14:00:26 #startmeeting Workstation WG 14:00:26 Meeting started Wed Mar 30 14:00:26 2016 UTC. The chair is stickster. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:00:26 Useful Commands: #action #agreed #halp #info #idea #link #topic. 14:00:26 The meeting name has been set to 'workstation_wg' 14:00:29 #meetingname workstation 14:00:29 The meeting name has been set to 'workstation' 14:00:31 #topic Roll call 14:00:34 .hello pfrields 14:00:35 stickster: pfrields 'Paul W. Frields' 14:01:20 .hello mclasen___ 14:01:21 mclasen___: Sorry, but you don't exist 14:01:26 bummer 14:01:32 .hello mclasen 14:01:36 mclasen___: mclasen 'Matthias Clasen' 14:02:06 * otaylor is here 14:03:15 hi 14:04:19 Hi ueno! 14:04:25 #chair mclasen___ otaylor 14:04:25 Current chairs: mclasen___ otaylor stickster 14:04:43 hi ueno! 14:04:56 .hello ryanlerch 14:04:57 ryanlerch: ryanlerch 'ryan lerch' 14:05:30 #chair ryanlerch 14:05:30 Current chairs: mclasen___ otaylor ryanlerch stickster 14:05:42 Heya Ryan! Thanks for being here during late hours 14:05:45 ryanlerch: hey, good to see you 14:05:53 heya mclasen___ ! 14:06:02 heya stickster! 14:06:12 * stickster notes we are missing quorum but this meeting is largely for discussion/strategy and not so much "decide yes/no to do " 14:06:38 * mclasen___ is trying to get hold of various laggards 14:06:44 #topic ostree based Workstation 14:07:14 the relevant link is https://fedoraproject.org/wiki/Changes/WorkstationOstree 14:07:23 if you hadn't seen it yet 14:07:26 #link https://fedoraproject.org/wiki/Changes/WorkstationOstree 14:08:04 I've made some edits to that page since the last meeting, to reflect things I've learned since then 14:08:26 in particular in the scope section 14:08:51 I think it is fair to characterize this as a stretch goal for f25; there's many things that are still up in the air 14:09:00 * stickster admits right up front, the thing that would help him most is having someone either demo or explain in a doc how xdg-apps work... I'm familiar with rpm-ostree to some extent after other demos and even trying it out in a VM 14:09:33 mclasen___: I agree about this as a stretch goal, because in particular the rel-eng work isn't well scoped here, and AIUI they have a very full plate already for F25 14:10:01 * stickster also remembers to ping mattdm that this meeting is happening in case he wishes to lurk 14:10:21 to some extent, this is riding on the coattails of project atomic - we will be able to benefit from rel-eng work for atomic 14:10:42 but yes, that will likely be a bottleneck 14:10:54 certainly for the rpm-ostree part... what I'm not certain about yet is tooling for xdg-apps 14:11:14 But first thing's first 14:11:38 mclasen___: Someone 14:11:40 argh 14:12:00 mclasen___: for an end-user though, would there be much of a visible change between "traditional" and os-tree based? 14:12:12 stickster: You might want to look at http://hughsie.github.io/xdg-app-ng-website/ - it's Richard Hughes's attempt to make a nice slick website for the project 14:12:18 other than gaining features like rolling back after a release... 14:12:55 ryanlerch: I think it depends on what you mean by "end-user" 14:13:42 ryanlerch: for someone who is not installing software or dropping down to the command line, it looks identical 14:14:03 ryanlerch: for someone who is installing apps through gnome-software it looks pretty much identical (except for the set of available apps) 14:14:16 ryanlerch: the visible changes are mostly in the way you install and update software 14:14:46 we've somewhat anticipated the changes in the gnome-software ui - the atomic update for the os as one blob 14:14:46 ryanlerch: but if you are used to dnf installing random packages - it looks entirely different (and probably worse if this is how you mainly use fedora) 14:14:57 sorry to be late 14:15:06 and separate app updates - with xdg-app we'll go back to allowing online updates, I think 14:15:06 #chair cschalle 14:15:06 Current chairs: cschalle mclasen___ otaylor ryanlerch stickster 14:15:19 ah ok, so a developer that say, wanted to install a particular library "package" for development on their system, it will be a big conceptual change? 