#ubuntu-uds-foundations-1 2013-05-14 <cjwatson> oh wow, my client has been logged in here since UDS 13.03 and I forgot about it <zyga> hi <zyga-uds> hi everyone <brendand> cjwatson, can you provide me the link for the first session (i'll be running it) <cjwatson> brendand: I'll start up the hangout once the plenary has finished <zyga> hi <cjwatson> I think there are access controls on summit that mean I need to start it up (or bdmurray, but me in this case), but more than happy for you to run the actual session :) <brendand> cjwatson, do you know do people need to be specifically invited, or do they just need the link? <cjwatson> they just need the link AFAIK <cjwatson> so you can pass it on <cjwatson> but there's a limit of *mumble* <zyga-uds> welcome everyone, if you need to join the hangout ask for the link please <roadmr> zyga-uds: I need to join the hangout :) <zyga-uds> if you wish to help with making notes in the etherpad on the side here, please do so <zyga-uds> roadmr: you'll get a link as soon as we get one <roadmr> zyga-uds: oooh :) ok heh * udsbotu changed the topic of #ubuntu-uds-foundations-1 to: Currently no events are active in this room - http://summit.ubuntu.com/uds-1305//foundations-1/ - http://ubottu.com/udslog/%23ubuntu-uds-foundations-1 * brendand feels like trusting people and posting the link here - rather than sending it to everyone privately. thoughts? <zyga-uds> +1 <zyga-uds> it will make it easier for people to join <zyga-uds> and if it fails, we'll know <sfeole> o/ <zyga-uds> hi <cjwatson> just fighting G+ to start it up now <sfeole> hey zyga <brendand> cjwatson, just pop the link in here when you're ready <brendand> cjwatson, thanks <cjwatson> https://plus.google.com/hangouts/_/e57d55608285e7215ba3273218e8ae43d4244d2e?authuser=1&hl=en-GB * udsbotu changed the topic of #ubuntu-uds-foundations-1 to: Track: Foundations | Checkbox Certification for ARM Servers | Url: http://summit.ubuntu.com/uds-1305/meeting/21723/foundations-1305-checkbox-arm-server/ <cjwatson> there's a fairly substantial lag between the hangout and the youtube video, just so you know <cjwatson> don't know if that's inherent or due to my network <roadmr> hello <zyga-uds> we'll be starting in about 5 minutes, <zyga-uds> at 16:05 UTC <brendand> cjwatson, new url or same one? <cjwatson> https://plus.google.com/hangouts/_/a5bb0a674d670614230e303f5f9e384e7dbbc0e6?authuser=1&hl=en-GB <cjwatson> no control over that I'm afraid <cjwatson> I think it's all back now <brendand> vanhoof[uds], https://plus.google.com/hangouts/_/a5bb0a674d670614230e303f5f9e384e7dbbc0e6?authuser=1&hl=en-GB <cjwatson> just starting the youtube feed <brendand> schwuk, want to join? <schwuk> brendand, not sure I will have much to contribute, but I'm certainly interested in the discussion <brendand> schwuk, may as well, plenty of room <smagoun> youtube feed just came online for me <zyga-uds> https://plus.google.com/hangouts/_/a5bb0a674d670614230e303f5f9e384e7dbbc0e6?authuser=1&hl=en-GB <smagoun> cjwatson: ^^ <cjwatson> yep <mahmoh> it's working for me now <cjwatson> I have no idea whether it's going both ways over my ADSL; if it is, then, well, good luck <roadmr> cjwatson: it seems to be working fine, thanks for manning the a/v thingamajig! * cjwatson puts on the crew hat <zyga-uds> gema if you want to join:Â https://plus.google.com/hangouts/_/a5bb0a674d670614230e303f5f9e384e7dbbc0e6?authuser=1&hl=en-GB <gema> zyga-uds: I will join if I need to, I am listening for now <zyga-uds> thanks <dannf> does checkbox use lshw? <roadmr> dannf: no, it doesn't. BTW let me know if you want a slot in the hangout, there's plenty of room and we love contributions and discussion <brendand> roadmr, can you say that in the hangout? <vanhoof> brendand: ara: you can sign me up to get you access to newer kit for virt <brendand> https://plus.google.com/hangouts/_/a5bb0a674d670614230e303f5f9e384e7dbbc0e6?authuser=1&hl=en-GB <ara> vanhoof, great :) <gema> QUESTION: are you going to evolve checkbox or are you going to keep the level of development you have on desktop and just grow the server side of the tool_ <gema> ? <gema> but some tests may only be applicable to desktop <bladernr> those are not run on servers <gema> bladernr: ack <bladernr> different test whitelists are used <gema> bladernr: understood <dannf`> device tree <dannf`> which kernel exposes from firmware <mahmoh> dmidecode (lost the stream) has a flag (that I can't think of atm) that will run early support for ARM <spineau> mahmoh: good to know, I'm adding a note for that <vanhoof> eep <vanhoof> booted <zyga-uds> I need to go AFK for 3 minutes <zyga-uds> roadmr:please take over etherpad <roadmr> zyga-uds: got it <mahmoh> spineau: if I remember the flag I'll let you know but it should be easy to find with the tool or ask colin worst case <spineau> mahmoh: ok, thanks <mahmoh> np <bladernr> I don't see why we would <zyga-uds> re <bladernr> Unless there's some special sort of marketing push for ARM systems, otherwise, a server is a server <mahmoh> it would be nice to be able to sort on arch <mahmoh> but that's not a requirement, just a nice to have <victorp_uds> hi ara <vanhoof> zyga-uds: can you pop in lshw -xml into the etherpad, I lost my session <bladernr> Is there anyting special about an ARM chassis that differs from a blade chassis? <victorp_uds> OEMs will be selling chassis with sleds on them I guess. So it is probably good to have something for the chassis set up too <zyga> vanhoof: pop in? <vanhoof> add it :) <victorp_uds> bladernr: in some cases they are the same chasis <narindergupta2> ipmi test could be one of them <vanhoof> bringingmy session back up <mahmoh> there are differences but they should be transparent from a cert perspective <zyga> vanhoof: done <bladernr> victorp_uds: ack <bladernr> mahmoh: that was my impression... the chassis is just a 'container' (yes, more than that, but from the actual server/blade POV, it's transparent) <victorp_uds> ara sorry Â I joined late, but are we including MaaS testing as part of certificaition testing for hyperscale servers? <mahmoh> bladernr: right <mahmoh> QUESTION ^^ <ara> victorp_uds, MaaS is going to be greylist for server certification and required for cloud <victorp_uds> It needs to be reuired too for hyperscale servers <victorp_uds> otherwise they cant be used <victorp_uds> :) <narindergupta2> i think