wrist rest pad
    • some old Logitech speaker
    • a Brother printer/scanner
    • a YubiKey 5 NFC
    • a few (water) bottles

    What do I use for on the go?

    I didn’t really travel that much for obvious reasons. However, I do have these items as well:

    • a no-name 8-in-1 Hub with multiple USB-Ports, HDMI, microSD and SD and USB-C Power Delivery.
    • a cheap no-name clip-on micrphone because the Laptop-internal microphone are mostly crappy anyway
    • a LAN cable just in case
    • a USB-C cable
    • my Sony WH-1000X3
    ]]>     Sujeevan Vijayakumaran     Impish Indri Ubuntu-fr t-shirt https://people.ubuntu.com/~olivier.fraysse/index.xml#of202110202210 https://people.ubuntu.com/~olivier.fraysse/index.xml#of202110202210 Wed, 20 Oct 2021 22:10:00 GMT Ocelot did it again! The French speaking Ubuntu community is happy to present you his splendid Impish Indri t-shirt. :) You can buy it before the end of October for €15 (+ shipping costs) and receive it at the end of November 2021. You can try to buy it later but it will be more expensive and you will not have any garanty of stock.

    ]]>     Olivier Fraysse     Installing Ubuntu Core onto 64-bit Bare Metal http://cheesehead-techblog.blogspot.com/2021/10/installing-ubuntu-core-onto-64-bit-bare.html http://cheesehead-techblog.blogspot.com/2021/10/installing-ubuntu-core-onto-64-bit-bare.html Thu, 07 Oct 2021 21:29:00 GMT

    I have a re-purposed AMD64 laptop motherboard, ready to become an experimental Ubuntu Core server.

    It's in fine condition. You can see that it boots an Ubuntu LiveUSB's "Try Ubuntu" environment just fine. Attached to the motherboard is a new 60GB SSD for testing. The real server will use a 1TB HDD.

    But Ubuntu Core doesn't install on bare metal from a Live USB. It's still easy, though.

    1. Boot a "Try Ubuntu" Environment on the target system.

    • Test your network connection. The picture shows a wireless connection. This particular laptop has a wireless chip that is recognized out-of-the box, so I didn't need to get out the long network cable.
    • Test that your storage device works. You can see in the picture that Gnome Disks can see the storage device.

    2. Terminal: sudo fdisk -l. Locate the storage device that you want to install Ubuntu Core onto.

    • The entire storage device will be erased.
    • My storage device is at /dev/sda today. It might be different next boot. Yours might be different.

    3. Open the web browser and download Ubuntu Core.

    4. Write Ubuntu Core to the storage device.

    • Warning: This command will erase your entire storage device. If there is anything valuable on your storage device, then you have skipped too many steps!
      xzcat Downloads/<.img.xz file> | sudo dd of=/dev/<target_storage_device> bs=32M status=progress; sync
    • So mine was
      xzcat Downloads/ubuntu-core-20-amd64.img.xz | sudo dd of=/dev/sda bs=32M status=progress; sync
    • Source: https://ubuntu.com/download/intel-nuc

    5. Reboot into Ubuntu Core.

    • When prompted by the "Try Ubuntu" environment, remove the LiveUSB so you are booting from your newly-written storage device.
    • Be patient. My first boot into Ubuntu Core led to a black screen for nearly a minute before the system acknowledged that it actually has been working the entire time.
    • After 3-4 minutes of non-interactive setup alternating between blank screens and scrolling setup output, Ubuntu Core finally asked me two questions:  Which network to connect to, and my Ubuntu SSO e-mail address.
    • Finally, the system rebooted again. This time it didn't ask any question - just displayed the new Ubuntu Core system's IP address.

    6. Log into Ubuntu Core.

      On my Desktop:
      me@Desktop:~$ ssh me@192.168.1.x
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-77-generic x86_64)
    Success: A working Ubuntu Core on bare metal.]]>     Ian Weisser     Web Hooks for the Janitor https://www.jelmer.uk/janitor-webhooks.html https://www.jelmer.uk/janitor-webhooks.html Mon, 06 Sep 2021 20:00:00 GMT The Debian Janitor is an automated system that commits fixes for (minor) issues in Debian packages that can be fixed by software. It gradually started proposing merges in early December. The first set of changes sent out ran lintian-brush on sid packages maintained in Git. This post is part of a series about the progress of the Janitor.

    As covered in my post from last week, the Janitor now regularly tries to import new upstream git snapshots or upstream releases into packages in Sid.

    Moving parts

    There are about 30,000 packages in sid, and it usually takes a couple of weeks for the janitor to cycle through all of them. Generally speaking, there are up to three moving targets for each package:

    • The packaging repository; vcswatch regularly scans this for changes, and notifies the janitor when a repository has changed. For salsa repositories it is instantly notified through a web hook
    • The upstream release tarballs; the QA watch service regularly polls these, and the janitor scans for changes in the UDD tables with watch data (used for fresh-releases)
    • The upstream repository; there is no service in Debian that watches this at the moment (used for fresh-snapshots)

    When the janitor notices that one of these three targets has changed, it prioritizes processing of a package - this means that a push to a packaging repository on salsa usually leads to a build being kicked off within 10 minutes. New upstream releases are usually noticed by QA watch within a day or so and then lead to a build. Now commits in upstream repositories don’t get noticed today.

    Note that there are no guarantees; the scheduler tries to be clever and not e.g. rebuild the same package over and over again if it’s constantly changing and takes a long time to build.

    Packages without priority are processed with a scoring system that takes into account perceived value (based on e.g. popcon), cost (based on wall-time duration of previous builds) and likelihood of success (whether recent builds were successful, and how frequently the repositories involved change).

    webhooks for upstream repositories

    At the moment there is no service in Debian (yet - perhaps this is something that vcswatch or a sibling service could also do?) that scans upstream repositories for changes.

    However, if you maintain an upstream package, you can use a webhook to notify the janitor that commits have been made to your repository, and it will create a new package in fresh-snapshots. Webhooks from the following hosting site software are currently supported:

    You can simply use the URL https://janitor.debian.net/ as the target for hooks. There is no need to specify a secret, and the hook can either use a JSON or form encoding payload.

    The endpoint should tell you whether it understood a webhook request, and whether it took any action. It’s fine to submit webhooks for repositories that the janitor does not (yet) know about.

    GitHub

    For GitHub, you can do so in the Webhooks section of the Settings tab. Fill the form as shown below and click on Add webhook:

    GitLab

    On GitLab instances, you can find the Webhooks tab under the Settings menu for each repository (under the gear symbol). Fill the form in as shown below and click Add Webhook:

    Launchpad

    For Launchpad, go to the repository (for Git) web view and click Manage Webhooks. From there, you can add a new webhook; fill the form in as shown below and click Add Webhook:

    ]]>     Jelmer Vernooij     My first six months at the Ubuntu Community Council https://torstenfranz.wordpress.com/2021/04/25/my-first-six-months-at-the-ubuntu-community-council/ https://torstenfranz.wordpress.com/2021/04/25/my-first-six-months-at-the-ubuntu-community-council/ Sun, 25 Apr 2021 15:30:00 GMT Six months ago I was elected to the Ubuntu Community Council. After the first month, I wrote a text about how I experienced the first month. Time flies and now six months have already passed.

    In the first few months we have been able to fill some of the councils and boards that needed to be refilled in the community. But even where this has not been possible, we have initiated new ways to ensure that we move forward on the issues. One example is the LoCo Council, which could not be filled again, but we found people who were given the task of rethinking this council and proposing new structures. This process of evaluating and rethinking this area will take some time.

    There are some issues that we have on the agenda at the moment. Some of these are general issues related to the community, but some affects individual members of the community or where there are problems.

    For some topics, we quickly realised that it makes sense to have contact persons at Canonical who can advance these topics. We were very pleased to find Monica Ayhens-Madon and Rhys Davies, two employees at Canonical, who support us in bringing topics into the organisation and also implement tasks. One consequence of this has been the reactivation of the Community Team at Canonical.

    One topic that we have also come across, through the staffing of the board and the update of the benefits that you get as a member, is the Ubuntu Membership. At this point I would like to advertise the community and to show your community connection with Ubuntu through a membership. If you want to do this and know what benefits you are entitled to, you can read about it in the Ubuntu Wiki.

    There are still enough construction sites, but structurally we are already on the right track again. Since the topics are dealt with in our free time and everyone on the Community Council has other things to do, topics sometimes drag on a bit. Sometimes I’m a bit impatient, but I’m getting better at it.

    After six months, I can see that we as a Community Council have laid many building blocks and have already had some discussions where we have different approaches and thus also very different ideas. This is good for the community and leads to the different positions and opinions finding their way into the community.

    You can read about our public meetings in the Community Hub. There is also the possibility, when we call for topics for our meetings, to bring in topics that we should look at in the Council, because this is important for the cooperation of the community.

    If you want to get involved in discussions about the community, you can do so at the Community Hub. You can also send us an email to the mailing list community-council at lists.ubuntu.com if you have a community topic on your mind. If you want to contact me: you can do so by commenting, via Twitter or sending a mail to me: torsten.franz at ubuntu.com

    ]]>     Torsten Franz     ReText turns 10 years https://mitya57.me/weblog/2021/02/retext-turns-10-years.html https://mitya57.me/weblog/2021/02/retext-turns-10-years.html Sun, 21 Feb 2021 18:30:00 GMT Exactly ten years ago, in February 2011, the first commit in ReText git repository was made. It was just a single 364 lines Python file back then (now the project has more than 6000 lines of Python code).

    Since 2011, the editor migrated from SourceForge to GitHub, gained a lot of new features, and — most importantly — now there is an active community around it, which includes both long-time contributors and newcomers who create their first issues or pull requests. I don’t always have enough time to reply to issues or implement new features myself, but the community members help me with this.

    Earlier this month, I made a new release (7.2), which adds a side panel with directory tree (contributed by Xavier Gouchet), option to fully highlight wrapped lines (contributed by nihillum), ability to search in the preview mode and much more — see the release page on GitHub.

    Side panel in ReText

    Also a new version of PyMarkups module was released, which contains all the code for processing various markup languages. It now supports markdown-extensions.yaml files which allow specifying complex extensions options and adds initial support for MathJax 3.

    Also check out the release notes for 7.1 which was not announced on this blog.

    Future plans include making at least one more release this year, adding support for Qt 6. Qt 5 support will last for at least one more year.

    ]]>     Dmitry Shachnev     Open Letter to KDE GSoC Students We Could Not Accept http://linuxgrandma.blogspot.com/2020/05/open-letter-to-kde-gsoc-students-we.html http://linuxgrandma.blogspot.com/2020/05/open-letter-to-kde-gsoc-students-we.html Tue, 05 May 2020 20:38:00 GMT
    Hello students,

     I no longer have access to your proposal or emails, thus the open letter on my blog.

     If you allowed commenting before the student proposal deadline, I along with other admins and mentors tried to help you improve your proposal. Some of you took the suggestions and sharpened your presentation, fleshed out your timeline and in general created a proposal you can be proud of.

     If you did not allow commenting or only uploaded your proposal right before the deadline, you missed out on this mentoring opportunity, and for that I am sorry. That cut us off from a vital communication link with you.

     This proposal process, along with fixing some bugs and creating some commits mean that you have real experience you can take with you into the future
    . I hope you also learned how to use IRC/Matrix/Telegram channels to get information, and help others as well. Even if you do not continue your involvement with the KDE Community, we hope you will profit from these accomplishments, as we have.

     We hope that your experiences with the KDE community up to now make you want to continue to work with us, and become part of the community. Many students whom we were not able to accept previously were successfully accepted later. Some of those students now are mentoring and/or part of the administration team, which is, in our eyes, the zenith of GSoC success.

     Some of you we were unable to accept because we could not find suitable mentors. The GSoC team is asking us this year to have three mentors per student, because the world has become so uncertain in this pandemic time. So more developers who will mentor are a precious resource.

     Almost every single proposal we got this year is work we want and need, or we wouldn't have published "Ideas" to trigger those proposals. If you are interested in doing this work and do not need the funding and deadlines that GSoC provides, we would welcome working with you outside of GSoC. In fact, each year we have Season of KDE which provides some mentoring, structure and timeline and no funding. This has been very successful for most mentees. And of course all are welcome to join our worldwide army of volunteers, who code, fix bugs, triage bug reports, write, analyze, plan, administer, create graphics, art, promo copy, events, videos, tutorials, documentation, translation, internationalization, and more! It is the KDE community who makes the software, keeps it up-to-date, plans and hosts events, and engages in events planned and hosted by others.

     Please join the KDE-Community mail list and dig in! Hope to see you at KDE Akademy.

    Oh hey, late update: I just learned today in #gsoc that I *do* have access to all the proposals -- and names and emails! So at the very least I will send a link to this open letter to all of our prospective students. Talk to you then. -v
    ]]>     Valorie Zimmerman     Como descargar y ver series o peliculas gratis en esta Cuarentena https://desentropia.com/2020/04/11/como-descargar-y-ver-series-o-peliculas-gratis-en-esta-cuarentena/ https://desentropia.com/2020/04/11/como-descargar-y-ver-series-o-peliculas-gratis-en-esta-cuarentena/ Sat, 11 Apr 2020 19:58:18 GMT En estos nuevos días en los que vivimos una situación muy fuera de lo común en el mundo quiero ayudar a aquellas personas que quieran entretenerse un poco con el Septimo arte.

    No entraré en detalles técnicos de como funciona BitTorrent ni como es el manejo de derechos de autor, esto es absolutamente de su parte.

    Me voy a enfocar en macOS, Windows y Linux, si quieren saber como funciona en su celular con Android o iOS/iPhone pueden buscar en internet otras alternativas.

    1. Instalar el programa para descargar qBittorrent

    qbittorrent-logo

    Hay muchos y variados, pero este tiene lo necesario de forma sencilla.

    Para Windows descargan el instalador haciendo clic aquí. Es un archivo normal de instalación, simplemente doble clic y acepten los valores por defecto.

    Para macOS descarguen el archivo DMG haciendo clic aquí. Abran el archivo y en la ventana que aparece arrastren el icono de Bittorrent a la carpeta azul de Aplicaciones.

    Para Linux, si estan en Ubuntu haciendo clic aquí podrán instalarlo con el Centro de Software o usando una terminal sudo apt install qbittorrent, si estan en otra distribución pueden usar el packete Flatpack disponible aquí.

    Una vez instalado abran el programa qBittorrent, tendra una apariencia similar a esta. Esta esta ventana verán las descargas que realicen.

    qbittorrent

    La última version al momento de escribir esto es la v4.2.3.

    2. Configurar el programa para buscar peliculas y series de muchas fuentes

    Hay muchas partes de donde buscar peliculas o series. Para activar esto tenemos que seguir estos pasos dentro de qBittorrent:

    1. Activar la vista de búsqueda, no será posible buscar hasta no activar los plugins

      qbittorrent

    2. Ir a la pestaña Buscar y hacer clic en el botón Plugins de búsqueda

      qbittorrent

    3. En la ventana que aparece, seleccionar la opción Buscar actualizaciones, esto actualizará y activará los plugins, no tardara más que unos segundos. Luego de esto clic en Aceptar y en el botón Cerrar para volver a la pantalla principal.

      qbittorrent

    3. Instalar un reproductor de videos, en este caso VLC

    vlc-logo

    Probablemente su computadores cuenten ya con algún reproductor de video, pero VLC permite reproducir muchos formatos de video y además tiene una funcionalidad excepcional para nuestro caso.

    Para instalarlo solo sigan las siguientes indicaciones:

    Windows: Descargan el instalador haciendo clic aquí. Es un archivo normal de instalación, simplemente doble clic y acepten los valores por defecto.

    macOS: Descarguen el archivo DMG haciendo clic aquí. Abran el archivo y en la ventana que aparece arrastren el icono de VLC a la carpeta azul de Aplicaciones.

    Linux: Si estan en Ubuntu haciendo clic aquí para instalarlo con el Centro de Software o usando una terminal sudo snap install vlc --channel=beta, si estan en otra distribución pueden usar el paquete Snap disponible aquí o Flatpack desde aquí.

    Eso es todo! Estamos listos para descargar, ahora, ¿como lo hacemos?

    4. Descargando y reproduciendo la pelicula o serie

    Ya con todo listo tendremos que seguir los ¡siguientes pasos para descargar y reproducir la película o serie que queramos.

    1. Abrir qBittorrent, ir a la pestaña Buscar y luego en este ejemplo busque Night of the Living Dead, una pelicula de dominio público del año 1968.

      Consejo #1: Dado que salen muchos resultados organicen la vista en la sección Semillas para buscar las películas con más fuentes y que descargaran más rápido)

      qbittorrent

      Consejo # 2: Para buscar temporadas o episodios pueden añadir a la búsqueda la siguiente información, SAA y EBB. Donde AA se refiere al número de Temporada (Season) deseada y BB al número del Capítulo deseado. Ejemplo de busqueda: Game of Thrones S02 E04 buscará el Capítulo 04 de la Temporada 02 de Game of Thrones.

    2. Haciendo doble clic sobre el resultado que deseen descargar iniciará la misma, aparecerá una ventana similar a esta, pueden cambiar la ruta de la descarga

      qbittorrent

    3. La descarga empezará y podrán ver el progreso de la descarga

      qbittorrent

    4. Una vez terminada la descarga abran el archivo con VLC. Su película empezará!

      vlc-playing

    5. La mayoría de veces que descargamos películas de esta forma estarán en su idioma original, si queremos poner subtítulos podemos usar la función de VLC llamada VLSub, que busca, descarga y activa los subtítulos que queramos.

      Esto lo podemos encontrar en el siguiente menú dependiendo del Sistema Operativo:

      Windows/Linux: Ver -> VLsub

      vlc-vlsub-linux-windows

      macOS: VLC -> Extensiones -> VLsub

      vlc-vlsub-macos

      Y luego en la pantalla de VLsub buscar el subtítulo (Recomiendo la opción Search by Hash) y descargarlo. Automáticamente el subtítulo se aplicará a su video!

      vlc-vlsub

    Y listo!

    Haciendo un poco de reflexión, se que usar un servicio de streaming es mucho más comodo y que seguir los anteriores pasos puede ser tedioso, me parece mejor suscribirse a una alternativa de tantas, parte de este recaudo llegará a todos los involucrados en la realización de una serie (yo personalmente pago una suscripción). Hay varias alternativas como Netflix, Amazon Prime Video, Apple TV+, Disney Plus, HBO Go, etc.

    Sin embargo, tambien he visto como las producciones empiezan a tener mucha exclusividad entre las plataformas, lo que hace difícil encontrar series o películas en el servicio que uno esta pagando, o que hayan otras prioridades en los gastos, por eso espero que este tutorial les sirva de ayuda.

    Si tienen alguna duda, recomendación o problema no duden en escribir un comentario aca abajo o contactenme en mis redes sociales!

    ]]>     Julian Alarcon     Fingerprint Reader Support for Lenovo x390Y on Ubuntu http://blog.sergiusens.org/posts/fingerprint-reader-support-for-lenovo-x390y-on-ubuntu/ http://blog.sergiusens.org/posts/fingerprint-reader-support-for-lenovo-x390y-on-ubuntu/ Sat, 28 Mar 2020 22:38:02 GMT Sergio Schvezov Creating AWS IAM Access Analyzers In All Regions Of All Accounts https://alestic.com/2020/01/aws-iam-access-analyzer/ https://alestic.com/2020/01/aws-iam-access-analyzer/ Mon, 06 Jan 2020 08:01:00 GMT Amazon recently announced the AWS IAM Access Analyzer, a useful tool to help discover if you have granted unintended access to specific types of resources in your AWS account.

    At the moment, an Access Analyzer needs to be created in each region of each account where you want to run it.

    Since this manual requirement can be a lot of work, it is a common complaint from customers. Given that Amazon listens to customer feedback and since we currently have to specify a “type” of “ACCOUNT”, I expect at some point Amazon may make it easier to run Access Analyzer across all regions and maybe in all accounts in an AWS Organization. Until then…

    This article shows how I created an AWS IAM Access Analyzer in all regions of all accounts in my AWS Organization using the aws-cli.

    Prerequisites

    To make this easy, I use the bash helper functions that I defined in last week’s blog post here:

    Running AWS CLI Commands Across All Accounts In An AWS Organization

    Please read the blog post to see what assumptions I make about the AWS Organization and account setup. You may need to tweak things if your setup differs from mine.

    Here is my GitHub repo that makes it more convenient for me to install the bash functions. If your AWS account structure matches mine sufficiently, it might work for you, too:

    https://github.com/alestic/aws-cli-multi-account-sessions

    IAM Access Analyzer In All Regions Of Single Account

    To start, let’s show how to create an IAM Access Analyzer in all regions of a single account.

    Here’s a simple command to get all the regions in the current AWS account:

    aws ec2 describe-regions \
  --output text \
  --query 'Regions[][RegionName]'

    This command creates an IAM Access Analyzer in a specific region. We’ll tack on a UUID because that’s what Amazon does, though I suspect it’s not really necessary.

    region=us-east-1
uuid=$(uuid -v4 -FSIV || echo "1") # may need to install "uuid" command
analyzer="accessanalyzer-$uuid"
aws accessanalyzer create-analyzer \
   --region "$region" \
   --analyzer-name "$analyzer" \
   --type ACCOUNT

    By default, there is a limit of a single IAM Access Analyzer per account region. The fact that this is a “default limit” implies that it may be increased by request, but for this guide, we’ll just not create an IAM Access Analyzer if one already exists.

    This command lists the name of any IAM Access Analyzers that might already have been created in a region:

    region=us-east-1
aws accessanalyzer list-analyzers \
  --region "$region" \
  --output text \
  --query 'analyzers[][name]'

    We can put the above together, iterating over the regions, checking to see if an IAM Access Analyzer already exists, and creating one if it doesn’t:

    regions=$(aws ec2 describe-regions
    –output text
    –query ‘Regions[][RegionName]’ | sort)

    for region in $regions; do
  analyzer=$(aws accessanalyzer list-analyzers \
    --region "$region" \
    --output text \
    --query 'analyzers[][name]')
  if [ -n "$analyzer" ]; then
    echo "$region: EXISTING: $analyzer"
  else
    uuid=$(uuid -v4 -FSIV || echo "1") # may need to install "uuid" command
    analyzer="accessanalyzer-$uuid"
    echo "$region: CREATING: $analyzer"
    aws accessanalyzer create-analyzer \
       --region "$region" \
       --analyzer-name "$analyzer" \
       --type ACCOUNT \
       > /dev/null # only show errors
  fi
done

    Creating IAM Access Analyzers In All Regions Of All Accounts

    Now let’s prepare to run the above in multiple accounts using the aws-cli-multi-account-sessions bash helper functions from last week’s article:

    git clone git@github.com:alestic/aws-cli-multi-account-sessions.git
source aws-cli-multi-account-sessions/functions.sh

    Specify the values for source_profile and mfa_serial from your aws-cli config file. You can leave the mfa_serial empty if you aren’t using MFA:

    source_profile=your_aws_cli_source_profile
mfa_serial=arn:aws:iam::YOUR_ACCOUNT:mfa/YOUR_USER

    Specify the role you can assume in all accounts:

    role="admin" # Yours might be called "OrganizationAccountAccessRole"

    Get a list of all accounts in the AWS Organization, and a list of all regions:

    accounts=$(aws organizations list-accounts \
             --output text \
             --query 'Accounts[].[JoinedTimestamp,Status,Id,Email,Name]' |
           grep ACTIVE |
           sort |
           cut -f3) # just the ids

regions=$(aws ec2 describe-regions \
            --output text \
            --query 'Regions[][RegionName]' |
          sort)

    Run this once to create temporary session credentials with MFA:

    aws-session-init $source_profile $mfa_serial

    Iterate through AWS accounts, running the necessary AWS CLI commands to create an AIM Access Analyzer in each account/role and each region:

    for account in $accounts; do
  echo "Visiting account: $account"
  aws-session-set $account $role || continue

  for region in $regions; do
    # Run the aws-cli commands using the assume role credentials
    analyzers=$(aws-session-run \
                  aws accessanalyzer list-analyzers \
                    --region "$region" \
                    --output text \
                    --query 'analyzers[][name]')
    if [ -n "$analyzers" ]; then
      echo "$account/$region: EXISTING: $analyzers"
    else
      uuid=$(uuid -v4 -FSIV || echo "1")
      analyzer="accessanalyzer-$uuid"
      echo "$account/$region: CREATING: $analyzer"
      aws-session-run \
        aws accessanalyzer create-analyzer \
          --region "$region" \
          --analyzer-name "$analyzer" \
          --type ACCOUNT \
          > /dev/null # only show errors
    fi
  done
done

    Clear out bash variables holding temporary AWS credentials:

    aws-session-cleanup

    In a bit, you can go to the AWS IAM Console and view what the Access Analyzers found.

    Yep, you have to look at the Access Analyzer findings in each account and each region. Wouldn’t it be nice if we had some way to collect all this centrally? I think so, too, so I’m looking into what can be done there. Thoughts welcome in the comments below or on Twitter.

    Cleanup

    The following deletes all IAM Access Analyzers in all regions in the current account. You don’t need to do this if you want to leave the IAM Access Analyzers running, especially since there is no additional cost for keeping them.

    # WARNING! DESTRUCTIVE!

source_profile=[as above]
mfa_serial=[as above]
role=[as above]

accounts=$(aws organizations list-accounts \
             --output text \
             --query 'Accounts[].[JoinedTimestamp,Status,Id,Email,Name]' |
           grep ACTIVE |
           sort |
           cut -f3) # just the ids

regions=$(aws ec2 describe-regions \
            --profile "$source_profile" \
            --output text \
            --query 'Regions[][RegionName]' |
          sort)

aws-session-init $source_profile $mfa_serial

for account in $accounts; do
  echo "Visiting account: $account"
  aws-session-set $account $role || continue

  for region in $regions; do
    # Run the aws-cli commands using the assume role credentials
    analyzers=$(aws-session-run \
                  aws accessanalyzer list-analyzers \
                    --region "$region" \
                    --output text \
                    --query 'analyzers[][name]')
    for analyzer in $analyzers; do
      echo "$account/$region: DELETING: $analyzer"
      aws-session-run \
        aws accessanalyzer delete-analyzer \
          --region "$region" \
          --analyzer-name "$analyzer"
    done
  done
done

aws-session-cleanup

    Original article and comments: https://alestic.com/2020/01/aws-iam-access-analyzer/

    ]]>     Eric Hammond     Puberty https://rhonda.deb.at/blog/2019/12/28#puberty https://rhonda.deb.at/blog/2019/12/28#puberty Sat, 28 Dec 2019 22:22:00 GMT I was musing about writing about this publicly. For the first time in all these years of writing pretty personal stuff about my feelings, my way of becoming more honest with myself and a more authentic person through that I was thinking about letting you in on this is a good idea.

    You see, people have used information from my personal blog in the past, and tried to use it against me. Needless to say they failed with it, and it only showed their true face. So why does it feel different this time?

    Thing is, I'm in the midst of my second puberty, and the hormones are kicking in in complete hardcore mode. And it doesn't help at all that there is trans antagonist crap from the past and also from the present popping up left and right at a pace and a concentrated amount that is hard to swallow on its own without the puberty.

    Yes, I used to be able to take those things with a much more stable state. But every. Single. Of. These. Issues is draining all the energy out of myself. And even though I'm aware that I'm not the only one trying to fix all of those, even though for some spots I'm the only one doing the work, it's easier said than done that I don't have to fix the world, when the areas involved mean the world to me. Are areas that support me in so many ways. Are places that I need. And on top of that, the hormones are multiplying the energy drain of those.

    So ... I know it's not that common. I know you are not used to a grown up person to go through puberty. But for god's sake. Don't make it harder than it has to be. I know it's hard to deal with a 46 year old teenager, so to say, I'm just trying to survive in this world of systematic oppression of trans people.

    It would be nice to go for a week without having to cry your eyes out because another hostile event happened that directly affects your existence. The existence of trans lives aren't a matter of different opinions or different points of view, so don't treat it like that, if you want me to believe that you are a person able of empathy and basic respect.

    Sidenote: Finishing to write this at this year's #36c3 is quite interesting because of the conference title: Resource Exhaution. Oh the irony.

    /personal | permanent link | Comments: 14 | Flattr this

    ]]>     Rhonda D'Vine     Managing dynamic inventory in private subnets using bastion jump box http://blog.diegoturcios.com/2019/11/managing-dynamic-inventory-in-private_56.html http://blog.diegoturcios.com/2019/11/managing-dynamic-inventory-in-private_56.html Tue, 19 Nov 2019 15:47:00 GMT Managing dynamic inventory in private subnets using bastion jump box
    The title of post is quite large, but is something I encountered issues in the last weeks. I had a VPC in AWS, creating x amount of instances in a private network, and was quite complex to manage this instance using static inventory files. So I will explain you how to manage this problem with Ansible.
    Before continue, I want to say these articles are really good and can help you with this issues.
    So you will be asking, if these articles are so good, why are you writing them again? Easy, I’m doing this in Gitlab CI, and I suppose other CI will encounter similar issues. It’s not possible to connect to the instances using the instructions above.

