18:01:12 <nirik> #startmeeting Infrastructure (2016-05-26)
18:01:12 <zodbot> Meeting started Thu May 26 18:01:12 2016 UTC.  The chair is nirik. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:01:12 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
18:01:12 <zodbot> The meeting name has been set to 'infrastructure_(2016-05-26)'
18:01:12 <nirik> #meetingname infrastructure
18:01:12 <nirik> #topic aloha
18:01:12 <nirik> #chair smooge relrod nirik abadger1999 lmacken dgilmore threebean pingou puiterwijk pbrobinson
18:01:12 <zodbot> The meeting name has been set to 'infrastructure'
18:01:12 <zodbot> Current chairs: abadger1999 dgilmore lmacken nirik pbrobinson pingou puiterwijk relrod smooge threebean
18:01:12 <nirik> #topic New folks introductions / Apprentice feedback
18:01:26 <jflory7> .hello jflory7
18:01:32 <skamath> .hello skamath
18:01:33 <zodbot> jflory7: jflory7 'Justin W. Flory' <me@justinwflory.com>
18:01:36 <zodbot> skamath: skamath 'Sachin S Kamath ' <sskamath96@gmail.com>
18:01:39 <devyani7> .hello devyani7
18:01:42 <zodbot> devyani7: devyani7 'Devyani Kota' <devyanikota@gmail.com>
18:01:43 <nirik> morning everyone
18:01:50 <jflory7> Hiya!
18:01:53 <skrzepto> .hello skrzepto
18:01:54 <zodbot> skrzepto: skrzepto 'Szymon Mucha' <skrzepto@gmail.com>
18:02:03 * pingou here
18:02:04 * sayan is here
18:02:09 <puiterwijk> hi
18:02:11 <decause> .hello
18:02:11 <zodbot> decause: (hello <an alias, 1 argument>) -- Alias for "hellomynameis $1".
18:02:13 * pcreech is here
18:02:17 <decause> .hello decause
18:02:18 <zodbot> decause: decause 'Remy DeCausemaker' <decause@redhat.com>
18:02:31 * threebean !
18:02:32 <nirik> Is there any new folks who would like to give a short one or two line introduction of themselves? If so, go ahead...
18:02:45 * lmacken 
18:03:05 <skrzepto> I am the new summer intern who will be working on FAS.
18:03:15 <pcreech> I'm not new, per-se, but I'm 'back'
18:03:45 <threebean> skrzepto: welcome!
18:03:54 <jflory7> I'm kind of the same as pcreech. I haven't been around much before now, but I'm getting ready to dive in starting this week and beyond. :)
18:04:05 <pingou> skrzepto: and hubs :)
18:04:10 <threebean> :)
18:04:13 <pingou> skrzepto: and python-fedora and.... and... :D
18:04:19 <skrzepto> pingou, yes :) and other projects ....
18:04:19 <nirik> welcome skrzepto!
18:04:20 <puiterwijk> and packaging flask-oidc
18:04:26 <nirik> and welcome back pcreech
18:04:35 <devyani7> its my first time here. hello everyone :) Myself: CS Undergraduate, GSoC intern, will be working on Fedora-hubs :)
18:04:51 <nirik> welcome jflory7 and devyani7 too. Lots of new folks. ;)
18:04:55 <pingou> welcome here devyani7 :)
18:05:05 * devyani7 waves to threebean :)
18:05:14 <devyani7> nirik: pingou: thanks :)
18:05:24 <jflory7> Thanks nirik :)
18:06:04 <skamath> Hello, I was away for a couple of weeks. I'll be working with the commops this GSoC :)
18:06:11 <nirik> if anyone needs setup in the apprentice program or pointers on where to get started, do see me after the meeting in #fedora-admin (or ask in the apprentice open office hours later in the meeting)
18:06:18 <skamath> *commops team
18:06:26 <nirik> excellent
18:06:37 <threebean> hey devyani7 :)
18:07:05 <nirik> ok, shall we move on to status/info?
18:07:26 <nirik> #topic announcements and information
18:07:26 <nirik> #info Mass update/reboot cycle complete. Machines are ready for freeze - kevin/smooge/patrick/tflink
18:07:26 <nirik> #info added +50GB space to bodhi-backend01, should last a bit - kevin
18:07:26 <nirik> #info Fedora Message Notifications (FMN) finally caught back up
18:07:26 <nirik> #info root passwords changed on all machines - kevin
18:07:27 <nirik> #info ansible 2.1 on batcave01 for a few, reverted back to 2.0 for now - kevin
18:07:31 <nirik> #info F24 final freeze coming up next week - everyone
18:07:43 <nirik> anything else folks would like to note or mention status and info wise?