we should start categarizing the hyperscale different from server. <victorp_uds> narindergupta2:+1 <victorp_uds> brendand: just use MaaS!!! <narindergupta2> +1 <victorp_uds> brendand:if you dont test MaaS then you are not testing the full solution <victorp_uds> brendand: definetly <victorp_uds> ara - are we having a different whitelist for hyperscale? <ara> victorp_uds, we haven't decided it <ara> victorp_uds, if we can avoid it, we will, if in the end we need specific tests, we will create a new one <ara> victorp_uds, we will use the server one until we really need to fork <victorp_uds> ara - I would rather you use the cloud whitelist rather than the server white list <victorp_uds> if you dont have a dedicated hyperscale one <narindergupta2> yes it has <victorp_uds> vanhoof: \o/ <vanhoof> victorp_uds: :D <narindergupta2> infact they have power management through chassis <narindergupta2> and fan control and power supply control <narindergupta2> through chassis <bladernr> but is that really through the chassis, or via ipmi passed from the chassis MM to the blade BMC? <narindergupta2> for BL series you are correct but for moonshot it is through chassis as BMS is in chassis <bladernr> ahhh <narindergupta2> /s/BMS/BMC <bladernr> that is different :) so instead of each cartridge having it's own bmc, there's then one master that controlls all cartriges (even in a mixed cartridge environment?) <narindergupta2> yes i BMC controlling 15 cartridge <narindergupta2> so total 3 BMC for 45 nodes within one chasssis <bladernr> wow <bladernr> that's pretty neat <zyga> brendand: really good session, thanks <lool> Next: Click Packages <brendand> zyga, yeah surprisingly <ara> great, I can stay here then <brendand> zyga, i thought we had everything fleshed out already :) <zyga> brendand: yeah, same here <mahmoh> juju bootstrap ; juju status * brendand runs off to SDK feedback session <mahmoh> hi spineau, bye spineau * udsbotu changed the topic of #ubuntu-uds-foundations-1 to: Track: Foundations | Click packages | Url: http://summit.ubuntu.com/uds-1305/meeting/21760/foundations-1305-click-package/ <aquarius_uds> hey all <bkerensa> hi <dbarth> hiya <dholbach> hiya <mdeslaur> hello <cjwatson> https://plus.google.com/hangouts/_/d3fd1e25ecacb43fde03034a86b8a3345f19b801?authuser=1&hl=en-GB <cjwatson> on air shortly <cjwatson> on air now <cjwatson> who wants to hop onto the hangout? <beuno> cjwatson, this will all be client side, right? <Laney> not on here <beuno> if so, I'll watch from the shadows <apw`> cjwatson:yep we can see yo <dbarth> it's on now <cjwatson> beuno: I expect there will be questions about server side too * Laney stabs firefox <Laney> oh yes <SuperMat1> hi guys! * ogra_ sees two guys hanging <apw`> yes you are good <beuno> cjwatson, ok, ok, I'll hop in <ogra_> yes <xnox> yeah <SuperMat1> yes, we can see you <alecu> loud and clear <barry> yes * xnox is watching you well from New York public library =) <sergiusens> you are hearable <aquarius_uds> https://lists.ubuntu.com/archives/ubuntu-devel/2013-May/037074.html is the discussion on ubuntu-devel <rickspencer3> o/ <olli-uds> hiho <rickspencer3> hi aquarius_uds I was invited to join, so I joined ;) <ogra_> joined and left :P <dobey> can qml not be byte-compiled? <mdeslaur> Any reason why the manifest file in the binary package doesn't simply point to a public source code repo when the source is available? <mdeslaur> ie: why even have a source package format <dobey> if random people are uploading it, we aren't distributing it are we? the person uploading it is <cjwatson> we're certainly (re)distributing it <dobey> we're just a "file sharing service" in that respect <cjwatson> it is not generally that simple :-) <xnox> it would be nice to upload the source and/or download them in addition to the app. <mdeslaur> ok, source package formay is bzr, and you install it with bzr co <apw`> cjwatson:can we not just 'keep' the <package>_src guarenteed available for the source once we have figured it out. <apw`> ie, so we have <package>.click and <package>_src.click <xnox> some people embed src tarball inside the app-package. but it's cumbersome to download on your developer machines. One would want to download it on your laptop instead of your phone. <TheMuso> dobey: I thought I read somewhere that QML could be byte-compiled, but I may be mixing it up with somethign else. <ogra_> rickspencer3, that will eat your disk on the phone fast <rickspencer3> hi ogra_ well, that's what I'm asking <rickspencer3> how much will it *really* do that, versus how much are we just worried that it will? <dobey> TheMuso: it would seem a bit odd to me if it wasn't possible, at least. <cjwatson> there are certainly source packages in the Ubuntu archive which are significantly larger than the binaries <ogra_> rickspencer3, i want to write a DVB TV app that needs 6 libs plus my C++ source plus the QML for the UI <cjwatson> though I would need to do some research if you wanted specifics :) <ogra_> i would have to include all of that source <rickspencer3> ogra_, right, but that seems like an exception to the rule <victorp_uds> rickspencer3:I think the amount of apps that will include *a* gpl component will be high <TheMuso> dobey: Especially if a dev wanted to obfoscate some secret class that they didn't want people to grab. <dobey> TheMuso: right, or an API key for a web service <ogra_> rickspencer3, devs are crazy people :) <xnox> Have the "source app store" for the desktop =) <Laney> aren't we going to need a source package format to get stuff built anyway, never mind the distribution problem? <xnox> login - and download the sources for apps installed on your phone =) <alecu> Hi, my team will be working on the UI to install click packages, and we'll need to get a list of apps installed by the current user, and download new application packages, so: QUESTION: who will be handling the database of installed packages? lp:click-package as well? <victorp_uds> cjwatson:do people need to get to it from the phone? they could download it from an app store website <xnox> Laney: good point. <beuno> alecu, no, the server <beuno> <---- <beuno> well <beuno> no <beuno> I lie <ogra_> liar <beuno> not the installed apps <dobey> right, liar <alecu> beuno: you usually do :-) <beuno> :) <beuno> <---- not <dobey> server will know what's been "purchased", but not if it's