    First Step

    We get our inventory in a dynamic way. For this we will use the inventory scripts.
    We need to modify the ec2.ini file with uncommenting the vpc_destination_variable and set the value to private_ip_address
    An example
    # For server inside a VPC, using DNS names may not make sense. When an instance
# has 'subnet_id' set, this variable is used. If the subnet is public, setting
# this to 'ip_address' will return the public IP address. For instances in a
# private subnet, this should be set to 'private_ip_address', and Ansible must
# be run from within EC2. The key of an EC2 tag may optionally be used; however
# the boto instance variables hold precedence in the event of a collision.
# WARNING: - instances that are in the private vpc, _without_ public ip address
# will not be listed in the inventory until You set:
vpc_destination_variable = private_ip_address
#vpc_destination_variable = ip_address
    Be sure to have your ansible.cfg, with the following line.
    host_key_checking = False
    This is useful, as we’re running this in a CI, we can’t hit enter to accept the connection in the terminal.
    Then we begin working with our yml file. As I’m running this on a container, I need to create the .ssh directory and the config file. Here it’s important to add StrictHostKeyChecking=no If we don’t do this, this will fail in our CI, as we can’t hit enter. If you don’t included it and run it locally, it will work.
    ---
- name: Creates ssh directory
  file:
    path: ~/.ssh/
    state: directory


- name: Create ssh config file in local computer
  copy:
    dest: ~/.ssh/config
    content: |
       Host 10.*.*.*
       User ubuntu
       IdentityFile XXXXX.pem
       StrictHostKeyChecking=no
       ProxyCommand ssh -q -W %h:%p {{ lookup('env', 'IP') }}
       Host {{ lookup('env', 'IP') }}
       User ubuntu
       StrictHostKeyChecking=no
       IdentityFile XXXXX.pem
       ForwardAgent yes
    And finally we test it running the ping command.
    ---
- name: test connection
  ping:
    In case you need the code : https://github.com/DiegoTc/bastionansible
    ]]>     Diego Turcios     GUADEC 2019 - Thessaloniki http://bobthegnome.blogspot.com/2019/09/guadec-2019-thessaloniki.html http://bobthegnome.blogspot.com/2019/09/guadec-2019-thessaloniki.html Wed, 04 Sep 2019 23:34:00 GMT I recently attended GUADEC 2019 in Thessaloniki, Greece. This is the seventh GUADEC I've attended, which came as a bit of a surprise when I added it up! It was great to catch up in person (some again, and some new!) and as always the face to face communication makes future online interactions that much easier.

    Photo by Cassidy James Blaede

    This year we had seven people from Canonical Ubuntu desktop team in attendance. Many other companies and projects had representatives (including Collabora, Elementary OS, Endless, Igalia, Purism, RedHat, SUSE and System76). I think this was the most positive GUADEC I've attended, with people from all these organizations actively leading discussions and a general consideration of each other as we try and maximise where we can collaborate.

    Of course, the community is much bigger than a group of companies. In particular is was great to meet Carlo and Frederik from the Yaru theme project. They've been doing amazing work on a new theme for Ubuntu and it will be great to see it land in a future release.

    In the annual report there was a nice surprise; I made the most merge requests this year! I think this is a reflection on the step change in productivity in GNOME since switching to GitLab. So now I have a challenge to maintain that for next year...


    If you were unable to attend you can watch the all talks on YouTube. Two talks I'd like to highlight; the first one is by Britt Yazel from the Engagement team. In it he talks about Setting a Positive Voice for GNOME. He talked about how open source communities have a lot of passion - and that has good and bad points. The Internet being as it is can lead to the trolls taking over but we can counter that but highlighting positive messages and showing the people behind GNOME. One of the examples showed how Ubuntu and GNOME have been posting positive messages on their channels about each-other, which is great!


    The second talk was by Georges Basile Stavracas Neto and he talked About Maintainers and Contributors. In it he talked about the difficulties of being a maintainer and the impacts of negative feedback. It resonated with Britt's talk in that we need to highlight that maintainers are people who are doing their best! As state in the GNOME Code of Conduct - Assume people mean well (they really do!).


    Georges and I are co-maintainers of Settings and we had a productive GUADEC and managed to go through and review all the open merge requests.

    There were a number of discussions around Snaps in GNOME. There seemed a lot more interest in Snap technology compared to last GUADEC and it was great to be able to help people better understand them. Work included discussions about portals, better methods of getting the Freedesktop and GNOME stacks snapped, Snap integration in Settings and the GNOME publisher name in the Snap Store.

    I hope to be back next year!]]>     Robert Ancell     Ubuntu 18.04.3 LTS is out, including GNOME stable updates and Livepatch desktop integration https://blogs.gnome.org/seb128/2019/08/08/ubuntu-18-04-3-lts-is-out-and-includes-gnome-bugfix-updates-and-livepatch-desktop-integration/ https://blogs.gnome.org/seb128/2019/08/08/ubuntu-18-04-3-lts-is-out-and-includes-gnome-bugfix-updates-and-livepatch-desktop-integration/ Thu, 08 Aug 2019 19:32:31 GMT Ubuntu 18.04.3 LTS has just been released. As usual with LTS point releases, the main changes are a refreshed hardware enablement stack (newer versions of the kernel, xorg & drivers) and a number of bug and security fixes.

    For the Desktop, newer stable versions of GNOME components have been included as well as a new feature: Livepatch desktop integration.

    For those who aren’t familiar, Livepatch is a service which applies critical kernel patches without rebooting. The service is available as part of an Ubuntu Advantage subscriptions but also made available for free to Ubuntu users (up to 3 machines).  Fixes are downloaded and applied to your machine automatically to help reduce downtime and keep your Ubuntu LTS systems secure and compliant.  Livepatch is available for your servers and your desktops.

    Andrea Azzarone worked on desktop integration for the service and his work finally landed in the 18.04 LTS.

    To enabling Livepatch you just need an Ubuntu One account. The set up is part of the first login or can be done later from the corresponding software-properties tab.

    Here is a simple walkthrough showing the steps and the result:

    The wizard displayed during the first login includes a Livepatch step will help you get signed in to Ubuntu One and enable Livepatch:

    Clicking the ‘Set Up’ button invites you to enter you Ubuntu One information (or to create an account) and that’s all that is needed.

    The new desktop integration includes an indicator showing the current status and notifications telling when fixes have been applied.

    You can also get more details on the corresponding CVEs from the Livepatch configuration UI

    You can always hide the indicator using the toggle if you prefer to keep your top panel clean and simple.

    Enjoy the increased security in between reboots!

     

     

     

    ]]>     Sebastien Bacher     Open source in 2019, Part 3/3 https://ttx.re/open-source-2019-part3.html https://ttx.re/open-source-2019-part3.html Mon, 15 Jul 2019 13:52:00 GMT 21 years in, the landscape around open source evolved a lot. In part 1 and part 2 of this 3-part series, I explained why today, while open source is more necessary than ever, it appears to no longer be sufficient. In this part, I'll discuss what we, open source enthusiasts and advocates, can do about that.

    This is not a call to change open source

    First, let me clarify what we should not do.

    As mentioned in part 2, since open source was coined in 1998, software companies have evolved ways to retain control while producing open source software, and in that process stripped users of some of the traditional benefits associated with F/OSS. But those companies were still abiding to the terms of the open source licenses, giving users a clear base set of freedoms and rights.

    Over the past year, a number of those companies have decided that they wanted even more control, in particular control of any revenue associated with the open source software. They proposed new licenses, removing established freedoms and rights in order to be able to assert that level of control. The open source definition defines those minimal freedoms and rights that any open source software should have, so the Open Source Initiative (OSI), as steadfast guardians of that definition, rightfully resisted those attempts.

    Those companies quickly switched to attacking OSI's legitimacy, pitching "Open Source" more as a broad category than a clear set of freedoms and rights. And they created new licenses, with deceptive naming ("community", "commons", "public"...) in an effort to blur the lines and retain some of the open source definition aura for their now-proprietary software.

    The solution is not in redefining open source, or claiming it's no longer relevant. Open source is not a business model, or a constantly evolving way to produce software. It is a base set of user freedoms and rights expressed in the license the software is published under. Like all standards, its value resides in its permanence.

    Yes, I'm of the opinion that today, "open source" is not enough. Yes, we need to go beyond open source. But in order to do that, we need to base that additional layer on a solid foundation: the open source definition.

    That makes the work of the OSI more important than ever. Open source used to be attacked from the outside, proprietary software companies claiming open source software was inferior or dangerous. Those were clear attacks that were relatively easy to resist: it was mostly education and advocacy, and ultimately the quality of open source software could be used to prove our point. Now it's attacked from the inside, by companies traditionally producing open source software, claiming that it should change to better fit their business models. We need to go back to the basics and explain why those rights and freedoms matter, and why blurring the lines ultimately weakens everyone. We need a strong OSI to lead that new fight, because it is far from over.

    A taxonomy of open source production models

    As I argued in previous parts, how open source is built ultimately impacts the benefits users get. A lot of us know that, and we all came up with our own vocabulary to describe those various ways open source is produced today.

    Even within a given model (say open collaboration between equals on a level playing field), we use different sets of principles: the OpenStack Foundation has the 4 Opens (open source, open development, open design, open community), the Eclipse Foundation has the Open Source Rules of Engagement (open, transparent, meritocracy), the Apache Foundation has the Apache Way... We all advocate for our own variant, focusing on differences rather than what we have in common: the key benefits those variants all enable.

    This abundance of slightly-different vocabulary makes it difficult to rally around and communicate efficiently. If we have no clear way to differentiate good all-benefits-included open source from twisted some-benefits-withheld open source, the confusion (where all open source is considered equal) benefits the twisted production models. I think it is time for us to regroup, and converge around a clear, common classification of open source production models.

    We need to classify those models based on which benefits they guarantee to the users of the produced software. Open-core does not guarantee availability, single-vendor does not provide sustainability nor does it allow to efficiently engage and influence the direction of the software, while open-collaboration gives you all three.

    Once we have this classification, we'll need to heavily communicate around it, with a single voice. As long as we use slightly different terms (or mean slightly different things when using common terms), we maintain confusion which ultimately benefits the most restrictive models.

    Get together

    Beyond that, I think we need to talk more. Open source conferences used to be all about education and advocacy: what is this weird way of producing software, and why you should probably be interested in it. Once open source became ubiquitous, those style of horizontal open source conferences became less relevant, and were soon replaced by more vertical conferences around a specific stack or a specific use case.

    This is a good evolution: this is what winning looks like. The issue is: the future of open source is not discussed anymore. We rest on our laurels, while the world continually evolves and adapts. Some open source conference islands may still exist, with high-level keynotes still raising the issues, but those are generally one-way conversations.

    To do this important work of converging vocabulary and defining common standards on how open source is produced, Twitter won't cut it. To bootstrap the effort we'll need to meet, get around a table and take the time to discuss specific issues together. Ideally that would be done around some other event(s) to avoid extra travel.

    And we need to do that soon. This work is becoming urgent. "Open source" as a standard has lots of value because of all the user benefits traditionally associated with free and open source software. That created an aura that all open source software still benefits from today. But that aura is weakening over time, thanks to twisted production models. How much more single-vendor open source can we afford until "open source" no longer means you can engage with the community and influence the direction of the software ?

    So here is my call to action, which concludes this series.

    In 2019, open source is more important than ever. Open source has not "won", this is a continuous effort, and we are today at a critical junction. I think open source advocates and enthusiasts need to get together, defining clear, standard terminology on how open source software is built, and start communicate heavily around it with a single voice. And beyond that, we need to create forums where those questions on the future of open source are discussed. Because whatever battles you win today, the world does not stop evolving and adapting.

    Obviously I don't have all the answers. And there are lots of interesting questions. It's just time we have a place to ask those questions and discuss the answers. If you are interested and want to get involved, feel free to contact me.

    ]]>     Thierry Carrez     Canonical’s Desktop Team is hiring https://blogs.gnome.org/laney/2019/07/02/canonicals-desktop-team-is-hiring/ https://blogs.gnome.org/laney/2019/07/02/canonicals-desktop-team-is-hiring/ Tue, 02 Jul 2019 10:43:12 GMT Join the desktop team

     

    edit: this post is fairly old now, and we’re well on the way with the rest of the process – if you didn’t apply yet, it’s probably worth waiting until next time

    Some good news for anyone who might read this. In the Canonical desktop team we’re hiring a new Software Engineer.

    More details in the job description, but if you’re looking for an opportunity that lets you:

    • work remotely
    • work on GNOME and related desktop technologies (both upstream and downstream!)
    • help to ship a solid Ubuntu every 6 months
    • work with smart people
    • have the opportunity to travel to, and present at, conferences and internal events

    then please apply. You do not need to already be a GNOME or a Ubuntu/Debian expert to apply for this position – you’ll be given a mentor and plenty of time and support to learn the ropes.

    Please feel free to contact me on IRC (Laney on all the best networks) / email (iain.lane@canonical.com) / Telegram (@lan3y) if you’re considering an application and you’d like to chat about it.

    ]]>     Iain Lane     OpenStack Stein for Ubuntu 18.04 LTS https://javacruft.wordpress.com/2019/04/17/openstack-stein-for-ubuntu-18-04-lts/ https://javacruft.wordpress.com/2019/04/17/openstack-stein-for-ubuntu-18-04-lts/ Wed, 17 Apr 2019 10:50:17 GMT The Ubuntu OpenStack team at Canonical is pleased to announce the general availability of OpenStack Stein on Ubuntu 18.04 LTS via the Ubuntu Cloud Archive. Details of the Stein release can be found here.

    You can enable the Ubuntu Cloud Archive pocket for OpenStack Stein on Ubuntu 18.04 LTS installations by running the following commands:

        sudo add-apt-repository cloud-archive:stein
    sudo apt update

    The Ubuntu Cloud Archive for Stein includes updates for:

    aodh, barbican, ceilometer, ceph (13.2.4), cinder, designate, designate-dashboard, glance, gnocchi, heat, heat-dashboard, horizon, ironic, keystone, magnum, manila, manila-ui, mistral, murano, murano-dashboard, networking-bagpipe, networking-bgpvpn, networking-hyperv, networking-l2gw, networking-odl, networking-ovn, networking-sfc, neutron, neutron-dynamic-routing, neutron-fwaas, neutron-lbaas, neutron-lbaas-dashboard, neutron-vpnaas, nova, nova-lxd, octavia, openstack-trove, openvswitch (2.11.0), panko, sahara, sahara-dashboard, senlin, swift, trove-dashboard, vmware-nsx, watcher, and zaqar.

    For a full list of packages and versions please refer to the Stein UCA version report.

    Python 3

    The majority of OpenStack packages now run under Python 3 only; notable exceptions include Swift.  Python 2 packages are no longer provided for the majority of projects.

    Branch package builds

    If you would like to try out the latest updates to branches, we deliver continuously integrated packages on each upstream commit-ish via the following PPA’s:

        sudo add-apt-repository ppa:openstack-ubuntu-testing/rocky
    sudo add-apt-repository ppa:openstack-ubuntu-testing/stein

    Reporting bugs

    If you have any issues please report bugs using the ‘ubuntu-bug’ tool to ensure that bugs get logged in the right place in Launchpad:

    sudo ubuntu-bug nova-conductor

    Thanks to everyone who has contributed to OpenStack Stein, both upstream and downstream. Special thanks to the Puppet OpenStack modules team and the OpenStack Charms team for their continued early testing of the Ubuntu Cloud Archive, as well as the Ubuntu and Debian OpenStack teams for all of their contributions.

    Have fun and see you all for Train!

    Cheers

    James

    (on behalf of the Ubuntu OpenStack team)

    ]]>     James Page     Intel NEO OpenCL driver for Disco https://tjaalton.wordpress.com/2019/04/09/intel-neo-opencl-driver-for-disco/ https://tjaalton.wordpress.com/2019/04/09/intel-neo-opencl-driver-for-disco/ Tue, 09 Apr 2019 16:11:30 GMT The past few months I’ve been packaging the bits needed for Intel’s new OpenCL driver, which they call NEO. The packages are now finally ready, you can enable ‘ppa:canonical-x/x-staging’ and install ‘intel-opencl’ on Disco. After installing it this is what ‘clinfo’ says on my laptop:

    Number of platforms                               1
  Platform Name                                   Intel(R) OpenCL HD Graphics
  Platform Vendor                                 Intel(R) Corporation
  Platform Version                                OpenCL 2.1 
  Platform Profile                                FULL_PROFILE
  Platform Extensions                             cl_khr_3d_image_writes cl_khr_byte_addressable_store
    cl_khr_fp16 cl_khr_depth_images cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics
    cl_khr_icd cl_khr_image2d_from_buffer cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics
    cl_intel_subgroups cl_intel_required_subgroup_size cl_intel_subgroups_short cl_khr_spir
    cl_intel_accelerator cl_intel_media_block_io cl_intel_driver_diagnostics cl_intel_device_side_avc_motion_estimation
    cl_khr_priority_hints cl_khr_throttle_hints cl_khr_create_command_queue cl_khr_fp64 cl_khr_subgroups
    cl_khr_il_program cl_intel_spirv_device_side_avc_motion_estimation cl_intel_spirv_media_block_io
    cl_intel_spirv_subgroups cl_khr_spirv_no_integer_wrap_decoration cl_khr_mipmap_image cl_khr_mipmap_image_writes
    cl_intel_planar_yuv cl_intel_packed_yuv cl_intel_motion_estimation cl_intel_advanced_motion_estimation
    cl_intel_va_api_media_sharing 
  Platform Host timer resolution                  1ns
  Platform Extensions function suffix             INTEL

  Platform Name                                   Intel(R) OpenCL HD Graphics
Number of devices                                 1
  Device Name                                     Intel(R) Gen9 HD Graphics NEO
  Device Vendor                                   Intel(R) Corporation
  Device Vendor ID                                0x8086
  Device Version                                  OpenCL 2.1 NEO 
  Driver Version                                  1.0.0
  Device OpenCL C Version                         OpenCL C 2.0 
  Device Type                                     GPU
  Device Profile                                  FULL_PROFILE
  Device Available                                Yes
  Compiler Available                              Yes
  Linker Available                                Yes
  Max compute units                               24
  Max clock frequency                             1100MHz
  Device Partition                                (core)
    Max number of sub-devices                     0
    Supported partition types                     None
    Supported affinity domains                    (n/a)
  Max work item dimensions                        3
  Max work item sizes                             256x256x256
  Max work group size                             256
  Preferred work group size multiple              32
  Max sub-groups per work group                   32
  Sub-group sizes (Intel)                         8, 16, 32
  Preferred / native vector sizes                 
    char                                                16 / 16      
    short                                                8 / 8       
    int                                                  4 / 4       
    long                                                 1 / 1       
    half                                                 8 / 8        (cl_khr_fp16)
    float                                                1 / 1       
    double                                               1 / 1        (cl_khr_fp64)
  Half-precision Floating-point support           (cl_khr_fp16)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
  Single-precision Floating-point support         (core)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
    Correctly-rounded divide and sqrt operations  Yes
  Double-precision Floating-point support         (cl_khr_fp64)
    Denormals                                     Yes
    Infinity and NANs                             Yes
    Round to nearest                              Yes
    Round to zero                                 Yes
    Round to infinity                             Yes
    IEEE754-2008 fused multiply-add               Yes
    Support is emulated in software               No
  Address bits                                    64, Little-Endian
  Global memory size                              13253832704 (12.34GiB)
  Error Correction support                        No
  Max memory allocation                           4294959104 (4GiB)
  Unified memory for Host and Device              Yes
  Shared Virtual Memory (SVM) capabilities        (core)
    Coarse-grained buffer sharing                 Yes
    Fine-grained buffer sharing                   No
    Fine-grained system sharing                   No
    Atomics                                       No
  Minimum alignment for any data type             128 bytes
  Alignment of base address                       1024 bits (128 bytes)
  Preferred alignment for atomics                 
    SVM                                           64 bytes
    Global                                        64 bytes
    Local                                         64 bytes
  Max size for global variable                    65536 (64KiB)
  Preferred total size of global vars             4294959104 (4GiB)
  Global Memory cache type                        Read/Write
  Global Memory cache size                        524288 (512KiB)
  Global Memory cache line size                   64 bytes
  Image support                                   Yes
    Max number of samplers per kernel             16
    Max size for 1D images from buffer            268434944 pixels
    Max 1D or 2D image array size                 2048 images
    Base address alignment for 2D image buffers   4 bytes
    Pitch alignment for 2D image buffers          4 pixels
    Max 2D image size                             16384x16384 pixels
    Max planar YUV image size                     16384x16352 pixels
    Max 3D image size                             16384x16384x2048 pixels
    Max number of read image args                 128
    Max number of write image args                128
    Max number of read/write image args           128
  Max number of pipe args                         16
  Max active pipe reservations                    1
  Max pipe packet size                            1024
  Local memory type                               Local
  Local memory size                               65536 (64KiB)
  Max number of constant args                     8
  Max constant buffer size                        4294959104 (4GiB)
  Max size of kernel argument                     1024
  Queue properties (on host)                      
    Out-of-order execution                        Yes
    Profiling                                     Yes
  Queue properties (on device)                    
    Out-of-order execution                        Yes
    Profiling                                     Yes
    Preferred size                                131072 (128KiB)
    Max size                                      67108864 (64MiB)
  Max queues on device                            1
  Max events on device                            1024
  Prefer user sync for interop                    Yes
  Profiling timer resolution                      83ns
  Execution capabilities                          
    Run OpenCL kernels                            Yes
    Run native kernels                            No
    Sub-group independent forward progress        Yes
    IL version                                    SPIR-V_1.0 
    SPIR versions                                 1.2 
  printf() buffer size                            4194304 (4MiB)
  Built-in kernels                                block_motion_estimate_intel;block_advanced_motion_estimate_check_intel;block_advanced_motion_estimate_bidirectional_check_intel;
  Motion Estimation accelerator version (Intel)   2
    Device-side AVC Motion Estimation version     1
      Supports texture sampler use                Yes
      Supports preemption                         No
  Device Extensions                               cl_khr_3d_image_writes cl_khr_byte_addressable_store cl_khr_fp16 cl_khr_depth_images cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_icd cl_khr_image2d_from_buffer cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_intel_subgroups cl_intel_required_subgroup_size cl_intel_subgroups_short cl_khr_spir cl_intel_accelerator cl_intel_media_block_io cl_intel_driver_diagnostics cl_intel_device_side_avc_motion_estimation cl_khr_priority_hints cl_khr_throttle_hints cl_khr_create_command_queue cl_khr_fp64 cl_khr_subgroups cl_khr_il_program cl_intel_spirv_device_side_avc_motion_estimation cl_intel_spirv_media_block_io cl_intel_spirv_subgroups cl_khr_spirv_no_integer_wrap_decoration cl_khr_mipmap_image cl_khr_mipmap_image_writes cl_intel_planar_yuv cl_intel_packed_yuv cl_intel_motion_estimation cl_intel_advanced_motion_estimation cl_intel_va_api_media_sharing 

NULL platform behavior
  clGetPlatformInfo(NULL, CL_PLATFORM_NAME, ...)  Intel(R) OpenCL HD Graphics
  clGetDeviceIDs(NULL, CL_DEVICE_TYPE_ALL, ...)   Success [INTEL]
  clCreateContext(NULL, ...) [default]            Success [INTEL]
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_DEFAULT)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_CPU)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_GPU)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_ACCELERATOR)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_CUSTOM)  No devices found in platform
  clCreateContextFromType(NULL, CL_DEVICE_TYPE_ALL)  Success (1)
    Platform Name                                 Intel(R) OpenCL HD Graphics
    Device Name                                   Intel(R) Gen9 HD Graphics NEO
  ICD loader properties
  ICD loader Name                                 OpenCL ICD Loader
  ICD loader Vendor                               OCL Icd free software
  ICD loader Version                              2.2.11
  ICD loader Profile                              OpenCL 2.1

    I’ll check with Intel if some of the ‘no devices found’ are to be expected or not..

    It’s still possible these might end up in the 19.04 release, we’ll see. They’re also uploaded to Debian, though with the Buster release keeping everyone busy I’m sure it’ll take some time to get them all through the NEW queue.

    NOTE: if you already have the stack installed from Intel’s github repo, please uninstall it first. Otherwise there will be file conflicts since the package names won’t match.

    ]]>     Timo Aaltonen     Setting Up a Domain with SSL on DigitalOcean Kubernetes using ExternalDNS and Helm //blog.andrewsomething.com/2019/04/04/external-dns-with-ssl-on-k8s/ //blog.andrewsomething.com/2019/04/04/external-dns-with-ssl-on-k8s/ Thu, 04 Apr 2019 04:00:00 GMT A little while back I added support for DigitalOcean to the ExternalDNS Helm chart, and I wanted to share my notes on how to use it. ExternalDNS is an extremely convenient tool that allows you to dynamically control DNS records for your Kubernetes resources just by adding an annotation. In this post, I’ll walk through how to install it with Helm and use it to point a domain at a Kubernetes service. I’ll also cover setting up SSL using a DigitalOcean managed SSL certificate on the load balancer.

    First, a few assumptions:

    Installing ExternalDNS with Helm

    With all of that in place, the first thing to do is install ExternalDNS into the cluster. You will need to generate a DigitalOcean API token for it to use. It’s best to create a token specifically for this service rather than using one you may have in your local environment. Then run the following command replacing $DO_API_TOKEN with the token you generated:

    helm install --name external-dns \
  --set digitalocean.apiToken=$DO_API_TOKEN,provider=digitalocean,rbac.create=true \
  stable/external-dns

    You can verify that it has been successfully installed by running:

    $ kubectl get pods -l "app=external-dns"

    When ready, the output should look something like this:

    NAME                           READY     STATUS    RESTARTS   AGE
external-dns-68bfc948b-jhhrq   1/1       Running   0          34s

    Generating a DigitalOcean Managed SSL Certificate

    Next, use doctl to generate an SSL certificate managed by DigitalOcean making use of their Let’s Encrypt integration. Giving it a name and replacing example.com with your domain, run:

    doctl compute certificate create  --name k8s-cert \
  --type lets_encrypt --dns-names example.com

    The output will include an ID that looks something like 9r3e053d-da5e-4390-b7b8-0fs23486e41q. You’ll need that in the next step.

    Deploying the Kubernetes Service

    Now you are ready to deploy your service to the Kubernetes cluster. For this example we are using an NGINX container for the deployment, but that could be any application running in your cluster. The important part for this exercise is the LoadBalancer Service. Here is the full example:

    kind: Service
apiVersion: v1
metadata:
  name: https-with-cert
  annotations:
    external-dns.alpha.kubernetes.io/hostname: "example.com"
    service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https: "true"
    service.beta.kubernetes.io/do-loadbalancer-certificate-id: "9r3e053d-da5e-4390-b7b8-0fs23486e41q"
spec:
  type: LoadBalancer
  selector:
    app: nginx-example
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 80

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-example
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx-example
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
          protocol: TCP

    Let’s look a little closer at the annotations section:

      annotations:
    external-dns.alpha.kubernetes.io/hostname: "example.com"
    service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https: "true"
    service.beta.kubernetes.io/do-loadbalancer-certificate-id: "9r3e053d-da5e-4390-b7b8-0fs23486e41q"

    Kubernetes annotations are just metadata attached to a Kubernetes object. They can be used for anything from specifying a maintainer for the service to a git commit hash or other release information. They can also be used to pass on information to controllers. In our case, both the DigitalOcean Cloud Controller Manager and the ExternalDNS controller are watching for services created with these annotations. Breaking down each one:

    • external-dns.alpha.kubernetes.io/hostname - Specifies the domain name to be assigned to the service
    • service.beta.kubernetes.io/do-loadbalancer-certificate-id - Specifies the ID of the DigitalOcean managed SSL cert
    • service.beta.kubernetes.io/do-loadbalancer-redirect-http-to-https - Configures the load balancer to automatically redirect clients from HTTP to HTTPS

    After replacing the domain and certificate ID in the full example and saving it to a file, apply the configuration with:

    kubectl apply -f path/to/https-with-domain.yaml

    Now let’s take a quick look at the logs for ExternalDNS by running:

    kubectl logs \
  `kubectl get pod -l app=external-dns -o jsonpath="{.items[0].metadata.name}"`

    When the record has been successfully configured, you will see two lines like:

    time="2019-04-04T01:19:11Z" level=info msg="Changing record." action=CREATE record=example.com ttl=300 type=A zone=example.com
time="2019-04-04T01:19:12Z" level=info msg="Changing record." action=CREATE record=example.com ttl=300 type=TXT zone=example.com

    You might be wondering why it created two records. ExternalDNS uses TXT records to mark records that it manages. It will not modify any records without a corresponding TXT record.

    Wrapping It Up

    With our service successfully deployed, it will now be available at the configured domain with SSL. If we redeploy the service latter, the DNS record will persist even if the underlying IP address were to change. If you’re looking for more detail, here’s some further reading for you:

    ]]>     Andrew SB     Resource Scale for Fractional Scaling support in GNOME Shell 3.32 https://blog.3v1n0.net/informatica/linux/gnome-shell-fractional-scaling-in-wayland-landed/ https://blog.3v1n0.net/informatica/linux/gnome-shell-fractional-scaling-in-wayland-landed/ Mon, 04 Mar 2019 15:17:55 GMT Fractional Scaling TestThe fractional scaling era for GNOME shell has finally arrived!

    The news spread out quite quickly, once last Friday Jonas pressed the button and that triggered the last-second merge for the relevant proposals we prepared for Mutter and GNOME Shell in order to get this available for GNOME 3.32.

    As someone might recall, we started this work some years ago (ouch!) and lead to an Hackfest in Taipei, but in between other work to do and priorities which caused this to be delayed a bit. While the first iteration was ready for some time now. But at every review we improved things fixing bugs (like missing scaled widgets) and optimizing some code paths, so hopefully this time helped in serving better quality :).

    We’ve still quite a lot of work to do (see these issues for mutter and shell) and some fixes that we have in queue already, but the main task is there. So starting from now the shell will paint all its elements properly and in good visual quality at any fractional scaled value, and independently for every monitor.

    Multi-monitor fractional scaling

    Monitors with different scaling values, and a window drawn in between the two

    As you might have noticed in the screenshot above, the X11 apps are still not really scaled in quality, while it’s not possible for them all (like xterm there), we need to work for a solution that will cover the legacy applications which does support scaling, and at the same time those which doesn’t want to be scaled at all (games!).

    As per what said above, this feature is still considered experimental and then you need to enable it via:

    gsettings set org.gnome.mutter experimental-features "['scale-monitor-framebuffer']"

    Doing this will allow you to set more a wider set of scaling values under Control Center, display panel.

    For what concerns Extensions, most of them should work with no change, but not those using directly the St.TextureCache, as we changed the methods signature by adding a resource_scale parameter.
    We discussed weather adding another method instead (as gir doesn’t support default values), but since 3.32 will need anyway a rewrite of most extensions anyways, and since it’s better to have them to behave properly with resource scale since the beginning (instead of blurred contents), we decided not to do it.
    So, please sync with this change (and sorry :)).

