16:30:16 #startmeeting fedora_coreos_meeting 16:30:16 Meeting started Wed Sep 26 16:30:16 2018 UTC. 16:30:16 This meeting is logged and archived in a public location. 16:30:16 The chair is jbrooks. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:30:16 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:30:16 The meeting name has been set to 'fedora_coreos_meeting' 16:30:27 #topic roll call 16:30:28 .hello2 16:30:29 sanja: sanja 'Sanja Bonic' 16:30:31 .helloo2 16:30:32 .fas jasonbrooks 16:30:32 .hello2 16:30:32 jbrooks: jasonbrooks 'Jason Brooks' 16:30:35 geoff-: Geoff Levand 16:30:35 ajeddeloh: ajeddeloh 'Andrew Jeddeloh' 16:30:42 .hello2 16:30:43 dustymabe: dustymabe 'Dusty Mabe' 16:30:53 .hello rfairleyredhat 16:30:54 rfairley: rfairleyredhat 'Robert Fairley' 16:31:38 .hello2 16:31:38 jlebon: jlebon 'None' 16:31:45 jbrooks: I removed the meeting item from one of the tickets (one we discussed last week) 16:32:01 #chair sanja ajeddeloh geoff- dustymabe rfairley jlebon 16:32:01 Current chairs: ajeddeloh dustymabe geoff- jbrooks jlebon rfairley sanja 16:32:08 dustymabe, ok 16:32:24 .hello sinnykumari 16:32:25 ksinny: sinnykumari 'Sinny Kumari' 16:33:08 #chair ksinny 16:33:08 Current chairs: ajeddeloh dustymabe geoff- jbrooks jlebon ksinny rfairley sanja 16:33:11 .hello2 16:33:12 slowrie: slowrie 'Stephen Lowrie' 16:33:20 #chair slowrie 16:33:20 Current chairs: ajeddeloh dustymabe geoff- jbrooks jlebon ksinny rfairley sanja slowrie 16:33:25 #topic Action items from last meeting 16:33:45 Looks like there were none? 16:33:55 https://meetbot-raw.fedoraproject.org/fedora-meeting-1/2018-09-19/fedora_coreos_meeting.2018-09-19-16.29.txt 16:33:58 jbrooks: yeah I don't think there were any 16:34:51 OK, tickets tagged w meeting: https://github.com/coreos/fedora-coreos-tracker/issues?q=is%3Aopen+is%3Aissue+label%3Ameeting 16:34:56 .hello sayanchowdhury 16:34:57 sayan: sayanchowdhury 'Sayan Chowdhury' 16:35:05 #topic Determine how to handle automatic rollback 16:35:13 #link https://github.com/coreos/fedora-coreos-tracker/issues/47 16:35:24 * jbrooks wonders, is link a thing? 16:35:33 I guess it's info? 16:35:39 #info https://github.com/coreos/fedora-coreos-tracker/issues/47 16:35:40 do we have lorbus[m] ? 16:35:51 .hello2 16:35:52 bgilbert: bgilbert 'Benjamin Gilbert' 16:35:59 #chair sayan bgilbert 16:35:59 Current chairs: ajeddeloh bgilbert dustymabe geoff- jbrooks jlebon ksinny rfairley sanja sayan slowrie 16:36:15 ajeddeloh: I think he is moving this week.. we'll definitely have him next week 16:36:20 +1 16:36:25 ajeddeloh, Do we need lorbus for this one? 16:36:38 i think it would help 16:36:52 OK, we can save it 16:36:58 not _need_ but he worked on some related stuff so haivng him would be nice. I'm fine delaying a week 16:37:08 +1 16:37:14 #topic Allow binaries written in Python via a "platform python" style approach 16:37:19 #info https://github.com/coreos/fedora-coreos-tracker/issues/32 16:37:22 * dustymabe waves 16:37:29 sorry this one took a large part of the meeting last week 16:37:45 we had two proposals floating around at the end of the meeting 16:38:11 we had discussed the number of security issues in python 16:38:22 i was proposing that we make a statement about that 16:38:27 .hello2 16:38:28 jligon: jligon 'Jeff Ligon' 16:38:34 #proposed we think security issues for python (#4) aren't significant enough to cause us great hardships during releases 16:38:42 bgilbert: was +0.5 16:38:48 #chair jligon 16:38:48 Current chairs: ajeddeloh bgilbert dustymabe geoff- jbrooks jlebon jligon ksinny rfairley sanja sayan slowrie 16:38:56 .hello mnguyen 16:38:56 can we make any counter proposals for that point? 16:38:56 mnguyen_: mnguyen 'Michael Nguyen' 16:40:07 #chair mnguyen_ 16:40:07 Current chairs: ajeddeloh bgilbert dustymabe geoff- jbrooks jlebon jligon ksinny mnguyen_ rfairley sanja sayan slowrie 16:41:13 dustymabe, I agree w/ your proposal 16:41:19 so, not a counter 16:41:35 any acks/nacks on above proposal? 