installed on a particular device <geofft> Laney: Not necessarily. For proprietary apps, my workplace at least is already working around Debian source packaging. <geofft> Laney: And I keep pondering just switching to ar and forgetting proper source packaging. <james_w> Laney: only if we're expecting to have a buildd system for these. If the developers upload binaries then we don't need it <alecu> dobey: the android server knows what is installed on each of your devices, though. <barry> cjwatson: even on the desktop, leaf packages only, right? <cjwatson> IMO yes <barry> +1 <alecu> dobey: (I'm not saying that's a good idea, though) <glatzor-uds> Hello, as anaptdaemondeveloper I am interested at which level the new package system will be integrated? Will there be a separate (perhaps DBus) API for the management? <dobey> alecu: right, that's certainly possible. but i'm not sure it's reasonable :) <Laney> james_w: Indeed, I was assuming we would have that <Laney> don't know what other app stores do <beuno> there is no plan to have a build system on the server <beuno> we'll ask for built binaries <cjwatson> glatzor-uds: noted, will get to that shortly <Laney> intriguing <AlanBell> can other people host a repository for click packages? <beuno> cjwatson, see alecu's question about what tracks installed apps <dholbach> maybe we could all prefix questions with QUESTION: so they stand out? <brunogirin> aquarius_uds: also if you focus on a simpler packaging model, you won't be able to repackage everything <cjwatson> urgh, my connection fell over <beuno> AlanBell, yes, it will just be http(s) downloads <cjwatson> is the hangout still running? <xnox> glatzor-uds: hey there =) <ogra_> cjwatson, yes <aquarius_uds> cjwatson: the hangout is running <aquarius_uds> but it is off air <dobey> cjwatson: yes and you're still in it it seems <cjwatson> bleh <cjwatson> my browser periodically loses its mind - I'll have to restart it <Laney> I think the lag is pretty significant <rickspencer3> I didn't think I was saying anything quite so controversial that cjwatson had to leave <dobey> or maybe not <glatzor-uds> hello xnox <zebaszp> QUESTION: where would click packages unpack to? and should we be concerned about the FHS? <dobey> oh there it goes <AlanBell> hangout has gone . . . <zebaszp> oh dammit, it died <xnox> cjwatson: =) now hangout is done pending on you coming back =) <alecu> it died <xnox> s/done/gone/ <jdstrand> arg <dholbach> volveremos pronto! <xnox> "<cjwatson> my browser periodically loses its mind - I'll have to restart it" <ogra_> probably someone with a higher bandwith line should be the host <mterry_uds> Huh, hangout isn't working for me right now <Laney> haha <aquarius_uds> the hangout will be back shortly: cjwatson is returning any moment now <mterry_uds> whoops, didn't see that was old news :) <cjwatson> zebaszp: /opt/apps.ubuntu.com/<package>/<version> or similar, which should be FHS-compatible <apw`> it is poor that the hangout is owned by any one person, shame on you google * ogra_ hands out candy from the corridor <zebaszp> cjwatson, thanks :) <apw`> oh i miss the candy, though my wasteline may not <rickspencer3> hey all, does it seem to be working again? <zebaszp> not for me yet <bioevolgenec> Nope <ballock> nope <mdeslaur> Please, stay on the line. Your call is important to us. <brunogirin> rickspencer3: no <Ferruck> no <ogra_> nope <dbarth> not yet <aquarius_uds> it will return shortly <zebaszp> lol mdeslaur <cjwatson> there is a lag; the same lag likely applies to startup <Ursinha-uds> there you go <mdeslaur> ah! back now <apw`> cjwatson:we are back <ogra_> there we are <xnox> back =) <brunogirin> yay, it's back! <zebaszp> yeah! <apw`> cjwatson:i can see you from here <dobey> it's on air <xnox> refresh webpage to reconnect, btw.... <Laney> i didn't have to <brunogirin> QUESTION: so are we saying that click-package is a simple way to package simple apps and is not designed to replace .debs? <zebaszp> yes brunogirin <alecu> brunogirin: I understand that, yes. <cjwatson> brunogirin: yes <zebaszp> I said it first :P <apw`> how will security handle evaluating binary only packages <mdeslaur> apw`: we'll be confining them <bioevolgenec> apw +1 <alecu> apw`: that's what app sandboxing is for <mdeslaur> apw`: and the app author is responsable for it <apw`> mdeslaur: that is both great, and about the most scarey thing in the world :) <geofft> mdeslaur: That seems like the actually interesting part of the design. :) <AlanBell> so, version numbers and automatic updates . . . <mdeslaur> apw`: well, it's something that is quite necessary if you want a phone with 100k apps <AlanBell> and updates from one repository to another, is this all stuff that has been thought about? <alecu> apw`: each app will be run as a different user, and within an apparmor profile, and will have limited access outside its sandbox <apw`> mdeslaur:yep, i cannot deny it is correct, it is just scarey <zebaszp> QUESTION: how are user privileges handled with click packages? forÂ installation,Â removal, on runtime, etc <geofft> I'm reminded of the complaining in the Mac developer community over the Apple App Store sandbox (on the desktop) <mdeslaur> alecu: not as a different user, no <xnox> AlanBell: server-side, as far as I understand it. <alecu> mdeslaur: ack <brunogirin> QUESTION: should it include a way to package tests (as in autopilot tests)? <dobey> cjwatson: if it was via aptdaemon, it'd make things much easier :) <mdeslaur> geofft: if you don't want it to be confined, you get it in the normal ubuntu archive <alecu> geofft: good point. But inspecting source code does not scale <dobey> as far as install/remove/upgrade goes <beuno> AlanBell, the plan is for the client to ping the server with all the apps it has installed and versions regularaly, and the server responds with newer versions * ogra_ hopes we'll never get a million apps <geofft> I certainly agree that confining is right, just that it's hard :) <zebaszp> why not, ogra_? <ogra_> (i prefer 100k good apps to 1mio crap ones) <AlanBell> beuno: so, if I run a third party repo for my app, can I override someone elses app? <zebaszp> oh <geofft> mdeslaur: I'm curious about things like, does it have the Android issue where you can't refuse certain permissions? <jonobacon> ogra_: agreed <dobey> but if we use aptdaemon, will it be rewritten in c++? or