    Putting my Ubuntu hat now, this won’t change much things for default ubuntu experience, since it’s still using X11 (although I’ve something in the works for this too), but people who want to take advantage of this can easily just login using the Ubuntu on Wayland session, enable the experimental setting and profit.

    As final world, thanks to people who helped having this in by reviewing and testing the code.

    ]]>     Marco Trevisan (Treviño)     Rise and fall of libclamav https://skitterman.wordpress.com/2019/01/31/rise-and-fall-of-libclamav/ https://skitterman.wordpress.com/2019/01/31/rise-and-fall-of-libclamav/ Thu, 31 Jan 2019 06:36:03 GMT Because I was bored and needed to procrastinate, I decided to look at the history of packages using libclamav over the last several releases. This is binary reverse-depends in main on i386:

    Release

    libclamav soname

    rdepends

    Sarge

    libclamav1

    2

    Etch

    libclamav2

    9

    Lenny

    libclamav5

    5

    Squeeze

    libclamav6

    3

    Wheezy

    libclamav7

    3

    Jessie

    libclamav7

    4

    Stretch

    libclamav7

    4

    Buster

    libclamav7

    4

    I started working on clamav around Etch (in Ubuntu, so it’s not an exact match) and transitions were a blast back then. Every single soname bump needed significant sourceful changes. It killed quite a number of projects. Of the four we still have in Debian (dansguardian, havp, icap, and python-clamav) only the icap modules aren’t essentially dead upstream.

    I guess API stability counts for something if you want people to use your library.

    P.S. None of the people working on clamav today are the same as when we had 3 soname bumps in one release cycle.

     

    ]]>     Scott Kitterman     So I created a subreddit for interesting G+ refugees. Emphasis on interesting. https://blogs.gnome.org/mneptok/2019/01/28/so-i-created-a-subreddit-for-interesting-g-refugees-emphasis-on-interesting/ https://blogs.gnome.org/mneptok/2019/01/28/so-i-created-a-subreddit-for-interesting-g-refugees-emphasis-on-interesting/ Mon, 28 Jan 2019 20:48:02 GMT So I created a subreddit for interesting G+ refugees. Emphasis on interesting.

    Come and play. Be suave. Don’t be a dick.

    Edward Morbius

    Kee Hinckley

    Rugger Ducky

    Sarah Lester

    Ward A

    Tim S

    Matthew H

    Yoko F Thunders

    Dave Thompson

    Grumpy Cat

    catty _big

    Dan Ramos

    Di Cleverly

    and the many more I know I’ve forgotten because I need an fud. And invite your friends!

    https://reddit.com/r/ploos

    ]]>     Kurt von Finck     Announcing the Ubuntu 18.10 Free Culture Showcase winners https://www.nhaines.com/blog/2018/09/28/announcing-ubuntu-18.10-free-culture-showcase-winners/ https://www.nhaines.com/blog/2018/09/28/announcing-ubuntu-18.10-free-culture-showcase-winners/ Fri, 28 Sep 2018 07:00:00 GMT October approaches, and Ubuntu marches steadly along the road from one LTS to another. Ubuntu 18.10 is another step in Ubuntu’s future. And now it’s time to unveil a small part of that change: the community wallpapers to be included in Ubuntu 18.10!

    Every cycle, talented artists around the world create media and release it under licenses that encourage sharing and adaptation. This cycle we had some amazing images submitted to the Ubuntu 18.10 Free Culture Showcase photo pool on Flickr, where all eligible submissions can be found. The competition was fierce; narrowing down the options to the final selections was painful!

    But there can be only 12, and the final images that will be included in Ubuntu 18.10 are:

    A big congratulations to the winners, and thanks to everyone who submitted a wallpaper. You can find these wallpapers (along with dozens of other stunning wallpapers) today at the links above, or in your desktop wallpaper list after you upgrade to or install Ubuntu 18.10 on October 18th.

    ]]>     Nathan Haines     NVIDIA PRIME in Ubuntu 18.04 and 18.10, and a call for testing https://albertomilone.com/blog/nvidia-prime-in-ubuntu-18-04-and-18-10-and-a-call-for-testing/ https://albertomilone.com/blog/nvidia-prime-in-ubuntu-18-04-and-18-10-and-a-call-for-testing/ Thu, 20 Sep 2018 09:19:48 GMT Ubuntu 18.04 marked the transition to a new, more granular, packaging of the NVIDIA drivers, which, unfortunately, combined with a change in logind, and with the previous migration from Lightdm to Gdm3, caused (Intel+NVIDIA) hybrid laptops to stop working the way they used to in Ubuntu 16.xx and older.

    The following are the main issues experienced by our users:

    • An increase in power consumption when using the power saving profile (i.e. when the discrete GPU is off).
    • The inability to switch between power profiles on log out (thus requiring a reboot).

    We have backported a commit to solve the problem with logind, and I have worked on a few changes in gpu-manager, and in the other key components, to improve the experience when using Gdm3.

    NOTE: fixes for Lightdm, and for SDDM still need some work, and will be made available in the next update.

    Both issues should be fixed in Ubuntu 18.10, and I have backported my work to Ubuntu 18.04, which is now available for testing.

    If you run Ubuntu 18.04, own a hybrid laptop with an Intel and an NVIDIA GPU (supported by the 390 NVIDIA driver),  we would love to get your feedback on the updates in Ubuntu 18.04.

    If you are interested, head over to the bug report, follow the instructions at the end of the bug description, and let us know about your experience.

    ]]>     Alberto Milone     Help needed to improve proposed migration http://blog.cyphermox.net/2018/09/help-needed-to-improve-proposed.html http://blog.cyphermox.net/2018/09/help-needed-to-improve-proposed.html Thu, 20 Sep 2018 07:35:00 GMT
    Every once in a while, in the Foundations team, we do a coding day. A year ago, Lukasz and I wrote a script, following an idea from Steve Langasek, to provide "hints" and help for the next steps necessary for a package to migrate from -proposed to -release.

    "ubuntu-archive-assistant" was born. I just pushed this to lp:ubuntu-dev-tools, after it being on its own in a separate git tree for a long while. I'd love to get help for feedback, as well as more people contributing fixes, etc. ubuntu-archive-assistant is designed to let you look at a specific package in -proposed and try to tell you what to do next to ensure it migrates from -proposed.

    This is great work for new contributors wishing to work on something, say, to get upload privileges in Ubuntu.

    Here's how it works (it uses subcommands right now).

    Without any further options than "ubuntu-archive-assistant proposed", it will list packages in -proposed and let you pick:
    $ ./ubuntu-archive-assistant proposed
    No source package name was provided. The following packages are blocked in proposed:

    (1) gnome-shell-extension-multi-monitors (Age: 338 days)
    (2) node-is-glob (Age: 278 days)
    (3) node-concat-with-sourcemaps (Age: 264 days)
    (4) node-postcss (Age: 231 days)
    (5) node-source-map (Age: 229 days)
    (6) android-platform-system-core (Age: 226 days)
    (7) libdigidocpp (Age: 226 days)
    (8) qesteidutil (Age: 225 days)
    (9) schleuder (Age: 218 days)
    (10) ncbi-blast+ (Age: 216 days)
    (11) node-postcss-filter-plugins (Age: 213 days)
    (12) node-postcss-load-options (Age: 213 days)
    (13) node-postcss-load-plugins (Age: 213 days)
    (14) node-postcss-minify-font-values (Age: 213 days)
    (15) node-postcss-load-config (Age: 209 days)
    (16) live-config (Age: 207 days)
    Page -1-. Press any key for next page or Q to select a package.
    Which package do you want to look at? 9
    Next steps for schleuder 3.2.2-1:
      Fix missing builds: amd64
         https://launchpad.net/ubuntu/+source/schleuder/3.2.2-1

    If you specify which package you want to look at, it will give you the specifics for that package (examples here are for what is currently in -proposed):
    $ ./ubuntu-archive-assistant proposed -s qesteidutil
    Next steps for qesteidutil 0.3.1-0ubuntu4:
      Fix missing builds: amd64, arm64, armhf, i386, ppc64el, s390x
         https://launchpad.net/ubuntu/+source/qesteidutil/0.3.1-0ubuntu4
    $ ./ubuntu-archive-assistant proposed -s android-platform-system-core
    Next steps for android-platform-system-core 1:7.0.0+r33-2build1:
      Fix missing builds: amd64, arm64, armhf, i386
         https://launchpad.net/ubuntu/+source/android-platform-system-core/1:7.0.0+r33-2build1 

    You can even get more information about the next steps for a package, by enabling --debug or --verbose:

    $ ./ubuntu-archive-assistant proposed -s live-config                 Next steps for live-config 5.20180224:
      Fix unsatisfiable dependencies in live-config:

    $ ./ubuntu-archive-assistant proposed --verbose -s live-config
    live-config is not considered ✘
    Next steps for live-config 5.20180224:
      Fix unsatisfiable dependencies in live-config:
        sysvinit-core | sysvinit (<< 2.88dsf-44) can not be satisfied on amd64 ✘
          sysvinit-core only exists in Debian ✘
     
    $ ./ubuntu-archive-assistant proposed --debug -s live-config
    live-config is not considered ✘
    Next steps for live-config 5.20180224:
    DEBUG: reasons: ['depends'] 
      Fix unsatisfiable dependencies in live-config:
        sysvinit-core | sysvinit (<< 2.88dsf-44) can not be satisfied on amd64 ✘
          sysvinit-core only exists in Debian ✘
             DEBUG: Is this package blacklisted? Should it be synced?

    We've covered some of the common reasons for a package to be stuck in proposed, but there are a ton of others. We'll need help to improve the tooling and make it useful for everyone wishing to work on proposed migration. There's a lot more that can be done, including spending time to parse update_output.txt (or better yet, a YAML representation of it) and testing package installation automatically to figure out what packages need no-change rebuilds, etc. A lot of it is integration of other tools that already exist.

    That's where you come in.

    This is a great way to learn a lot more about what happens to packages after they are uploaded, and what more you can do to ensure your own uploads move quickly to be accessible to all Ubuntu users; and many of the improvements can be as simple as contributing a simple test for one failure case for packages in -proposed.

    More to come about ubuntu-archive-assistant. There are other subcommands in it than just "proposed". :)]]>     Mathieu Trudel     Flisol Bogotá 2018 https://jhosman.com/en/locoteams/flisol-bogota-2018/ https://jhosman.com/en/locoteams/flisol-bogota-2018/ Tue, 08 May 2018 01:49:07 GMT

    Flisol Bogota 2018

    On April 28, we celebrated in the best way the Latin American Free Software Installation Festival (FLISoL) in Bogotá. FLISoL is the biggest event for the dissemination of Free Software in Latin America in which more than 20 countries together around 240 events recorded for this 2018 In Bogota part will take place in theFundación Tecnológica Autónoma de Bogotá FABA (Carrera 14 N° 80 – 35) from 9 a. m. Saturday April 28 this year with free entry. The Flisol Bogotá 2018, is one of the largest in Latin America with the largest number of attendees.

    The Latin American Festival of Installation of Free Software is designed for students, academics, businessmen, workers, civil servants, enthusiasts and the general public to raise awareness of our philosophy, scope, progress and development around Free Software, and share these citizens using ICT freedoms and opportunities that this provides. In Colombia it is the 14th time it is held in Bogota since 2005.

    On this occasion, the festival allowed us to observe that free culture, beyond being a space for the installation of software distributions, operating systems (Linux) or programs that promote the opening of the Internet and the empowerment of people with respect to technology, is a form to contribute and build societies.

    There were more than 1,600 people who participated in more than 90 activities that included lectures, workshops, panels, spaces for children -FLISoL Kids-, a cinema of free culture, music, origami and much more.

    We had two international speakers of whom we are very grateful to have shared this wonderful experience: Nuritzi Sanchez President, Board of Directors at GNOME Foundation; Founding Member, Ecosystem Team Manager at Endless and Jorge Luis Batista Automatic engineer, Cuban enthusiast of Open Street Map.

    We greatly appreciate the support provided by the International Community of Ubuntu and also the Canonical team for making this possible, and we look forward to continue helping in Colombia more and more in the future.

    ads

    We also had an installation area where the largest number of operating systems were Ubuntu Bionic 18.04 LTS

     

    The stand of the Community Ubuntu Colombia:

    All Festival information is on the website: www.flisolbogota.org and you can see the programation in: www.flisolbogota.org/programacion 

    Any additional information may be requested at the info@flisolbogota.org mail or in our social networks Twitter:flisol_bogota or Facebook: Flisol Bogota

    Photos of the Event: https://www.flickr.com/search/?text=flisol%20bogota&sort=date-posted-desc

    You can see All reactions of Twitter, photos and videos in:

    ]]>     Jhosman Lizarazo     Debugging the debugger https://chriscoulson.me.uk/blog/?p=295 https://chriscoulson.me.uk/blog/?p=295 Wed, 02 May 2018 21:02:46 GMT I use gdb quite often, but until recently I’ve never really needed to understand how it works or debug it before. I thought I’d document a recent issue I decided to take a look at – perhaps someone else will find it interesting or useful.

    We run the rust testsuite when building rustc packages in Ubuntu. When preparing updates to rust 1.25 recently for Ubuntu 18.04 LTS, I hit a bunch of test failures on armhf which all looked very similar. Here’s an example test failure:

    ---- [debuginfo-gdb] debuginfo/borrowed-c-style-enum.rs stdout ----

NOTE: compiletest thinks it is using GDB with native rust support
executing "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/stage2/bin/rustc" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs" "-L" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo" "--target=armv7-unknown-linux-gnueabihf" "-C" "prefer-dynamic" "-o" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf" "-Crpath" "-Zmiri" "-Zunstable-options" "-Lnative=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/native/rust-test-helpers" "-g" "-L" "/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf.gdb.aux"
------stdout------------------------------

------stderr------------------------------

------------------------------------------
NOTE: compiletest thinks it is using GDB version 8001000
executing "/usr/bin/gdb" "-quiet" "-batch" "-nx" "-command=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script"
------stdout------------------------------
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Breakpoint 1 at 0xcc4: file /<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs, line 61.

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3

------stderr------------------------------
/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script:10: Error in sourced command file:
No symbol 'the_a_ref' in current context

------------------------------------------

error: line not found in debugger output: $1 = borrowed_c_style_enum::ABC::TheA
status: exit code: 0
command: "/usr/bin/gdb" "-quiet" "-batch" "-nx" "-command=/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script"
stdout:
------------------------------------------
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Breakpoint 1 at 0xcc4: file /<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/src/test/debuginfo/borrowed-c-style-enum.rs, line 61.

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3

------------------------------------------
stderr:
------------------------------------------
/<<BUILDDIR>>/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.debugger.script:10: Error in sourced command file:
No symbol 'the_a_ref' in current context

------------------------------------------

thread '[debuginfo-gdb] debuginfo/borrowed-c-style-enum.rs' panicked at 'explicit panic', tools/compiletest/src/runtest.rs:2891:9
note: Run with `RUST_BACKTRACE=1` for a backtrace.

    The failing tests are all running some commands in gdb, and the inferior (tracee) is crashing inside the dynamic loader (/lib/ld-linux-armhf.so.3) before running any rust code.

    I managed to recreate this test failure on an armhf box, but when I installed the debug symbols for the dynamic loader (contained in the libc6-dbg package) so that I could attempt to debug these crashes, the failing tests all started to pass.

    A quick search on the internet shows that I’m not the first person to hit this issue – for example, this bug reported in April 2016. According to the comments, the workaround is the same – installing the debug symbols for the dynamic loader (by installing the libc6-dbg package). This obviously isn’t right and I don’t particularly like walking away from something like this without understanding it, so I decided to spend some time trying to figure out what is going on.

    This first thing I did was to load the missing debug symbols manually in gdb after hitting the crash, in order to hopefully get a useful backtrace:

    $ gdb build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
...
(gdb) run                                           
Starting program: /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf

Program received signal SIGSEGV, Segmentation fault.
0xf77c9f4e in ?? () from /lib/ld-linux-armhf.so.3
(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library                                                
0xf77c7a40  0xf77dadd0  Yes (*)     /lib/ld-linux-armhf.so.3                                             
0xf771ce90  0xf778e288  No          /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/../../stage2/lib/rustlib/armv7-unknown-linux-gnueabihf/lib/libstd-42d13165275d0302.so
0xf76c91f0  0xf76d394c  No          /lib/arm-linux-gnueabihf/libgcc_s.so.1
0xf75dad80  0xf7687a90  No          /lib/arm-linux-gnueabihf/libc.so.6
0xf75b1a14  0xf75b2410  No          /lib/arm-linux-gnueabihf/libdl.so.2
0xf759c810  0xf759edf0  No          /lib/arm-linux-gnueabihf/librt.so.1
0xf757a210  0xf7585214  No          /lib/arm-linux-gnueabihf/libpthread.so.0
(*): Shared library is missing debugging information.
(gdb) add-symbol-file ~/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so 0xf77c7a40
add symbol table from file "/home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so" at
        .text_addr = 0xf77c7a40
(y or n) y
Reading symbols from /home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so...done.
(gdb) bt full
#0  dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2275
        cnt = 1
        afct = 0x0
        head = <optimized out>
        ph = <optimized out>
        mode = <optimized out>
        main_map = <optimized out>
        file_size = 4294899100
        file = <optimized out>
        has_interp = <optimized out>
        i = <optimized out>
        prelinked = <optimized out>
        rtld_is_main = <optimized out>
        tcbp = <optimized out>
        __PRETTY_FUNCTION__ = <error reading variable __PRETTY_FUNCTION__ (Cannot access memory at address 0x15810)>
        first_preload = <optimized out>
        r = <optimized out>
        rtld_ehdr = <optimized out>
        rtld_phdr = <optimized out>
        cnt = <optimized out>
        need_security_init = <optimized out>
        count_modids = <optimized out>
        preloads = <optimized out>
        npreloads = <optimized out>
        preload_file = <error reading variable preload_file (Cannot access memory at address 0x157fc)>
        rtld_multiple_ref = <optimized out>
        was_tls_init_tp_called = <optimized out></details>
#1  0xf77d76d0 in _dl_sysdep_start (start_argptr=start_argptr@entry=0xfffef6b1, dl_main=0xf77c872d <dl_main>) at ../elf/dl-sysdep.c:253
        phdr = <optimized out>
        phnum = <optimized out>
        user_entry = 4197241
        av = <optimized out>
#2  0xf77c8260 in _dl_start_final (arg=0xfffef6b1) at rtld.c:414
        start_addr = <optimized out>
        start_addr = <optimized out>
#3  _dl_start (arg=0xfffef6b1) at rtld.c:521
        entry = <optimized out>
#4  0xf77c7b90 in ?? () from /lib/ld-linux-armhf.so.3
        library_path = <error reading variable library_path (Cannot access memory at address 0x28920)>
        version_info = <error reading variable version_info (Cannot access memory at address 0x28918)>
        any_debug = <error reading variable any_debug (Cannot access memory at address 0x28914)>
        _dl_rtld_libname = <error reading variable _dl_rtld_libname (Cannot access memory at address 0x298a8)>
        _dl_rtld_libname2 = <error reading variable _dl_rtld_libname2 (Cannot access memory at address 0x298b4)>
        tls_init_tp_called = <error reading variable tls_init_tp_called (Cannot access memory at address 0x29898)>
        audit_list = <error reading variable audit_list (Cannot access memory at address 0x298a4)>
        preloadlist = <error reading variable preloadlist (Cannot access memory at address 0x2891c)>
        _dl_skip_args = <error reading variable _dl_skip_args (Cannot access memory at address 0x2994c)>
        audit_list_string = <error reading variable audit_list_string (Cannot access memory at address 0x29968)>
        __stack_chk_guard = <error reading variable __stack_chk_guard (Cannot access memory at address 0x28968)>
        _rtld_global = <error reading variable _rtld_global (Cannot access memory at address 0x29060)>
        _rtld_global_ro = <error reading variable _rtld_global_ro (Cannot access memory at address 0x28970)>
        _dl_argc = <error reading variable _dl_argc (Cannot access memory at address 0x28910)>
        __GI__dl_argv = <error reading variable __GI__dl_argv (Cannot access memory at address 0x29894)>
        __pointer_chk_guard_local = <error reading variable __pointer_chk_guard_local (Cannot access memory at address 0x28964)>

    You can grab the glibc source and see that the dynamic loader ends up here in elf/rtld.c:

    if (__glibc_unlikely (GLRO(dl_naudit) > 0))
  {
    struct link_map *head = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
    /* Do not call the functions for any auditing object.  */
    if (head->l_auditing == 0)
      {
        struct audit_ifaces *afct = GLRO(dl_audit);
        for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
          {
            if (afct->activity != NULL) // ##CRASHES HERE##
              afct->activity (&head->l_audit[cnt].cookie, LA_ACT_CONSISTENT);

            afct = afct->next;
          }
      }
  }

    The reason for the crash is that afct is NULL:

    (gdb) p $_siginfo
$1 = {si_signo = 11, si_errno = 0, si_code = 1, _sifields = {_pad = {0, 56, 19628232, 19628288, -156661788, 0, 80, 19811416, -156663808, -157316581, 104, 1073741824, 19811416, 96, 19811408, 80, -156661788, 14, 
      19551104, 96, 104, 13358248, 19551584, 19552160, 19552232, 19811488, 32, 128, 64}, _kill = {si_pid = 0, si_uid = 56}, _timer = {si_tid = 0, si_overrun = 56, si_sigval = {sival_int = 19628232, 
        sival_ptr = 0x12b80c8}}, _rt = {si_pid = 0, si_uid = 56, si_sigval = {sival_int = 19628232, sival_ptr = 0x12b80c8}}, _sigchld = {si_pid = 0, si_uid = 56, si_status = 19628232, si_utime = 19628288, 
      si_stime = -156661788}, _sigfault = {si_addr = 0x0}, _sigpoll = {si_band = 0, si_fd = 56}}}
(gdb) p afct
$2 = (struct audit_ifaces *) 0x0

    A quick look through the dynamic loader code shows that this condition should be impossible to hit.

    As the crash doesn’t happen with debug symbols, I thought I would attempt to debug it without the symbols. First of all, I set a breakpoint at the start of dl_main by specifying it at offset 0xcec in the .text section:

    $ gdb build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
...
(gdb) starti
Starting program: /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf

Program stopped.
0xf77c7b80 in ?? () from /lib/ld-linux-armhf.so.3
(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library
0xf77c7a40  0xf77dadd0  Yes (*)     /lib/ld-linux-armhf.so.3
(*): Shared library is missing debugging information.
(gdb) break *0xf77c872c
Breakpoint 1 at 0xf77c872c
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xf77da458 in ?? () from /lib/ld-linux-armhf.so.3

    Huh? It’s now crashed at a different place, without hitting our breakpoint at the start of dl_main. Loading the debug symbols again shows us where:

    (gdb) add-symbol-file ~/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so 0xf77c7a40
add symbol table from file "/home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so" at
        .text_addr = 0xf77c7a40
(y or n) y
Reading symbols from /home/ubuntu/libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so...done.
(gdb) bt
#0  ?? () at ../sysdeps/arm/armv7/multiarch/memcpy_impl.S:654 from /lib/ld-linux-armhf.so.3
#1  0xf77c871e in handle_ld_preload (preloadlist=<optimized out>, main_map=0x0) at rtld.c:848
#2  0x00000000 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

    This doesn’t make much sense, but the fact that setting a breakpoint has altered the program flow is our first clue.

    On Linux, gdb interacts with the inferior using the ptrace system call. The next thing I wanted to try was running gdb in strace in order to capture the ptrace syscalls, so that I could compare differences afterwards and see if I could find any more clues.

    I created the following simple gdb command file:

    file /home/ubuntu/src/rustc/rustc-1.25.0+dfsg1+llvm/build/armv7-unknown-linux-gnueabihf/test/debuginfo/borrowed-c-style-enum.stage2-armv7-unknown-linux-gnueabihf
run
quit

    I then ran gdb with this file inside strace, with the symbols for the dynamic loader installed. Here’s the log up until the point at which gdb calls PTRACE_CONT:

    $ strace -t -eptrace gdb -quiet -batch -nx -command=~/test.script
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21136, si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
...
13:08:35 ptrace(PTRACE_GETREGS, 21137, NULL, 0xffd6afec) = 0
13:08:35 ptrace(PTRACE_GETSIGINFO, 21137, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21137, si_uid=1000}) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21137, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_CONT, 21137, 0x1, SIG_0) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21137, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_GETREGS, 21137, NULL, 0xffd6afec) = 0
13:08:35 ptrace(PTRACE_GETSIGINFO, 21137, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21137, si_uid=1000}) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGSTOP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACESYSGOOD) = 0
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACEFORK) = 0
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORKDONE) = 0
13:08:35 ptrace(PTRACE_CONT, 21138, NULL, SIG_0) = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_GETEVENTMSG, 21138, NULL, [21139]) = 0
13:08:35 ptrace(PTRACE_KILL, 21139)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21139, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21138, NULL, PTRACE_O_EXITKILL) = 0
13:08:35 ptrace(PTRACE_KILL, 21138)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21138, si_uid=1000, si_status=SIGCHLD, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_KILL, 21138)     = 0
13:08:35 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21138, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:08:35 ptrace(PTRACE_SETOPTIONS, 21137, NULL, PTRACE_O_TRACESYSGOOD|PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORK|PTRACE_O_TRACECLONE|PTRACE_O_TRACEEXEC|PTRACE_O_TRACEVFORKDONE|PTRACE_O_EXITKILL) = 0
13:08:35 ptrace(PTRACE_GETREGSET, 21137, NT_PRSTATUS, [{iov_base=0xffd6b3b4, iov_len=72}]) = 0
13:08:35 ptrace(PTRACE_GETVFPREGS, 21137, NULL, 0xffd6b298) = 0
13:08:35 ptrace(PTRACE_GETREGSET, 21137, NT_PRSTATUS, [{iov_base=0xffd6b36c, iov_len=72}]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0x411efc, [NULL]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0x411efc, [NULL]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9ef8, [0xf00cbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9ef8, 0xf00cde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5310, [0xbf00e71c]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5310, 0xde01e71c) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bde01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5d90, [0xe681bf00]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5d90, 0xe681de01) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77c9a44, [0x4c18de01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18bf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb5b8, [0x603cde01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cbf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77cb220, [0x4639de01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639bf00) = 0
13:08:35 ptrace(PTRACE_PEEKTEXT, 21137, 0xf77d5bb0, [0x6d7bde01]) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bbf00) = 0
13:08:35 ptrace(PTRACE_CONT, 21137, 0x1, SIG_0) = 0

    First of all, notice that there are several PTRACE_POKEDATA calls. These are used by gdb to write to memory locations in the process that we’re debugging, eg, to set breakpoints. For more information about how breakpoints work in gdb, this blog post has some good information. Basically, gdb writes an invalid instruction to the breakpoint location and this causes a SIGTRAP when executed, which is intercepted by gdb. When you continue over the breakpoint, gdb writes the original instruction back, single-steps over it, re-writes the invalid instruction and then continues execution.

    This is an obvious way in which gdb can interfere with our process and make it crash, so I focused on these calls. I’ve filtered them out below:

    13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9ef8, 0xf00cde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5310, 0xde01e71c) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bde01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5d90, 0xe681de01) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77c9a44, 0x4c18bf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb5b8, 0x603cbf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77cb220, 0x4639bf00) = 0
13:08:35 ptrace(PTRACE_POKEDATA, 21137, 0xf77d5bb0, 0x6d7bbf00) = 0

    Notice that the first 7 of these write the same 2-byte sequence – 0xde01. These are breakpoints in code that is running in Thumb mode (see arm_linux_thumb_le_breakpoint in gdb/arm-linux-tdep.c in the gdb source code). 0xde01 in Thumb mode is an undefined instruction.

    (Note that the write to 0xf77d5310 is actually a breakpoint at 0xf77d5312, as 0xde01 appears in the 2 higher order bytes and this is little-endian).

    We aren’t inserting any breakpoints ourselves – these breakpoints are set automatically by gdb to monitor various events in the dynamic loader during startup. This is something I wasn’t aware of before debugging this.

    It may be useful to know how gdb determines the addresses on which to set breakpoints at startup. The dynamic loader exports various events as SystemTap probes, and data about these is stored in the .note.stapsdt ELF section. We can inspect this using readelf:

    $ readelf -n /lib/ld-linux-armhf.so.3

Displaying notes found in: .note.gnu.build-id                                                            
  Owner                 Data size       Description                          
  GNU                  0x00000014       NT_GNU_BUILD_ID (unique build ID bitstring)                      
    Build ID: 3f3b9b4bfea2654f2cedf6db2d120b4e3a39ea7e                      

Displaying notes found in: .note.stapsdt                                                                 
  Owner                 Data size       Description 
  stapsdt              0x00000032       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld                                           
    Name: init_start                                
    Location: 0x00002a44, Base: 0x00017b9c, Semaphore: 0x00000000                                        
    Arguments: -4@.L1204 4@[r7, #52]                      
  stapsdt              0x0000002e       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld                                  
    Name: init_complete                                              
    Location: 0x00002ef8, Base: 0x00017b9c, Semaphore: 0x00000000                                        
    Arguments: -4@.L1207 4@r4                                           
  stapsdt              0x0000002e       NT_STAPSDT (SystemTap probe descriptors)                         
    Provider: rtld
    Name: map_failed
    Location: 0x00004220, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[sp, #20] 4@r5
  stapsdt              0x00000035       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: map_start
    Location: 0x000045b8, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #252] 4@[r7, #72]
  stapsdt              0x0000003c       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: map_complete
    Location: 0x0000e020, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36] 4@r4
  stapsdt              0x00000036       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: reloc_start
    Location: 0x0000e09e, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36]
  stapsdt              0x0000003e       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: reloc_complete
    Location: 0x0000e312, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[fp, #20] 4@[r7, #36] 4@r4
  stapsdt              0x00000037       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: unmap_start
    Location: 0x0000ebb0, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #104] 4@[r7, #80]
  stapsdt              0x0000003a       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: unmap_complete
    Location: 0x0000ed90, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: -4@[r7, #104] 4@[r7, #80]
  stapsdt              0x00000029       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: setjmp
    Location: 0x0001201c, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r14
  stapsdt              0x00000029       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: longjmp
    Location: 0x00012088, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r4
  stapsdt              0x00000031       NT_STAPSDT (SystemTap probe descriptors)
    Provider: rtld
    Name: longjmp_target
    Location: 0x000120ba, Base: 0x00017b9c, Semaphore: 0x00000000
    Arguments: 4@r0 -4@r1 4@r14

    GDB uses this information to map events to breakpoint addresses. You can read a bit more about gdb’s linker interface here, and more about userspace SystemTap probes here.