16:42:09 note that this proposal does not state that we will ship python, it's more just concentrating on point #4 from the list of reasons to not ship python 16:42:23 I'm looking through the CVE updates from the ticket 16:42:26 I'm with bgilbert on a +0.5 16:42:44 I think I could go for +1 16:42:52 i.e. it alone is not even to force us to not ship python 16:43:07 ajeddeloh: yep, that's another way of wording it 16:43:36 there's some stuff, but some of it would probably not require backports 16:44:13 several of the Python issues are in sort of obscure modules that might not be used by anything we'd ship 16:44:20 looking at the package lists, some of those (specifically nfs-utils and xfsprogs) don't even have python USE flags for gentoo and I wonder what python they need 16:44:36 s/what python they need/what they need python for 16:44:41 any more acks/nacks ? jlebon mnguyen_ slowrie geoff- sayan 16:44:56 I don't have a particularly strong opinion either way 16:45:11 ajeddeloh: yep, and the depedency in container-selinux was already removed so that's one less too 16:45:56 I agree with "it alone is not even to force us to not ship python" 16:46:34 dustymabe, Is that sufficient? 16:46:51 ok so we've got like 3/4 +0.5 a few +1 16:46:55 dustymabe: that list is just runtime requirements, yes? not build time as well? 16:47:35 ajeddeloh: correct. I have not evaluated buildrequires, but honestly I don't think that's something we care about too much 16:48:02 agreed, just double checking 16:48:15 dustymabe, There's that narrow proposal, but the bulk of the issue remains 16:48:22 ok since I've got no "No" votes I think we can put this one in the bag 16:48:38 #agreed we think security issues for python (#4) aren't significant enough to cause us great hardships during releases 16:48:42 jbrooks: yes 16:48:50 I was then moving to the other proposal 16:48:57 :) 16:49:03 #proposed we'd really really like to remove python, but if we choose that we want to keep a tool or a few tools in fedora coreos that use python then we think the system python approach given that it solves #1 and #3, which are our primary concerns, would be reasonable. 16:49:46 i.e. the above point gives us the option to ship "system python" if we find a tool that we "need" that requires python 16:50:05 it doesn't say that we will ship python 16:50:09 dustymabe, Would this approach involve us maintaining our own separate python packages 16:50:22 jbrooks: ideally not, no 16:51:03 there are a few ways we could achieve the goal, but maybe worth another discussion, unless we do want to dig into that here? 16:53:15 dustymabe, Do we need a re-summary on the issue? 16:53:34 Refocus, comment and take it up next time? 16:53:58 jbrooks: meaning a "summary comment" in the issue itself? 16:54:08 or want me to summarize here in the meeting? 16:54:44 I was thinking in the issue, there's kind of a lot in there now 16:55:11 But it could be here, too -- what do others think? 16:55:30 I'll take an action item to investigate _why_ some of the packages depend on python that seem like they shouldn't 16:55:31 yeah, was hoping to put this one to bed soon. either way works for me.. waiting to hear from all the pretty faces that are also here :) 16:56:16 eh, +1 16:56:38 Personally, I'm cool w/ python, I expect it to be in fedora, so I don't have a lot to say on the removing it front 16:56:38 +1 for proposed, or +1 for wait til next time and add summary to issue ? 16:57:24 I expect many will just shoehorn it in for things like ansible as they do now w/ CL 16:57:28 +1 for proposed 16:57:37 jbrooks: I think it's important to not think of fcos as "fedora-like" in many ways 16:57:39 +1 for proposed 16:57:47 +1 for proposed though 16:57:47 ajeddeloh++ 16:57:51 just the name ;) 16:57:57 and the packages 16:58:08 Anyway, minimal is always nice 16:58:13 ok 3 +1, jbrooks was that a +1 from you ? 16:58:20 Yes, +1 16:58:25 4 +1 16:58:29 +1 for proposed 16:58:45 slowrie: sayan walters ? 16:59:33 +1 for proposed 16:59:44 #agreed we'd really really like to remove python, but if we choose that we want to keep a tool or a few tools in fedora coreos that use python then we think the system python approach given that it solves #1 and #3, which are our primary concerns, would be reasonable. 