will we ship python on phones? <mdeslaur> geofft: yes, but it's par for the course now...android and ios do it, etc. <ogra_> dobey, in javascript ;) <diwic> maybe if the privileges cost extra (if an application declares wanting to send SMS, Canonical takes 30% instead of 20%) that would make apps in general wanting to have the least privileges. <jdstrand> re sandboxing/confinement/isolation: https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement. I suggest taking that up on ubuntu-devel@ mailing list of #ubuntu-hardened on Freenode <cjwatson> we don't presently have a prohibition on using python for non-long-running things <mdeslaur> geofft: in v1, yes <beuno> AlanBell, yes, like it is today with PPAs and such <jdstrand> if people have questions (it is tangentially related to this, but really its own topic) <geofft> jdstrand: thanks <ogra_> dobey, we already ship python (and guess we'll go on doing so) ... you are not allowed to write daemons in it though <dobey> ogra_: aptdaemon is written in python though :) <cjwatson> a d-bus service is kind of on the edge; IMO it doesn't run for long enough to be a practical problem <ogra_> dobey, as long as it doesnt constantly run ... <xnox> REST call to a server, return paged results. <dobey> rickspencer3: having a local copy of the db <zebaszp> apt-cache? XD <xnox> (e.g. top 10, 20, 50, etc) <mdeslaur> cpu is less important than data transfer fees <dobey> searching via aptdaemon would be fine <xnox> zebaszp: no, no =) no apt-cache =) <mdeslaur> having a local database is a bad idea <dobey> hitting the rest api is going to hit network, which may more costly than just using cpu <ogra_> dobey, we dont want a db locally <zebaszp> I know, I was just kidding <glatzor-uds> next to the aptdaemon API there is also the PackageKit API (system and session).It would be sad to see another API to trigger installations/updates <ogra_> dobey, we generally have SD card speed on the disks <xnox> aptdaemon API is back-end agnostic =) such that you can search clicks and debs and rpms and etc. <ogra_> you dont want to search a DB locally if you can avoid it <zebaszp> side note: iOS (as far as I know) does not keep a local db for the App Stor <zebaszp> *Store <mdeslaur> whatever api, it needs to gain knowledge of using an online db, instead of a local db <xnox> It's a good isolation point. either of them. <zebaszp> Cydia (aka APT for iOS) does, though, but we probably don't want to go that way :P <dobey> ogra_: if it's a minimal db (and not the apt cache), it's probably not an issue in terms of speed vs. SD <beuno> there will be a search api on the server <mdeslaur> Cydia is painful :P <dobey> ogra_: network could be MUCH slower <zebaszp> indeed mdeslaur <ogra_> dobey, well, show me a package db that works fast on an SD on constrained HW and i'll agree :) <ogra_> i simply havent seen one yet <mdeslaur> a package db that contains 250k packages is going to be big. <ogra_> right <xnox> please no. <diwic> mdeslaur, not to mention the network fees to download its regular updates. <mdeslaur> yep <zebaszp> I don't know about iOS App Store data consumption because I have an iTouch, and I never bothered checking network usage <xnox> no changelogs - i'd rather have them in the app-store / on the web. And not downloaded and stored on my phone pointlessly. <zebaszp> I agree with xnox <beuno> oh, absolutely no local DB of all the apps available <geofft> IIRC iOS does the changelog as part of the app store submission, but not as part of the downloaded thing <dobey> mdeslaur: i wouldn't store the entire apt cache locally. just an index cache, and hit the network for more extensive data. we don't need to store *everything* offline <xnox> I really don't care about changelogs any more on my phone. It just updates. <victorp_uds> aquarius_uds: +1 <victorp_uds> aquarius_uds:make it optional <zebaszp> the App Store (I know, sorry for bringing it up yet again) does that, it shows a "changes" box on each app in the upgrade list <xnox> if I want to read it, I read them on my computer on the apps store "big" webpage. <mdeslaur> dobey: storing a cache with a limited subset of data adds complexity for very little benefit <xnox> zebaszp: is it app store, or the app on first launch showing it? i remeber apps themself have a "changelog widget" <cjwatson> brunogirin: where are we expecting that these would be run? <zebaszp> the app store, xnox <dobey> mdeslaur: and yet necessary if we want a fast UI <xnox> thanks. <victorp_uds> aquarius_uds:seems that we are forgetting that an app will also have a web page that people can refer too? <apw`> cjwatson:tests might want to be in the same 'hole' as source <zebaszp> at least, when I go to the upgrade section, each app with available upgrade has a "changes" dropdown <cjwatson> perhaps, yes <cjwatson> zebaszp: yeah, but it often says "Bugs fixed", right? :) <mdeslaur> dobey: oh, caching the app store data is a different issue <dobey> mdeslaur: if we're going to have live search or let users filter results while they're coming in, we're going to have to cache some data for speed <mdeslaur> dobey: why? ios doesn't, android doesn't... <brunogirin> cjwatson: as part of validating that the app doesn't break anything and as an option for users to run them locally (ok, scope creeep for v1 :-)) <zebaszp> cjwatson, sometimes, but you'd be surprised <mdeslaur> dobey: search is better served online <olli-uds> there are existing tests <zebaszp> I think changes on the last version also appear on the store itself, before downloading a *new* app <achiang> why would an end user want a test suite on the phone? <rickspencer3> hi mdeslaur o/ <rickspencer3> :) <achiang> ... downloaded as part of the app isntall <brunogirin> achiang: to file a bug report <achiang> brunogirin: i highly doubt any normal consumers would want that <mdeslaur> hehe <jdstrand> \o/ <mdeslaur> :) <jdstrand> fyi (again)> https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement <zebaszp> as an example, check Feedly's store page, the "What's new" section works as a changelog of sorts: https://itunes.apple.com/us/app/feedly/id396069556 <mdeslaur> I can join the hangout with people want to discuss security more <mdeslaur> s/with/if/ <zebaszp> but with mobile apps, you don't need much more than that <alecu> o/ <zebaszp> when apps upgrade to major revisions, though, they