18:07:45 * pingou still working on the FMN redesign
18:07:52 <lmacken> nirik: what issues happened with ansible 2.1?
18:08:11 <nirik> lmacken: we hit: https://github.com/ansible/ansible/issues/15996 apparently
18:08:32 <nirik> particuarly in the httpd roles stuff it was passing in vars that were getting ignored/not used.
18:08:41 <puiterwijk> #info flask-oidc is ready for folks to start integrating - patrick
18:08:41 <nirik> which made it all blow up. ;(
18:08:45 <puiterwijk> (more to follow i n"Learn about")
18:09:33 <nirik> they are looking into it now... hopefully it will have an easy fix and a 2.1.1 will come out
18:10:18 <nirik> lmacken: BTW, last nights updates pushes finished fine, todays are going... I think we are back on track there.
18:10:23 <nirik> Oh, one other info:
18:10:31 <lmacken> nirik: good good.
18:10:37 <nirik> #info monday is a holiday in many places, don't expect people to be around as much as normal
18:11:44 <threebean> #info PyCon US is next week!
18:11:51 <pingou> I've on my todo to send an email to the list about what's going on this summer
18:12:04 <nirik> threebean: oh yeah. Thats right...
18:12:09 <nirik> who all is heading to that?
18:12:12 <pingou> we have quite a few projects having quite a few deadlines and I thought it might be cool to present these
18:12:22 <pingou> lmacken: kushal abompard ?
18:12:32 <nirik> pingou: sounds good. perhaps also update infra calendar...
18:12:47 <nirik> kushal I am pretty sure is already there... not sure who else
18:12:59 * threebean will be
18:13:08 <pingou> nirik: they are more project deadline (like before flock), not sure it's worth a calendar entry but we could :)
18:13:09 <threebean> going to try and promote some hacking on the koji test suite at the sprints.
18:13:17 <pingou> cool threebean !
18:13:22 <nirik> excellent.
18:13:50 <nirik> lmacken: you heading to pycon?
18:13:57 <lmacken> nirik: yep, tomorrow
18:13:59 <nirik> pingou: I take it you are not?
18:14:35 <nirik> cool. safe travels all, let us know if there's anything we can help with from our end
18:14:42 <nirik> #topic Seeking feedback on Modularity plans - threebean
18:14:43 <pingou> nirik: indeed, not this year
18:14:58 <threebean> https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedoraproject.org/
18:15:00 <threebean> No need to go into this in detail in the meeting, but we're designing "lots of stuff" in the Modularity Working Group, but we don't want to accidentally wind up at cross-odds with the infra team.  Can we schedule a discussion of it next week, so people have some time to prepare and ask questions?
18:15:02 <nirik> threebean: I have your post marked to reply to, but just have not found time. ;( it's been a crazy week
18:15:08 * threebean nods
18:15:25 <threebean> nirik: and there's crazy stuff in modularity land, which we should take slowly and think about and stuff
18:15:27 <pingou> threebean: sounds like a good idea, but pycon?
18:15:31 <nirik> it looked like lots of things were already there (but might get bigger in scope)
18:15:41 <nirik> and a few new things...
18:15:59 <pingou> from what I saw, there are a few changes needed to existing tools, but rather limited, most work seems to be in the new tool
18:16:02 <pingou> s
18:16:31 <threebean> pingou: hm.  I can dip out of pycon for an infra discussion on it if we can next week.
18:16:42 <pingou> roger
18:16:51 <threebean> pingou: yeah - that's probably fair (about new versus old stuff).
18:16:52 <pingou> threebean: all modules are expected to be built from yaml files?
18:16:54 * nirik is ok on a meetup for it... where and when?
18:17:06 <threebean> nirik: could we do it as a section of the infra meeting next week?
18:17:18 <nirik> sure.
18:17:24 <threebean> i'm open to video chat on jit.si anytime too if you want to talk informally.
18:17:53 <nirik> infra meeting next week would be fine with me... and we can expand out if we go too far afield there. ;)
18:18:06 <pingou> wfm to
18:18:08 <threebean> cool cool :)
18:18:44 <nirik> ok, anything else for this right now? or shall we move on?