17:00:00 ok. I'll add this information to the tickets 17:00:15 .hello2 17:00:16 bhavin192: bhavin192 'Bhavin Gandhi' 17:00:36 #action dustymabe to update python ticket w/ acked proposals 17:00:37 the next step that I'm looking at is compiling a list of python dependent software that we think we want or need (obviously the list of installed software needs to be analyzed) 17:01:07 and then we can go from there. If it's "only" firewalld then we are a lot closer to removing python altogether 17:01:15 +1 17:01:29 if it's a bigger list then it'll take longer for us to break apart things 17:01:39 thanks all for the discussion 17:01:45 OK, next topic? 17:02:07 i think walters isn't around at this time slot 17:02:30 jbrooks: +1 17:02:37 #topic Allow binaries written in Python via a "platform python" style approach 17:02:43 wait 17:02:45 sorry 17:02:59 #topic Major release and update cycle for Fedora CoreOS 17:03:16 #info https://github.com/coreos/fedora-coreos-tracker/issues/22 17:03:39 and in particular, https://github.com/coreos/fedora-coreos-tracker/issues/22#issuecomment-409694543 17:04:51 bgilbert, Would next just be the same as testing most of the time, or would it be regenerated each day w/ the newest pkgs 17:05:22 i think next would be like next release (i.e. f29 right now) 17:05:40 But when there isn't an f29 yet? 17:05:44 Would it be rawhide? 17:05:47 dustymabe: next would track the next release when it's baked "enough" 17:05:49 never rawhide 17:05:58 the idea is that someone should be able to safely run next all the time 17:06:15 right, so for a period of time next would either not exist or just follow stable ? 17:06:19 jbrooks: interesting question. I was assuming it'd track testing 17:06:56 I don't think we want to push nightly updates; too much churn 17:07:20 That's the fedora atomic ref I'm usually on -- the nightly one, composed of stable pkgs 17:07:46 How often is the least stable CL updated currently? 17:08:01 "there's not an official schedule" 17:08:06 but every 2 weeks 17:08:22 plus very occasional out-of-cycle releases for fixes 17:09:23 I use the updates-testing ref to give karma to atomic pkgs 17:09:53 right, so the idea is that even "next" would be useful for servers that aren't actively managed 17:10:08 we don't want to reboot them every day, and if we keep changing their package sets, they're less useful for catching regressions 17:10:44 bgilbert: are you suggesting for next that we try some sort of stability guarantee ? 17:10:45 the idea is not that there's a human actively paying attention, giving karma etc. 17:10:58 Yeah, I think if we're to have three usable streams, those are three good ones to target 17:11:05 dustymabe: what does guarantee mean? 17:11:16 for CL, we expect all three channels to be usable in prod 17:11:25 pkgs we care about will need karma to move through bodhiu 17:11:28 I think the cadence of the 'next' would depend on how much confidence we have in the automated testing of it 17:11:30 it's just that alpha is more likely to regress than beta is more likely than stable 17:11:50 bgilbert: yeah. that 17:11:56 just wondering what the expectations are 17:11:57 Maybe an updates-testing ref could be behind the scenes, testing only, or something 17:12:16 jbrooks: sure, I don't mind some additional refs for technical purposes 17:12:21 as long as we're not advising them to be used in prod 17:12:26 bgilbert: +1 17:12:39 I'm +1 to the straw proposal 17:12:42 i think we're going to need multiple 17:12:49 ok let me take a second 17:12:51 geoff-: I don't think our automated testing is within a stone's throw of adequate to catch e.g. driver regressions on bare metal 17:12:52 +1 here as well 17:13:10 so we have next, testing, stable 17:13:19 geoff-: the point of the channels is, in part, so users can help us catch regressions before they promote 17:13:20 we've discussed next already 17:13:47 testing would be basically packages that are already in fedora's stable yum repos but we have not yet released as a stable FCOS ? 17:14:00 dustymabe: yes 17:14:10 and how often would we push out testing ref ? 17:14:27 dustymabe: the straw proposal was every two weeks 17:14:41 bgilbert: so one problem with that 17:14:41 About testing: Periodic snapshot of the current Fedora release + updates, perhaps every two weeks. 17:14:43 that I see 17:15:02 let's say today an update hits a stable yum repo 17:15:07 in CL, there's a new beta every unspecified *cough*4 weeks*cough* 17:15:21 and we do a testing release 17:15:37 and tomorrow another update hits stable 17:15:37 here, what does updates mean? do we make updates packages available once in two week or pull in once they are available? 