tend to do an advert-like changelog <xnox> In app purchases, addons, extensions? <zebaszp> like "We've redesigned the whole interface so it is now easier to do x and y", and that sort of thing <dobey> i wrote an alternate package manager once <xnox> are those going to be implemented? or those will be separate apps? (e.g. a free app and a paid app) <brunogirin> achiang: you're probably right, it could be a future extension to enable the Ubuntu app store to validate the quality of an app (or lack thereof) <mdeslaur> Users should be able to rate apps <mdeslaur> I don't think the platform is in a good position to be rating developer's apps <dobey> cjwatson: if it's all abstracted behind aptdaemon on the client, does it matter much? <beuno> yes, we have ratings and reviews <dobey> aquarius_uds: similar to when all branches on lp were upgraded to bzr v2 format <zebaszp> beuno, on USC, yes, but what about Touch? I thought the Dash would replace USC, can we rate apps from there? <brunogirin> QUESTION: ideally, we'd want to minimise app dev's effort to re-package apps from one release to another: how can we do that? <zebaszp> is there/will there be one-click packaging on QtCreator or something along those lines? <alecu> brunogirin: good point. My guess is that packages should work from release to release <dobey> zebaszp: it would be part of the "preview" in the dash, i'd suspect <beuno> zebaszp, yes, the plan is to keep using the same system <cjwatson> this is mainly an SDK job to maintain maximal compatibility <cjwatson> if you look at the format as present, it has a framework field so that you can pick different versions if need be <jdstrand> beuno: maybe I misheard-- I thought we would have a gate on manual review (even if that was not an in depth review)? <mdeslaur> I assume device compatibility via capabilities is going to be in the manifest file, and needs to be looked into server-side <beuno> jdstrand, we will have a manual review stage, yes <jdstrand> ok <beuno> how in depth, I can't say :) <jdstrand> sure <davmor22> QUESTION: is there a danger here that more space will be taken up if the apps are installing all their own libs? Also is there not more chance of malicious software being hidden in libs attached to apps? <brunogirin> alecu: yes, otherwise you release a new version of Ubuntu and some take several months to be updated or are never updated at all <zebaszp> yay! :D <dobey> does the SDK currently do cross-compiling for all the necessary archs? <cjwatson> davmor22: (a) yes if taken too far, but the primary focus is apps built against the SDK (b) apparmor confinement <cjwatson> dobey: we have a need to discuss cross-compiling with the SDK folks in detail <cjwatson> aiui it doesn't yet <cjwatson> imo it should :) <dobey> ok <dobey> right, it will have to if developers are going to upload binaries <zebaszp> just looking at his face, rickspencer3 is not amused <beuno> productized! <cjwatson> beuno: bingo <dobey> arm, i386, x86_64 at least <beuno> ralsina1, you listening? :) <aquarius_uds> ralsina1:ping :) <xnox> well, mostly =) <geofft> QUESTION: So this clearly isn't in the space of 0installer/listaller/etc. now, given sandboxing. Is the plan explicitly that it never will be? <dobey> beuno: alecu and i are at least <ralsina1> Sure! <geofft> Namely, for an ISV (like my workplace) that sells software that's inherently unsandboxable, this is sounding less interesting than it originally sounded <geofft> Which is not a complaint, just worth knowing. <xnox> geofft: nothing is set in stone. But so far for really large apps (compiled with their own libraries and large / precise dependenices) .deb and normal apt archive is the best way to go. <zebaszp> QUESTION: why isn't Rick as cheerful as the rest? <rickspencer3> hi zebaszp <zebaszp> I want to hear you laugh :P <rickspencer3> HA HA HA <rickspencer3> ? <xnox> geofft: e.g. skype is a .deb multi-arched and in canonical partner repository. I'd be expecting that on the desktop for a while still. <dholbach> thanks everyone! <aquarius_uds> ralsina1: so, could you please track the work items that arise from the app lens design in the click packages blueprint? <zebaszp> that doesn't count :( <xnox> geofft: it's not sandboxable it should be on ubuntu phones =/ <geofft> xnox: I'm also thinking of the companies who currently distribute things via RPM or .tgz only. <cjwatson> geofft: the plan is, at least, to always require sandboxing for this; one of the purposes is to use that so that apps don't get snarled up in indefinitely long review queues * udsbotu changed the topic of #ubuntu-uds-foundations-1 to: Currently no events are active in this room - http://summit.ubuntu.com/uds-1305//foundations-1/ - http://ubottu.com/udslog/%23ubuntu-uds-foundations-1 <zebaszp> oh! 1 hour break! <cjwatson> geofft: so if sandboxing is literally impossible for your application (why?), then I would say it's out of scope <aquarius_uds> I would be interested to hear why an app is unsandboxable, too <cjwatson> geofft: as I said earlier in the session, I'm intentionally not trying to supersede all uses of .debs <geofft> cjwatson: Well, the primary thing we sell is desktop virtualization :) <geofft> So unless there's an apparmor profile that lets us get to the virtualization interfaces, well.... <geofft> I'm also thinking of things (both from my company and others) like backup clients that read everything in your homedir or your system <cjwatson> there will certainly be situations where .debs are still required/useful, and I don't think e.g. that it would be worth spending lots of time going through and converting the Ubuntu archive (for one thing, we'd be taking on an incremental maintenance commitment by doing that) <cjwatson> I think mdeslaur would have to speak to the specifics of confining such things <cjwatson> both whether it's possible and whether it's useful <dobey> geofft: i presume sandboxed wouldn not preclude a way to allow the user to say an app is allowed to access certain data <geofft> I was curious if this would be useful as a simpler replacement for .deb for companies that can barely be bothered to distribute RPMs. <cjwatson> however I'm reminded of the fact that Android has a permission called "BRICK" <jdstrand> geofft: they can be confined, but required hand-crafted profiles. that is out of scope for apps in the app