18:19:00 <threebean> oh - how about this, just for some structure..
18:19:19 <threebean> next week maybe in the "learn about" section, I could go through each piece in the diagram and say a little about how it might need to change?
18:19:28 <threebean> that way it's not just all one big mess.
18:19:42 <nirik> a higher level overview?
18:19:53 * threebean nods
18:19:55 <nirik> that would be welcome. (by me at least)
18:20:04 <threebean> cool.  we can move on and come back to it next week.
18:20:05 <threebean> thanks!
18:20:11 <nirik> sounds good.
18:20:31 <nirik> #topic Apprentice office hours
18:20:41 <nirik> jflory7: you had some queries here...
18:20:45 <skamath> !
18:20:46 <jflory7> Yeah.
18:20:56 <nirik> Question: Would it be inappropriate to use Infinote for public note-taking?
18:20:56 <nirik> (e.g. tasks related to infrastructure projects, like GSoC projects) - jflory7
18:21:10 <nirik> Absolutely fine. You can use it for anything Fedora related.
18:21:16 <jflory7> Okay, cool, thanks. :)
18:21:27 <jflory7> I probably will use it a bit for that this summer then.
18:21:28 <nirik> note that everything is kept in a git repo, so likely bad for anything that should be private
18:21:36 * jflory7 nods
18:21:37 <jflory7> Ack.
18:21:38 <nirik> skamath: go ahead and chime right in. ;)
18:21:58 <skamath> Is there a good yaml guide anywhere around here?
18:22:15 <nirik> hum. I don't know of one off the top of my head, but others might?
18:22:16 <skamath> I wanted to get started with the badges (as part of GSoC)
18:22:18 <puiterwijk> something like http://www.yaml.org/start.html ?
18:22:31 <puiterwijk> Or a more verbose: http://ess.khhq.net/wiki/YAML_Tutorial
18:23:07 <nirik> jflory7: On your other question:
18:23:11 <skamath> puiterwijk: I know the very basics. Nevertheless, I'll go through them :) Thanks. <eof>
18:23:11 <nirik> Suggestion: For a weekly topic, it would be interesting to see how other members
18:23:11 <nirik> of Infra using TaskWarrior manage their workflows / how they use it. - jflory7
18:23:22 <jflory7> skamath: Check this out too for Badges specifically: https://badges.fedoraproject.org/builder
18:23:35 <nirik> I'd be happy to talk about task warrior... I've been using it here for a bit now. I know threebean does... not sure who else.
18:23:45 <puiterwijk> I use it
18:23:47 <skamath> puiterwijk++ jflory7++
18:23:51 <pingou> decause: does iirc
18:24:09 <jflory7> I'm just starting to use it, but it would be cool to see how other members of Infra use it to understand how it can be used, what different things you can do with it, and how it fits into someone
18:24:13 <jflory7> * someone's workflow.
18:24:17 * devyani7 started using today :)
18:24:31 * skamath is poking around with it
18:24:38 <nirik> I did do a blog post not long back about it...
18:24:38 <jflory7> There's plenty of guides online, but a Fedora context would be cool too :)
18:24:52 <jflory7> Ooh, that would be a cool reference for the time being.
18:24:58 <nirik> https://www.scrye.com/wordpress/nirik/2016/03/30/taskwarrior-tips-and-notes/
18:25:03 * devyani7 clicks
18:25:26 <skamath> nirik++ rad!
18:25:47 <nirik> might be time for an update... but yeah, I am liking it pretty well overall.
18:25:49 * jflory7 bookmarks
18:26:31 <nirik> also if you need/want it, there's a android app and a gnome-desktop extension... I set those up, but never use them... :)
18:26:37 <jflory7> Will definitely read it all post-meeting, thanks. :) In addition, would be cool to get a "power user" perspective if anyone else wanted to demo or explain certain things that aren't well-documented with Taskwarrior.
18:26:53 <skamath> RIght now, I'm using Evernote to sync.
18:26:56 <nirik> The android app may be of use at flock or the like... note a task if you are not in front of your laptop
18:27:15 * skamath is switching over
18:27:24 <nirik> cool.
18:27:45 <nirik> ok, any other general apprentice questions or issues?
18:27:56 <jflory7> None from me at the moment.
18:28:04 <odin2016> interesting.
18:28:06 <skamath> !
18:28:52 <skamath> How can I get read only access to the fedora machines. Couldn't do much research this week.