17:15:55 in two weeks the first update would hit stable, but in four weeks the second update would make it to users 17:16:05 dustymabe: right 17:16:18 that seems a little "long" in Fedora pace terms 17:16:31 +1 to what dustymabe said 17:16:39 we're not necessarily trying for Fedora pace :-) 17:16:41 since that update already spent some time in the updates-testing yum repo before it ever hit stable 17:16:45 I feel that, too, but we're expecting ppl to use testing 17:16:48 and next 17:16:50 and stable 17:17:10 So stable is conservative 17:17:25 right. I'm actually ok with that 17:17:29 btw, as with CL I don't expect the release cadence to be contractual, so we can adjust as needed 17:17:41 but I wonder if we should adjust the name 17:18:08 well maybe not 17:18:11 massive +1 to "not contractual" 17:18:23 You need RHEL for that ;) 17:18:41 a +2 you might even say :) 17:18:50 either way i'm actually OK with the proposal, just some of the expectations in *fedora* are that once they hit "stable" in bodhi there bug or security issue should be "fixed" if they update 17:19:04 their* 17:19:16 That's why I think of the nightly option 17:19:19 and I wonder if we'll feel any pain as a result of the disconnect 17:19:29 sure, part of the FCOS value is batching updates for people 17:19:33 Like, access to what fedora has deemed stable 17:19:34 so we'd definitely need to backport secutiry fixes 17:19:39 as soon as its available 17:19:40 right, backports are a part of this 17:19:47 certainly for stable, maybe even for testing 17:19:55 .hello2 17:19:56 walters: walters 'Colin Walters' 17:20:04 we'd need to look at the security update and bugfix stream and backport things that were important 17:20:04 #chair walters 17:20:04 Current chairs: ajeddeloh bgilbert dustymabe geoff- jbrooks jlebon jligon ksinny mnguyen_ rfairley sanja sayan slowrie walters 17:20:08 welcome, Colin 17:20:08 note: backport, not promote 17:20:31 hmm, define that? 17:20:51 i.e. we wouldn't promote the fixed build? we'd take the patch and do our own build ? 17:21:05 if there's an important CVE fix in the kernel, we'd probably patch for the CVE rather than take a new kernel version 17:21:31 I'll elide the rant about how many regressions we've been seeing in stable kernels 17:21:45 yeah, i wonder how much pain that opens us up to 17:21:56 but we'd want to make sure we're not promoting regressions to stable, cuz we want it to be stable 17:22:01 dustymabe: indeed. 17:22:28 We're doing our own kernels? 17:22:35 i.e. I think we'd need someone to basically be really close, *secret handshake* close, with the kernel team 17:23:04 ideally, yes. but I don't know if that's required? 17:23:14 i.e. reading changelogs should be sufficient 17:23:29 there's an interesting question about what sort of SLO we're providing on catching Every Last Security Update 17:23:39 the usual answer, for all distros everywhere, is "none at all" 17:24:05 We're coming close to the end of the (half) hour -- do we have actions on this? 17:24:15 bgilbert: so I guess the kernel point is one we're going to have to discuss further 17:24:21 so, call it a best effort thing. but if there's something like SegmentSmack, we want to get it fixed. 17:24:35 Backporting CVE patch instead of using updated kernel means we will get limited testing as well becasue regular Fedora users won't be tetsing it 17:24:37 kernel was an example. also things like docker or curl 17:25:08 ksinny: yeah 17:25:21 bgilbert: let's take this to comments in the issue and sync back up next week 17:25:29 dustymabe: +1 17:25:38 Sounds good 17:25:39 there's a sorta damned if you do, damned if you dont thing with kernel regressions too. If you promote, you get all the regressions in the new kernel, if you backport, you get all bad backports 17:25:46 +1 17:25:46 ajeddeloh++ 17:26:06 #topic Open Floor 17:26:13 Any open floor items? 