    With a base address of 0xf77c7000, we can look at the PTRACE_POKEDATA calls and see that the addresses map to these probes:

    • 0xf77c9a44 => init_start
    • 0xf77c9ef8 => init_complete
    • 0xf77cb5b8 => map_start
    • 0xf77cb220 => map_failed
    • 0xf77d5312 => reloc_complete
    • 0xf77d5bb0 => unmap_start
    • 0xf77d5d90 => unmap_complete

    This is consistent with the probe_info array in gdb/solib-svr4.c in the gdb source code.

    I then ran gdb inside strace again, this time without the symbols for the dynamic loader installed. Here’s the log up until the point at which the inferior process crashes:

    $ strace -t -eptrace gdb -quiet -batch -nx -command=~/test.script
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=21098, si_uid=1000, si_status=0, si_utime=0, si_stime=0} ---
...
13:01:50 ptrace(PTRACE_GETREGS, 21099, NULL, 0xffb84a9c) = 0                                                                                                                                                       
13:01:50 ptrace(PTRACE_GETSIGINFO, 21099, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21099, si_uid=1000}) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_CONT, 21099, 0x1, SIG_0) = 0                                                      
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_GETREGS, 21099, NULL, 0xffb84a9c) = 0
13:01:50 ptrace(PTRACE_GETSIGINFO, 21099, NULL, {si_signo=SIGTRAP, si_code=SI_USER, si_pid=21099, si_uid=1000}) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGSTOP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACESYSGOOD) = 0
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACEFORK) = 0
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORKDONE) = 0
13:01:50 ptrace(PTRACE_CONT, 21100, NULL, SIG_0) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGTRAP, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_GETEVENTMSG, 21100, NULL, [21101]) = 0
13:01:50 ptrace(PTRACE_KILL, 21101)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21101, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21100, NULL, PTRACE_O_EXITKILL) = 0
13:01:50 ptrace(PTRACE_KILL, 21100)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21100, si_uid=1000, si_status=SIGCHLD, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_KILL, 21100)     = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=21100, si_uid=1000, si_status=SIGKILL, si_utime=0, si_stime=0} ---
13:01:50 ptrace(PTRACE_SETOPTIONS, 21099, NULL, PTRACE_O_TRACESYSGOOD|PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORK|PTRACE_O_TRACECLONE|PTRACE_O_TRACEEXEC|PTRACE_O_TRACEVFORKDONE|PTRACE_O_EXITKILL) = 0
13:01:50 ptrace(PTRACE_GETREGSET, 21099, NT_PRSTATUS, [{iov_base=0xffb84e64, iov_len=72}]) = 0
13:01:50 ptrace(PTRACE_GETVFPREGS, 21099, NULL, 0xffb84d48) = 0
13:01:50 ptrace(PTRACE_GETREGSET, 21099, NT_PRSTATUS, [{iov_base=0xffb84e1c, iov_len=72}]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0x411efc, [NULL]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0x411efc, [NULL]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9a44, [0x4c18bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9a44, [0x4c18bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9ef8, [0xf00cbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77c9ef8, [0xf00cbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9ef8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb5b8, [0x603cbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb5b8, [0x603cbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb220, [0x4639bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77cb220, [0x4639bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5310, [0xbf00e71c]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5310, 0x1f0e71c) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5314, [0x4620e776]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5314, 0x4620e7f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5bb0, [0x6d7bbf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5d90, [0xe681bf00]) = 0
13:01:50 ptrace(PTRACE_PEEKTEXT, 21099, 0xf77d5d90, [0xe681bf00]) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5d90, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0x4c18bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0x603cbf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0x4639bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0x6d7bbf00) = 0
13:01:50 ptrace(PTRACE_CONT, 21099, 0x1, SIG_0) = 0
13:01:50 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_TRAPPED, si_pid=21099, si_uid=1000, si_status=SIGSEGV, si_utime=0, si_stime=0} ---

    Focusing again on the PTRACE_POKEDATA calls:

    13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9ef8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5310, 0x1f0e71c) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5314, 0x4620e7f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5d90, 0xe7f001f0) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77c9a44, 0x4c18bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb5b8, 0x603cbf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77cb220, 0x4639bf00) = 0
13:01:50 ptrace(PTRACE_POKEDATA, 21099, 0xf77d5bb0, 0x6d7bbf00) = 0

    We see writes to the same 7 addresses where breakpoints were set during the first run, but now there’s a different byte sequence and an extra write. This time, gdb is writing a 4-byte sequence – 0xe7f001f0 to 6 addresses. These are breakpoints for code running in ARM mode (see eabi_linux_arm_le_breakpoint in gdb/arm-linux-tdep.c in the gdb source code). The 2 writes to 0xf77d5310 and 0xf77d5314 are a single breakpoint at 0xf77d5312 (there are 2 writes because it is not on a 4-byte boundary).

    Checking the ARMv7 reference manual shows that 0xe7f001f0 is an undefined instruction in ARM mode. However, this byte sequence is decoded as the following valid instructions in Thumb mode:

    lsl r0, r6, #7
b #-16

    So, it takes the contents of r6, does a logical shift left by 7, writes it to r0 and then does an unconditional branch backwards by 16 bytes. This is quite likely going to cause our program (in this case, the dynamic loader) to go off the rails and crash with a less than useful stacktrace, which is the behaviour we’re seeing.

    Why is this happening?

    The next step was to figure out why gdb is inserting the ARM breakpoint instruction sequence instead of the Thumb one. To do this, I needed to understand where the breakpoints are written, and grepping the source code suggests the PTRACE_POKEDATA calls happen in inf_ptrace_peek_poke in gdb/inf-ptrace.c (actually, you won’t find PTRACE_POKEDATA here – it’s PT_WRITE_D which is defined in /usr/include/sys/ptrace.h).

    Running gdb inside gdb with the dynamic loader debug symbols installed and setting a breakpoint on inf_ptrace_peek_poke shows me the call stack. Note that I set a breakpoint by line number, as inf_ptrace_peek_poke is inlined and it was the only way I could get the conditional breakpoint to work:

    $ gdb --args gdb --command=~/test.script
...                                                                                                                                                                
(gdb) break ./gdb/inf-ptrace.c:578 if writebuf != 0x0                                                                                                                                                              
Breakpoint 1 at 0x51218: file ./gdb/inf-ptrace.c, line 578.                                                                                                                                                        
(gdb) run                                                                                                                                                                                                          
Starting program: /usr/bin/gdb --command=\~/test.script                                                                                                                                                            
Cannot parse expression `.L1207 4@r4'.                                                                                                                                                                             
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                                                                                                                                                                                   

[Thread debugging using libthread_db enabled]                                                                                                                                                                      
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".                                                                                                                                      
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git                                                         
Copyright (C) 2018 Free Software Foundation, Inc.                                                        
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>                                                                                                                                      
This is free software: you are free to change and redistribute it.                                                                                                                                                 
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"                                                                                                                                         
and "show warranty" for details.                                                                                                                                                                                   
This GDB was configured as "arm-linux-gnueabihf".                                                        
Type "show configuration" for configuration details.                                                     
For bug reporting instructions, please see:                                                              
<http://www.gnu.org/software/gdb/bugs/>.                                                                 
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".

Breakpoint 1, inf_ptrace_xfer_partial (ops=<optimized out>, object=<optimized out>, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint>     "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/inf-ptrace.c:578
578     ./gdb/inf-ptrace.c: No such file or directory.
(gdb) p/x offset
$1 = 0xf77c9a44
(gdb) bt
#0  inf_ptrace_xfer_partial (ops=<optimized out>, object=<optimized out>, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/inf-ptrace.c:578
#1  0x00457512 in linux_xfer_partial (ops=0x8306e0, object=<optimized out>, annex=0x0, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2, xfered_len=0xfffeee18)
    at ./gdb/linux-nat.c:4280
#2  0x004576da in linux_nat_xfer_partial (ops=0x8306e0, object=TARGET_OBJECT_MEMORY, annex=<optimized out>, readbuf=0x0, writebuf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=2,
    xfered_len=0xfffeee18) at ./gdb/linux-nat.c:3908
#3  0x005f64f4 in raw_memory_xfer_partial (ops=ops@entry=0x8306e0, readbuf=readbuf@entry=0x0, writebuf=writebuf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", memaddr=4152138308, len=len@entry=2,
    xfered_len=xfered_len@entry=0xfffeee18) at ./gdb/target.c:1064
#4  0x005f6a98 in target_xfer_partial (ops=ops@entry=0x8306e0, object=object@entry=TARGET_OBJECT_RAW_MEMORY, annex=annex@entry=0x0, readbuf=readbuf@entry=0x0,
    writebuf=writebuf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308, len=<optimized out>, xfered_len=xfered_len@entry=0xfffeee18) at ./gdb/target.c:1298
#5  0x005f7030 in target_write_partial (xfered_len=0xfffeee18, len=2, offset=<optimized out>, buf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", annex=0x0, object=TARGET_OBJECT_RAW_MEMORY, ops=0x8306e0)
    at ./gdb/target.c:1554
#6  target_write_with_progress (ops=0x8306e0, object=object@entry=TARGET_OBJECT_RAW_MEMORY, annex=annex@entry=0x0, buf=buf@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", offset=4152138308,
    len=len@entry=2, progress=progress@entry=0x0, baton=baton@entry=0x0) at ./gdb/target.c:1821
#7  0x005f70d2 in target_write (len=2, offset=2, buf=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", annex=0x0, object=TARGET_OBJECT_RAW_MEMORY, ops=<optimized out>) at ./gdb/target.c:1847
#8  target_write_raw_memory (memaddr=memaddr@entry=4152138308, myaddr=myaddr@entry=0x6b29fc <arm_linux_thumb_le_breakpoint> "\001\336", len=len@entry=2) at ./gdb/target.c:1473
#9  0x00590c8e in default_memory_insert_breakpoint (gdbarch=<optimized out>, bp_tgt=0x9236f0) at ./gdb/mem-break.c:66
#10 0x004de3aa in bkpt_insert_location (bl=0x923698) at ./gdb/breakpoint.c:12525
#11 0x004e8426 in insert_bp_location (bl=bl@entry=0x923698, tmp_error_stream=tmp_error_stream@entry=0xfffef07c, disabled_breaks=disabled_breaks@entry=0xfffeefec,
    hw_breakpoint_error=hw_breakpoint_error@entry=0xfffeeff0, hw_bp_error_explained_already=hw_bp_error_explained_already@entry=0xfffeeff4) at ./gdb/breakpoint.c:2553
#12 0x004e9556 in insert_breakpoint_locations () at ./gdb/breakpoint.c:2977
#13 update_global_location_list (insert_mode=insert_mode@entry=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12177
#14 0x004ea0a0 in update_global_location_list_nothrow (insert_mode=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12215
#15 0x004ea484 in create_solib_event_breakpoint_1 (insert_mode=UGLL_MAY_INSERT, address=address@entry=4152138308, gdbarch=gdbarch@entry=0x0) at ./gdb/breakpoint.c:7555
#16 create_solib_event_breakpoint (gdbarch=gdbarch@entry=0x928fb0, address=address@entry=4152138308) at ./gdb/breakpoint.c:7562
#17 0x004497bc in svr4_create_probe_breakpoints (objfile=0x933888, probes=0xfffef148, gdbarch=0x928fb0) at ./gdb/solib-svr4.c:2089
#18 svr4_create_solib_event_breakpoints (gdbarch=0x928fb0, address=<optimized out>) at ./gdb/solib-svr4.c:2173
#19 0x00449c5c in enable_break (from_tty=<optimized out>, info=<optimized out>) at ./gdb/solib-svr4.c:2465
#20 svr4_solib_create_inferior_hook (from_tty=<optimized out>) at ./gdb/solib-svr4.c:3057
#21 0x0056bba6 in post_create_inferior (target=0x801084 <current_target>, from_tty=from_tty@entry=0) at ./gdb/infcmd.c:469
#22 0x0056c736 in run_command_1 (args=<optimized out>, from_tty=0, run_how=RUN_NORMAL) at ./gdb/infcmd.c:665
#23 0x00465334 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>) at ./gdb/cli/cli-decode.c:1886
#24 0x006062a6 in execute_command (p=<optimized out>, p@entry=0x880f10 "run", from_tty=0) at ./gdb/top.c:630
#25 0x00548760 in command_handler (command=0x880f10 "run") at ./gdb/event-top.c:583
#26 0x00606a66 in read_command_file (stream=stream@entry=0x874ae0) at ./gdb/top.c:424
#27 0x004684e2 in script_from_file (stream=stream@entry=0x874ae0, file=file@entry=0xfffef7d0 "~/test.script") at ./gdb/cli/cli-script.c:1592
#28 0x004639bc in source_script_from_stream (file_to_open=0xfffef7d0 "~/test.script", file=0xfffef7d0 "~/test.script", stream=0x874ae0) at ./gdb/cli/cli-cmds.c:568
#29 source_script_with_search (file=0xfffef7d0 "~/test.script", from_tty=<optimized out>, search_path=<optimized out>) at ./gdb/cli/cli-cmds.c:604
#30 0x0058821a in catch_command_errors (command=0x463a89 <source_script(char const*, int)>, arg=0xfffef7d0 "~/test.script", from_tty=1) at ./gdb/main.c:379
#31 0x00588ea0 in captured_main_1 (context=<optimized out>) at ./gdb/main.c:1125
#32 captured_main (data=<optimized out>) at ./gdb/main.c:1147
#33 gdb_main (args=<optimized out>) at ./gdb/main.c:1173
#34 0x004343ac in main (argc=<optimized out>, argv=<optimized out>) at ./gdb/gdb.c:32

    Frame 9 (default_memory_insert_breakpoint) looks like it will probably be interesting to us. Taking a look at what it does:

    int
default_memory_insert_breakpoint (struct gdbarch *gdbarch,
                  struct bp_target_info *bp_tgt)
{
  CORE_ADDR addr = bp_tgt->placed_address;
  const unsigned char *bp;
  gdb_byte *readbuf;
  int bplen;
  int val;

  /* Determine appropriate breakpoint contents and size for this address.  */
  bp = gdbarch_sw_breakpoint_from_kind (gdbarch, bp_tgt->kind, &bplen);

  /* Save the memory contents in the shadow_contents buffer and then
     write the breakpoint instruction.  */
  readbuf = (gdb_byte *) alloca (bplen);
  val = target_read_memory (addr, readbuf, bplen);
  if (val == 0)
    {
       ...
      bp_tgt->shadow_len = bplen;
      memcpy (bp_tgt->shadow_contents, readbuf, bplen);

      val = target_write_raw_memory (addr, bp, bplen);
    }

  return val;
}

    The call to gdbarch_sw_breakpoint_from_kind appears to return the bytes written for our breakpoint. gdbarch_sw_breakpoint_from_kind delegates to arm_sw_breakpoint_from_kind in gdb/arm-tdep.c. (The gdbarch_ functions provides a way for architecture independent code in gdb to call functions specific to the architecture associated with the target). Taking a look at what this does:

    static const gdb_byte *
arm_sw_breakpoint_from_kind (struct gdbarch *gdbarch, int kind, int *size)
{
  struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);

  switch (kind)
    {
    case ARM_BP_KIND_ARM:
      *size = tdep->arm_breakpoint_size;
      return tdep->arm_breakpoint;
    case ARM_BP_KIND_THUMB:
      *size = tdep->thumb_breakpoint_size;
      return tdep->thumb_breakpoint;
    case ARM_BP_KIND_THUMB2:
      *size = tdep->thumb2_breakpoint_size;
      return tdep->thumb2_breakpoint;
    default:
      gdb_assert_not_reached ("unexpected arm breakpoint kind");
    }
}

    So, arm_breakpoint_from_kind returns an ARM, Thumb or Thumb2 breakpoint instruction sequence depending on the value of kind. If we switch to frame 9, we should be able to inspect the value of kind:

    (gdb) f 9
#9  0x00590c8e in default_memory_insert_breakpoint (gdbarch=<optimized out>, bp_tgt=0x9236f0) at ./gdb/mem-break.c:66
66      ./gdb/mem-break.c: No such file or directory.
(gdb) p bp_tgt->kind
$2 = 2

    2 is ARM_BP_KIND_THUMB, so this appears to check out. Moving further up the stack, we find that kind is determined in frame 10 (bkpt_insert_location in gdb/breakpoint.c). Let’s have a look at what that does:

    static int
bkpt_insert_location (struct bp_location *bl)
{
  CORE_ADDR addr = bl->target_info.reqstd_address;

  bl->target_info.kind = breakpoint_kind (bl, &addr);
  bl->target_info.placed_address = addr;

  if (bl->loc_type == bp_loc_hardware_breakpoint)
    return target_insert_hw_breakpoint (bl->gdbarch, &bl->target_info);
  else
    return target_insert_breakpoint (bl->gdbarch, &bl->target_info);
}

    This calls breakpoint_kind, which delegates to arm_breakpoint_kind_from_pc in gdb/arm-tdep.c via gdbarch_breakpoint_kind_from_pc. arm_breakpoint_kind_from_pc maps the breakpoint address to an instruction set and returns one of three values – ARM_BP_KIND_ARM, ARM_BP_KIND_THUMB or ARM_BP_KIND_THUMB2. From looking at arm_breakpoint_kind_from_pc, we can see the most interesting part is a call to arm_pc_is_thumb. Let’s have a look at how this works:

    int
arm_pc_is_thumb (struct gdbarch *gdbarch, CORE_ADDR memaddr)
{
  struct bound_minimal_symbol sym;
  char type;
  ...

  /* If bit 0 of the address is set, assume this is a Thumb address.  */
  if (IS_THUMB_ADDR (memaddr))
    return 1;

    So, first of all it checks whether bit 0 of the breakpoint address is set. Looking at the SystemTap probes in .note.stapsdt from our earlier readelf output, we can see that this is not the case for any probe. Following on:

      /* If the user wants to override the symbol table, let him.  */
  if (strcmp (arm_force_mode_string, "arm") == 0)
    return 0;
  if (strcmp (arm_force_mode_string, "thumb") == 0)
    return 1;

  /* ARM v6-M and v7-M are always in Thumb mode.  */
  if (gdbarch_tdep (gdbarch)->is_m)
    return 1;

    We’re not forcing the mode and this isn’t ARM v6-M or v7-M, so, continuing:

      /* If there are mapping symbols, consult them.  */
  type = arm_find_mapping_symbol (memaddr, NULL);
  if (type)
    return type == 't';

    arm_find_mapping_symbol tries to find a mapping symbol associated with the breakpoint address. Mapping symbols are a special type of symbol used to identify transitions between ARM and Thumb instruction sets (see this information). Breaking here in gdb shows that there isn’t a mapping symbol associated with the init_start probe:

    (gdb) break ./gdb/arm-tdep.c:434
Breakpoint 2 at 0x43ec3c: file ./gdb/arm-tdep.c, line 434.
(gdb) run
...

Breakpoint 2, arm_pc_is_thumb (gdbarch=gdbarch@entry=0x928fb0, memaddr=memaddr@entry=4152138308) at ./gdb/arm-tdep.c:434
434     ./gdb/arm-tdep.c: No such file or directory.
(gdb) p/x memaddr
$2 = 0xf77c9a44
(gdb) p type
$3 = 0 '\000'

    So, continuing to the next step:

      /* Thumb functions have a "special" bit set in minimal symbols.  */
  sym = lookup_minimal_symbol_by_pc (memaddr);
  if (sym.minsym)
    return (MSYMBOL_IS_SPECIAL (sym.minsym));

    lookup_minimal_symbol_by_pc tries to map the breakpoint address to a function symbol. MSYMBOL_IS_SPECIAL(sym.minsym) expands to sym.minsym->target_flag_1 and is 1 if bit 0 of the symbol’s target address is set, indicating that the function is called in Thumb mode (see arm_elf_make_msymbol_special in gdb/arm-tdep.c for where this is set). Breaking here in gdb shows that this succeeds:

    (gdb) break ./gdb/arm-tdep.c:439
Breakpoint 3 at 0x43ec54: file ./gdb/arm-tdep.c, line 439.
(gdb) cont
Continuing.

Breakpoint 3, arm_pc_is_thumb (gdbarch=gdbarch@entry=0x928fb0, memaddr=memaddr@entry=4152138308) at ./gdb/arm-tdep.c:439
439     in ./gdb/arm-tdep.c
(gdb) p sym.minsym
$4 = (minimal_symbol *) 0x964278
(gdb) p *sym.minsym
$5 = {mginfo = {name = 0x952ff8 "dl_main", value = {ivalue = 5932, block = 0x172c, bytes = 0x172c <error: Cannot access memory at address 0x172c>, address = 5932, common_block = 0x172c, chain = 0x172c}, 
    language_specific = {obstack = 0x0, demangled_name = 0x0}, language = language_auto, ada_mangled = 0, section = 10}, size = 10516, filename = 0x949a48 "rtld.c", type = mst_file_text, created_by_gdb = 0, 
  target_flag_1 = 1, target_flag_2 = 0, has_size = 1, hash_next = 0x0, demangled_hash_next = 0x0}
(gdb) p sym.minsym->target_flag_1
$6 = 1

    It indicates that the init_start probe is in dl_main, and that it is called in Thumb mode.

    We can use readelf to inspect the symbol table and verify that this is correct:

    $ readelf -s libc6-syms/usr/lib/debug/lib/arm-linux-gnueabihf/ld-2.27.so | grep dl_main
    42: 0000172d 10516 FUNC LOCAL DEFAULT 11 dl_main

    Note that bit 0 of the target address is set.

    If lookup_minimal_symbol_by_pc fails, then we’re basically out of luck and arm_pc_is_thumb will return 0 (indicating that the breakpoint address is in an area that is executing ARM instructions). But this depends on the .symtab ELF section being present, so there is an obvious issue here as this is stripped from the binary in the build (and shipped in a separate debug object).

    I then ran gdb in gdb without the dynamic loader symbols installed and set a breakpoint on default_memory_insert_breakpoint:

    $ gdb --args gdb --batch --command=~/test.script
(gdb) set debug-file-directory /home/ubuntu/libc6-syms/usr/lib/debug/:/usr/lib/debug/                                                                                                                             
(gdb) break default_memory_insert_breakpoint(gdbarch*, bp_target_info*)                                  
Breakpoint 1 at 0x190c34: file ./gdb/mem-break.c, line 39.                                                                                                                                                         
(gdb) run                                                                                                                                                                                                          
Starting program: /usr/bin/gdb --batch --command=\~/test.script                                                                                                                                                    
Cannot parse expression `.L1207 4@r4'.                                                                                                                                                                             
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                                                                         

[Thread debugging using libthread_db enabled]                                                                                                                                                                      
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".                                                                                                                                      

Breakpoint 1, default_memory_insert_breakpoint (gdbarch=0x9288c0, bp_tgt=0x922fe8) at ./gdb/mem-break.c:39
39      ./gdb/mem-break.c: No such file or directory.
(gdb) bt
#0  default_memory_insert_breakpoint (gdbarch=0x9288c0, bp_tgt=0x922fe8) at ./gdb/mem-break.c:39         
#1  0x004de3aa in bkpt_insert_location (bl=0x922f90) at ./gdb/breakpoint.c:12525
#2  0x004e8426 in insert_bp_location (bl=bl@entry=0x922f90, tmp_error_stream=tmp_error_stream@entry=0xfffef07c, disabled_breaks=disabled_breaks@entry=0xfffeefec,
    hw_breakpoint_error=hw_breakpoint_error@entry=0xfffeeff0, hw_bp_error_explained_already=hw_bp_error_explained_already@entry=0xfffeeff4) at ./gdb/breakpoint.c:2553
#3  0x004e9556 in insert_breakpoint_locations () at ./gdb/breakpoint.c:2977
#4  update_global_location_list (insert_mode=insert_mode@entry=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12177
#5  0x004ea0a0 in update_global_location_list_nothrow (insert_mode=UGLL_MAY_INSERT) at ./gdb/breakpoint.c:12215
#6  0x004ea484 in create_solib_event_breakpoint_1 (insert_mode=UGLL_MAY_INSERT, address=address@entry=4152138308, gdbarch=gdbarch@entry=0x0) at ./gdb/breakpoint.c:7555
#7  create_solib_event_breakpoint (gdbarch=gdbarch@entry=0x9288c0, address=address@entry=4152138308) at ./gdb/breakpoint.c:7562
#8  0x004497bc in svr4_create_probe_breakpoints (objfile=0x933238, probes=0xfffef148, gdbarch=0x9288c0) at ./gdb/solib-svr4.c:2089
#9  svr4_create_solib_event_breakpoints (gdbarch=0x9288c0, address=<optimized out>) at ./gdb/solib-svr4.c:2173
#10 0x00449c5c in enable_break (from_tty=<optimized out>, info=<optimized out>) at ./gdb/solib-svr4.c:2465
#11 svr4_solib_create_inferior_hook (from_tty=<optimized out>) at ./gdb/solib-svr4.c:3057
#12 0x0056bba6 in post_create_inferior (target=0x801084 <current_target>, from_tty=from_tty@entry=0) at ./gdb/infcmd.c:469
#13 0x0056c736 in run_command_1 (args=<optimized out>, from_tty=0, run_how=RUN_NORMAL) at ./gdb/infcmd.c:665
#14 0x00465334 in cmd_func (cmd=<optimized out>, args=<optimized out>, from_tty=<optimized out>) at ./gdb/cli/cli-decode.c:1886
#15 0x006062a6 in execute_command (p=<optimized out>, p@entry=0x874758 "run", from_tty=0) at ./gdb/top.c:630
#16 0x00548760 in command_handler (command=0x874758 "run") at ./gdb/event-top.c:583
#17 0x00606a66 in read_command_file (stream=stream@entry=0x875da8) at ./gdb/top.c:424
#18 0x004684e2 in script_from_file (stream=stream@entry=0x875da8, file=file@entry=0xfffef7d0 "~/test.script") at ./gdb/cli/cli-script.c:1592
#19 0x004639bc in source_script_from_stream (file_to_open=0xfffef7d0 "~/test.script", file=0xfffef7d0 "~/test.script", stream=0x875da8) at ./gdb/cli/cli-cmds.c:568
#20 source_script_with_search (file=0xfffef7d0 "~/test.script", from_tty=<optimized out>, search_path=<optimized out>) at ./gdb/cli/cli-cmds.c:604
#21 0x0058821a in catch_command_errors (command=0x463a89 <source_script(char const*, int)>, arg=0xfffef7d0 "~/test.script", from_tty=0) at ./gdb/main.c:379
#22 0x00588ea0 in captured_main_1 (context=<optimized out>) at ./gdb/main.c:1125
#23 captured_main (data=<optimized out>) at ./gdb/main.c:1147
#24 gdb_main (args=<optimized out>) at ./gdb/main.c:1173
#25 0x004343ac in main (argc=<optimized out>, argv=<optimized out>) at ./gdb/gdb.c:32
(gdb) p/x bp_tgt->placed_address
$1 = 0xf77c9a44
(gdb) p bp_tgt->kind
$2 = 4

    Sure enough, default_memory_insert_breakpoint is called this time with kind == 4 (ARM_BP_KIND_ARM) which seems to be incorrect. Setting a breakpoint in arm_pc_is_thumb again, we can verify that the reason for this is that the call to lookup_minimal_symbol_by_pc fails:

    (gdb) break ./gdb/arm-tdep.c:439                                                                                                                                                                                   
Breakpoint 1 at 0x3ec54: file ./gdb/arm-tdep.c, line 439.                                                                                                                                                          
(gdb) run
Starting program: /usr/bin/gdb --command=\~/test.script                                                  
Cannot parse expression `.L1207 4@r4'.                                                                   
warning: Probes-based dynamic linker interface failed.                                                   
Reverting to original interface.                    

[Thread debugging using libthread_db enabled]       
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".

Breakpoint 1, arm_pc_is_thumb (gdbarch=0x928fb0, memaddr=4152138308) at ./gdb/arm-tdep.c:439
439     ./gdb/arm-tdep.c: No such file or directory.
(gdb) p/x memaddr
$1 = 0xf77c9a44
(gdb) p sym.minsym
$2 = (minimal_symbol *) 0x0

    This results in arm_pc_is_thumb returning 0 and arm_breakpoint_kind_from_pc returning ARM_BP_KIND_ARM, which results in arm_sw_breakpoint_from_kind returning the wrong breakpoint instruction sequence.

    TL;DR

    GDB causes a crash in the dynamic loader (ld.so) on armv7 if ld.so has been stripped of its symbol table, because it is unable to correctly determine the appropriate instruction set when inserting probe event breakpoints.

    If you’ve got to the end of this (congratulations), then you’re probably going to be disappointed to hear that I’m not sure what the proper fix is – this isn’t really my area of expertise. For the rustc package, I just added a Build-Depends: libc6-dbg [armhf] as a workaround for now, and that might even be the correct fix. But, it’s certainly nicer to understand why it didn’t work in the first place.

    ]]>     Chris Coulson     Spaces – uncomplicating your network https://ivoks.com/ubuntu/spaces-uncomplicating-your-network/ https://ivoks.com/ubuntu/spaces-uncomplicating-your-network/ Thu, 12 Apr 2018 04:44:16 GMT An old OpenStack network architecture
    An old OpenStack network architecture

    For past 5-6 years I’ve been in business of deploying cloud solutions for our customers. Vast majority of that was some form of OpenStack, either a simple cloud or a complicated one. But when you think about it – what is a simple cloud? It’s easy to say that small amount of machines makes an easy, and large amount of machines makes a complicated cloud. But, that is not true. Complexity of a typical IaaS solution is pretty much determined by network complexity. Network, in all shapes and forms, from the underlay network to the customer’s overlay network requirements. I’ll try to explain how we deal with the underlay part in this blog.