18:29:11 <nirik> skamath: we can add you to the apprentice group... see me in #fedora-admin after the meeting and we can get you setup...
18:29:20 <nirik> or for that matter I can do it now... whats your fas account?
18:29:27 <skamath> nirik: I am already in the group :)
18:29:35 <nirik> oh, in that case see:
18:29:50 <nirik> https://infrastructure.fedoraproject.org/infra/docs/sshaccess.rst
18:30:22 <skamath> Cool. Thanks again :)
18:30:42 <nirik> Oh, one quick thing I wanted to mention: There was an interesting article in this weeks lwn about 'drive by' contributors...
18:30:45 <skamath> eof
18:30:53 <nirik> ie, people who submit some single patch or fix and thats it...
18:31:10 <misc> but that's in the paid section for now, no ?
18:31:16 <nirik> it had some nice ideas how to make your projects good for such contributors.
18:31:29 * pingou curious
18:31:32 <nirik> yeah, will be out free next week, we can discuss it more then, but might be worth trying to do some of those things...
18:31:48 <nirik> much of which was "have good docs for how to submit things/process"
18:32:04 <pingou> pagure was on lwn last week as well :)
18:32:23 * danofsatx almost forgot
18:32:26 <nirik> so a quick doc with steps, then a detailed version with details on each step... so drive by folks don't need to ask about how to submit their one patch
18:32:27 <danofsatx> I'm here!
18:32:35 <nirik> anyhow, we can discuss that more later.
18:32:37 <nirik> welcome danofsatx
18:32:49 <nirik> #topic Learn about: oidc tutorial part 2 - patrick
18:32:55 <nirik> puiterwijk: take it away. :)
18:33:05 <puiterwijk> Okay, so I get to explain the next part in my OIDC series.
18:33:10 <puiterwijk> First two remarks:
18:33:20 <puiterwijk> 1. I will be scheduling a classroom sometime soon, given the complexity of the subject
18:33:24 <nirik> whats OIDC?
18:33:25 <nirik> :)
18:33:26 <pingou> +1
18:33:34 <pingou> nirik: that's not a remark, that's a question :D
18:33:34 <puiterwijk> OIDC = OpenID Connect
18:34:01 <puiterwijk> 2. I am expecting that people have either attended last weeks meeting or read back my part there, since explaining it all over will again take me 30 minutes :)
18:34:29 <puiterwijk> So, with this, let's get this show on the road. This week I was planning to talk about scopes, what are they ,what do you do with them, and such
18:34:31 <nb> misc, i think subscribers can send links to stuff, let me see if i can figure out how
18:35:04 <puiterwijk> First off: flask-OIDC has been released last monday. Which means that people can now start integrating their applications against our development instance on iddev.fedorainfracloud.org
18:35:12 <pingou> https://meetbot.fedoraproject.org/teams/infrastructure/infrastructure.2016-05-19-18.00.log.html last week's minutes
18:35:42 <puiterwijk> Okay, so scopes. As some people might know, OpenID Connect is based heavily on OAuth2, which is a specification for getting and using authorization tokens.
18:35:56 <misc> nb: "send free link"
18:36:20 <puiterwijk> These tokens are used to authenticate as a client to a remote API as a specific user.
18:36:55 <nb> #link The value of drive-through contributions https://lwn.net/SubscriberLink/688560/b76a2332f597f06b/
18:36:59 <puiterwijk> You can request tokens as part of the OpenID Connect process as part of the Access token or Authorization Code flows. Note explicitly that the id_token flow doeS NOT provide you with an access token
18:37:59 <puiterwijk> So, every scope is attached to a client ID (client being the application deployment), and a user that authorized the issuance of the token (the user that logged in).
18:38:16 <pingou> !
18:38:19 <puiterwijk> pingou: yes?
18:38:35 <pingou> can the user choose the scope of the token?
18:38:43 <puiterwijk> The user will consent to the scopes
18:38:51 <pingou> for example on android app foo asks for foo and bar
18:38:59 <pingou> the choice of the user is either: ok or don't use the app
18:39:20 <pingou> I would love if we could do: ok for foo but not for bar
18:39:41 <pingou> (which is what I tried to implement in pagure)
18:39:58 <puiterwijk> Right. The application can do that
18:40:17 <puiterwijk> the application can see what kind of scopes its tokens have at any point, and if it's not enough, get the user to re-authenticate with a larger scopeset
18:40:51 <pingou> :/
18:41:08 <pingou> most devs will say: but for feature X I need bar, so I'll just always ask for bar
18:41:21 <puiterwijk> pingou: the reason for that is that the specification has no way to indicate which permissions are required and which are optional.