14:15:55 ryanlerch: ^ better formulation than "random" :-) 14:16:22 ryanlerch: yes, it's a big change... basically the idea is that developers should work in isolated environments specific to their project and not mutate the OS 14:16:26 For instance, I want to hack on Pagure. To do that I might need to install a set of packages peculiar to that project. 14:16:45 But -- the alternative is to use python-virtualenv in which case IIUC all the requirements end up in my $HOME 14:17:04 which is more "upstreamy" 14:17:10 one premise here is that you shouldn't do development by installing stuff on your system, but instead embrace vagrant and other vm or container-based approaches 14:17:35 mclasen___: Although doesn't that offload some work onto a principal project developer? 14:18:01 "If you want developers to use Fedora to work on your project, you also need to set up a container for your project, not just the standardtree in github" 14:18:50 stickster: I think it's reasonably normal for develoepers to provide a vagrantfile with their project 14:18:57 it is closer to the way developers work on other platforms, I believe; at least that is the approach that the cdk takes 14:19:11 stickster: probably more normal than providing a list of fedora packages to be installed 14:19:45 for python stuff, it's probably most normal to document setting up a virtualenv and pip installing into it 14:19:46 mclasen___: excuse my ignorance, cdk? 14:19:52 in any case, I don't think we'll have this part of the story necessarily fully fleshed out for f25 - there's a lot of groundwork to be done first 14:20:11 ryanlerch: Container Development Kit, but is that a Red Hat product thing? 14:20:24 yes 14:20:32 thanks stickster, mclasen___ 14:20:54 otaylor: Python is one of the few areas I have any experience doing myself 14:21:13 otaylor: So you guys are thinking about venv as among the vagrant/container-like use cases? 14:21:50 stickster: yeah. It's listed in https://fedoraproject.org/wiki/Workstation/AtomicWorkstation actualyl specifically 14:21:57 * stickster shuts up about the Python rathole after this :-) 14:22:10 But I think we've been talking about more vm/container solutions because they are more general 14:22:55 otaylor: gotcha. I'm interested to know that e.g. Fedora Engineering team members could make use of this new Fedora Worsktation in their day-to-day 14:23:08 sounds like +1 14:23:29 OsTree is *a way* of installing Fedora Workstation - in the short term it's definitely not *the way* - it's going to take a while to sort out everything that an abitrary existing Fedora user might want to do 14:24:28 Right, one important thing to note is that F25 != only a new Workstation 14:25:39 stickster: Don't quite understand - Are you asking about OsTree for other variants? 14:25:45 otaylor: so, OStree doenst use packages at all, right? Does this mean that all the "end user applications", weather they be a CLI end user app or a GUI app needs to be "repackaged" for use in an OStree based system? 14:25:45 #info The new ostree model Workstation will be an additive product at first and isn't expected to replace the existing Workstation right away; will need "field" data to see where we need to make changes or enhancements for use cases 14:25:49 otaylor: ^ 14:26:15 let me know if we're not saying the same thing and I'll undo that 14:26:26 stickster: That sounds right 14:26:30 coolio 14:26:40 * hughsie also wants to keep the support matrix as small as possible; supporting gnome-software-on-packagekit-on-librpm is totally different to gnome-software-on-xdg-app-on-ostree 14:26:56 o/ hughsie! 14:27:07 * hughsie was summoned :) 14:27:21 well we are still using rpms to compose the OS tree build afaik? rpm-ostree? 14:27:42 ryanlerch: THere is no rpm installation on the end-users system 14:28:20 cschalle, sure, it's the same inputs, just very different ways of managing changes 14:28:27 (walters has plans to enable layering packages on top of rpm-ostree, but I think it doesn't really fit in with a no-sysadmin vision very well. It adds sysadmin back) 14:28:31 ryanlerch: the answer is a bit different for the os image and xdg-apps 14:28:40 the os image can just be populated by straight fedora rpms 14:28:46 #info We need to be careful about support combinatorics, i.e. not making support matrix unwieldy by too many variations of underlying tech (PK/xdg-app; librpm/ostree; others) 14:28:51 for xdg-apps, we need at least relocatable rpms 14:28:57 stickster, +! 