13:04:27 <mvollmer> #startmeeting
13:04:27 <zodbot> Meeting started Mon Jul 13 13:04:27 2015 UTC.  The chair is mvollmer. Information about MeetBot at http://wiki.debian.org/MeetBot.
13:04:27 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
13:04:32 <mvollmer> .hello mvo
13:04:32 <andreasn> .hello andreasn
13:04:39 <stefw> .hello stefw
13:04:43 <zodbot> mvollmer: mvo 'Marius Vollmer' <marius.vollmer@gmail.com>
13:04:46 <zodbot> andreasn: andreasn 'Andreas Nilsson' <anilsson@redhat.com>
13:04:49 <zodbot> stefw: stefw 'Stef Walter' <stefw@redhat.com>
13:05:10 <dperpeet> .hello dperpeet
13:05:11 <zodbot> dperpeet: dperpeet 'Dominik Perpeet' <dperpeet@redhat.com>
13:05:14 <mvollmer> #topic Agenda
13:05:26 <stefw> * Big ... storaged ... merge
13:05:39 <andreasn> wowowow
13:06:35 <andreasn> * ssh key auth
13:07:36 <mvollmer> * journal update?
13:07:56 <dperpeet> mvollmer, not much new from last week
13:07:56 <mvollmer> ok, let's go.
13:08:06 <mvollmer> #topic  Big ... storaged ... merge
13:08:18 <mvollmer> just found/fixed one more mdraid bug
13:08:23 <stefw> so i think there's nothing blocking this now ...
13:08:25 <mvollmer> https://github.com/storaged-project/storaged/pull/14
13:08:58 <andreasn> do you want help with more testing, or we're pretty much good to go?
13:09:03 <mvollmer> that fix is not a blocker for the merge
13:09:25 <mvollmer> personally, I am a it unsure of the level of quality
13:09:46 <stefw> so code review ... will fix that?
13:09:51 <mvollmer> yeah
13:09:56 <mvollmer> and manual testing
13:09:57 <stefw> what are the pull requests?
13:10:07 <mvollmer> only one
13:10:15 <mvollmer> https://github.com/cockpit-project/cockpit/pull/2308
13:10:30 <andreasn> #info https://github.com/cockpit-project/cockpit/pull/2308
13:11:03 <mvollmer> we can remove one HACK
13:11:10 <mvollmer> I make a note
13:12:43 <mvollmer> phatina, what do you think about https://github.com/storaged-project/storaged/pull/14 ?
13:13:05 <petervo> so once we merge, we are stop pushing updates into f22 right?
13:13:13 <stefw> i think so
13:13:25 <mvollmer> yes, but w should set up a copr
13:13:30 <stefw> we have a copr
13:13:34 <mvollmer> true
13:13:34 <stefw> and we always build there
13:14:06 <mvollmer> then we need to tell people that they also need phatina/storaged
13:14:17 <phatina> mvollmer: I'm OK with #14
13:14:35 <mvollmer> phatina, cool.
13:15:25 * stefw will do some review
13:15:31 <stefw> petervo, dperpeet, can you also review?
13:15:35 <stefw> worth doubling up on this one
13:15:36 <petervo> sure
13:15:40 <dperpeet> yeah
13:15:46 <dperpeet> petervo, want to go first?
13:15:50 <mvollmer> thanks!
13:15:55 <stefw> i'll leave the review to one of you guys
13:16:02 <stefw> since i'll be doing some other prep before vacation, if that's okay
13:16:12 <dperpeet> sure
13:16:19 <mvollmer> #action dperpeet petervo andreasn, review https://github.com/cockpit-project/cockpit/pull/2308
13:17:29 <andreasn> sounds good
13:17:30 <petervo> sure
13:17:30 <dperpeet> petervo, just assign to yourself once you start
13:17:30 <dperpeet> if I start before then, I'll assign to myself
13:18:02 <petervo> next topic?
13:18:05 <mvollmer> yep
13:18:14 <mvollmer> #topic ssh key auth
13:18:57 <petervo> first part made it in, i'm still working on tests for the pam module
13:19:35 <stefw> gladiac, if you have cmock PAM support ^^
13:19:41 <mvollmer> petervo, can you give a short overview of what this does?
13:19:46 <petervo> sure
13:20:18 <gladiac> ?
13:20:53 <gladiac> we plan to implement a pam_wrapper to test PAM modules
13:20:55 <gladiac> if you mean that
13:21:05 <gladiac> but this is https://cwrap.org
13:21:23 <stefw> gladiac, ok
13:21:51 <gladiac> I've started to implement it bug haven't had the time to work on it again
13:22:02 <petervo> so the plan is that we will add a pam module so that when you log into cockpit that pam module will start a ssh-agent
13:22:32 <petervo> and look at that standard locations and load any private keys that either have no password
13:23:01 <petervo> or use the same password you used to login with
13:23:20 <petervo> then when you try to connect to another machine in the same cockpit-ws session
13:23:36 <petervo> we use an internal channel to proxy that agent
13:24:01 <petervo> to the new ssh session, so it can offer the keys it has loaded
13:24:34 <petervo> as part of the ui, we want to add a way to manage the authorized keys for each account
13:24:39 <andreasn> I did some more work on the mockups https://raw.githubusercontent.com/cockpit-project/cockpit-design/master/users/administrator-accounts-keys.png
13:24:57 <andreasn> and version 2 https://raw.githubusercontent.com/cockpit-project/cockpit-design/master/users/administrator-accounts-keys-2.png
13:25:01 <petervo> as well as load / unload keys from the agent for the logged in account
13:25:18 <petervo> i think that pretty much covers it
13:25:26 <mvollmer> ok, thanks!