    It’s not a secret that a traditional tree like network architecture just doesn’t work for cloud environments. There are multiple reasons why; it doesn’t scale very well, it requires big OSI layer 2 domains and… well, it’s based on OSI layer 2. Debugging issues on that level is never a joyful experience. Therefore, for IaaS environments one really wants to do a modern design in a form of a spine-leaf architecture. Layer 3 spine-leaf architecture. This allows us to have bunch of smaller layer 2 domains, which then nicely correlate to availability zones, power zones, etc. However, managing environments with multiple layer 2 and therefore even more layer 3 domains requires a bit of rethinking. If we truly want to be effective in deploying and operating a cloud across multiple different layer 2 domains we need to think of the network in a bit more abstract mode. Luckily, this is nothing new.

    In traditional approach to network, we talk about TORs, management fabric, BMC/OOB fabric, etc. These are most of the time layer 2 concepts. Fabric, after all, is a collection of switches. But the approach is correct; we should always talk about networks in abstract terms. Instead of talking about subnets and VLANs, we should talk about purpose of the network. This becomes important when we talk about spine-leaf architecture and multiple different subnets that serve the same purpose. In rack 1, subnet 172.16.1.0/24 is management network, but in rack 2, management network is on subnet 192.168.1.0/24, and so on. It’s obvious that it’s much nicer to abstract those subnets into a ‘management network’. Still, nothing new. We do this every day.

    So… Why do our tools and applications still require us to use VLANs, subnets and IPs? If we deploy same application across different racks, why do we have to keep separate configurations for each of the units of the same application? What we really want is to have all of our Keystones listening on OpenStack Public API network, and not on subnets 192.168.10.0/24, 192.168.20.0/24 and 192.168.30.0/24. We end up thinking about application on a network, but we configure differently exact copies of the same application (units) on different subnets. Clearly our configuration tools are not doing what we want, but rather forcing us to transform our way of thinking into what those tools need. It’s a paradox that OpenStack is not that complicated, rather it’s made complicated by the tools used to deploy it.

    While trying to solve this problem in our deployments at Canonical, we came up with concept of spaces. A space would be this abstracted network that we have in our heads, but somehow fail to put into our tools. Again, spaces are not a revolutionary concept in networking, they have been in our heads all this time. So, how do we implement spaces at Canonical?

    We have grown concept of spaces across all of our tooling; MAAS, juju and charms. When we configure MAAS to manage our bare metal machines, we do not define networks as subnets or VLANs, we rather define networks as spaces. A space has a purpose, description and few other attributes. VLANs, and indirectly subnets too, become properties of the space, instead of other way around. This also means that when we deploy a machine, we deploy it connected to a space. When we deploy a machine, we usually do not deploy it on a specific network, but rather with specific requirements; must be able to talk to X, must have Y CPU and Z RAM. If you ever asked yourself why does it take so much time to rack and stack a server, it’s because of this disconnect of what we want and how we handle the configuration.

    We’ve also enabled Juju to make this kind of requests – it asks MAAS for machines that is connected to a space, or set of spaces. It then exposes this spaces to charms, so that each charm knows what kind of networks this application has on its disposal. This allows us to do ‘juju deploy keystone –bind public=public-space -n3’; deploy three keystones, connect them to a public-space, a space defined in MAAS. What VLAN will that be, which subnet or an IP, we do not care; the charm will get information from Juju about these “low level” terms (VLANs, IPs). We humans do not think of VLANs and subnets and IPs; at best we think in OSI layer 1 terms.

    Sounds a bit complicated? Let’s flip it the other way around. What I can do now is define my application as “3 units of keystone, which use internal network for SQL, public network for exposing API, internal network for OpenStack’s internal communication and is also exposed on OAM network for management purposes” and this is precisely how we deploy OpenStack. In fact, the Juju bundle looks like this:

    keystone:
      charm: cs:keystone
      num_units: 3
      bindings:
        "": oam-space
        public: public-space
        internal: internal-space
        shared-db: internal-space

    Those who follow OpenStack development will notice that something similar has landed in OpenStack recently; routed provider networks. It’s the same concept, solving the same problem. It’s nice to see how Juju uses this out of the box.

    Big thanks to MAAS, Juju, charms and OpenStack communities for doing this. It allowed us to deploy complex applications with a breeze, and therefore shifted our focus to bigger picture, IaaS modeling and some other, new challenges!

    ]]>     Ante Karamatić     No Title Available https://carla-sella.blogspot.com/2018/02/blog-post.html https://carla-sella.blogspot.com/2018/02/blog-post.html Sat, 03 Feb 2018 13:50:00 GMT
    ]]>     Carla Sella     Preparing for Xubuntu 18.04 https://open.knome.fi/2017/10/24/preparing-xubuntu-18-04/ https://open.knome.fi/2017/10/24/preparing-xubuntu-18-04/ Tue, 24 Oct 2017 06:55:22 GMT Xubuntu 17.10 was just released, but planning for Xubuntu 18.04 – the next long-term support (LTS) release – began quite some time ago. For our users, LTS releases mostly mean a system that is going to be more stable and supported for longer. For us contributors, this means a bunch of things.

    As a repercussion of the longer support cycle and the sought out stable nature of the LTS releases, we do not want to introduce (too many) new components, libraries or other technical changes, as each change has regression potential. This is also a delicate balancing act between getting bugs fixed but keeping enough things as they are.

    The LTS releases are also kind of an flagship for Xubuntu – they are the recommended releases for most users and while we can land stable release updates (SRU) to fix bugs and other major flaws, the scope of changes is limited. Since the next LTS release will be released two years later, we want to get things right.

    For contributors – particularly us non-developer kinds – this is an ideal situation to revisit and improve artwork and documentation amongst other things. Here are some things I am going to be working on for the next months to get the new LTS look and feel more polished than the previous one.

    Branding – or, updated logo

    In an earlier article I wrote about the refreshed Xubuntu logo – the why and the what. Here’s the other what.

    Practically this change means we will have to touch every package with Xubuntu branding and make sure they use the updated logo. For the most part this is trivial, but landing the changes requires time and some co-operation from the team.

    We will also need to make sure the new logo lands on the official website, all related sites and social media before the release – ideally before the first milestone release. Last but not least, we need to communicate this change to our official vendors and provide them the new logo as soon as possible so they can start updating their products.

    Wallpapers

    As with any release, the LTS release also needs a wallpaper. This needs to be drafted, proposed and polished. The process usually takes from a few days to a few weeks. We’ll also want to land the wallpaper relatively early to be able to fix potential issues with it before release.

    The Xubuntu team has organized a community wallpaper contest for the last two LTS releases and it’s very likely we will be organizing one for 18.04 as well. I was not completely satisfied in how we ran the contest last time, and I’ve started a discussion to review our policies already, as getting comments from the team can sometimes be quite slow. While the community wallpaper package does not serve any defaults, we will need to end the contest well before the related freezes to double check license issues (like attribution) and leave enough time for uploading them.

    Documentation

    Even if there is no need to rewrite sections – or the whole documentation – this time around, there are several tasks for the documentation team as well.

    First of all, it’s time to refresh both the installer slideshow and the website feature tour. Nothing has been planned yet, but both of these are at least two years old and in need of a facelift – both visually and in terms of content.

    We haven’t had to touch the documentation much in a long time because the main software selection and features have stayed the same. On the other hand this means that the documentation might be somewhat stale. This might be hard to identify – and possibly even harder to get stale sections refreshed – but we definitely should have a look at our offering before the release. To do this, we need to consider the following questions:

    • Does the documentation provide a good overview of the system for new users?
    • Does the documentation help users get started?
    • Does the documentation answer the most common questions?
    • Does the documentation help get the most common (non-hardware specific) issues solved?
    • Does the documentation help more advanced users – including those that are familiar with other Linux operating systems but not Xubuntu?
    • Is all information in the documentation up-to-date?
    • Does the documentation need extending in any area?
    • Can we extend the documentation in a useful way without making it too verbose?

    But wait! There’s more!

    My work item list for Xubuntu 18.04 doesn’t end here. You can find all of the registered work items on our status tracker.

    It’s worth noting that not all of the work items in the status tracker have an assignee. This means we are still looking for people who can help us make Xubuntu 18.04 a greater release than its predecessors. Maybe you can volunteer and pick up a work item or two?

    In addition to the work items, there are a few other activities that we need help with:

    • Test. By testing the daily and milestone ISOs you can help us make sure there aren’t (so many) annoying bugs in the final release.
    • Take part in the community wallpaper contest. This is not open yet, but once it is, submit your work. You can win and get some swag as well as your work included in an official Xubuntu release!
    • Submit us ideas for improving and extending our documentation. I mentioned some of the questions we have to ask ourselves with the documentation. Can you help us answer these and even work with us on the writing and proofreading?

    Even these tasks just scratch the surface of what needs to be done – and what can be done.

    Get your hands dirty now and read more about getting involved with Xubuntu, subscribe to the Xubuntu development discussion mailing list and join our development IRC channel #xubuntu-devel which is active on most days.

    This article is part of the article series .

    ]]>     Pasi Lallinaho     freenode #live http://nhandler.com/blog/2017/08/26/freenode-live.html http://nhandler.com/blog/2017/08/26/freenode-live.html Sat, 26 Aug 2017 00:00:00 GMT For those of you who might not be aware, freenode is an IRC network that caters to free and open source projects. We have had a goal for a number of years to hold freenode #live, an in-person conference where our staff, projects, FOSS supporters, and IRC enthusiasts could all get together in one place. Thanks to some very generous sponsorship, primarily by Private Internet Access, this conference is finally happening! The first ever freenode #live conference will take place October 28 - 29, 2017 in Bristol, United Kingdom.

    This conference will only be a success with support from the community. Luckily, there are many ways to help out.

    1. Register to attend. We are working on putting together a great lineup of speakers that you will not want to miss. Registering allows us to finalize many logistical details surrounding the event to make sure everything runs smoothly.
    2. Do you represent a FOSS group? We would love to have your group present at the event. There will be an exhibitor hall where you can advertise your organization and attract new users and contributors.
    3. Submit a talk. Our call for proposals is still open. New and experienced speakers are welcome. Feel free to contact 2017-team@freenode.live and we would be happy to work with you to come up with a talk idea or provide feedback.
    4. If you or your company are interested in helping to sponsor this event, please reach out to exhibit@freenode.live. We have opportunities for budgets of all sizes.

    I look forward to hopefully seeing you at freenode #live!

    ]]>     Nathan Handler     More on the imported repositories http://www.justgohome.co.uk/blog/2017/08/more-on-the-imported-repositories.html http://www.justgohome.co.uk/blog/2017/08/more-on-the-imported-repositories.html Mon, 21 Aug 2017 16:53:44 GMT git ubuntu illustration

    This is the third post in our series on our git workflow tooling in Ubuntu. There is an index of all our planned posts in the first post. As mentioned there, it is important to keep in mind that the tooling and implementation are still highly experimental.

    Nish introduced our imported repositories using the git ubuntu clone wrapper, as well as using git directly.

    I'd like to go into a little more detail about what we're actually importing.

    Automatic imports watch for new source publications in Launchpad. When they occur, the importer will push new commits and tags to match those publications and move up branch pointers automatically. All branches maintained by the importer are fast-forwarding. A temporary exception to this is during our experimental stage, before we release a 1.0. Until then, we may re-import packages as we work on the importer.

    Our importer maintains one repository per source package in lp:~usd-import-team for now. Eventually we expect to make these available under an alias of the form lp:ubuntu/+source/<package>.

    The imported trees correctly reflect the ancestry of individual source packages. This includes both Debian and Ubuntu history, with Ubuntu history correctly parented from the appropriate points in Debian's history.

    There is a branch corresponding to each Debian and Ubuntu series (eg. sid, stretch, xenial, artful), and in the case of Ubuntu, pocket (eg. trusty-updates, xenial-security, artful-proposed). We’ll cover details on how exactly these work, and the logic behind their design, in future posts.

    Single source of truth

    A goal of the importer is to reflect the single source of truth, which we define as Launchpad's source publication history. Therefore, the only source of the imported tags and branches must come via the importer and not directly from uploaders. Only the importer can push to the imported repositories. We do have a mechanism to preserve "rich history" provided by git committers that in any other project they'd be able to push directly; more on this in a future post.

    Note that this methodology means that upstream's commit graphs are typically not made available by the importer. You won't find individual upstream commits by looking in our imported respository against a particular package. We may decide to make this possible in the future by relying on the "rich history" import mechanism combined with the use of our parenting invariant. More on this in a future post.

    We're trying hard to make sure that there is no case where a source package upload can cause the importer to fail. We're treating any failure to import a source package as a bug in our importer. The importer should be able to import anything that was ever uploaded to Debian or Ubuntu.

    Available branches

    As Nish mentioned, there are two main types of branches:

    1. Devel branches: the branches on which to start development.
    2. Pocket branches: understanding the current state of the archive.

    There are also "applied" versions of these branches, which provide quilt patches already applied.

    The "devel" branches

    Ubuntu developers are used to using pull-lp-source to grab the latest version of a package source on which to base development. We want to make git clone work instead.

    What is the correct version on which to base development? In Ubuntu, this can vary depending on the exact publication state. Usually you want the highest version published in the development release, or the highest version published in a particular series for an SRU. For this purpose, the git importer maintains devel branches. For the development release, this is just called ubuntu/devel. For a stable release, it is ubuntu/<codename>-devel; for example: ubuntu/xenial-devel.

    This is intended to save developers the effort of figuring out which pocket to use (between the release pocket, proposed, updates and security) and saves scripts from having to figure it out themselves.

    One exception to this is in the rare case that a version in the proposed pocket has been discarded, such as a failed SRU. The importer only follows new version publications and does not follow deletions. In this case you may wish to start directly from a pocket branch (described below). Alternatively, before you begin you could start from the devel branch and use git revert to add a commit reversing the published change in line with the deletion. The infrastructure doesn’t care which method you choose.

    Pocket branches

    A different use case is to look at the git branches to understand what the archive looks like today, or how it looked in the past.

    Ubuntu’s pockets

    First let’s review what Ubuntu pockets actually are.

    In Ubuntu, the archive for a particular release (“series”) is divided up into a number of “pockets”, which correspond to the entries in your sources.list file:

    1. The release pocket. This pocket has no specific name. During development, the release pocket is where package eventually land. Upon release, this pocket is frozen and never changes again.

    2. The “proposed” pocket. This pocket is used for two different purposes depending on whether the series is in development or has been released. During development, this is the staging area in which packages are built, tested and checked for installability before they land. When all tests pass, packages are moved into the release pocket in a process called proposed migration. After release, the proposed pocket is used for a different purpose: manual user verification of proposed stable release updates through the SRU verification process. When a package passes SRU verification, the package is moved into the updates pocket, rather than the release pocket is as the case during development.

    3. The “updates” pocket. Only used for stable releases, this pocket is used to issue recommended updates to users during the lifetime of a stable release.

    4. The “security” pocket. Only used for stable releases, this pocket is used to issue security updates to users during the lifetime of a stable release. Updates to the security pocket are always also copied into the updates pocket.

    The name of a pocket is in the form <series>-<type>, such as xenial-security and artful-updates. As an exception, the release pocket is the series with no suffix, such as trusty.

    Importing pockets into git

    The importer maintains a branch for each pocket, in the form ubuntu/<pocket name>, such as ubuntu/trusty (the Trusty release pocket), ubuntu/xenial-security, ubuntu/artful-proposed and so on.

    Combining pocket branches: the devel branches

    To support the archeology use case, the importer must maintain these pocket branches. However, for the ongoing development use case, it's far more convenient for developers to use our "devel branches".

    We do this by making use of our "parenting invariant", which we’ll describe in more detail in a future post. For now, it’s sufficient to understand that the devel branches are the points at which you should start development, and the pocket branches can be used to examine the current state of the various pockets in the Ubuntu archive.

    Applied branches

    For our drive-by contributor use case, it would be nice if these drive-by contributors didn't have to understand quilt. It's reasonable to expect that, straight after running git clone from Ubuntu and selecting an appropriate branch, the tree that appears is exactly the source used to build the corresponding Ubuntu package. For drive-by contributors unfamiliar with Debian packaging, this means that quilt patches should appear applied. Our "applied" branches and tags provide this function.

    The non-applied branches are the normative imports from Debian and Ubuntu developer uploads. They are intended to represent the source package exactly and without any derived components. This means that quilt patches appear in debian/patches/ as normal, but are not applied.

    From one of these import commits, all quilt patches (if any) are applied one by one. Each application results in a separate git commit. A final commit with an identical tree is added for branch fast-forwarding purposes, and these commits form the line of the "applied" branch.

    Consequently, you can switch to an "applied" branch, or corresponding tag, and you'll see the state of the Ubuntu source package with all patches applied and as if quilt doesn't exist. Drive-by contributors can then file pull requests against such a branch (eg. applied/ubuntu/devel) and bots and sponsors will be able to understand exactly what is being requested.

    It will often be necessary to pull out requested changes into a separate quilt patch, add dep3 headers, and possibly squash the requested change into an existing quilt patch, before uploading. We hope to automate some of this in the future, but for now this is left as a task for sponsors who accept git workflow upload requests. Contributors can either submit pull requests against the applied branches this way, or fold up into quilt patches themselves and submit pull requests against the non-applied branches instead.

    In the future, it may be desirable for all Ubuntu developers to forget quilt and live entirely inside git-based patchsets. For the time being, we want to support both traditional and git-based workflows. So both applied and non-applied branches are maintained by the importer.

    It is a matter of debate as to whether the non-applied or applied branches should appear by default. We are open to further discussion on this.

    Available tags

    The first time the importer imports a new version of a source package, it tags it using an "import tag", which is of the form import/<version>. The patches-applied equivalent is derived, and the result is tagged in the form applied/<version>.

    Pocket copies, such as from Debian into Ubuntu via autosync, are not tagged; the pocket branches are moved forward with new commits (with identical trees) as necessary.

    Since not all valid package version strings are valid git tag names, the tag names are escaped using the same rules as specified in dep14, Debian's recommendation on git repository layouts.

    We use tags of the form upload/<version> to supply rich history for adoption into the imported commit graph. This cannot be pushed directly; more on this in a future post.

    To support the preservation of orig tarballs using pristine tar, the importer also tags upstream/<version>.

    pristine-tar and the dsc branches

    So that the git repositories contain all the information needed to reconstruct an imported source package, the importer also stores the orig tarballs using pristine-tar and the signed dsc file in separate branches. Orig tarballs are automatically extracted on package build as needed by the git ubuntu build wrapper. This means that git ubuntu clone followed by git ubuntu build should Just Work.

    Orig tarballs between Debian and Ubuntu may vary in exceptional cases, so the importer keeps these properly namespaced in debian/pristine-tar and ubuntu/pristine-tar branches to avoid collisions, and likewise for the dsc files debian/dsc and ubuntu/dsc. pristine-tar doesn't currently support multiple branches; it assumes a single branch of pristine-tar. Our git ubuntu build wrapper works around this for now. In the future I'd like for us to drive getting parameterised branch name support into pristine-tar upstream to support our use case.

    Conclusion

    In order to provide a full understanding of what we're doing to those developers interested in all the detail, I've tried to cover all the git reference objects presented by our importer in this post today.

    In our next post, Nish will continue discussing the git ubuntu tooling by introducing git ubuntu tag.

    ]]>     Robie Basak     1er Festival Universitario de Tecnologías Libres https://cesarsevilla.wordpress.com/2016/10/28/1er-festival-universitario-de-tecnologias-libres/ https://cesarsevilla.wordpress.com/2016/10/28/1er-festival-universitario-de-tecnologias-libres/ Fri, 28 Oct 2016 22:09:25 GMT banner2-1024x512A petición del público traemos para todos ustedes a través de la Unidad Territorial – Fundacite Zulia (UTZ) el “Festival Universitario de Tecnologías Libres”, el mismo tiene como objetivo: Impulsar el crecimiento y desarrollo del Software Libre y Código Abierto dentro del ámbito Educativo Institucional en la Región Occidental, para lograr la independencia Científica–Tecnológica del software, apoyándose en los Decretos Nacionales y leyes que ampara el estado venezolano.

    Este Festival, se llevará a cabo en el Auditorio de la Universidad José Gregorio Hernández los días viernes 11/11/16 de 8:00 am / 12:00 m – 2:00 pm / 5:00pm y el sábado 12/11/16 de 9:00 am / 12:00 m.

    El día Viernes realizaremos 5 Charlas técnicas y para el día Sábado realizaremos 2 charlas y una Jornada de Instalación de Sistemas Operativos Libres y/o Herramientas Libres.

    Es importante resaltar que contaremos con varios representantes a nivel nacional, entre ellos Representante de la Cámara Venezolana de la industria Tecnológica, del Laboratorio Vivencial, de la Comunidad de Ubuntu-ve, y de diferentes organizaciones con el propósito de presentar los diferentes proyectos tecnológicos hechos con herramientas libres.

    Si deseas participar en dicha actividad recuerda que debes registrarte a través del siguiente enlace: https://www.eventbrite.es/e/entradas-festival-universitario-de-tecnologias-libres-2016-27283438499

    Si deseas obtener mayor información, puedes contactarme a través del correo csevilla@fundacite-zulia.gob.ve

    ]]>     Cesar Sevilla     A week ago … https://blogs.fsfe.org/myriam/2016/06/08/a-week-ago/ https://blogs.fsfe.org/myriam/2016/06/08/a-week-ago/ Wed, 08 Jun 2016 20:44:39 GMT my cat Filoue turned 15. She survives her nephew Stupsi, who sadly left us earlier this year.

    This reminds me how long I contribute to KDE already 🙂 She has been sitting next to the keyboard purring on almost everything I did in the last 15 years.

    ]]>     Myriam Schweingruber     Ask Ubuntu moderator election is now underway! https://unbrokenspectrum.wordpress.com/2016/06/07/ask-ubuntu-moderator-election-is-now-underway/ https://unbrokenspectrum.wordpress.com/2016/06/07/ask-ubuntu-moderator-election-is-now-underway/ Tue, 07 Jun 2016 16:19:04 GMT We are in the midst of our 5th moderator election to add more firepower to our existing mod crew.

    In the 6 years that Ask Ubuntu has been around, nearly 230,000 questions and 300,000 answers have been posted on the site, with the daily traffic clocking a whopping 487k visits as of now.

    These numbers will only go up from here and to support this growing community, we are expanding our moderator team to accommodate two more. As is the policy with Stack Exchange network of sites, the new moderators will be added to the existing team and not replace them.

    If you have a minimum of 300 reputation on Ask Ubuntu and think you can do a good job, consider nominating yourself for the role. The nomination phase itself runs for 7 days, followed by a week of primaries and then the actual election. People with 150 reputation are eligible for voting and I encourage them to vote for candidates that they think are most suitable for the role.

    If you have any questions about the election process, you can ask them on meta. Discussions about the election can be had in the chat room too.

    If mod work is not your cup of tea but you’re still looking for a way to help, you can always help us answer the incoming new questions. Featured questions would be a good place to start.

    UPDATE:

    Ask Ubuntu moderator election 2016 is now over and the following community members have been elected as moderators:

    ]]>     Barneedhar     Easy Rake-based Deployment for Git-hosted Rails Apps http://ben-collins.blogspot.com/2016/03/easy-rake-based-deployment-for-git.html http://ben-collins.blogspot.com/2016/03/easy-rake-based-deployment-for-git.html Fri, 25 Mar 2016 17:54:00 GMT OpenStrokes, a website I've been working on. Some things were just too complex (capistrano) and some were way too simple (StackOverflow answers that didn't do everything, or didn't check for errors).

    So, as most people do, I wrote my own. Hopefully this short rake task can help you as well. This assumes that your application server has your app checked out as a clone of some git repo you push changes to and that you are running under passenger. When I want to deploy, I log in to my production server, cd to my app repo, and then run:

    rake myapp:deploy

    For just strictly view updates, it completes in 3 seconds or less. There are several things it does, in addition to checking for errors:

    • Checks to make sure the app's git checkout isn't dirty from any local edits.
    • Fetches the remote branch and checks if there are any new commits, exits if not.
    • Tags the current production code base before pulling the changes.
    • Does a git pull with fast-forward only (to avoid unexpected merging).
    • Checks if there are any new gems to install via bundle (checks for changes in Gemfile and Gemfile.lock).
    • Checks if there are any database migrations that need to be done (checks for changes to db/schema.db db/migrations/*).
    • Checks for possible changes to assets and precompiles if needed (checks Gemfile.lock and app/assets/*).
    • Restarts passenger to pick up the changes.
    • Does a HEAD request on / to make sure it gets an expected 200 showing the server is running without errors.

    The script can also take a few arguments:

    • :branch Git branch, defaults to master
    • :remote Git remote, defaults to origin
    • :server_url URL for HEAD request to check server after completion

    Note, if the task encounters an error, you have to manually complete the deploy. You should not rerun the task.

    Any finally, here is the task itself. You can save this to lib/tasks/myapp.rb

    # We can't use Rake::Task because it can fail when things are mid
# upgrade

require "net/http"

def do_at_exit(start_time)
  puts "Time: #{(Time.now - start_time).round(3)} secs"
end

def start_timer
  start_time = Time.now
  at_exit { do_at_exit(start_time) }
end

namespace :myapp do
  desc 'Deployment automation'
  task :deploy, [:branch, :remote, :server_url] do |t, args|
    start_timer

    # Arg supercedes env, which supercedes default
    branch = args[:branch] || ENV['DEPLOY_BRANCH'] || 'master'
    remote = args[:remote] || ENV['DEPLOY_REMOTE'] || 'origin'
    server_url = args[:server_url] || ENV['DEPLOY_SERVER_URL'] || 'http://localhost/'

    puts "II: Starting deployment..."

    # Check for dirty repo
    unless system("git diff --quiet")
      puts "WW: Refusing to deploy on a dirty repo, exiting."
      exit 1
    end

    # Update from remote so we can check for what to do
    system("git fetch -n #{remote}")

    # See if there's anything new at all
    if system("git diff --quiet HEAD..#{remote}/#{branch} --")
      puts "II: Nothing new, exiting"
      exit
    end

    # Tag this revision...
    tag = "prev-#{DateTime.now.strftime("%Y%m%dT%H%M%S")}"
    system("git tag -f #{tag}")

    # Pull in the changes
    if ! system("git pull --ff-only #{remote} #{branch}")
      puts "EE: Failed to fast-forward to #{branch}"
      exit 1
    end

    # Base command to check for differences
    cmd = "git diff --quiet #{tag}..HEAD"

    if system("#{cmd} Gemfile Gemfile.lock")
      puts "II: No updates to bundled gems"
    else
      puts "II: Running bundler..."
      Bundler.with_clean_env do
        if ! system("bundle install")
          puts "EE: Error running bundle install"
          exit 1
        end
      end
    end

    if system("#{cmd} db/schema.rb db/migrate/")
      puts "II: No db changes"
    else
      puts "II: Running db migrations..."
      # We run this as a sub process to avoid errors
      if ! system("rake db:migrate")
        puts "EE: Error running db migrations"
        exit 1
      end
    end

    if system("#{cmd} Gemfile.lock app/assets/")
      puts "II: No changes to assets"
    else
      puts "II: Running asset updates..."
      if ! system("rake assets:precompile")
        puts "EE: Error precompiling assets"
        exit 1
      end
      system("rake assets:clean")
    end

    puts "II: Restarting Passenger..."
    FileUtils.touch("tmp/restart.txt")

    puts "II: Checking HTTP response code..."

    uri = URI.parse(server_url)
    res = nil

    Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https') do |http|
      req = Net::HTTP::Head.new(uri, {'User-Agent' => 'deploy/net-check'})
      res = http.request req
    end

    if res.code != "200"
      puts "EE: Server returned #{res.code}!!!"
      exit 1
    else
      puts "II: Everything appears to be ok"
    end
  end
end

    Here's an example of the command output:

    $ rake myapp:deploy
II: Starting deployment...
remote: Counting objects: 15, done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 8 (delta 6), reused 0 (delta 0)
Unpacking objects: 100% (8/8), done.
From /home/user/myapp
   efee45c..e5468c1  master     -> origin/master
From /home/user/myapp
 * branch            master     -> FETCH_HEAD
Updating efee45c..e5468c1
Fast-forward
 app/views/users/_display.html.erb     | 7 +++++--
 public/svg/badges/caretakers-club.svg | 1 -
 2 files changed, 5 insertions(+), 3 deletions(-)
 delete mode 100644 public/svg/badges/caretakers-club.svg
II: No updates to bundled gems
II: No db changes
II: No changes to assets
II: Restarting Passenger...
II: Checking HTTP response code...
II: Everything appears to be ok
Time: 3.031 secs
    ]]>     Ben Collins     Speaking at San Diego Linux users group https://philipballew.wordpress.com/2016/03/21/speaking-at-san-diego-linux-users-group/ https://philipballew.wordpress.com/2016/03/21/speaking-at-san-diego-linux-users-group/ Mon, 21 Mar 2016 23:31:49 GMT Earlier this month, I had the honor and privilege of speaking at the San Diego Linux users group. I spoke about ways to customize your Ubuntu desktop, the talk finished a little earlier than the group meeting was planned to go to, so I used that time to talk about some of the server stuff with Ubuntu, as well as the switch to systemd. This seemed to take up the rest of the time. Overall, I was able to have a great experience and felt that I benefited Ubuntu tremendously.Thanks again for the invite everybody!

    Nice picture of the group that I spoke to

    Nice picture of the group that I spoke to

    ]]>     Philip Ballew     Test Android Auto – New Opel Astra [ENG] https://www.mirkopizii.com/ubuntu-com-planet/test-android-auto-new-opel-astra-eng/ https://www.mirkopizii.com/ubuntu-com-planet/test-android-auto-new-opel-astra-eng/ Sat, 30 Jan 2016 23:00:00 GMT Well yes, not only reviews and tests only for products like computer but today we are also on car industry testing the new Opel Astra Elective which supports Android Auto.