17:26:16 ajeddeloh: yeah, so might as well choose the one that requires less work of you :) 17:26:19 Fedora CoreOS logo: https://github.com/coreos/coreos.fedoraproject.org/blob/master/public/images/fedoracoreos-logo.svg 17:26:37 sanja: nice 17:26:41 is that open up to feedback 17:26:42 yay! nice 17:26:43 dustymabe: or the one with less code churn :-) 17:26:43 sanja++ 17:26:43 ajeddeloh: Karma for sanja changed to 4 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:26:50 or is that capital D done 17:26:52 sanja++ 17:27:12 And I'd like to move the website to be GitHub Pages - means the repository stays as is BUT it'll be a slightly different structure. It'll be same as buildah.io and podman.io - makes it easier for all of us. I'll just have to tell Fedora infra to point the DNS to there. Everyone ok with that? 17:27:17 sanja: seconding dustymabe's question 17:27:30 * ajeddeloh is slightly disappointed we're not rolling with the "corehat" 17:27:41 Dusty, it's kind of Capital D done because branding approved and unless you want to go through another month or two of waiting, consider it a capital D. 17:27:41 sanja: +1 to moving it 17:27:54 sanja: +1 for the move 17:27:55 What would you like to change? 17:28:08 sanja: some sort of visual distinction between "core" and "os" would make it easier to read 17:28:09 ok, moving will be initiated today then and I'll see when I can get it done the earliest with Fedora infra 17:28:26 anyone else got comments on the logo because I'll collect them now and send them over to Mo 17:28:27 e.g. letter weight 17:28:33 sanja: i think it would be cool to have it be light blue on the outside, dark blue on the middle core and white in the middle :) 17:28:56 right now the core doesn't look that much different than CL, right ? 17:28:59 was the COREOS text sans serif before? 17:29:10 it was 17:29:21 dusty so no pink basically? 17:29:25 see https://coreos.com/ 17:29:26 just light blue, dark blue, white? 17:29:42 right, for FCOS - just a suggestion :) 17:30:03 or dark blue, light blue, white, whichever one looked better 17:30:16 dustymabe: I like that 17:30:20 i don't even know if it would look good or not, that's just what I had in my head 17:30:36 Ok, so I'll take to Mo: * consider color change where outer core is light blue or dark blue, inner core the remaining of light/dark, and inner white, * change coreos text so it's more easily distinguishable 17:30:46 the pink from the logo might be nice =) 17:31:07 sanja++ 17:31:07 bgilbert: Karma for sanja changed to 5 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:31:07 The pink is a slight hint to IoT and closer to the old than if it's all blue 17:31:28 I'll get those two points to her, anyone else? 17:31:29 I trust mo with the serif/sans decision, but it was startling to see first time. 17:31:58 sanja++ obviously I'm not the only person with an opinion so I won't mind if it doesn't end up happening 17:31:58 dustymabe: Karma for sanja changed to 6 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:31:59 made me wonder if there was a font error in inkscape 17:32:07 hehe 17:32:31 OK, anything else for this week? 17:32:37 ok, let's see what she comes back with, I think she also didn't want to include too many fonts and there is already a distinction between fedora and coreos in the texts but I'll tell her those 17:32:38 distinguishing between the old and new logo would be nice too 17:32:47 thanks everyone bgilbert++, dustymabe++, jligon++ 17:32:47 sanja: Karma for jligon changed to 1 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:32:47 * ksinny has one quick item 17:32:51 #info Thanks to Ed vielmetti for giving access and getting account set-up on packet.net to use aarch64 machine for Fedora CoreOS related work. 17:32:58 #link https://github.com/WorksOnArm/cluster/issues/110 17:32:59 thanks ed-packet! 17:33:01 awesome 17:33:05 I am getting familar to the Packet web intreface and options available 17:33:11 dustymabe++ 17:33:18 bgilbert++ 17:33:18 sanja: Karma for bgilbert changed to 2 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:33:22 ksinny: kola also can work with packet too (correct me if I'm wrong slowrie ) 17:33:28 so it might be worth trying that out 17:33:34 kola does indeed support packet 17:34:02 nice 17:34:38 * ksinny will take a look later on 17:34:58 ksinny: I wrote that code in kola; let me know if you have any problems 17:35:08 All right, let's close this out 17:35:15 bgilbert: sure 17:35:22 bgilbert++ 17:35:22 ksinny: Karma for bgilbert changed to 3 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:35:28 #endmeeting