store in the shrot term <jdstrand> short <dobey> geofft: facebook app for example would want to access your photos, so you could upload them, for example <cjwatson> that doesn't necessarily render them out of scope for this package format / independent distribution though <dobey> doh, i said "for example" twice there <jdstrand> you can still use apparmor with debs, etc, so like cjwatson said, that is always available <geofft> jdstrand: if the implication is "possibly okay in the long term", cool! <mdeslaur> geofft: I'm missing some context...you want to get your application in the app store? <cjwatson> FWIW, I think sandboxing is kind of orthogonal to listaller/0install/etc. <zebaszp> examples, examples, examples! </ballmer> <cjwatson> in that the thing that executes apps is (in principle, mostly) independent of the thing that installs them <cjwatson> 0install does define a "how to run this app" command for each app <geofft> mdeslaur: I'm mostly just thinking about proprietary apps I've run as a user that distribute themselves as poorly-made RPMs. <cjwatson> listaller probably does too (haven't looked in detail), and we clearly need to <geofft> So, like, IBM's TSM backup client, VMware Player (which isn't even an RPM), proprietary VPN clients, .... <dobey> i must be off though, as that session ate through my normal lunch time. :) <geofft> From the description of "better format for people who don't care about Debian packaging complexities", it sounds like it fits those. <mdeslaur> geofft: well, a backup client is a bit special, but the other apps you've mentioned should work file with both the packaging format, and the app confinement <geofft> From the description "and sandboxing", it sounds like it fits none of those, so I'm just realigning my expectations <cjwatson> don't care and can't be persuaded to care :) <mdeslaur> geofft: if you're just looking for a way to distribute your stuff internally, the click package format is just a simplified deb at the moment, so you have nothing to gain from using that vs. regular debs <mdeslaur> geofft: and the deb format is just an archive really...you don't need a source package to create one <geofft> Yeah. Work is currently using actual debs (slightly less than actual source packages) and actual CDBS. <cjwatson> right, I think if you already have in-house .deb experience the gains are less interesting <geofft> _I'm_ happy to do Debian packaging, but not everyone is. <geofft> OK. <cjwatson> in that a sizeable part of this is simplifying things for app developers <cjwatson> now, there *are* other gaisn <cjwatson> *gains <mdeslaur> geofft: so instead of generating your .deb files from source packages, just create them as an archive <cjwatson> things like speed of app installation, guaranteed independence if things go wrong - at the cost of flexibility though <cjwatson> so it depends, if you were relying on being able to do non-trivial maintainer script things, you're probably still better off with .debs <cjwatson> if it's "unpack a filesystem tree", this might be simpler * cjwatson <- not a salesman <geofft> Sounds reasonable <kiwinote> so the app store server will allow us to upload deb files as well as click packages? <kiwinote> or does deb files imply an own distribution channel? <cjwatson> not in v1 at least; I think if you're doing debs you might consider getting them into Ubuntu (if appropriate) or partner (if appropriate) <xnox> kiwinote: correct. debs should go into PPA / Ubuntu Archive / self-hosted and will not be available to install on the phone. djennings@example.org. <cjwatson> err, "not be available to install on the phone" is a strong statement, you mean through the dash integration stuff <xnox> kiwinote: there is also myapps / extras.ubuntu.com for deb apps. <kiwinote> thanks, looks like canonical partners seems the best fit here <xnox> cjwatson: normal debs -> imply writable root-fs -> which we do not have, until convergence is delivered & enabled. <cjwatson> https://wiki.ubuntu.com/ImageBasedUpgrades calls for a switch to enable apt <xnox> true. <cjwatson> and nothing to stop you reflashing with extra things installed ... anyway I'm mostly just objecting to the use of categorical negative statements that are likely to scare people :) * xnox looks at my "convergence" poster again =) sure normal debs will need to start working rather sooner than later. * xnox off to find lunch. * cjwatson -> dinner * udsbotu changed the topic of #ubuntu-uds-foundations-1 to: Track: Foundations | Image based updates | Url: http://summit.ubuntu.com/uds-1305/meeting/21725/foundations-1305-image-based-updates/ <cjwatson> https://plus.google.com/hangouts/_/00c6326d8b41453b4fabc6512864290fa41cf78a?authuser=1&hl=en-GB <cjwatson> on air now <diwic> cjwatson, still "starting soon..." here <apw> no sign of the stream on the u-tube bit <lool> started here after reloading <mfisch> diwic: thats youtube being stupid, force reload several times <lool> reload the page <diwic> tried that, this time it worked though <apw> what junk ... there now <cjwatson> diwic: there's a time lag <diwic> cjwatson, btw last session one could see the background color of your screen reflecting in your face :-) <zyga> hi <jdstrand> information disclosure <cjwatson> diwic: heh, not much I can do about the lighting in this room - wasn't designed for video <timrc> achiang: always get a kick out of your profile picture <stgraber> https://wiki.ubuntu.com/ImageBasedUpgrades * achiang is on video mute because eating lunch now (i had another call last hour) * lool hasn't joined the HO but is watching and might jump in later <ogra_> rsalveti, <ogra_> oops <gQuigs> anyone have direct youtube link? <gema> gQuigs: for joining the hangout or just watching? <gQuigs> gema: just watching <zyga> QUESTION: stgraber, does that mean the recovery partition and the upgader itself cannot be upgraded if they have issues? <gema> gQuigs: http://www.youtube.com/watch?feature=player_embedded&v=Nddn4duIR2c <gQuigs> thanks gema <lool> zyga: they can be upgraded just like all the android bits can be upgraded including the bootloader <cjwatson> stgraber: sure, sorry <gema> gQuigs: you just need to click on the embedded version of the videos where it says "YouTube" and it takes you there, no probs <zyga> lool: thanks <lool> but we likely wouldn't do this too frequently <Laney> is there going