    First of all, before I start, I want to thanks my friend Davide, who works in Opel workshop, for all of his patience and availability gave to me. Really thanks because he lets me to write this review.
    Of course, I tested this all with him smartphone (OnePlus Two) and mine (Nexus 5). Screenshots made by him 🙂

    Details about new Opel Astra Elective

    Unfortunately in this first “episode” I will focus on use of Android Auto but, if you want to see more (explained) car’s details, you can go to Opel website: http://www.opel.com/

    What is Android Auto?

    I don’t know how to say.. Android Auto is all and nothing…

    What I want to say, informally, is that Android Auto is what we see on our car’s display..
    It seems a common operative system where, by default, there are different separate applications installed where you may have to update them for fixing bugs and you may need to go to your trusted mechanical.

    No, you have not to do all these things I wrote. It’s only a sort of “Screen Mirroring” or better, you see in your car’s display, what you should see on your smartphone’s screen. You may ask “what about apps?”.
    No problem with apps, they are directly to your smartphone! It sounds strange, no?

    So ok, you might not understand what I’m saying and of course, what you can do with Android Auto.
    To give an example, you can think about using modern technology system (including functionalities of your smarphone) into every car that have Android Auto receiver.
    After installing official application via Play Store, you will be able to open, through display, apps which gives support such as Spotify, WhatsApp, standard functionalities like messages, calls, Google Maps, Google Play Music and many more.
    Of course to go on, you should connect your smartphone to your car using the USB cables.

    Exploring Android Auto

    If we remove the automatic access to Android Auto when we connect the phone, or we exit from this mode without disconnect it from USB, the “Trasmission” icon will be the one of Android Auto.

    1_Android_auto_opelastra(Click image to enlarge)

    After connection, you can see a short and fast tutorial which explain you how to use Android Auto.
    Of course if you haven’t install “Android Auto” application, you will be required to do it through Play Store.

    This is the first thing that appear after the connection is this:

    2_Android_auto_opelastra(Click image to enlarge)

    Here is the small tutorial where the app explain the first steps.. In this screen, Android Auto say that we can press button (available on steering wheel) to active vocal commands (and here we will use Google Now functionalities).

    3_Android_auto_opelastra(Click image to enlarge)

    We don’t like the button or it does not work anymore because we broke it? No problem, we could use the vocal commands by pressing microphone icon on the top right.

    4_Android_auto_opelastra(Click image to enlarge)

    And here, the app shows us menu’ which have the role of launcher. It lets us to access to various applications like navigator, phone, music, etc.
    About navigator, by default, it’s used Google Maps, Google Play Music for our music and the default app we have for everything we want.

    Of course we can use different messaging apps like WhatsApp, Telegram and so on but only if they are compatible with Android Auto. (They will be more soon).

    5_Android_auto_opelastra6_Android_auto_opelastra

    (Click image to enlarge)

    When all it’s loaded (and accepted warnings), we will be in front of first screen which is what we see into Google Now and so, what we see on our phone, we will see into car’s display..

    In my case, I see that I can start navigator to drive to Modena or I can choose the last address that I’ve inserted into Google Maps. Other informations displayed are traffic, and how much the trip would take, in terms of time.

    7_Android_auto_opelastra(Click image to enlarge)

    We don’t like Google Play Music or we don’t have internet connection? No problem we can use the default radio Opel system. Here’s how it will be.
    Note, we can also see the weather forecast.. It’s surely the Google Now!

    8_Android_auto_opelastra(Click image to enlarge)

    Touching the “Phone” icon, we can see our address book. If we want, we can also digit phone number and start calling.
    Naturally, we can use vocal commands when available by press on button on steering wheel or display.

    9_Android_auto_opelastra(Click image to enlarge)

    Starting navigation, as said, we have 3D view of Google Maps and also here, we can insert address by talking (through vocal commands) or write it with touchscreen.

    10_Android_auto_opelastra(Click image to enlarge)

    We was talking about choose different application instead of default..
    When we press button on menu, if more apps are available for the selection, before the default we will be asked to select which one we want to use.
    For example, pressing music icon, we will be asked if open Google Play Music or Spotify.

    11_Android_auto_opelastra(Click image to enlarge)

    Yeah, Spotify is available (and we can see it through selections) and we choose it!
    What say, we have convergence with different devices, in fact, using and installing only one application, we can have compatibility for phone and Android Auto.
    Spotify of course it’s really similar to what appears on our phone.

    12_Android_auto_opelastra13_Android_auto_opelastra

    (Click image to enlarge)

    Also WhatsApp it’s available with Android Auto and you can notice how the small notification appears when we receive message.
    Touching the notification (on display), the system will read us the message via TTS (Text-To-Speech) and we can obviously reply thanks to the vocal system.

    Anyway, we can also send a message saying “Send Message” followed with the name of contact.

    14_Android_auto_opelastra(Click image to enlarge)

    You received message and you have to reply without press keys on touchscreen? If available, we can answer with a fast standard reply like “I’m driving, sorry!” as WhatsApp do.

    15_Android_auto_opelastra(Click image to enlarge)

    You don’t like or don’t want to use Android Auto anymore? You’re free to exit (also with smartphone connected).

    16_Android_auto_opelastra(Click image to enlarge)

    Conclusions

    What I can say, in my honest opinion it’s really curious and nice.. Maybe if the maps of Google Maps would be more updated like “Tom Tom”, it would be really something perfect.
    After all, also the possibility of developing own applications for Android Auto or using existing one for music, messages, and so on.. It’s something really nice.

    About me, I like it and it deverves all the best. Really congratulations to Google!

    Of course, if you’re instered into developing apps, having more details or see who supports Android Auto, you can visit this website: https://www.android.com/intl/en/auto/.

    Note: if you found something incorrect about what I said or about my not best english, write into comments please.. Thank you!

    ]]>     Mirko Pizii     How to Integrate Slack with Launchpad https://daker.me/2016/01/how-to-integrate-slack-with-launchpad.html https://daker.me/2016/01/how-to-integrate-slack-with-launchpad.html Tue, 26 Jan 2016 00:00:00 GMT Slack is a great platform for team communication, it is a collection of chat rooms, both public and private. It helps confine all your team communications to one place. Slack also provides an API to let you interacte with it, so i have to decided to write a simple app using Flask to integrate Slack with Launchpad using its new webhooks feature.

    Launchpad & Slack logos

    Deploying to Heroku

    You can check the full steps in the README file

    $ git clone git@github.com:daker/launchpad-slack.git
    $ cd launchpad-slack
    $ heroku create
    $ git push heroku master
    $ heroku open

    Once installed and everything is configured, things will start working like a charm :

    Slack chat Slack Slash command

    Contributing

    Of course of you can contribute fixes and improvements, how to do it ? easy :

    • Fork it
    • Create your feature branch (git checkout -b my-new-feature)
    • Commit your changes (git commit -am 'Add some feature')
    • Push to the branch (git push origin my-new-feature)
    • Create new Pull Request
    ]]>     Adnane Belmadiaf     mass subscriptions http://polka.bike/blog/mass-subs http://polka.bike/blog/mass-subs Fri, 11 Dec 2015 23:12:44 GMT As you may be aware, Lubuntu is transitioning from GTK to Qt graphics libraries, which means a transition from LXDE to LXQt. Same people, more or less, just different libs. Of course, every component is different. We finally have packages in Debian and Ubuntu Xenial. There's even instructions on how to install them!

    We needed to subscribe our Lubuntu Packages Team to all of these bug mails. Sure, we could have went to 18 different source package pages and just clicked our way to it, but that kind of takes a darn while.

    Luckily there's a solution: launchpadlib. Just a pip install away (or use package python-launchpadlib), it gives you all sorts of control over and access to Launchpad data. It's almost better than using the web interface! Well, assuming you're fine with Python.

    In our case here, it's possible to simply name a team and/or person and give it a list of packages and have it subscribe them all. Takes a few seconds after you have the code, which you can find here. The meat of the code is one line:

    lp.distributions['ubuntu'].getSourcePackage(name=filearray[i]).addBugSubscription(subscriber=lp.people[teamtowrite])

    which is basically like saying for a particular source package in the Ubuntu project, add a bug subscription for the particular team or person. Heck, it almost reads like normal English.

    This might be useful for normal people, too. Say you wanted to subscribe to all the bugs for a particular set of packages you're helping to develop. It'd be great for that.

    More than anything, it shows the power of the Launchpad API and the hard work that Colin and the rest of the Launchpad team put into it!

    With that, I'd like to especially thank cjwatson, dobey, and wgrant, whom were all helpful in figuring this out on IRC, as well as tsimonq2, who was responsible for the majority of the code.

    ]]>     Walter Lapchynski     Current progress on AlgAudio https://rafalcieslak.wordpress.com/2015/10/06/current-progress-on-algaudio/ https://rafalcieslak.wordpress.com/2015/10/06/current-progress-on-algaudio/ Tue, 06 Oct 2015 18:24:20 GMT … or “what I’ve been working on for the past three months”.

    So this summer I have participated in a programming internship at Audiovisual Technology Center – CeTA in Wrocław. CeTA is developing a number of very exciting projects, and the one I had the pleasure to work on is AlgAudio.

    screenshot

    (download links available below)

    AlgAudio is a new signal processing framework that we’ve been developing from scratch. The user builds an audio processing network by placing “building blocks” of simple operations, connecting them together, configuring their parameters, and defining how the parameters should influence each other. The network works in real time, so any changes to the parameters are immediately reflected in the outputted audio. This makes AlgAudio a perfect tool for live performances.

    The general concept was inspired by Max/MSP, but AlgAudio is intended to provide a higher-level interface. It is supposed to be used by musicians, so we do our best to make it easy to work with without any programming or mathematical skills. The building blocks usually represent a more complex operation (comparing to Max or PureData), and expose a number of parameters that can be manually configured, or controlled live via an external controller.

    At this stage, AlgAudio is ready to be tried out. Most core features are already implemented, so you can actually build really interesting synthesizers. However, there is still a lot to be done. Most importantly, the module collections need expansion (currently only the very basic modules are available, for example there are no audio filtering blocks available ATM), the module browser needs a better hierarchical structure, we are missing a number of parameter connecting modes, the UI needs various improvements, subpatching and polyphonic features need improvements, and we need a test framework to ensure top quality.

    We also believe that creating external modules should be very simple, so that third-parties can provide their own module collections. The API is not quite stable yet, but we’re getting there. This is what an example module looks like:

      <module id="mix3" name="3ch mixer">
    <params>
      <inlet id="in1"/>
      <inlet id="in2"/>
      <inlet id="in3"/>
      <outlet id="out"/>
    </params>
    <description> This module mixes three channels together. </description>
    <sc>
arg in1, in2, in3, out;
var sum = In.ar(in1) + In.ar(in2) + In.ar(in3); 
Out.ar(out, sum);
    </sc>
    <gui type="standard auto"/>
  </module>

    It’s that simple!

    But what if you would like to inject custom features? AlgAudio has a built-in plugin system. Each module may come with custom logic. The C++ interface allows interaction with literally any other AlgAudio component (you might even get as far as to, say, get your module to modify how other modules are displayed!). Below is the source of a simple module that sums the values of two parameters, and outputs the result as a third parameter.

    class DataSum : public AlgAudio::Module{
  void on_param_set(std::string name, float value){
    float v  = GetParamControllerByID("input1")->Get();
          v += GetParamControllerByID("input2")->Get();
    GetParamControllerByID("output")->Set(v);
  }
};

    This source code should be pretty self-explanatory. Does it get much more complex? Here’s a sequencer module that outputs a hard-coded sequence:

    class SimpleSeq : public AlgAudio::Module{
public:
  int i = 7;
  int seq[8] = {60, 62, 64, 65, 64, 62, 69, 67};
  const  float fill = 0.8;
  void on_init(){
    step();
  }
  void step(){
    i = (i+1)%8;
    int note = seq[i];
    float period = GetParamControllerByID("period")->Get();
    GetParamControllerByID("freq")->Set( AlgAudio::Utilities::mtof(note) );
    GetParamControllerByID("gate")->Set(1.0f);
    timerhandles += AlgAudio::Timer::Schedule(period * fill, [this](){
      GetParamControllerByID("gate")->Set(0.0f);
    });
    timerhandles += AlgAudio::Timer::Schedule(period, [this](){
      step();
    });
  }
  
};

    You can browse the API here.

    We are releasing AlgAudio under the terms of the Lesser GNU General Public License, so you’ll be free to use it however you like. We host AlgAudio source code on Github.

    At this moment the development of AlgAudio will significantly slow down, as we are looking for funds and contributors. We will be thankful if you could notify us about your interest in AlgAudio (contact either me or CeTA).

    Download

    AlgAudio will be getting an official website soon, but before that you can download binaries for Linux and Windows from Github (OS X support is planned). Downloads for 1.99.1

    Please keep in mind that this is not a stable release, and we cannot guarantee that AlgAudio won’t crash sometimes. If you find any bugs, please report them here.

    ]]>     Rafał Cieślak     Resource control with systemd https://dktrkranz.wordpress.com/2015/09/02/resource-control-with-systemd/ https://dktrkranz.wordpress.com/2015/09/02/resource-control-with-systemd/ Wed, 02 Sep 2015 16:31:54 GMT I’m receiving more requests for upload accounts to the Deb-o-Matic servers lately (yay!), but that means the resources need to be monitored and shared between the build daemons to prevent server lockups.

    My servers are running systemd, so I decided to give systemd.resource-control a try. My goal was to assign lower CPU shares to the build processes (debomatic itself, sbuild, and all the related tools), in order to avoid blocking other important system services from being spawned when necessary.

    I created a new slice, and set a lower CPU share weight:
    $ cat /etc/systemd/system/debomatic.slice
    [Slice]
    CPUAccounting=true
    CPUShares=512
    $

    Then, I assigned the slice to the service unit file controlling debomatic daemons by adding the Slice=debomatic.slice option under the Service directive.

    That was not enough, though, as some processes were assigned to the user slice instead, which groups all the processes spawned by users:
    systemd-cgls

    This is probably because schroot spawns a login shell, and systemd considers it belonging to a different process group. So, I had to launch the command systemctl set-property user.slice CPUShares=512, so all processes belonging to the user.slice will receive the same share of the debomatic ones. I consider this a workaround, I’m open to suggestions how to properly solve this issue 🙂

    I’ll try to explore more options in the coming days, so I can improve my knowledge of systemd a little bit more 🙂

    ]]>     Luca Falavigna     DebConf 15 https://overbenny.wordpress.com/2015/08/16/debconf-15/ https://overbenny.wordpress.com/2015/08/16/debconf-15/ Sun, 16 Aug 2015 11:31:42 GMT I am still alive and currently attending DebConf 15. Feel free to grab me for a talk. I am just shy, not antisocial.

    ]]>     Benjamin Drung     SUSE Ruling the Stack in Vancouver https://www.vuntz.net/journal/post/2015/05/26/SUSE-Ruling-the-Stack-in-Vancouver https://www.vuntz.net/journal/post/2015/05/26/SUSE-Ruling-the-Stack-in-Vancouver Mon, 25 May 2015 22:58:00 GMT Rule the Stack

    Last week during the the OpenStack Summit in Vancouver, Intel organized a Rule the Stack contest. That's the third one, after Atlanta a year ago and Paris six months ago. In case you missed earlier episodes, SUSE won the two previous contests with Dirk being pretty fast in Atlanta and Adam completing the HA challenge so we could keep the crown. So of course, we had to try again!

    For this contest, the rules came with a list of penalties and bonuses which made it easier for people to participate. And indeed, there were quite a number of participants with the schedule for booking slots being nearly full. While deploying Kilo was a goal, you could go with older releases getting a 10 minutes penalty per release (so +10 minutes for Juno, +20 minutes for Icehouse, and so on). In a similar way, the organizers wanted to see some upgrade and encouraged that with a bonus that could significantly impact the results (-40 minutes) — nobody tried that, though.

    And guess what? SUSE kept the crown again. But we also went ahead with a new challenge: outperforming everyone else not just once, but twice, with two totally different methods.

    For the super-fast approach, Dirk built again an appliance that has everything pre-installed and that configures the software on boot. This is actually not too difficult thanks to the amazing Kiwi tool and all the knowledge we have accumulated through the years at SUSE about building appliances, and also the small scripts we use for the CI of our OpenStack packages. Still, it required some work to adapt the setup to the contest and also to make sure that our Kilo packages (that were brand new and without much testing) were fully working. The clock result was 9 minutes and 6 seconds, resulting in a negative time of minus 10 minutes and 54 seconds (yes, the text in the picture is wrong) after the bonuses. Pretty impressive.

    But we also wanted to show that our product would fare well, so Adam and I started looking at this. We knew it couldn't be faster than the way Dirk picked, and from the start, we targetted the second position. For this approach, there was not much to do since this was similar to what he did in Paris, and there was work to update our SUSE OpenStack Cloud Admin appliance recently. Our first attempt failed miserably due to a nasty bug (which was actually caused by some unicode character in the ID of the USB stick we were using to install the OS... we fixed that bug later in the night). The second attempt went smoother and was actually much faster than we had anticipated: SUSE OpenStack Cloud deployed everything in 23 minutes and 17 seconds, which resulted in a final time of 10 minutes and 17 seconds after bonuses/penalties. And this was with a 10 minutes penalty due to the use of Juno (as well as a couple of minutes lost debugging some setup issue that was just mispreparation on our side). A key contributor to this result is our use of Crowbar, which we've kept improving over time, and that really makes it easy and fast to deploy OpenStack.

    Wall-clock time for SUSE OpenStack Cloud

    Wall-clock time for SUSE OpenStack Cloud

    These two results wouldn't have been possible without the help of Tom and Ralf, but also without the whole SUSE OpenStack Cloud team that works on a daily basis on our product to improve it and to adapt it to the needs of our customers. We really have an awesome team (and btw, we're hiring)!

    For reference, three other contestants succeeded in deploying OpenStack, with the fastest of them ending at 58 minutes after bonuses/penalties. And as I mentioned earlier, there were even more contestants (including some who are not vendors of an OpenStack distribution), which is really good to see. I hope we'll see even more in Tokyo!

    Results of the Rule the Stack contest

    Results of the Rule the Stack contest

    Also thanks to Intel for organizing this; I'm sure every contestant had fun and there was quite a good mood in the area reserved for the contest.

    Update: See also the summary of the contest from the organizers.

    ]]>     Vincent Untz     Here’s how to patch Ubuntu 8.04 or anything where you have to build bash from source https://leftyfb.com/2014/09/25/heres-how-to-patch-ubuntu-8-04-or-anything-where-you-have-to-build-bash-from-source/ https://leftyfb.com/2014/09/25/heres-how-to-patch-ubuntu-8-04-or-anything-where-you-have-to-build-bash-from-source/ Thu, 25 Sep 2014 17:03:01 GMT UPDATED: I have updated the post to include the post from gb3 as well as additional patches and some tests

    Just a quick post to help those who might be running older/unsupported distributions of linux, mainly Ubuntu 8.04 who need to patch their version of bash due to the recent exploit here:

    http://thehackernews.com/2014/09/bash-shell-vulnerability-shellshock.html

    I found this post and can confirm it works:

    https://news.ycombinator.com/item?id=8364385

    Here are the steps(make a backup of /bin/bash just in case):

    #assume that your sources are in /src
cd /src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 1 28); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 1 28);do patch -p0 < ../bash43-$i; done
#build and install
./configure --prefix=/ && make && make install
cd ../../
rm -r src

    To test for exploits CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187 I have found the following information at this link

    To check for the CVE-2014-6271 vulnerability

    env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

    it should NOT echo back the word vulnerable.

    To check for the CVE-2014-7169 vulnerability
    (warning: if yours fails it will make or overwrite a file called /tmp/echo that you can delete after, and need to delete before testing again )

    cd /tmp; env X='() { (a)=>\' bash -c "echo date"; cat echo

    it should say the word date then complain with a message like cat: echo: No such file or directory. If instead it tells you what the current datetime is then your system is vulnerable.

    To check for CVE-2014-7186

    bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "CVE-2014-7186 vulnerable, redir_stack"

    it should NOT echo back the text CVE-2014-7186 vulnerable, redir_stack.

    To check for CVE-2014-7187

    (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash || echo "CVE-2014-7187 vulnerable, word_lineno"

    it should NOT echo back the text CVE-2014-7187 vulnerable, word_lineno.

    ]]>     Mike Rushton     Open Source Conference 2014 Kansai@Kyoto https://mizuno-as.hatenadiary.org/entry/20140806/1407307913 https://mizuno-as.hatenadiary.org/entry/20140806/1407307913 Wed, 06 Aug 2014 06:51:53 GMT On August 1-2, 2014, Open Source Conference 2014 Kansai@Kyoto was held in Kyoto.
    (http://www.ospn.jp/osc2014-kyoto/)


    This event is the largest OSS community gathers for in Japan. We participate as exhibitor and speaker every year. Yes, Of course as for this year.


    Hiroshi Chonan was in charge of the seminar. He talked about trusty and Utopic.

    The highlight of the event is as follows:


    The NetBSD team displayed Luna work station of OMRON. Luna(= opposed to Sun) is very old UNIX workstation in Japan. However, the newest Twitter client "Mikutter" works in this workstation on NetBSD!


    Mikutter is simple, powerful and moeful twitter client. This is very popular among young geek. (We call them "Teokure" in Japan)


    This is Takayoshi Okano. He is one of greatest FLOSS translators in Japan. And it is Open Street Map mapper too.

    In this way, the Japanese FLOSS community is very active and happy!

    ]]>     Hajime MIZUNO     Ubuntu 14.04 LTS release party + Offline meeting 14.04 Tokyo http://fabric-janitor.blogspot.com/2014/06/a-few-weeks-ago-ubuntu-japanese-team.html http://fabric-janitor.blogspot.com/2014/06/a-few-weeks-ago-ubuntu-japanese-team.html Thu, 05 Jun 2014 03:09:00 GMT
    Virtual tour:
    1) A lot of sandwitchs (for 100 enlister) and party dishes.


    Note: These represent just the tip of the iceberg. But, they completely-disappeared within 20 minutes....:)


    2) A lot of Ubuntu 14.04 LTS CDs (From LoCo kit, thanks Canonical!) with *pretty* stuffed Tahr and Unicorn (owner: Shibata Mitsuya).






    3) Terazono Junya with LipoD(Lipovitan D, Japanese popular energy drink).
     


    4) Large screen (very nice, thanks GREE!)



    5) Retrospective by Jun. Ubuntu Japanese Team create "Ubuntu Japanese Remix" for a long time (about 8years), He is great leader.




    6) Seminar by Tokura Aya (Microsoft). She is evangelist/image character of Microsoft Azure/Cloud in Japan.
     



    7) Seminar by Shiobara Hiroaki(GMO Internet). He escort "Mikumo-Conoha", the macot fay of "ConoHa" (CMO's Cloud service). 
     

    8) Seminar by Yokota Masatoshi(Sakura Internet), He and Mr. Shiobara starts a verbal battle like Wrestling Entertainment (Its entertainment. They keep friendliness and respets, but thats engage in a heated debate. I Know, they give the right hand of fellowship after sessions. :) ).



    One of sessions theme are "Retrospective", overview for 10 years of ubuntu.

    - "Ubuntu and Me, a certain ubuntu user's voice" by Terazono Junya (indivisual, but he is famous planetary informatics scientist, a.k.a. "Hayabusa project's PR expert with LipoD" ).
    - "Retrospective last 10 years" by Kobayashi Jun (Ubuntu Japanese Team)

    Another seminar sessions focused "VPS and Cloud production environment with Ubuntu", line-up as follows.

    - "Ubuntu + Microsoft Azure, Quickguide before a you use Azure"  by Tokura Aya, a.k.a. "Cloudia Madobe" (Microsoft Corporation).
    - "Ubuntu on Microsoft Azure" by Tsumura Akira (Japan Azure User Group)
    - "GMO Cloud with Ubuntu 14.04" by Shiobara Hiroaki (GMO Internet)
    - "Using Ubuntu on Sakura's VPS/Cloud" by Yokota Masatoshi (Sakura Internet)
    - "Using Juju for your Ubuntu environment" by Matsumoto Takenori (Canonical)

    Yes, they are awesome presenters(thanks!), they distribute Ubuntu environment as a Cloud/VPS operator. We can use Ubuntu on there VPS/Cloud service with your one-click operation. Excellent!


    And, You can check an another report on gihyo.jp (http://gihyo.jp/admin/serial/01/ubuntu-recipe/0325) by Terauchi Yasuyuki (in Japanese), that sponsored by GIHYO.

    In closing, I would like to thank you all for convention. Thanks a lot!

    ]]>     Fumihito YOSHIDA     Trusty DVD parcels http://my-ubuntu-day.blogspot.com/2014/05/trusty-dvd-parcels.html http://my-ubuntu-day.blogspot.com/2014/05/trusty-dvd-parcels.html Sun, 18 May 2014 14:21:00 GMT I am just getting the parcels of DVDs ready. I will take them to the post office this week sometime. Thanks to everyone who is willing to be a distribution point.
    ]]>     Maia Grotepass     Ubuntu Open Week wrap-up https://ubuntuclassroom.wordpress.com/2014/04/25/ubuntu-open-week-wrap-up-2/ https://ubuntuclassroom.wordpress.com/2014/04/25/ubuntu-open-week-wrap-up-2/ Fri, 25 Apr 2014 23:20:49 GMT ubuntu-open-week

    From April 22nd through April 24th the Ubuntu Classroom team worked with teams across the Ubuntu community to bring together 12 sessions exploring various parts of our community, from Documentation to Core Apps to the Kernel team to present Ubuntu Open Week.

    The event was a huge success! If you missed anything, logs (for IRC-based sessions) and videos (from On Air! sessions) are now available:

    Tues 22 Apr Wed 23 Apr Thu 24 Apr
    Introduction to Open Week – jose Ubuntu Women Project – pleia2 and belkinsa Ubuntu Development Team – dholbach
    Ubuntu Server Team – beisner Get started contributing to Ubuntu Core Apps [ON AIR!] – popey and dpm Organizing Ubuntu App Dev Schools – dholbach and dpm
    Ubuntu Documentation Team – pleia2 Ubuntu Kernel Team – jsalisbury Kubuntu Team – Quintasan, ovidiu-florin
    Getting Acquainted with the Juju Review Queue and Process [ON AIR!] – lazyPower Ubuntu Quality Team – balloons Ubuntu LoCo Teams – jose

    Thanks again to everyone who participated in this event, from presenters who lead sessions to attendees who came with their curiosity and questions!

    ]]>     Ubuntu Classroom     IR Receiver extension for Ambilight raspberry pi clone http://supermario-world.blogspot.com/2014/04/ir-receiver-extension-for-ambilight.html http://supermario-world.blogspot.com/2014/04/ir-receiver-extension-for-ambilight.html Wed, 23 Apr 2014 05:48:00 GMT
    This brought me to trying to do it directly via my remote.  My HTPC uses a mceusb, so I was tempted to just get another mceusb for the pi.  This would have been overkill though, the pi has tons of unused GPIO's, it can be done far simpler (and cheaper).

    I looked into it and discovered that someone actually already wrote a kernel module that directly controls an IR sensor on a GPIO.  The kernel module is based off the existing lirc_serial module, but adapted specifically for the raspberry pi.  (See http://aron.ws/projects/lirc_rpi/ for more information)

    Hardware

    All that's necessary is a 38 kHz IR sensor.  You'll spend under $5 on one of them on Amazon (plus some shipping) or you can get one from radio shack if you want something quick and local.  I spent $4.87 on one at my local radio shack.

    The sensor is really simple, 3 pins.  All 3 pins are available in the pi's header.  One goes to 3.3V rail, one to ground, and one to a spare GPIO.  There's a few places on the header that you can use for each.  Just make sure you match up the pinout to the sensor you get.  I chose to use GPIO 22 as it's most convenient for my lego case.  The lirc_rpi defaults to GPIO 18.

    Some notes to keep in mind:

    1. While soldering it, be cognizant of which way you want the sensor to face so that it can be accessed from the remote.  
    2. Remember that you are connecting to 3.3V and Ground from the Pi header.  The ground connection won't be the same as your rail that was used to power the pi if you are powering via USB.  
    3. The GPIO pins are not rated for 5V, so be sure to connect to the 3.3V.



    Software


    LIRC is available directly in the raspbian repositories.  Install it like this:

    # sudo apt-get install lirc

    Manually load the module so that you can test it.

    # sudo modprobe lirc_rpi gpio_in_pin=22

    Now use mode2 to test that it's working.  Once you run the command, press some buttons on your remote.  You should be output about space, pulse and other stuff.  Once you're satisfied, press ctrl-c to exit.

    # mode2 -d /dev/lirc0

    Now, add the modules that need to be loaded to /etc/modules.  If you are using a different GPIO than 18, specify it here again.  This will make sure that lirc_rpi loads on boot.

    /etc/modules

    lirc_dev
    lirc_rpi gpio_in_pin=22


    Now modify /etc/lirc/hardware.conf to match this configuration to make it work for the rpi:

    /etc/lirc/hardware.conf

    # /etc/lirc/hardware.conf
    #
    # Arguments which will be used when launching lircd
    LIRCD_ARGS="--uinput"

    #Don't start lircmd even if there seems to be a good config file
    #START_LIRCMD=false

    #Don't start irexec, even if a good config file seems to exist.
    #START_IREXEC=false

    #Try to load appropriate kernel modules
    LOAD_MODULES=true

    # Run "lircd --driver=help" for a list of supported drivers.
    DRIVER="default"
    # usually /dev/lirc0 is the correct setting for systems using udev 
    DEVICE="/dev/lirc0"
    MODULES="lirc_rpi"

    # Default configuration files for your hardware if any
    LIRCD_CONF=""
    LIRCMD_CONF=""

    Next, we'll record the buttons that you want the pi to trigger the backlight toggle on.  I chose to do it on the event of turning the TV on or off.  For me I actually have a harmony remote that has separate events for "Power On" and "Power Off" available.  So I chose to program KEY_POWER and KEY_POWER2.  If you don't have the codes available for both "Power On" and "Power Off" then you can just program "Power Toggle" to KEY_POWER.