18:41:22 <pingou> but I'm disgressing :)
18:41:39 <pingou> puiterwijk: pity
18:41:47 <puiterwijk> So that means that if I would make them all optional, a user might issue no consent and return to the app with an empty token, and the app can't use it
18:42:05 <puiterwijk> So, these scopes are basically just a string that points to a specific permission that the token is authorized for
18:42:40 <puiterwijk> There are a few values pre-defined: openid, email, profile, phone. The "openid" scope you will pretty much always want to request, since it authorizes the release of an id_token with any information about the user
18:42:55 <puiterwijk> profile gives name, email and phone are probably self-explanatory
18:43:50 <puiterwijk> We will have to define further scopes for our infrastructure. I will be writing documentation on how to define those soon. Basically, we need to decide on what kind of base URI we will be using
18:44:20 <nirik> we probibly will have to go over each app and think what it might need right?
18:44:32 <puiterwijk> nirik: yes
18:44:41 <nirik> fas_groups likely will be popular
18:44:53 <puiterwijk> So when these scopes are defined, an application could for example request "https://fedorahosted.org/koji/scope/build_package", and the user will see a consent screen asking for release of "Build package on Koji" for example
18:45:18 <puiterwijk> nirik: yes, very likely
18:45:29 <pingou> does that mean pagure could trigger a build on koji as the user logged in?
18:45:48 <puiterwijk> pingou: if Pagure had requested a token for the user with that scope and the user consented, yes
18:45:51 <pingou> (bad example due to ssl certs, but for the idea?)
18:45:56 <pingou> cool :)
18:46:06 <puiterwijk> pingou: well, I am working on a patch for koji for it to accept these tokens ... :)
18:46:12 <pingou> \ó/
18:46:22 <puiterwijk> so hopefully we will be able to get rid of ssl certs for koji rather soon
18:46:24 <pingou> puiterwijk: I can write the patch to drop SSL from FAS :D
18:46:32 <puiterwijk> pingou: heh :)
18:46:38 <pingou> \ó/²
18:47:20 <nirik> how does 2fa fit in? could we have some permissions that require the user auth with a second factor?
18:47:58 <puiterwijk> nirik: yes. I am planning to make it possible to mark certain scopes as "requires ACR x"
18:48:09 <nirik> great
18:48:32 <puiterwijk> Also, the Authentication class will be returned as part of the authentication response.
18:49:15 <puiterwijk> These are more things we will need to define, but I am hoping to have a lot of the basic definitions et al ready in a week or two
18:50:07 <puiterwijk> So, I would suggest one thing for application developers: make sure to have a clear view on which scopes you need to request from users, and only request that part. Don't request too much, as the user might get hesitant if the list of permissions requested is too large
18:50:21 <puiterwijk> (if anyone's see Android pre-M installs, you will likely know what I mean)
18:51:15 <puiterwijk> I think that that's all for now on the scopes part of things for now, this mostly needs a lo tof defining at the particular applications regarding what they need
18:52:15 <puiterwijk> Oh, one thing for people that will want to start testing with it: note that you will either need to run o nhttp://localhost or use TLS. You will not be able to enter anything else as return URI when you register your client
18:53:20 <puiterwijk> Are there any further questions? We have 6 more minutes
18:54:02 <nirik> I look forward to our OAUTH2 token overlords
18:54:36 <nirik> thanks puiterwijk
18:54:43 <nirik> #topic Open Floor
18:54:46 <jflory7> puiterwijk++
18:55:02 <nirik> anyone have any final items for open floor? questions, comments, ideas, mad plans to take over the world?
18:55:27 <jflory7> Latter sounds interesting. ;)
18:55:32 <jflory7> Nothing from me, though
18:55:35 <pingou> I have something for the last point, but I can't speak now
18:55:42 <jflory7> pingou++
18:55:47 <devyani7> :P
18:56:02 <puiterwijk> I thought I was well underway of taking over the Fedora authn world...
18:56:14 <odin2016> nope... just poking rhel 5 bkxes at work.
18:56:16 <nirik> :)
18:56:41 <nirik> ok, thanks everyone for coming. Do continue in #fedora-admin, #fedora-apps and #fedora-noc.
18:56:45 <nirik> #endmeeting