to be any UI for the apt update route? <gQuigs> gema: wasn't loading for djennings@example.org... oh.. because I'm on the wrong talk :/ oops <gema> ;) <lool> stgraber: FYI, green on black a bit hard to read over stream; white on black or black on white might be better <stgraber> zyga: the update may contain changes to any partition including the android bits, basedband or even recovery partition <zyga> stgraber: interesting, thanks <zyga> stgraber: and totally impressive demo <gema> cjwatson: can you unclick stgraber? <gema> so that others take the screen when talking <victorp> stgraber, how are system configurations, like operator branding is kept at update time. I am assuming it is not stored on the data partition <cjwatson> gema: done <gema> cjwatson: ta! <victorp> stgraber, so is that file then automatically re-install in an update? <Laney> so operators and oems would have to offer an apt archive too, right? <stgraber> victorp: yes, it'd appear as if it was part of our read-only base system <zebaszp> QUESTION: what about superphones/desktop-capable mobile devices? how would you update those, do you disable apt for the base system packages? <stgraber> Laney: nope, they'd have to provide us with a .tar.xz overlay to apply on our base system <Laney> stgraber: but you can get yourself out of overlay upgrade mode <geofft> who generates the diff images? I guess this is part of the server? <stgraber> right, in which case those bits will likely not be updated <victorp> stgraber, lool are default apps installed in the system partition? <sergiusens> ogra_: yeah, how are ports going to be maintained? <victorp> ogra_, yes with rickspencer3 branding <victorp> :) <Laney> hmm <victorp> ogra_, shouldnt we give the community the option to have the same set up? <infinity> ogra_: Is there any reason we need to have enough Android userspace installed that these weird directories are being created? <ogra_> infinity, persistent properties are stored in direcories and files in /userdata <infinity> ogra_: I don't see why we need the bits that create all that junk if what we really need is just a libc and a few binary drivers. <sergiusens> victorp: not all devices are _fastboot_ devices and simple to tinker with <victorp> sergiusens, agreed, I thought we were talking about the "official" community devices that we produce images for <victorp> rather than all devices <TheMuso> infinity: Thats the impression I was under as well. <infinity> It sounds to me like we're including more of Android's userspace than we actually need. <victorp> infinity, we are using more than that right now <infinity> But that's probably out of scope for this conversation. <ogra_> infinity, we include HAL, all sensor drivers and userspace tools, the audio system etc .... and the platform-api makes use of these <sergiusens> infinity: not really <victorp> ogra_, seems like you need another session for that? <apw> it seems like this is getting into rather tooo detailed, it sounds like the two sides need to get together offline and "work it out" <victorp> that = partitions and folders <victorp> apw, +1 <ogra_> victorp, well, we're short on free slots <victorp> ogra_, make one slot with you, lool and stgraber :) <ogra_> as long as the syystem can adapt i'm happy though <victorp> ogra_, adapt and assimilate <sergiusens> ogra_: if that happens include me in the slot as some of that work will fall onto me <ogra_> fine with me, i just dont want to find out by end of the month that what i implemented will never work :) <ogra_> sergiusens, sure * victorp hugs ogra_ * ogra_ hugs victorp <lool> (I hear nice bird cheeps coming from one of the streams) <ogra_> might be me <ogra_> i have the window open <victorp> very relaxing <timrc> Bird Song as a Service <ogra_> heh <cjwatson> acronym isn't great <infinity> I prefer Bird as a Service. <lool> victorp: apps provided with the system are installed in the system partition for now; I've suggested that we could possibly bundle them as .click packages and install them on first boot in the future, but it seems it's a bit early to consider this <ogra_> pidgin mail ? <victorp> lool, sure , makes sense <victorp> lool, it would be nice for all apps to be manage/upgraded the same way <lool> true <victorp> as long as you can install newer versions of apps in the system partition as clicks so you dont have to wait for updates that maybe gated on who knows what <sergiusens> cjwatson: I guess you can start with the community core apps <victorp> lool, ^ <cjwatson> victorp: that's definitely a new technical requirement - may be interesting issues with having different versions of apps installed in different places <apw> presumably the image updater does not care what format they are <lool> victorp: exactly; there's no reason that the app update frequency and OS update frequency need to match; especially for e.g. OEM apps <infinity> There's nothing wrong with the Android-style hybrid of having a package both in the base system AND in the store. <cjwatson> it doesn't but click-package certainly would :) <infinity> Assuming we can overlay that sanely. <sergiusens> infinity: +1 <cjwatson> we'd need to make sure that the app executor can cope, basically <infinity> The upshot of the Android hybrid model is that if your store app update explodes, you can remove it and you're back to the base system core apps that work. <lool> any other question from anyone? <victorp> cjwatson, that happens lots where a manufacturer install a partner app as part of the system but then the publisher releases newer version for the store <gema> what kind of testing are we planning on this? <victorp> e.g. dropbox <cjwatson> infinity: do they just have an executor that looks in both places? <timrc> Is there going to be a rollback feature? <apw> stgraber, i have been adding what I am _hearing_ as actions, they should be reviewed before the end in case I miss understood <sergiusens> lool: is it going to be possible to rollback? <apw> stgraber, and some need owners if they are right <infinity> cjwatson: I'm not sure, TBH, how that works. The older version just "disappears" from the UI until you uninstall the new one. <infinity> cjwatson: On the underside, I'm not sure what they're doing. <lool> sergiusens: oh that's a good one <gema> QUESTION: What about testing, what are you guys going to do/expect from QA? <geofft> Are