14:29:01 +1 even 14:29:16 I figure QA would say bravo too 14:29:27 stickster, for instance upgrading a live workstation to an atomic workstation is going to be hard 14:29:38 and vice versa of course 14:29:57 ryanlerch: GUI applications are installed by packages. Command line applications - we have no current plans to provide installation other than in a container/vm. 14:30:24 hughsie: Although we may want a story for doing that so people can keep $HOME while doing so 14:30:36 even if it's "install around /home" 14:30:47 stickster, story = "testing and QA" :) 14:30:47 otaylor: so if i wanted to run vim, i would have to run that in a seperate container? 14:31:08 otaylor, why not vim as an xdg-app? 14:31:08 hughsie: stickster: I don't see us supporting that, other than backup/restore 14:31:11 ryanlerch: Probably - TBD 14:31:45 ryanlerch: It's certainly possible to have command line apps as unsandboxed xdg-apps with a little extra glue to get them to appear on the path 14:31:49 i mean, nobody said it has to be GUI apps only 14:32:01 and stuff like powertop won't like be run in a container or vm 14:32:03 mclasen___: Ouch, with > 200 GB /home partitions out there that could be a disincentive 14:32:04 hughsie, I guess that is doable, but it would require us to design the portals to also work in command line mode 14:32:36 cschalle, or just say all command line stuff is unrestricted and unsndboxed? 14:32:37 ryanlerch: But there's some danger of breakingthe xdg-app story if we go off too far in that direction 14:32:52 cschalle: portals? 14:33:22 ryanlerch, portals are the method of which a sandboxed application gets access to stuff outside its sandbox, ie files in your Documents folder 14:33:36 cschalle: thanks :) 14:33:47 otaylor: can you explain that last statement? 14:34:48 stickster: WHat I mean is that we are trying to be very clear that xdg-app is not a general container solution. It's for GUI applications launched from a desktop file via your app shell, that interact with the user through the windowing system and talk to the rest of the system via D-Bus portals 14:34:56 hughsie, but part of the 'story' here is supposed to be that library bundling is ok due to sandboxing mitigating the security concerns, if we switch to saying unsandboxed in the long term story for command line apps I guess we undermine that message 14:35:07 otaylor: Ah, I understand. Thanks. 14:35:10 cschalle, true 14:35:11 stickster: if it is a separate partition, you should be able to install over your traditional fedora install with an ostree one, I think 14:35:16 cschalle: well, a sandboxed vim is not very useful 14:35:23 mclasen___: That's all I was hoping for :-) 14:35:30 cschalle: as in, you would not be able to open your files to edit them 14:35:31 once we have an installer that can install the ostree variant, anyway 14:35:33 mclasen___, correct 14:35:39 mclasen___: I don't think there's a clean solution without separate /home... just hoping we could at least make that work :-) 14:35:40 alexlarsson, agreed, which is why I mentioned needing command line portals to make that viable 14:35:43 stickster: Once we say "but also it's for running command line applications" then we have to be clear where the line is when someone asks "and what about httpd"? 