13:25:49 <mvollmer> what about key creation and automatic ssh-copy-id when adding a machine to the dashboard?
13:26:11 <stefw> later
13:26:17 <mvollmer> ok, fair enough
13:26:18 <stefw> right now we're just focusing on making teh core functionality work
13:26:26 <stefw> and the cloud use cases
13:26:33 <stefw> where people are pasting keys into other places etc.
13:27:23 <mvollmer> sounds nice
13:27:53 <mvollmer> can cockpit-ws be the ssh-agent?  is ssh-agent a lot of complicated code?
13:28:19 <mvollmer> no, it's unprivileged
13:28:32 <mvollmer> sorry, just thinking loud.
13:28:45 <stefw> yes it's complicated
13:28:48 <stefw> lots of crypto
13:29:08 <mvollmer> and cockpit-ws can't read $HOME
13:29:10 <mvollmer> right?
13:29:29 <stefw> right
13:29:37 <dperpeet> I think it's better to keep those permissions separate
13:30:41 <mvollmer> ok, so to try this out, I need to set up the keys 'manually', and then I don't need to keep the passwords in sync.
13:32:02 <petervo> yes to setting up manually, the passwords do need to be the same
13:32:29 <petervo> until we add ui for unlocking loading others
13:33:09 <petervo> and you'll need #2469 as well
13:33:22 <mvollmer> ok, thanks.
13:33:29 <petervo> otherwise you won't have a running agent
13:35:05 <petervo> i did have a question related to this, when we test "clean" we don't install the selinux package
13:35:47 <andreasn> I had some issues with a missing package
13:35:51 <andreasn> or a new enough version
13:36:08 <andreasn> but we figured it out after a while
13:36:16 <petervo> ah yes, this requires libssh 0.7.1
13:37:15 <petervo> does that mean that basically any time we change anything in our selinux rules, we have stop pushing updats to that os?
13:37:43 <mvollmer> petervo, yes, until we get the selinux changes as well.
13:37:56 <mvollmer> "get the selinux changes _in_ as well"
13:38:11 <mvollmer> stefw, that's correct, right?
13:38:28 <stefw> well unless we disable the test there temporarily
13:38:34 <petervo> and that's done by opening a ticket on bugzilla?
13:38:35 <stefw> have we filed a bug with the selinux change yet?
13:38:38 <stefw> yes
13:38:58 <petervo> not yet, figured once tests were done i'd do that
13:39:36 <petervo> also i think that part probably needs review to make sure what i'm doing is sane
13:40:46 <stefw> that'll happen in the bug
13:40:48 <stefw> the selinux bug
13:41:10 <petervo> i meant this part
13:41:41 <petervo> https://github.com/cockpit-project/cockpit/pull/2469/files#diff-26a90ad5ed850422fe8837ea8823c205R341
13:42:03 <petervo> loading the context into the exec context
13:44:04 <stefw> yeah, i don't understand why that's necessary
13:44:16 <stefw> but the selinux guys should be able to help
13:44:24 <petervo> without that, i get the undefined_t context only
13:44:37 <petervo> ok i'll open a ticket
13:47:35 <dperpeet> mvollmer, next topic?
13:47:38 <mvollmer> yep
13:47:59 * mvollmer had lost the keyboard somhow
13:48:11 <mvollmer> couldn't type into irc anymore, weird.
13:48:13 <mvollmer> anyway
13:48:24 <mvollmer> #topic journal update
13:48:37 <dperpeet> not much new to add
13:48:48 <dperpeet> I moved everything back into the systemd package
13:48:59 <dperpeet> after we cleared that up last time
13:49:05 <dperpeet> and fixed the issues andreasn found
13:49:06 <mvollmer> do you need more help?
13:49:30 <dperpeet> no, I just need some more time, since last week was very limited
13:49:39 <mvollmer> ok
13:49:49 <dperpeet> I'm reasonably sure we can merge just the new layout this week
13:50:00 <dperpeet> and then change the features in a follow-up
13:50:15 <andreasn> what's the pull request issue?
13:50:26 <dperpeet> https://github.com/cockpit-project/cockpit/pull/2467
13:50:39 <dperpeet> I haven't pushed the changes yet (for some reason)
13:51:06 <andreasn> #info https://github.com/cockpit-project/cockpit/pull/2467
13:51:17 <dperpeet> there is one design issue
13:51:53 <dperpeet> andreasn and I talked about it: if there are log messages from multiple machines, we decided that the affected hostname would get its own fixed-width column
13:52:28 <dperpeet> andreasn, have you decided where that should go?
13:53:04 <dperpeet> you could write that down in the wiki, maybe https://github.com/cockpit-project/cockpit/wiki/Feature:-Journal-v2
13:53:29 <dperpeet> and then I can put it into the mustache template, ready to be used when necessary
13:53:36 <andreasn> dperpeet: I feel that's the best solution. If it had it's own dropdown for selecting and deselecting machines. You could have 5 machines, but you would deselect 3 to get the correlation between the two remaining
13:54:00 <andreasn> and it's then also clear where the log message is from
13:54:05 <andreasn> sure, I'll add it
13:54:17 <dperpeet> thanks!
13:54:34 <dperpeet> as a side note, andreasn and I couldn't detect any significant performance impacts
13:54:39 <dperpeet> from using the templates
13:54:50 <dperpeet> instead of "optimized string concatenation"
13:55:26 <dperpeet> that's it from me on that topic
13:56:32 <stefw> sounsd good
13:56:34 <mvollmer> ok
13:56:50 <mvollmer> any other business?
13:57:51 <andreasn> not from me
13:58:27 <mvollmer> #endmeeting