    # irrecord -d /dev/lirc0 ~/lircd.conf

    Once you have the lircd.conf recorded, move it into /etc/lirc to overwrite /etc/lirc/lircd.conf and start lirc

    # sudo mv /home/pi/lircd.conf /etc/lirc/lircd.conf
    # sudo /etc/init.d/lirc start

    With lirc running you can examine that it's properly recognizing your key event using the irw command.  Once irw is running, press the button on the remote and make sure your pi recognizes it.  Once you're done press ctrl-c to exit.

    # irw

    Now that you've validated the pi can recognize the command, it's time to tie it to an actual script.  Create /home/pi/.lircrc with contents like this:

    /home/pi/.lircrc

    begin
         button = KEY_POWER
         prog = irexec
         repeat = 0
         config = /home/pi/toggle_backlight.sh off
    end

    begin
         button = KEY_POWER2
         prog = irexec
         repeat = 0
         config = /home/pi/toggle_backlight.sh on
    end

    My toggle_backlight.sh looks like this:

    /home/pi/toggle_backlight.sh

    #!/bin/sh
    ARG=toggle
    if [ -n "$1" ]; then
    ARG=$1
    fi
    RUNNING=$(pgrep hyperion-v4l2)
    if [ -n "$RUNNING" ]; then
    if [ "$ARG" = "on" ]; then
    exit 0
    fi
    pkill hyperion-v4l2
    hyperion-remote --color black
    exit 0
    fi
    if [ "$ARG" = "off" ]; then
    hyperion-remote --color black
    exit 0
    fi
    #spawn hyperion remote before actually clearing channels to prevent extra flickers
    hyperion-v4l2 --crop-height 30 --crop-width 10 --size-decimator 8 --frame-decimator 2 --skip-reply --signal-threshold 0.08&
    hyperion-remote --clearall


    To test, run irexec and then press your remote button.  With any luck irexec will launch the toggle script and change your LED status.

    # irexec

    Lastly, you need to add irexec to your /etc/rc.local to make it boot with the pi.  Make sure you put the execution before the exit 0

    /etc/rc.local

    su pi -c "irexec -d"
    su pi -c "/home/pi/toggle_backlight.sh off"

    Reboot your pi, and make sure everything works together.  

    # sudo reboot


    ]]>     Mario Limonciello     apt 1.0 https://mvogt.wordpress.com/2014/04/04/apt-1-0/ https://mvogt.wordpress.com/2014/04/04/apt-1-0/ Fri, 04 Apr 2014 14:30:02 GMT APT 1.0 was released on the 1. April 2014 [0]! The first APT version was announced on the 1. April exactly 16 years ago [1].

    The big news for this version is that we included a new “apt” binary that combines the most commonly used commands from apt-get and apt-cache. The commands are the same as their apt-get/apt-cache counterparts but with slightly different configuration options.

    Currently the apt binary supports the following commands:

    • list: which is similar to dpkg list and can be used with flags like
      --installed or --upgradable.
    • search: works just like apt-cache search but sorted alphabetically.
    • show: works like apt-cache show but hide some details that people are less likely to care about (like the hashes). The full record is still available via apt-cache show of course.
    • update: just like the regular apt-get update with color output enabled.
    • install,remove: adds progress output during the dpkg run.
    • upgrade: the same as apt-get dist-upgrade –with-new-pkgs.
    • full-upgrade: a more meaningful name for dist-upgrade.
    • edit-sources: edit sources.list using $EDITOR.

    Here is what the new progress looks like in 1.0:
    apt-progress

    You can enable/disable the install progress via: 

    # echo 'Dpkg::Progress-Fancy "1";' > /etc/apt/apt.conf.d/99progressbar

    If you have further suggestions or bugreport about APT, get in touch and most importantly, have fun!

    ]]>     Michael Vogt     The Ubuntu PC Case Mod Pt.10 The CPU + Kubuntu stickers https://noskcaj10.wordpress.com/2013/12/18/the-ubuntu-pc-case-mod-pt-9-the-cpu-kubuntu-stickers/ https://noskcaj10.wordpress.com/2013/12/18/the-ubuntu-pc-case-mod-pt-9-the-cpu-kubuntu-stickers/ Wed, 18 Dec 2013 06:21:44 GMT Hello everyone,

    The CPU (an AMD FX-8320) finally arrived this week, and i’ve put the LEDs on since i shouldn’t be doing any more cutting any time soon. On top of this, I received a sponsorship from linux australia recently, which is paying for the main motherboard and PSU. I also have a few other parts that count as christmas gifts which i think i’m getting, plus a $10 donation to the gofundme project, which is being used for the power LEDs and a small soldering iron.

    Adding the LEDs was rather easy, since they have a super strong glue strip on the underside, and it plugs straight on to the fan controller.

    P1010670

    P1010673

    The dvd drives are now in place, they’ve turned out rather well for a first attempt at stealthing

    P1010674

    The CPU came in a rather large, aluminium tin.

    P1010679

    My favourite part of this is the lid opens up into two separate pieces

    P1010682P1010683

    One of which is a rather strange, but cute, print.

    P1010685

    The underside of the cpu. If a computer part could be un-photogenic, this is it.

    P1010688

    The cooler still needs a clean, but i’ll save that for when it is being painted

    P1010690

    The other new this week, is i’ve received 200 Kubuntu stickers. I will send these free to anyone in Australia who is willing to pay postage. Email me for my address if you would like some.

    P1010692

    I still need someone who cn make me the itx mount, but i’m starting to give up on that.

    To sponsor me, email me at noskcaj@ubuntu.com
    Current sponsor(s): IceModz.com , linux.org.au
    Help fund this (Please): http://www.gofundme.com/39uhgg

    Thank you

    ]]>     Jackson Doak     Ubuntu Touch and User Privacy http://mdeslaur.blogspot.com/2013/12/ubuntu-touch-and-user-privacy.html http://mdeslaur.blogspot.com/2013/12/ubuntu-touch-and-user-privacy.html Mon, 16 Dec 2013 19:25:00 GMT Application Confinement When we started thinking about how to design the security infrastructure in Ubuntu Touch, one of the important criterias was user privacy. For Ubuntu Touch, and the converged desktop in the future, we are moving from a model where people install software provided in an archive maintained by packagers to a model where applications get uploaded by the authors themselves directly into a software store. While this allows users to quickly gain access to the latest and greatest applications, it also brings with it a new problem: how to prevent malicious applications from stealing the user’s private data.

    The traditional archive model in Ubuntu is based on trust, barrier to entry, and time. In order to get something uploaded or modified in the archive, a developer needs to demonstrate trustability by contributing a significant amount of work before upload rights are granted. Learning how to create and modify packaging, and successfully getting contributions sponsored is complex, time consuming, and is a barrier to entry. Once a package does get uploaded or modified, it is generally done in the development release. This allows a package to be in the archive for a certain amount of time before it becomes part of an official release. Hopefully, if something malicious does make it to the archive, it will be discovered in the development release before it gets published in an official release.

    This long and complex process results in a software archive that can be trusted, but prevents software developers from being able to quickly get new versions of their software into the hands of their users. One of the goals of the Ubuntu Software Store is to allow a software developer to perform a few simple steps and have their application available to be installed by users in minutes, not in months.

    How do we trust software that can be made available to users in minutes? Simple: we confine it, and prevent it from accessing the user’s private data.

    The Permissions Problem


    At some point, an application may need to access some of the user’s data for it to be useful. For example, an image editing application is quite useless if it can’t open any of the user’s pictures. There needs to be a way to give applications permission to access certain data.

    On another mobile platform, this is solved in two ways: having each application ship with a list of required permissions, and implement a shared storage location where applications can freely access the user’s files. When a user installs an application, a dialog box is displayed listing all the permissions that are required for the application to work correctly. The user then has two choices: they can either continue with the installation and grant the required permissions, or they can cancel the installation process.

    As a user, this is a difficult choice to make.

    In order for a user to make an informed decision about a security question, there needs to be some context. If a flashlight application I am attempting to install indicates that it requires access to my address book, I have no idea at this point in time why that access is required. Does the application feature a “Recommend this app to friends!” button which would require access to my contact list, or does it contain adware that wants to data mine me? At this stage, I am unable to make an informed decision on the trustworthiness of the application, and will most likely install it even if I’m not in complete agreement with the permissions that are being requested. This is an all-or-nothing proposition: there is no way for me to use an application if I don’t accept the complete list of permission it requests.

    This results in a software store loaded with no-cost applications that exist solely to data mine personal information for profit. Users are walking around with mobile devices completely unaware of the fact that the trivial applications they’ve installed are tracking every move they make.

    Trusted Helpers


    In the security model we’ve developed, users get to make decisions on sensitive actions at the moment they are needed, instead of at application installation time. This is performed by system components called “Trusted Helpers”.

    Ubuntu Software Store applications are confined by default. They can only access their own directories, and their own data. Instead of granting permissions to access user data, we grant access to request user data using Trusted Helpers. This allows applications to access specific data as approved by the user instead of granting permissions to access it all.

    For example, instead of granting permission to directly access all of the user’s contact list, an application can request access to a contact. The system address book will then display a list of contacts to the user and only the specific contact selected by the user will be sent to the application. The application only has access to the contact which was specifically authorized by the user.

    If a flashlight application needs access to a user contact in order for a “Recommend this app to friends!” button to work, the user will be making an informed choice, as the request will be the direct result of having pressed the button. The flashlight app can be used without fear of it accessing contact information during normal usage.

    The same idea exists to exchange data between applications. If the user wants to edit a picture using an image editing application, the application will ask a system service known as the Content Hub to obtain an image. The Content Hub will then request a picture from the application which owns the data, in this case the Gallery application. The Gallery application will display a picker dialog to the user allowing them to select a specific photo to which the image editor will be granted access.

    A similar approach exists for access to other system services that are security-sensitive, such as the device GPS. At the moment an application wants to access the user’s location, a dialog will be displayed asking for permission. If the user accepts the request, the decision is cached, and the application can now access the user’s location in the future. If the user declines, the application can continue functioning normally, but without the location information. A user will be able to revoke the granted permissions at any time.

    Trusted Helpers allow users to specify, in a fine-grained way, which private information can be accessed by applications. The decision to grant these permissions is done at the moment the access is needed, giving the user the appropriate context for making an informed decision. Applications can be installed and used without fear that private data is being collected in the background.

    Policy Groups


    Applications in the Ubuntu Software Store are confined with technology called AppArmor. In order to facilitate the creation of AppArmor profiles by application developers, Ubuntu comes with a predefined list of “Policy Groups”. These Policy Groups are specified by application developers when creating packages for submission to the Ubuntu Software Store.

    Some of the Policy Groups simply give access to the APIs necessary to communicate with Trusted Helpers. For example, the “location” Policy Group allows an application to communicate with the location service which uses the GPS, but does not give access to the GPS directly. The location service is a Trusted Helper which will prompt the user for authorization, so the mere presence of this Policy Group doesn’t directly affect user privacy.

    Some of the other Policy Groups, such as “networking”, grant access to common services that aren’t really suitable for user prompting. Since most applications need network access, it would be inconvenient and inefficient to prompt the user for each one.

    Although Policy Groups weren’t designed to be visible to end users, there is a utility in the Ubuntu Software Store called “Permy” that will display the ones being used by each installed application.

    Power users who would like to experiment with restricting Policy Groups for installed applications can currently do so by editing the security manifest files. Each package in the Ubuntu Software Store ships a security manifest file that enumerates the Policy Groups granted to the package. When the package is installed, its security manifest file is available in /var/lib/apparmor/clicks/ and it can be edited by the admin of the system. For example, if you wanted to remove the “networking” Policy Group from the hello-world application:

    $ adb shell vi /var/lib/apparmor/clicks/ar.com.beuno.hello-world_hello-world_0.1.json

    change:

    {
        "policy_groups": [
           "networking"
        ],
        "policy_version": 1.0
    }

    to:

    {
        "policy_groups": [],
        "policy_version": 1.0
    }

    Then apply the changes to the AppArmor policy with:

    $ adb shell aa-clickhook -f

    At the moment, application upgrades will reset any modifications done to Policy Groups, but we will be introducing override files in this development cycle. The override files will allow power users to revoke application Policy Groups in a way that will survive application upgrades.

    In the future, we intend to develop the required system service to allow power users to easily revoke Policy Groups with a simple graphical interface.

    The User is in Control


    We believe the user should ultimately be in control of all access to their private data, and security should be more fine-grained than the all-or-nothing access inherent to a set of predetermined permissions associated with an application. Allowing the user to selectively share data with applications on a use by use basis as is done with Trusted Helpers makes Ubuntu Touch and the Ubuntu Software Store the ideal platform for privacy conscious users.]]>     Marc Deslauriers     Ubuntu Trusty translations are now open https://blogs.gnome.org/happyaron/2013/12/14/ubuntu-trusty-translations-are-now-open/ https://blogs.gnome.org/happyaron/2013/12/14/ubuntu-trusty-translations-are-now-open/ Sat, 14 Dec 2013 08:55:05 GMT We are pleased to announce that Trusty is now open for translation:

    https://translations.launchpad.net/ubuntu/trusty

    * Translation caveats. Remember that according to the release schedule [1] translatable messages might be subject to change until the User Interface Freeze [2].
    * Language packs. During the Trusty development cycle, language packs containing translations will be released twice per week [3] except for the freeze periods. This will allow users and translators to quickly see and test the results of translations.
    * Test and report bugs. If you notice any issues (e.g. untranslated strings or applications), do check with the translation team [4] for your language first. If you think it is a genuine bug, please report it [5].

    Happy translating! :-)

    [1] https://wiki.ubuntu.com/TrustyTahr/ReleaseSchedule
    [2] https://wiki.ubuntu.com/UserInterfaceFreeze
    [3] https://dev.launchpad.net/Translations/LanguagePackSchedule
    [4] https://translations.launchpad.net/+groups/ubuntu-translators
    [5] https://bugs.launchpad.net/ubuntu-translations/+filebug

    ]]>     Aron Xu     I Know what You Did This Summer https://blogs.gnome.org/lferrett/2013/08/03/i-know-what-you-did-this-summer/ https://blogs.gnome.org/lferrett/2013/08/03/i-know-what-you-did-this-summer/ Sat, 03 Aug 2013 20:50:51 GMT For your visual pleasure, here are some fresh screenshots from GNOME 3.9.5. Enjoy 🙂

    Weather and Maps

    Plan your vacations!
    Plan your vacations!

    Disk Usage and Notes

    When numbers really matters
    When numbers really matters

    Photos

    Make your memories bright
    Make your memories bright

    Universal Access

    Plain and simple
    Plain and simple

    System Monitor and Nautilus and…

    Oh my gosh! Is this menu item real?!?!?
    Oh my gosh! Is this menu item real?!?!?

     

     

    ]]>     Luca Ferretti     Spanish or Bust: Attaining fluency in 90 days or else ... http://ncommander.blogspot.com/2013/06/spanish-or-bust-attaining-fluency-in-90.html http://ncommander.blogspot.com/2013/06/spanish-or-bust-attaining-fluency-in-90.html Sat, 29 Jun 2013 01:38:00 GMT
    "How do you have an adventure?"

    "You take a stupid idea, and follow through ..."

    Perhaps, I've truly lost my mind for once, but I've decided to embark on a personal project to try and achieve some fluency in Spanish in just 90 days, and posting it to the internet to try and keep me honest and on track towards doing so. I will post future updates as I go, and would welcome help from anyone who would be interested in helping!

    The cost of failure: being forced to praise Wndows 8 in a future video, and run it for one week on my laptop.



    (I apologize for the quality, but I finally managed to find the nerve to record myself doing this, and just uploaded before I lost it again)


    ]]>     Michael Casadevall     Left Canonical https://dmtechtalk.wordpress.com/2013/06/11/left-canonical/ https://dmtechtalk.wordpress.com/2013/06/11/left-canonical/ Tue, 11 Jun 2013 15:59:51 GMT After almost 6 years the time has come to move on. I’m no longer with Canonical. New things on the horizon. I still plan on participating in Linux especially ARM Linux and also still being a part of Ubuntu Linux Community too.

    It’s been an interesting journey with Canonical, managing engineers around the world, up at weird hours of the day, starting a new flavour of Ubuntu (ARM), fighting daylight savings time twice a year, and finally supporting sales folks.  Always interesting, but I’m looking forward to the next new thing.  I will however miss the people, for the last 6 years I worked with some really smart people and I learned a lot from them.

    ]]>     David Mandala     Fixing build failures for 13.04 http://drowninginbugs.blogspot.com/2013/04/fixing-build-failures-for-1304.html http://drowninginbugs.blogspot.com/2013/04/fixing-build-failures-for-1304.html Mon, 08 Apr 2013 19:02:00 GMT One of the pleasures (and privileges) of Free Software is transparency in consistency, here meaning it's fairly painless to see where stuff fails to build in Ubuntu and to be able to help in fixing those failures.

    Let's get 13.04 into shape!]]>     Daniel T Chen     Setting up full-disk encryption in OpenBSD 5.3 /blog/2013-03-26-setting-up-full-disk-encryption-in-openbsd-5.3/ /blog/2013-03-26-setting-up-full-disk-encryption-in-openbsd-5.3/ Tue, 26 Mar 2013 13:40:54 GMT I recently decided to try out a snapshot of OpenBSD 5.3, intrigued by the notice that

    softraid(4) RAID1 and crypto volumes are now bootable on i386 and amd64 (full disk encryption).

    I’ve always used an encrypted LVM (as setup by the alternate CD) with a fully encrypted root on my netbook and laptop when running Debian/Kubuntu and never noticed much a performance hit. Unfortunately, I’m not the only one who has noticed a significant drop in performance with full-disk encryption on OpenBSD.

    Although the steps required to setup full-disk encryption (as opposed to requiring manual intervention at boot or the equivalent of loop-mounted encrypted images via vnconfig(8)) on OpenBSD are not explicitly documented anywhere, searching through the mailing lists, man pages, and trial and error provided the following steps:

    1. Boot from your install media. Select the (S)hell option.
    2. Assuming the disk you’re installing to is “wd0”, run fdisk -i wd0 if you’re on an i386. If I’m not mistaken, you can skip to the following step otherwise.
    3. Run disklabel -E wd0. Create a label (typically b) of the appropriate size of type swap for swap, and then add a label a using the remainder of the space of type RAID. We aren’t going to put swap on our crypto device since OpenBSD has encrypted the swap partition by default since 2005.
    4. Setup the crypto volume as described in bioctl(8). You will be prompted for a passphrase and presented with a message along the lines of softraid0: SR CRYPTO volume attached as sd0 on successful setup. I used bioctl -c C -l /dev/wd0a softraid0 where
      • -c C specifies a device with raidlevel “CRYPTO”,
      • -l /dev/wd0a specifies the label of type RAID created in step 3 to use for the CRYPTO device, and
      • softraid0 is the softraid device to configure (this value should work unless you already have a softraid0 device).
    5. exit from the shell and (I)nstall as normal, installing to the disk sd0 (or whichever disk the crypto volume got attached as). In the partitioning dialog, you may need to manually adjust things since the auto-partitioning creates an additional swap label on sd0, which we don’t need given we already have wd0b.
    6. Using ed(1), add the line 1a8bab44e9cc178d.b none swap sw to /mnt/etc/fstab, assuming that 1a8bab44e9cc178d is the DUID associated with wd0.1 Alternatively, wait until you boot into your system, and add it to your /etc/fstab using vi(1) or mg(1).
    7. Reboot, and you’ll be prompted for your passhprase. You’re done!

    Here’s a screenshot of steps 1 through 4.

    Steps 1 through 4

    Here’s a screenshot of the passphrase prompt, after successfully entering the passphrase:

    Passphrase prompt

    If I’ve made any errors in the steps above, please point them out in the comments below or by sending me an email.

    1. You can find this out by running sysctl hw.disknames. It will output something like hw.disknames=wd0:1a8bab44e9cc178d,cd0:,[...]. Just search for the DUID associated with wd0. ↩︎

    ]]>     Ryan Kavanagh     Bash script self-updates from github http://foss-boss.blogspot.com/2013/03/bash-script-self-updates-from-github.html http://foss-boss.blogspot.com/2013/03/bash-script-self-updates-from-github.html Mon, 11 Mar 2013 22:07:00 GMT Recently the systems engineering team @ Cloud9ers ($dayjob) has been busy building the infrastructure for a very ambitious and large scale project for one of our customers. The project involves tons of distributed programming besides lots of systems work as well. I'd like to share with the community a small tidbit of information. It's often some small things the one sometimes gives a moment to admire, and hereby share!

    The problem

    • We are building a private cloud. Ubuntu server instances running on that are cloned from a master template
    • While most clouds provide what I call "Instance Identity" information through some pre-known web service URI, in our case we utilize VMware's "Invoke-VMScript" API to run scripts inside the cloned template, thus customizing it and giving it its identity, then puppet takes it from there. Note that we're using a simple vCenter+ESXi (no vCloud stuff here) no shared storage even!

    Ok the real problem

    • Editing the template, and publishing it across the cloud (a topic for another post) takes considerable time! I wanted a way to be able to quickly update my identity scripts without having to re-build and re-publish images

    Solution

    • A script with a trivially simple (thus mostly fixed) "bootstrap" section, which auto-updates itself from github and relaunches its-new-self!

    Code

    Nothing ground breaking, but still a cool trick eh! Yeah I could have added a broken this into multiple scripts and maybe run-parts them. Of-course this script is quite basic, but it's meant to remain that way since the heavy lifting is puppet's responsibility!
    Note: To run this successfully the user this is run under, should have passwordless sudo rights to run "ip" and to run "itself" :) Got cool ideas, thoughts or comments? Leave me a message

    ]]>     Ahmed Kamal     I think I have a solution to the rolling and releasing http://davmor2.blogspot.com/2013/03/i-think-i-have-solution-to-rolling-and.html http://davmor2.blogspot.com/2013/03/i-think-i-have-solution-to-rolling-and.html Thu, 07 Mar 2013 23:22:00 GMT
    This I think gives users a regular cadence they are used to. Gives people like system 76 a regular OEM install it has security back ports from the continuing rolling release.  It gives app devs a set of libs for 6 months that won't change.  And means there is only a fortnight slow down for the devs.

    Plus the community driven derivatives can continue to use their current 6 monthly cadence. Everyone is happy :-)]]>     Dave Morley     Introducing Friends! https://blogs.gnome.org/kenvandine/2013/03/07/introducing-friends/ https://blogs.gnome.org/kenvandine/2013/03/07/introducing-friends/ Thu, 07 Mar 2013 21:46:33 GMT The Friends Service provides an API for interacting with your social
    networks. The friends service uses microblogging accounts configured in
    Ubuntu Online Accounts.

    Currently there are friends plugins for facebook, twitter, flickr,
    foursquare and identica.

    Sound familiar? Friends is actually a rewrite of the Gwibber service. It
    began as an attempt to port gwibber-service to python3 and add testing, but
    it quickly became obvious that it would be easier to start over. Credit for
    the rewrite goes to Barry Warsaw and Robert Park, they rocked friends!

    Impressively, Barry got the rewrite started by writing the test suite and using test
    driven development, what a hero! Friends now has an extensive test suite and truly 
    beautiful code.

    The service provides a Dee.SharedModel that contains the aggregated feed
    from all of your enabled accounts. Any application can connect to this
    model and provide a user interface to display the feed. You can create
    filtered models off that shared model to sort or limit the results to specific
    accounts, types, etc. Your application never actually talks directly to the
    web API provided by the social network, it would just interact with Friends.

    This Dee model is currently used in the Friends lens, People lens and Gwibber.

    The Friends service also provides APIs for sharing images, posting status
    updates, replies, liking posts, retweet, contact sync, etc.

    GObject APIs are provided by libfriends, including vala and GIR bindings (plus some GTK widgets). There is also a QML plugin, qml-friends.

    All the packages are available in universe for raring, and for quantal in the super-friends PPA.

    Here’s an example using Friends from QML posting a status update:

    
import QtQuick 2.0
import Ubuntu.Components 0.1
import Friends 0.1

MainView {
    applicationName: "poster"

    width: units.gu(50)
    height: units.gu(20)

    FriendsDispatcher {
        id: friends
        // use this to check if the send was successfull
        onSendComplete: {
             if (success) {
                 activitySpinner.visible = false;
                 entry.text = "";
                 console.log ("Send completed successfully");
             } else {
                 activitySpinner.visible = false;
                 console.log ("Send failed: " + errorMessage);
             }
         }
    }

    Column {
        anchors.centerIn: parent
        width: units.gu(40)
        spacing: units.gu(2)

        TextArea {
            id: entry
            objectName: "entry"
            anchors {
                left: parent.left
                leftMargin: units.gu(1)
                right: sendButton.left
                rightMargin: units.gu(1)
                bottomMargin: units.gu(1.5)
            }
            focus: true
            font.pixelSize: FontUtils.sizeToPixels("medium")
            font.family: "Ubuntu"
            // send message if return was pressed
            Keys.onReturnPressed: sendButton.clicked(null)
            Keys.onEscapePressed: text = ""
            height: units.gu(4)
            placeholderText: i18n.tr("Compose")
            autoSize: true
            maximumLineCount: 0
            ActivityIndicator {
                id: activitySpinner
                objectName: "activitySpinner"
                anchors.centerIn: entry
                visible: false
                running: visible
            }
        }
        Button {
            id: sendButton
            objectName: "sendButton"
            anchors {
                right: parent.right
                rightMargin: units.gu(1)
                left: entry.right
                bottom: entry.bottom
            }
            width: units.gu(9)
            height: units.gu(4)
            color: "#dd4814"
            text: i18n.tr("Send")
            onClicked: {
                console.log ("Post: " + entry.text);
                activitySpinner.visible = true
                friends.sendAsync(entry.text);
            }
        }
    }
}
    ]]>     Ken VanDine     git-annex: encrypted remotes https://debblog.philkern.de/2013/03/git-annex-encrypted-remotes.html https://debblog.philkern.de/2013/03/git-annex-encrypted-remotes.html Sun, 03 Mar 2013 22:44:00 GMT data loss I blogged about, I had to reverse engineer the encryption used by git-annex for its encrypted special remotes. The file system on which the content lived has a bullet hole of 8 GB in it, which was helpfully discarded by pvmove. It's pretty unhappy about that fact, parts of the git repository are unusable and directories cannot be accessed anymore. git-annex cannot possibly run anymore.

    However, I was still able to access the git-annex branch within said git repository (using porcelain). This branch contains a file called remote.log which contains the keys of the special remotes. There's one per remote, encrypted to a GPG key of your choice and all files within that remote are encrypted with the same symmetric key.

    One small detail stopped me from getting the decryption right the first time, though. It seems that git-annex uses randomness generated by GPG and armored into base64. In my naïveté I spotted the base64 and decoded it. Instead it's used verbatim: the first 256 bytes as HMAC key (which reduces randomness to 192 bytes) and the remaining bytes for the symmetric key used by GPG (which will do another key derivation for CAST5 with it). A bug about that just hit the git-annex wiki.

    With that knowledge in mind I wrote a little tool that's able to generate encrypted content keys from the plain ones used in the symlinks. That helps you to locate the file in the encrypted remote. Fetch it and then use the tool to decrypt the file in question with the right key.

    The lesson: Really backup the git repository used with git-annex and especially remote.log. I'm now missing most of the metadata but for some more important files it's luckily still present. Recovery of the file content does not depend on it if you can deduce the filename from the content. If you have many little files it might be a bit futile without it, though.]]>     Philipp Kern     Let's shard something http://blog.xtremeghost.com/2012/11/lets-shard-something.html http://blog.xtremeghost.com/2012/11/lets-shard-something.html Fri, 30 Nov 2012 07:59:00 GMT
    Today I'll be talking about sharded clusters in MongoDB using Ubuntu Precise and Juju.

    According the the mongodb documentation found on their website, one way of deploying a Shard Cluster is as follows:
    • deploy config servers
    • deploy a mongo shell (mongos)
    • deploy shards
    • connect the config servers to the mongo shell
    • add the shards to the mongo shell
    This is a pretty involved process that normally takes several hours to accomplish.  In this post, I will show you a way of deploying a sharded cluster in minutes using Ubuntu, Juju and the MongoDB charm.

    For the impatient, here is a video of the entire deployment:



    For the not so impatient, here is a more detailed explanation of the deployment.

    A few things to keep in mind when configuring this sharded cluster configuration:
    • Each shard will be a replica set with three nodes each.  As such, each shard must have a different replica-set name so it can be successfully registered as part of the cluster.
    • We will deploy three configuration servers
    Bootstrap the environment
    juju bootstrap

    Mongo Shell
    juju deploy mongodb mongos

    As described in the MongoDB charm, there are many options that can be configured to suit your needs.  For this deployment, most of the configuration options will work with the exception of the replicaset which will need to be different for each shard.

    Fortunately, a simple yaml file with our configuration overrides is all that's needed.

    Prepare a configuration file similar to the following:
    shard1:
      replicaset: shard1
    shard2:
      replicaset: shard2
    shard3:
      replicaset: shard3
    configsvr:
      replicaset: configsvr

    We'll save this one as ~/mongodb-shard.yaml



    Config Servers ( we'll deploy 3 of them )
    juju deploy mongodb configsvr --config ~/mongodb-shard.yaml -n3


    Shards ( We'll deploy three replica-sets )
    juju deploy mongodb shard1 --config ~/mongodb-shard.yaml -n3
    juju deploy mongodb shard2 --config ~/mongodb-shard.yaml -n3
    juju deploy mongodb shard3 --config ~/mongodb-shard.yaml -n3


    Connect the Config Servers to the Mongo shell (mongos)
    juju add-relation mongos:mongos-cfg configsvr:configsvr


    Connect each Shard to the Mongo shell (mongos)
    juju add-relation mongos:mongos shard1:database
    juju add-relation mongos:mongos shard2:database
    juju add-relation mongos:mongos shard3:database


    With the above commands, we should now have a three replica-set sharded cluster running.
    Using the default configuration, here are some details of our sharded cluster:
    • mongos is running on port 27021
    • configsvr is running on port 27019
    • the shards are running on the default mongodb port of 27017
    • The web admin is turned on by default and accessible with your browser on port 28017 on each of the shards after exposing the service.