14:36:00 cschalle: yeah, but portals are typically UIs... 14:36:09 alexlarsson, that was my comment exactly ;) 14:36:12 cschalle: In general portals imply application modification, and I think the main interest for command line tools would be existing tools 14:36:20 cschalle: i don't see how they could ever work on the terminal 14:36:58 alexlarsson, I don't have a clear idea either, which is why I leave it to you to figure these things out ;) 14:37:00 otaylor: So one line might be anything designed to touch or be touched by a non-local resource/system 14:37:26 i would say 14:37:31 "anything interactive" 14:37:34 i.e. vim's OK, but not httpd, and you should be using venv/vagrant for your web app 14:38:03 typically via X/Wayland, but possibly also via a terminal 14:38:29 Of course, none of the xdg-app desktop interaction as it now stands would work with the terminal 14:38:47 i.e. you can "xdg-app run org.vim.Editor the-file.txt" 14:38:53 but thats rather annoying 14:39:14 alexlarsson: you'd need to have a way to export a pty slave instead of $DISPLAY 14:39:15 whereas the .desktop file integration makes it completely invisible to users of a graphical app 14:40:16 xdg-app runtimes are kept in ostree too right? is this a seperate ostree to what the workstation ostree will be? 14:40:19 actually its possible for the xdg-app to access its controlling terminal 14:40:33 ryanlerch: a different repo, yes 14:40:40 /var/lib/xdg-app/repo 14:41:01 ryanlerch: there are two repostories on the users system - on for the OS, and one for runtimes and apps 14:41:30 ryanlerch: then those point to remotes elsewhere 14:41:30 otaylor: Is that restrictive or is it an arbitary number of repos for runtimes/apps? 14:41:57 Its actually two, one system wide, and one per-user 14:42:06 But there is no need for more than that 14:42:14 why would there be? 14:42:19 stickster: one repository locally, but can have multiple remotes. (Like you can have one rpm database with packages insetalled from multiple yum repositories) 14:42:19 there's an dvantage to having fewer repositories, since we get transparent content sharing across all the things in the same repo 14:42:29 gotcha 14:43:08 stickster: I'm guessing we'd have two repositories on the fedora infrastructure - one to host OS images, and one to host apps and runtimes 14:43:09 installing the application checks out a revision from the repo to some other place on the file system 14:44:29 stickster: you don't need multiple repos to e.g. have multiple versions of an app/runtime (or different runtimes) installed in parallel 14:44:42 alexlarsson: thanks, that's what I was looking for 14:44:53 If you don't know ostree well, think of it like git 14:44:58 distinguishing between repos/remotes was the key 14:45:02 there is one local git repository 14:45:08 it has multiple remotes configured 14:45:21 and for each such remote it can mirror a set of branches 14:45:29 each such branch is an app (or remote) 14:45:40 just asked walters, his suggestion here is that package layering will mitigate some of the security issues around bundling when you are not sandboxing and that maybe fuse or something might be a solution, where you when running certain tools can map a directory into your container for instance 14:45:45 (Except that while you *could* have one local git repository for all your projects, you usually don't) 14:45:47 and gets checked out in a directory next to the repo, named by the sha1 hash 14:45:51 a not-really related question: will all the seperate runtimes for xdg app lead to the footprint of an install being bigger on my system (storage-wise) than a traditional package-based system? 14:46:25 it could, if you install apps from a variety of places that depend on different runtimes 14:46:26 ryanlerch, probably, although ostree is doing some deduplication 14:46:29 ryanlerch: yes. Probably more from bundling of dependencies with apps than runtime duplication 14:46:39 think of it like installing kde to try out kate 14:46:45 cschalle: that is how the document portal works, i.e. the fuse fs maps a single file into your app 14:47:04 ryanlerch: any file that is exactly duplicated will be shared 14:47:08 cschalle: but, you need the callout to pick the file outside the app so we can trust to give the app access to the file, and that a UI 14:47:30 alexlarsson, yeah, so colin thought that we might want some command line portals (which could probably be shared between docker and xdg-app for these kind of usecases) 14:47:58 ryanlerch: it depends, if you currently want to run a fedora 22 app on fedora 23 you need a vm or a chroot, which would likely be larger than having the f23 + f22 runtimes 14:48:12 ryanlerch: but yeah, doing so will take more space than f23 only 14:48:34 cschalle: but how do you "call out" into a portal from inside a terminal? 