there plans / thoughts to make this work on the desktop? <victorp> sergiusens, +1 <geofft> It sounds like all this discussion is very Android-specific. <zebaszp> QUESTION (I asked this earlier): what about superphones/desktop-capable mobile devices? how would you update those, do you disable apt for the base system packages? <timrc> sergiusens: was that coincidence that we asked the same question? <sergiusens> timrc: interesting, didn't see it. <timrc> sergiusens: freaky <sergiusens> timrc: but it had to be asked... today we have lots of mechanisms to move around <gema> ack <lool> ah it's actually timrc's question too <apw> QUESTION: how are these updates going to interact with the propose 'staggered updates' we are moving to for .debs ? <cjwatson> YM phased updates I think? <victorp> zebaszp, superphones are first of all phones. So i will assume they update more like phones that desktop for the core base packages <lool> sergiusens, timrc: Will ask as soon as the current discussion ends <apw> cjwatson, indeed phased <timrc> lool: Thanks <zebaszp> thanks victorp, but then what happens to non-core user-installed desktop packages? <lool> (URL rewrites basically) <victorp> zebaszp, indeed what happens <lool> e.g. channels.json?model=galaxy-nexus&country=fr <lool> zebaszp: these are installed in the userdata partition <victorp> zebaszp, if they are store in the data partition <mwilley> It would be interesting to apply these techniques on the desktop as well; is it considered? Â Something like a chromebook. <lool> which is not updated <victorp> then they can be updated with apt, they wont be wiped by this, but it creates an interesting game with dependecies <ogra_> mwilley, if it proves to be good, i dont see why not <lool> mwilley: it's definitley something we'd like to apply to desktop, but we will need to study the additional requirements for converging with desktop use cases and supporting the installed userbase <victorp> mwilley, agreed - this is interesting for some desktops and thinclients <victorp> lool, 14.04 :) <rsalveti> "developer" mode :-) <victorp> stgraber, so you can't install .deb packages in the userdata partition? <lool> no; unless you are root and create a whole Ubuntu chroot there :-) <xnox> well it will be an "upgrade", whice leaves things rw & offers no other upgrade paths. <ogra_> rsalveti, and we'll make them tap 8 times !!! <sergiusens> lool: how is convergence going to be taken into account then? <rsalveti> ogra_: o/ <ogra_> muhahaha <victorp> lool, does that work for a converge device? <sergiusens> ah, youtube lag answered my question :-P <xnox> sergiusens: not targeted for 13.10. <victorp> alright stgraber just answer my question <rsalveti> and not properly planned I'd guess <lool> great <lool> any other question? <victorp> stgraber, that needs some thinking about for 14.04 <Laney> how will we be delivering SRUs? <barry> lp:~barry/+junk/resolver <Laney> rolling them up into a weekly image or something? <ogra_> weekly ? <barry> (probably needs a better name + a real lp project page) <lool> victorp: we've actually discussed it in the past, but didn't settle on a design for this <stgraber> https://phablet.stgraber.org <xnox> Laney: monthly delta image. <geofft> There's some mention in the blueprint about multiple /var/lib/dpkgs etc. Did that end up being relevant? <ogra_> yeah, monthly sounds more like it <victorp> lool, I agree that it doesnt not need to be solved for 13.10 <geofft> (I'm interested in that for a couple of reasons, only one of which is an implementation of image-based updates) <xnox> geofft: that's rough plans at how to handle convergence. <timrc> so if I skip 10 updates, and then update, will I have 10 separate updates in tandem to do? <geofft> xnox: So not relevant for a pure image-based system, until apt starts being user-exposed? <xnox> and having some ReadOnly dpkg packages while others RW. <lool> victorp: one approach could be to have split dpkg/apt databases between system and userdata, but that brings some issues with it that I think stgraber was listing; another approach would be to maintain an Ubuntu chroot under the userdata partition and update it like an app -- a bit like the Ubuntu for Android idea <achiang> timrc: it depends on what kind of user you are <xnox> timrc: if upgrader calculates, that a full image is quicker, it will simply take that. <xnox> geofft: correct. <timrc> xnox: okay <victorp> lool, that is what I was thinking <geofft> OK. Idly, is there current work towards that in some bzr branch or something? <lool> geofft: it's definitely one of the two approaches that we're considering <xnox> timrc: see stephane's demo earlier. <geofft> I was half wanting to fiddle with that in my spare time <jsjgruber-uds> QUESTION: When would the updates happen so the user isn't impacted by the reboot? <victorp> lool, anyway - we should understand it better by october, via UfA work <stgraber> server code: https://code.launchpad.net/~stgraber/+junk/phablet-update <victorp> and we can talk again then <timrc> jsjgruber-uds: when you open the kindle app and get into a good book <stgraber> client code: https://code.launchpad.net/~barry/+junk/resolver <lool> victorp: exactly; also, we will have had some experience with these image based updates and a better understanding of them too <timrc> (my experience with android :)) <achiang> timrc: that will be the model for commercial phones -- you have to do upates in serial <victorp> timrc, user error... stop reading books and the world will be better <victorp> :) <achiang> timrc: however, note that for a commercial phone, it won't be 10 updates, but more like 1 or 2 over the life of the device <timrc> achiang: aye <lool> achiang: depends <ogra_> totally <timrc> victorp: hah <victorp> timrc, also the download will be done in the background (wifi only) so you would not know * barry enjoys the relaxing birdsong in the last few minutes <Laney> will we have a way of presenting the changes? <apw> presumably we will be taking into account whether they have b/w for this <Laney> so you can see how much you want to reboot or not <sergiusens> achiang: well you could do like the chromebook and subscribe to the _developer channel_ <apw> for example being on wifi does not mean i want updates, i may be proxying 3g onto wifi for example
{'channel': 'ubuntu-uds-foundations-1', 'month': 5}