    After a few minutes, your sharded cluster should be ready.  Let's verify that everything went as planned:
    • Verify your config servers
      • juju expose configsvr
      • juju status configsvr
      • Open your browser to http://<public-address-of-configsvr:28017
    • Verify that each shard
      • juju expose <shard1|shard2|shard3>
      • juju status <shard1|shard2|shard3>
      • Open your browser to http://<public-address-of-shard>:28017
    • Verify that each shard has been successfully register with the cluster:
      • juju expose mongos
      • juju status mongos
      • mongo --host <public-address-of-mongos>:27021
      • Once connected:
        • sh.status()
        • Results should be similar to the following:
    MongoDB shell version: 2.0.6
    connecting to: ec2-184-169-254-0.us-west-1.compute.amazonaws.com:27021/test
    mongos> sh.status()
    --- Sharding Status --- 
      sharding version: { "_id" : 1, "version" : 3 }
      shards:
            {  "_id" : "shard1",  "host" : "shard1/ec2-184-169-236-25.us-west-1.compute.amazonaws.com:27017,ec2-54-241-89-206.us-west-1.compute.amazonaws.com:27017,ip-10-170-173-51:27017" }
            {  "_id" : "shard2",  "host" : "shard2/ec2-204-236-159-194.us-west-1.compute.amazonaws.com:27017,ip-10-170-22-104:27017" }
            {  "_id" : "shard3",  "host" : "shard3/ec2-184-169-219-11.us-west-1.compute.amazonaws.com:27017,ec2-184-169-239-214.us-west-1.compute.amazonaws.com:27017,ip-10-170-215-20:27017" }
      databases:
            {  "_id" : "admin",  "partitioned" : false,  "primary" : "config" }

    mongos> 
        • In the above status, you should see the hosts associated with each of your shards.

    You now have a MongoDB sharded cluster accessible via the public-address of the mongos instance... enjoy ... and don't forget to destroy the environment when you're done with it:

     juju destroy-environment


    -Juan

    ]]>     Juan Negron     Kubuntu got Donations, KDE needs Donations http://werghdf.blogspot.com/2012/09/kubuntu-got-donations-kde-needs.html http://werghdf.blogspot.com/2012/09/kubuntu-got-donations-kde-needs.html Fri, 21 Sep 2012 13:31:00 GMT DSCF7055 There we were starting discussions for the Ubuntu Developer Summit at the end of October in Copenhagen and wondering who we could afford to send when I got a nice e-mail asking what it would cost to send everyone who wanted to go. I replied with a rough budget of what the flights and hotel would be and next thing I know that amount had appeared in my Paypal account. Now I like to think Kubuntu is a friendly and trusting community but this is generosity beyond my expectations. I'm constantly amazed with how much people like Kubuntu and how they show it.

    Now KDE needs your donation for the annual Randa Sprint of kde-core developers. It's nearly at the target so let's see if we can push it over the line today! Click here to lend your support to: KDE Randa Meetings and make a donation at www.pledgie.com ! ]]> Jonathan Riddell UK LoCo Christmas Dinner @ Dans Le Noir https://itigloo.com/2011/12/10/uk-loco-christmas-dinner-dans-le-noir/ https://itigloo.com/2011/12/10/uk-loco-christmas-dinner-dans-le-noir/ Sat, 10 Dec 2011 14:36:44 GMT Thanks to Alan Bell for organising a wonderful Christmas dinner at Dans Le Noir last night. It was a wonderful venue and the food was amazing. I never realised how dark, dark could really be.

    I would recommend this restaurant to anybody.  Also remember, this is the only restaurant  where you can get away with eating with your fingers and licking your plate when you are finished. As it is so dark, who would ever know.

    I was however, slightly disappointed that some of the other members of the podcast team couldn’t come. Maybe to make up for this, they should all be blindfolded while recording the next podcast.  Just a suggestion 😉

    ]]>     Chris Woollard     UDS Day 3 https://gilir.wordpress.com/2011/11/03/uds-day-3/ https://gilir.wordpress.com/2011/11/03/uds-day-3/ Thu, 03 Nov 2011 04:33:54 GMT

    Today Sessions :

    Defect Analyst Bug Review Dashboard

    http://summit.ubuntu.com/uds-p/meeting/19483/other-p-bug-dashboard/

    https://blueprints.launchpad.net/ubuntu/+spec/other-p-bug-dashboard

    This session was to create a way to monitor bugs across several packages and in an efficient way. Currently, most people who want to work on bugs of multiple packages create a team and subscribe all packages to this team. It’s working to get information, but nothing exist to summarize statistics about the bugs (status, severity, in progress …).

     

    Ask Ubuntu for the experts

    http://summit.ubuntu.com/uds-p/meeting/19717/community-askubuntu-experts/

    https://blueprints.launchpad.net/ubuntu/+spec/community-askubuntu-experts

    Presentation of Askubuntu.com, and some advanced features to use it (edit, tag, bounty, votes …), and possible integration with Loco teams. It still sad that it’s only in English, so not easy to do support, in counties which don’t speak English.

     

    Calendar Integration

    http://summit.ubuntu.com/uds-p/meeting/19450/desktop-p-calendar-integration/

    https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-calendar-integration

    This session was to discuss the use of a calendar application, because with the switch to Thunderbird, there is no calendar in 11.10.

    There is different solutions :

    – Adding extension to TB to handle calendar features. But some people express the wish to have no extension by default on TB.

    – Adopting Maya, the calendar application of Elementary OS. But this application is not finished, and it needs help to be functional.

    – Write a new application. But it needs time and resources, + it will probably be dropped once Gnome have it’s own calendar application, or if Maya is finished and works well.

    Discussion followed in the Default application session, and probably nothing will happen this cycle to add a calendar solution (unless a drop-in solution is found).

     

    12.04 LTS (Precise Pangolin) Release Planning

    http://summit.ubuntu.com/uds-p/meeting/19548/other-p-release-lts-planning/

    https://blueprints.launchpad.net/ubuntu/+spec/other-p-release-lts-planning

    This one was about the schedule of the release, the different milestones etc … It’s a review of the current roadmap, and adjustments of it. For example, the DebianImportFreeze (the date when automatic imports from Debian testing stopped) was moved later in the cycle due to Christmas break. Also, it was confirmed that there will be no RC official images, but a period when images will be declared as “release candidate”.

    Also, the status of derivatives was discussed. Finally, something was written about the status of derivatives, how you can achieve this status, what support is provided by Canonical … It was something always blurry, and we suffer it when Lubuntu tried to be official.

    See details on :

    https://wiki.ubuntu.com/RecognizedDerivatives

     

    The plenaries was about ARM technology and patents. There was also the traditional group photos after.

     

    GNOME Version

    https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-gnome-version

    http://summit.ubuntu.com/uds-p/meeting/19454/desktop-p-gnome-version/

    This session was to discuss which version of GNOME will be shipped, 3.2 (the actual stable one) or 3.4 (the next stable one).

    For the 2 main parts of the platform (GTK and glib), the plan is to update them to 3.4. It may have problems with multitouch support which is now included in GTK. It may conflict with Ubuntu multitouch implementation. There was also a discussion about the idea to have some sort of LTS version for GTK (discussion to be continued with GNOME people).

    The plan for the rest of the applications is to stay by default on 3.2, and pickup components from 3.4 in some cases. Nautilus (and gvfs), Evolution for example should stay with 3.2, like empathy. For other small applications, it will be discuss case by case.

     

    Default Apps Discussion

    https://blueprints.launchpad.net/ubuntu/+spec/desktop-p-default-apps

    http://summit.ubuntu.com/uds-p/meeting/19442/desktop-p-default-apps/

    This is the usual session to discuss applications by default. Many topics was discussed :

    – Inclusion of Boot-repair in the Live-CD : probably yes if there is no stopper.

    – Inclusion of FreeRDP : to be check with security.

    – Video editor : No (not needed by default)

    – Rhythmbox / Banshee :

    This subject was a bit of surprise for me, I didn’t expect such discussion will happen. However, the 2 applications have problems :

    – Banshee : Problem on ARM (doesn’t work), no GTK3 support, and removing Banshee will remove Mono from the CD (good for the space) and probably from main (which make Security team happy, not having to maintain Mono stack for 5 years)

    – RB : U1 store need to be updated, Music lense needs to be updated, it needs a release from upstream.

    A quick vote on usage of both applications in the room makes approximately a 50 / 50 result (maybe a bit more for RB).

    Conclusion, RB will probably be back on the CD, if no problem is raised by the other teams not present during the session. The decision was not easy, but IMO it makes sense in the context of an LTS. And, well, Banshee will still be available in the archive, will at least the same level of integration than in 11.10.

    ]]>     Julien Lavergne     FlossManuals/Google Documentation Summit https://dindafoss.wordpress.com/2011/10/18/flossmanualsgoogle-documentation-summit/ https://dindafoss.wordpress.com/2011/10/18/flossmanualsgoogle-documentation-summit/ Tue, 18 Oct 2011 13:45:26 GMT I’m fortunate to be included in the group attending the Floss Manuals & Google hosted event Documentation Summit. Four really worthwhile and interesting projects were chosen and several freelancers (like myself) are also helping out. The format is part unconference and part book sprint. The goals are promote dialog among the various FOSS folks as well as produce a book about each project in three days. Pretty ambitious!

    Dialog is easy, there is never a lack of ideas and suggestions. The projects include KDE, OpenStreet Map, Sahana and OpenMRS. Sahana is an emergency relief and disaster planning project and OpenMRS is a Medical Records System for developing areas. These were the two projects I knew the least about coming into the event but both have greatly impressed me with their scope and team members.

    The books will be available for download by this weekend so I’ll update everyone on where to find them. Also, if you’re a developer looking to scratch an itch and help folks, one of these projects might be for you! If you’re a System Admin or make recommendations to organizations who might need a great OpenMRS or disaster planning software, we’ll have a book for you at the end of the week.

    Follow the event on twitter #docsummit #flossmanuals

    ]]>     Belinda Lopez     Ubuntu Global Jam Oneiric http://tumbleweed.org.za/2011/09/05/ubuntu-global-jam-oneiric http://tumbleweed.org.za/2011/09/05/ubuntu-global-jam-oneiric Mon, 05 Sep 2011 17:22:04 GMT We had quite a successful Ubuntu Global Jam on Saturday. Thanks Yola for hosting us. It was only 5 of us, and I was the only one with any uploads under my belt, but the nice small team meant I had time to help everyone fix some build failures. We had intended to focus on Scientific packages, but it was easier to just pick arbitrary build failures from the most recent archive rebuild.

    Maia visited us briefly at lunch time and took some photos, thanks :) Sorry you couldn’t stay longer.

    Some stats from the jam

    Examples that we fixed together:

    Kyle Williams:

    Marco Gallotta:

    Michiel Baird:

    I think that’s pretty good for a day’s work :P

    In other news

    Eep, haven’t blogged an ages. Since I last blogged, I’ve become a Debian Developer, made an Ibid point release, been to (my first) UDS and a Debconf (which were both fantastic, and very different), spent a week sailing in Croatia with my brother, and been pulled into the Ubuntu release team. All this has meant little progress in my MSc, though :/

    ]]>     Stefano Rivera     The sooner the better. https://primes2h.wordpress.com/2011/06/06/the-sooner-the-better/ https://primes2h.wordpress.com/2011/06/06/the-sooner-the-better/ Mon, 06 Jun 2011 10:32:19 GMT Hi everybody!

    Oneiric Alpha 1 is out and ready to be tested in your laptop.

    If you want to be sure your graphic/audio card, touchpad or whatever work when Oneiric will be released on October 13th join us in the Laptop Testing Project.
    You can discover every early bug to allow developers enough time to fix those bugs in time for the Official Release.

    The procedures for testing images and reporting results are
    explained on https://wiki.ubuntu.com/Testing/Laptop/Procedures

    Test results will be tracked on http://laptop.qa.ubuntu.com/

    Bugs have to be reported in the Ubuntu bug tracker (see https://help.ubuntu.com/community/ReportingBugs)

    If you are new to this please register on the tracker, one account per laptop you own.
    Remember that you don’t have to if you already tested a laptop last cycle or have an account for ISO testing.

    Please let us know if you have any questions, in #ubuntu-testing IRC channel on the Freenode network or joining the QA mailing list at https://lists.ubuntu.com/mailman/listinfo/ubuntu-qa

    Good testing!

    ]]>     Sergio Zanchetta     Ubuntu Power Users: first meeting https://ubuntumug.wordpress.com/2011/05/27/ubuntu-power-users-first-meeting/ https://ubuntumug.wordpress.com/2011/05/27/ubuntu-power-users-first-meeting/ Fri, 27 May 2011 13:18:16 GMT The Ubuntu Power Users Community had a meeting on Thursday, May 26, 2011 at 17:00 UTC in the #ubuntu-meeting channel. This was the first meeting of this new community, and we had many things on our agenda: the organization of the team, the team logo/branding, the overall team goals and purpose, our long term goals and the goals for the Oneiric cycle. Although we discussed many topics, we didn’t manage to talk about everything we originally planned.

    We started the discussion with stating our team vision. Our goal is to help power users to get the most out of Ubuntu. We want to provide a place for power users to communicate, document configuration functionality, and provide tools for tweaking the system. Basically, we want to give users the power to expand, adjust, and tweak their system. To achieve these goals we want to create documentation of tweaks and useful tools, with a mind toward safety. We don’t want to suggest tweaks that could cause issues for a user and can not be backed out of.

    We talked about what actions can be done in this cycle. A very important part of our mission is to build the Kitchen Sink: a single application that supports multiple plug-in that provides you with a plethora of check-boxes for switching on and off all kinds of different things. This application will most probably be the well known Ubuntu Tweak. The developer of Ubuntu Tweak, Tualatrix Chou has already joined our mailing list.

    The Ubuntu Power User Community will focus on making Ubuntu Tweak ready for Oneiric, and push it into the repositories. The next version of Ubuntu Tweak will have a plugin feature, so the problematic PPA part of the program can be a separate install in the next version. First, we need to focus on getting the code in shape. According to Jordan Mantha (LaserJock), it needs some analysis for safety and stability. A plugin for Unity specific settings has to be made. The packaging will fall into place pretty easily once these are done.

    An important part of our mission is creating documentation for Unity about topics like keyboard shortcuts, what options exist in CompizConfig Settings Manager and dconf-editor, and what they actually do. We already have a lot of information on Ask Ubuntu, so it can serve as a good starting point. The main problem is that Ask Ubuntu is not a documentation source. Our goal is to create high quality documentation for Power Users based on the information available on Ask Ubuntu and from other sources.

    The first meeting of the Ubuntu Power User Community was a very important milestone in the life of the project. We set some ambitious but not unreachable goals for us. If you want to get involved in the Power User Community just subscribe to the mailing list list or join the #ubuntu-power-users IRC channel on Freenode. There is a plenty of room for you to share your power with others.

    ]]>     László Torma     xexit reaches 1.0. Thanks Juha http://ltspthinclient.blogspot.com/2011/03/xexit-reaches-10-thanks-juha.html http://ltspthinclient.blogspot.com/2011/03/xexit-reaches-10-thanks-juha.html Tue, 29 Mar 2011 17:16:00 GMT nice article by Juha, I put in some polishing on xexit, my solution to rotten processes that just don't know when to quit on LTSP servers.

    I've included a (slightly modified) version of Juha's script (and, of course, added him to the AUTHORS file), got a proper manpage for it, and done some packaging.

    Certain members of the Brazillian hyper-geniuses have indicated it may be possible to get someone to sponsor it for Debian.

    In the meantime, users looking to try it can check my ppa, and grab the 1.0 version there. Note that the xexit scripts you need will be in the /usr/share/docs/xexit directory, and should be copied to /etc/Xexit.d. I don't install them there by default, as they're Gnome specific, and I don't wish to aggrivate (by default) users of other fine desktops.]]>     Scott Balneaves     Overview of a Puppet Split CA architecture http://blog.mathiaz.net/2010/10/overview-of-puppet-split-ca.html http://blog.mathiaz.net/2010/10/overview-of-puppet-split-ca.html Wed, 06 Oct 2010 17:49:00 GMT
    The Puppet Master CA is the only Certificate Authority (CA) in the whole infrastructure. It issues certificates for all Puppet agents. It also manages the Puppet Master systems.

    The Puppet Masters are only responsible for compiling catalogs requested by Puppet Agents - they don't act as CA themselves. They only accept Puppet Agents which certificates have been issued by the Puppet Master CA.

    The Puppet Agent retrieves their certificates from the Puppet Master CA the first time they run. They connect to the Puppet Masters afterwards to get their catalogs. They won't contact the Puppet Master CA anymore.

    Puppet Master CA


    The Puppet Master CA manages all Puppet Masters. In particular it distributes its own Certificate Revocation List (CRL) file to every Puppet Master. The Puppet Master CA also issues certificates to Puppet Agents.

    Puppet Master


    A Puppet Master runs under Apache and Passenger. Apache ssl module is configured to require certificates signed by the Puppet Master CA (/etc/apache2/site-available/puppetmaster):
    # Require certificates to be valid
SSLVerifyClient require
SSLVerifyDepth  1

    The Puppet Master is also configured to not act as a Puppet CA (/etc/puppet/puppet.conf):
    [main]
ca = false

    Puppet Agent


    Puppet Agents retrieve their certificate from the Puppet Master CA and request their catalog from one of the Puppet Masters (/etc/puppet/puppet.conf):
    [agent]
ca_server = PUPPET_MASTER_CA
server = PUPPET_MASTER

    Conclusion


    From a security perspective setting the SSLVerifyClient option to require increases the protection of Puppet Masters from unknown requests and revoked Puppet Agents. Having the Puppet Master CA manage the Puppet Masters also facilitates the distribution of the Puppet Master CA CRL.

    On the reliability front new systems won't be added to the infrastructure if the Puppet Master CA is unavailable. However existing Puppet Agents are still functional as long as they can connect to a Puppet Master.]]>     Mathias Gug     Microsoft takes off the mask https://antoniosanchez.wordpress.com/2010/05/04/microsoft-takes-off-the-mask/ https://antoniosanchez.wordpress.com/2010/05/04/microsoft-takes-off-the-mask/ Tue, 04 May 2010 19:28:01 GMT Recently the General Director for Education of Microsoft took off his mask arguing in a interview that here, in Andalusia, we are using software that Microsoft left ten years ago.

    Here in Andalusia, at the south of Spain, every computer (400.000+) at the schools runs «software libre» thanks to the commitment made by the regional government 7 years ago. Specifically, we run Guadalinex Edu, a base of Ubuntu with a lot of free educational applications in the top.

    During the interview you can read in spanish somethings like these:

    • Journalist: «Andalusia has introduced free software in schools and has left out Microsoft …»
    • Microsoft: «There are few communities that have implemented only free software, Andalusia is one. Free software is not sustainable by the model itself. We invest 9500 million annually in research and development and the results are the products we put on the market. We know what it takes to make an operating system and it’s a lot of money. The software is free of charge but who is paying this price? Because we have to pay someone to operate and maintain, and these costs are more expensive than ours. This is obvious because there are other interests behind. Free software is built with subsidies and you can’t do subsidies to be the engine that supports a model of technological innovation in the school.»
    • Journalist: «Guadalinex is similar enough to Windows, right?»
    • Microsoft: «Well, if you look in Windows 7, it does not look like Guadalinex at all. Sometimes, we make the mistake of comparing the latest versions of these operating systems with Microsoft products launched back in 2000. You say that the software used by schools in Andalusia is similar to XP, fine, but Windows XP is that it launched a decade ago. We left it 10 years ago and the world has changed. And if you keep Windows XP is due to a poor idea: Is it enough with what I have? Depends on the needs and if you want to give our kids the best or not.»

    With the new version of Guadalinex Edu based on Ubuntu Lucid Lynx our students and teachers can:

    • interact with each other thanks to new collaboration tool in a simple way.
    • install a lot of software previously tested doing a single click through the software center.
    • make a backup of all their personal files in a usb stick and recover it later doing a single click.

    all of then installed and ready for use in less than 30 minutes through the network or usb device.

    Furthermore, every people of the educational community can obtain professional support by phone for free of charge through the Advanced Center for ICT Schools Management who is in charge of the maintenance of the whole network. How many of these services offer Microsoft?

    I would like to recommend this person of Microsoft to have a look at the new version of Guadalinex Edu (available in few days) and then ask him what do they think is the best for kids? Perhaps motivation, enthusiasm and hard work of the entire free software community can exceed 9.5 billion invested by Microsoft. Don’t worry about kids, you must be worried about the day when these children reach the professional market and the quality and freedom of the free software used at schools will have more weight than all the investment you are doing in your proprietary software.

    :wq

    ]]>     Antonio Sánchez     Webling und Android http://blog.diener.li/allgemein/webling-und-android/ http://blog.diener.li/allgemein/webling-und-android/ Mon, 09 Nov 2009 14:27:34 GMT Ja ich habe seit Kurzem auch so einen kleinen Alleskönner als Handy. Auch wenn ich meinen Freerunner sehr mag, auf mein neues Spielzeug ist einfach mehr Verlass. Da mein altes Handy einem Wasserschaden (kein Kommentar) zum Opfer fiel, besorgte ich mir ein HTC Hero mit Google Android. Ein iPhone wollte ich nicht und ich bereue es bis heute nicht. Mein kleiner Held ist nicht nur die Hälfte so teuer, sondern bringt auch alles mit was ich brauche.

    Nun aber zum Wesentlichen. Etwas vom dümmsten an Handys war bislang die Portierung der Kontakte auf das neue Gerät. Umso erfreuter war ich, dass es dieses Mal sehr einfach ging. Da Android nun mal von Google kommt, unterstützt es natürlich auch Synchronisation mit dem Kalender, den Mails und den Kontakten von Google. Wenn man mal die Bedenken bezüglich der „Datenkrake“ Google aussen vor lässt und sich auf die funktionellen Fakten bezieht, dann ist das mehr als nur optimal. Angenommen man benutzt bereits die genannten Google Dienste bereits, muss man auf dem Android lediglich seine Kontodaten angeben und alles regelt sich von selbst.

    Wie einige von euch wahrscheinlich wissen, bin ich Teilhaber von uSystems GmbH, die unter anderem eine Vereinsverwaltungssoftware entwickelt. Die nennt sich Webling und kann eigentlich viel mehr, aber in diesem Beispiel brauche ich sie nur als Adressverwaltung. Denn seit einiger Zeit habe ich mir eine persönliche Instanz davon unter den Nagel gerissen und brauche es um die Kontaktdaten meiner Freunde zu verwalten. So habe ich einen zentralen Ort, wo ich von überall darauf Zugriff habe. Warum ich das erwähne? Nun Webling kann Daten nicht nur Importieren, sondern auch in diversen Formaten exportieren. Hier zeigt sich wieder mal, dass gewisse simple und bereits recht alte Standards auch heute noch immer super sind. Denn Webling bietet unter anderem die Möglichkeit in eine CSV-Datei zu exportieren und Google wiederum diese zu importieren. Und da die Google Kontakte ja mit meinem Handy synchronisiert werden, habe ich nun sofort alle meine Kontakte auch auf meinem Handy. Und sollte ich mal einen neuen Kontakt nicht importiert haben, so kann ich jederzeit von überall über den neuen Webling Mobile Client auch per Handy auf alle Daten zugreifen. Sehr praktisch sag ich da nur!  🙂 (Auch wenn ich natürlich etwas voreingenommen bin.)

    ]]>     Carlos Diener - emonkey     UDS Karmic &#8211; Day One https://mgunes.wordpress.com/2009/05/26/uds-karmic-day-one/ https://mgunes.wordpress.com/2009/05/26/uds-karmic-day-one/ Tue, 26 May 2009 11:45:43 GMT I’m in Barcelona to attend the Ubuntu Developer Summit for Karmic Koala, thanks to the kind sponsorship of Canonical, and I thought I’d use the last bit of  energy I have left from the first day to post short summaries of the sessions I attended.

    Increasing Apport Coverage

    This QA session was about increasing the coverage of the Apport automated bug reporting tool. One obvious way to do this will be to increase the amount of packages with Apport package hooks, so the QA team will lead a drive to do exactly that. The target will be to make sure that packages to which a sampling (likely by a 50% reduction) of the last 1000 bugs  filed belong have hooks by the next release. The #1 blocker leading to the current situation where we have few packages with hooks was identified to be the fact that few people know that the feature exists at all or is useful to the extent that it actually is. Assuming that there’s a free time slot, a plenary tutorial will be held about this in an effort to remind attending developers and QA people of this relatively simple yet rather important task.

    Design and Usability Clinic

    This was a hands-on session where the Canonical Design and User Experience Team offered aid to people who needed design/UX advice for their projects in a “clinic” setting. After about quarter an hour of introductions and roundtable talk, the attendees divided up into several groups discussing usability issues in their respective projects. A nice and apparently improvised byproduct was the permanent “UX Clinic” table that got set up in the lounge, around which similar discussions went on intermittently in the rest of the day.

    Specialization Within Bug Control

    Having more specialist members on the Ubuntu Bug Control team has been a recurring wish. This session focused on the new mentoring program aimed at getting more specialist (and otherwise) people from the Bug Squad into the Bug Control team. Christophe Sauthier and Emmet Hikory from the MOTU team were present to share their experiences with the mentoring model at length, which was beneficial.

    Meet Your Users

    This design/UX session revolved around (I choose the term advisedly) the theme of “personas”, that is, hypothetical audience stereotypes whom Ubuntu should be designed for. The premise Ivanka Majic, the session lead, put forward was that basing design decisions on the requirements of the more “peripheral” users in terms of association and attachment to Ubuntu and free software would both cover various specialist bases, and ensure that the more central area which has requirements that are more homogeneous and already better catered for would be covered as well.

    Attendees suggested various stereotypes along the lines of  “students”, “children”, “administrators” and “media producers” on post-it notes, part of which were later evaluated on scales according to criteria such as age, social status, influence level, cultural background, so on.

    My only gripe with this session was paradoxically also the major highlight of it: the talk seemed to stay hung up in the air, with no real conclusion or points to act from (the Gobby server failing and the consequent lack of collective notes certainly didn’t help). Of course this was the start of what we hopefully all expect to be a long conversation; the abrupt interruption of time running out only underlined the hunger I felt, and felt that others also felt, for more in-depth discussion of the audience factor in free software design and usability, and that in itself is promising, given that it’s actually gaining traction in Ubuntu now. Had Troy Sobotka, who has been an outspoken, if unforgiving, proponent of audience-aligned design in free software attended, he might have burst into tears of joy.

    Finding Tasks For New Developers

    Daniel Holbach this session, which focused on coming up with new means of offering “bitesize” work to new contributors to Ubuntu, mainly in the development area, which would further lower the barriers of entry and attract different sets of would-be contributors.

    ]]>     Murat Güneş     Next Stop UDS https://dendrobates.wordpress.com/2009/05/20/next-stop-uds/ https://dendrobates.wordpress.com/2009/05/20/next-stop-uds/ Wed, 20 May 2009 13:42:24 GMT All the Canonical folks are meeting this week prior to UDS.  We’ve already had some great discussions including:

    Canonical Plan for World Domination

    — text redacted —

    (Sorry, if I told you, I’d have to kill you.)

    Actually, it is a great time to see all our co-workers from across the globe.  However, I can’t wait for next week, when UDS starts.  UDS is a great time to see all of you, the people that make Ubuntu great.  Please come up to me and talk to me, even if I seem busy.  We are randomizing the tracks this UDS, so each track will move to a new room after each session.  There is no more hiding in a room and not meeting new people.  Please take advantage of it.  The F/OSS world is a weird diverse and interesting place, don’t let yourself miss any of it.

    ]]>     Rick Clark     The Way to a new Ubuntu party for the Jaunty Jackalope http://kalon33.blogspot.com/2009/05/way-to-new-ubuntu-party-for-jaunty.html http://kalon33.blogspot.com/2009/05/way-to-new-ubuntu-party-for-jaunty.html Tue, 05 May 2009 16:15:00 GMT
    A new party is cooking at Bordeaux on May 23rd ! For the fifth edition, this time helped by the ABUL, The Giroll lug perpetuates the tradition of cheerfulness which has made the reputation of its parties. It's also the time to be a little bit more ambitious, a little bit more one year before the Software Libre Meeting (a.k.a. RMLL) 2010 which will be held in our nice town of Bordeaux. In fact, this time we hope doing more stuff like Ubuntu discovery, Gaming using Linux... But keeping our webradio (see previous posts), our Free lunch (free as "Libre", as we also share cooking recipes of the meals we share at this lunch) and our Install Party. As usual, it starts around 10am at the ECM Saint-Pierre and will finish a bit late (last time, at the public radio show, we finished at 2am... ;)). Conferences will be also organised by our partner ABUL at the Utopia Cinemas (100m from the ECM) the first one at 2pm and the second one at 3.30pm, about the Software Libre issues and consequences. The expended programme will be:

    • 10am: Welcome coffee for the early morning enthousiasts
    • noon: Free Lunch, bring one or more of your meals and recipes to share them with us !
    • 2pm: Conference: les enjeux du logiciel libre (in french) by Pierre Jarillon at cinéma Utopia
    • 3.30pm: Conference: les enjeux du logiciel libre (in french) by Pierre Jarillon at cinéma Utopia
    • 4.30pm: Conference: Ubuntu Jaunty Jackalope (9.04) News by Nicolas Derive (kalon33, me ^^)
    • 6.30pm: Start of the Radio-Giroll Show in live and in public.
    • All the day (10am-8pm or more): Install Party, Animations about Ubuntu discovery and Gaming, and some more depending on people expectations.
    We're hoping you will attend !!

    For more information, call or let us a message at +33581314334 or mail us at contact at giroll dot org

    French announcements are available here and there (Thanks to Ephase and ABUL)
    Artwork from the poster (designed by Ephase) is available here under Creative-Commons 3.0 by-Sa license. Please let us a comment and a link if you use it :)]]>     Nicolas Derive     Ubuntu Makassar : KoPi Ngoprek 4.4 https://kipas.wordpress.com/2009/04/26/ubuntu-makassar-kopi-ngoprek-44/ https://kipas.wordpress.com/2009/04/26/ubuntu-makassar-kopi-ngoprek-44/ Sun, 26 Apr 2009 14:45:21 GMT Muhammad Takdir