14:49:15 alexlarsson: the simplest case would be that the file passed on the command line gets portal'ed, but I think this falls over for anything complicated. 14:49:25 otaylor: yeah 14:49:54 yeah, it would clearly not be a 1to1 match of our 'UI' portals, and in some cases they might need to function so differently that calling them portals might be misleading 14:50:02 xdg-app-portal print ? 14:50:41 maybe some of this is more like super priviledged containers? 14:51:07 xdg-app run org.vim.Editor `xdg-app export-file --app=org.vim.Editor ~/test.txt` 14:51:09 that would work 14:51:21 but its hardly easy to use 14:51:54 So there's obviously details still to work out on the portal side 14:51:59 well I guess it is a discussing worth having with relevant parties, but maybe not something for us to hash out in this meeting? 14:52:05 One other point is the release engineering tasks 14:53:13 * cschalle feels that stickster needs to follow that up with another sentence ;) 14:53:18 I would like to un-subtly and expliclty make the point that this needs discussed *frequently* and *in detail* between the folks designing the working product and the Fedora release engineering team 14:53:49 The Change page has a rough initial list of what we think we need 14:54:11 mclasen___: Right, but the devil's in the details for things like "Tooling for building xdg-apps in Fedora 14:54:14 " 14:54:27 I will take the action to set up a meeting Owen, myself and 'rel-eng' 14:54:35 the hard bits for rel-eng would be getting the non /usr build target, right? 14:54:47 i.e. every rpm would need to be built multiple times? 14:54:51 suggestions for who to reach out to ? Amanda Carter has been mentioned to me 14:55:15 That's actually a good bit of work. Could involve rpkg/fedpkg or some other tooling, integration in the fedora-packager stuff, the tools to compose the product, and then also how do we expose those things in all the web services (koji, pkgdb, bodhi, others) 14:55:16 hughsie: not every, only apps that we xdg-appify 14:55:55 and also, not those that are in the runtime 14:56:11 mclasen___: Amanda has been organizing the work around Atomic and Docker layered images in Fedora, ISTM this is a similar project size/type 14:56:17 mclasen___, sure, but that would mean providing rel-eng with a list with all the apps, and all the non runtime deps, right? 14:56:17 only the leaf rpms, and whatever dependencies they need to bundle (that are not in our defined runtime) 14:56:25 seems "all" might be an easier thing to decide on 14:56:43 hughsie: Not really 14:56:53 Don't we want contributors to be able to build xdg-apps for things they offer? 14:56:57 hughsie: because there will be fallout from things not rebuilding with a different prefix 14:57:08 hughsie: don't want to spend time on that for unused packages 14:57:16 what stickster said^^ 14:57:28 stickster: ideally it should be rebuilt on demand 14:57:44 I think one of the main things is figuring out what we can help with- certainly things like adding xdg-app support to koji and rpkg are potentially things we can help out with. 14:58:01 alexlarsson: what do you mean by "on demand"? 14:58:06 alexlarsson: by "on demand" you mean when a desktop-app package is updated, an xdg-app is auto-generated? 14:58:22 * stickster uses the stupid example of his pulsecaster package which is clearly a desktop app 14:58:42 otaylor: i mean, if and when you want to package foo, all the dependencies of foo are queued for a rebuild with a different prefix 14:58:53 package foo as an xdg-app i mean 14:59:01 otaylor: re: helping with xdg-app support, that would certainly be useful and (I hope!) productive 14:59:28 alexlarsson: yeah, well, that's certainly raising the stakes 14:59:52 that auto-packaging/rebuilding makes sense to me although yeah, it's definitely some retooling work 14:59:55 otaylor: yeah, i guess, in terms of infrastructure 15:00:22 i think it might be less confusing to rebuild everything to /app at package submission time 15:00:32 something like pulsecaster woul be easy to relocate 15:00:35 firefix less so 15:00:41 But I think we can agree this isn't something to dump over the wall to rel-eng a month before release and expect it to be done... starting up some way to scope & track the work will help a lot. 15:01:02 hughsie: well, you don't want to rebuild things in the runtime 15:01:20 alexlarsson, did you do any work to try and guess how many apps would fail to relocate? 15:01:30 not really 15:01:33 #info release engineering and service tooling component of offering xdg-app on top of Workstation is significant work; will need consistent outreach to rel-eng and infra guys 15:01:41 i know for instance the firefox wrapper script hardcodes /usr 15:01:43 alexlarsson, well, what happens if i'm targeting the fedora18 runtime, and i need a newer glib in my app bundle? 15:01:57 We're over our hour, guys, and I have another meeting to attend. I can hand the gavel to someone else to #endmeeting when ready 15:02:12 hughsie: then you're not using a fedora 18 rpm to bundle, so you need to do something else, no? 15:02:20 stickster: maybe we just end the meeting and continue on #fedora-workstation 15:02:32 mclasen___: I think Amanda is probably the person to contact and feel free to cc me/drop my name to discuss whether/how she might want to help track 15:02:36 i think we're talking about bundling the rpms from a single fedore release 15:02:38 yeah, we need to get both our internal and external tooling story polished. In some sense the external one is even more important in my eyes. I mean getting gnome-calculator as an xdg-app is a lot less value IMHO than getting github to offer an Atom xdg-app for instance 15:02:42 anyway, i gotta go 15:02:45 stickster: ok, thanks 15:02:46 alexlarsson: Thanks for being here 15:02:49 hughsie: you too 15:02:53 alexlarsson, i'm thinking about the pathological case; e.g. vmware wanting to use a new glib and also wanting to work on fedora 18 15:03:06 hughsie: but they would not be using koji 15:03:12 hughsie: you don't need to target the fedora 18 runtime to work on fedora 18! 15:03:20 hughsie: they would take the f18 runtime and do whatever they want to jam in a new glib 15:03:27 #action mclasen___ will contact Amanda and involve stickster so we can figure out how/where to discuss further with rel-eng and track work 15:03:27 hughsie: but it doesn't affect how we build our apps 15:03:30 you just need to target the f18 kernel 15:03:55 * stickster hands gavel to mclasen___ and cschalle to #endmeeting when ready... I'll take care of sending notes out 15:04:01 alexlarsson, i guess; i just think everything is easier than having a dynamic number of apps opting in and out 15:04:21 stickster: where do we stand with 3rd party apps proposal 15:04:26 well, and the f18 desktop shell 15:04:38 hughsie: well, the core stuff like glibc will be pretty hard to build relocated, and for no reason, because they will be in the runtime, not the apps 15:05:23 cschalle: I still have some editing to do, have been a bit buried this past week with Alpha and some personnel issues 15:05:29 ok np 15:05:30 but it's on my list for end of week 15:05:34 alexlarsson, "everything - a few things we know are going to fail" 15:06:15 hughsie: i guess we could queue the builds but not block if they fail 15:06:29 right; that would certainly work 15:06:58 then one would fix the relocated build when needed to package an app and the new rebuild would succeed 15:07:16 I guess that would work 15:08:03 alexlarsson, do you know if we have any non-blocking-build stuff in koji right now? 15:08:08 ok, do anyone got anything else for the working group? or should we endmeeting? 15:08:09 e.g. best effort builds 15:08:19 hughsie: yeah, non-important arches 15:08:33 tier 2 or whatever 15:08:34 if so, turning that on now would be a great step 15:08:47 and let us fix / exclude the easy stuff early 15:09:05 mips and ppc64 for instance 15:09:21 do we care about xdg-app i386 builds? 15:09:32 so, the entire thing could be handled as a secondary arch 15:09:35 i guess relocated arm and x64 is all we want 15:09:39 x86_64-app 15:09:39 i think so 15:10:12 * mclasen___ going to call it now 15:10:17 two new arches should be easy enough for rel-eng, considering they're just the same as existing witha custom build cflags 15:10:17 #endmeeting