- Arch-devops - lists.archlinux.org

[arch-devops] Meeting tomorrow 19:30 CET
by Jelle van der Waa 08 Dec '21

08 Dec '21

Hi all, I'd like to have another DevOps meeting with as topics: * Gitlab status / ToS * Mailman 3 progress * CDN status * Gluebuddy * DBScripts debug packages deployment More information is available in the pad [1] [1] https://md.archlinux.org/2H6y_4lFTOyOmw61VrEMnA

1 1

[arch-devops] Gluebuddy progress
by Jelle van der Waa 03 Dec '21

03 Dec '21

Hi all, Yesterday anthraxx and I hacked together on getting gluebuddy ready for production. Gluebuddy is a tool to automatically put Arch Linux Staff in the correct Gitlab organization/teams and can later be expanded to enforce more repository settings. The open pull request was updated to not remove our archceo Arch Linux group owner and handles our three devops onboarding/offboarding tasks of adding users to the Staff team, Infrastructure Team and Arch Linux group. [1] There are a few open questions: We match on extern_id which is the username in Gitlab and not the keycloak id, is that correct and is that an issue? For keycloak access we now use the admin account, we should rather use an openid client which has “realm-management roles” such as “query-groups, query-users, view-users” The gitlab personal token used for changing For deploying it to a live server we need: Setup a new VPS for running gluebuddy Create a systemd/service with timer so gluebuddy runs every X minutes Find a way to distribute gluebuddy, an option is to use Gitlab release where we upload a signed locally build gluebuddy (retrieve and veriy this in the ansible role). As packaging doesn’t make much sense here. Create an ansible role for gluebuddy [1] https://gitlab.archlinux.org/archlinux/gluebuddy/-/merge_requests/2 Greetings, Jelle van der Waa

1 0

[arch-devops] Wanting to give access to kevr to aur-dev
by Sven-Hendrik Haase 20 Nov '21

20 Nov '21

Hello, as some of you might know, kevr has been hard at work rewriting the AUR in Python and FastAPI. He now wants to deploy this and has been asking for infra access to the aur-dev test server. We evaluated different ways of giving him partial access that involves just mysql and logs access but as it turns out, loki and grafana make this very annoying and burdensome right now, requiring us to host a second loki and grafana just for this. As such, I suggest the practical solution of giving him a user on aur-dev in order for us to move on with this. He wouldn't have access to the real production AUR, just the test box. What this effectively entails is me giving him a user in the docker group which should give him all the access he might need. Any objections to this? Cheers, Sven

3 3

[arch-devops] Artifact signing
by Kristian Klausen 14 Nov '21

14 Nov '21

Hi all, shibumi has been writing a few blog posts[1][2][3] on `cosign` recentely and its "Keyless Signatures"[4] feature. This motivated me to look into it for artifact signing from our CI[5], in particular for arch-boxes (our VM images). After discussing it on IRC (-devops), I'm sending this mail to get some inputs. I have opened a MR with a few solutions sketched[6] (with great help from @shibumi). [1] https://shibumi.dev/posts/first-look-into-cosign/ [2] https://shibumi.dev/posts/what-are-ephemeral-certificates/ [3] https://shibumi.dev/posts/keyless-signatures-with-github-actions/ [4] https://github.com/sigstore/cosign/blob/main/KEYLESS.md [5] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/280 [6] https://gitlab.archlinux.org/archlinux/infrastructure/-/merge_requests/508 Best regards, Kristian Klausen

1 0

[arch-devops] Alertmanger alerts now shown in Grafana
by Jelle van der Waa 16 Oct '21

16 Oct '21

Hi All, With the new Grafana, it now integrates alertmanager alerts, so they can be viewed and can be silenced as well. You can see them in Grafana here. [1] [1] https://monitoring.archlinux.org/alerting/list Greetings, Jelle van der Waa

1 0

[arch-devops] Arch DevOps Meeting Tomorrow
by Jelle van der Waa 06 Oct '21

06 Oct '21

Hi All, Tomorrow is another DevOps meeting, topics include * AUR deployment Greetings, Jelle van der Waa

1 0

[arch-devops] forum@archlinux.org moved to GitLab Service Desk
by Kristian Klausen 24 Sep '21

24 Sep '21

Hi all (cc'ing arch-devops for traceability) Per fukawi2 request[1], forum(a)archlinux.org is now redirected to a GitLab Service Desk[2]. [1] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/394 [2] https://gitlab.archlinux.org/archlinux/service-desks/forum Best regards Kristian Klausen

1 0

[arch-devops] DevOps meeting Thursday 2021-08-26 19:30 CEST
by Jelle van der Waa 31 Aug '21

31 Aug '21

Hi All, This Thursday is another DevOps meetings, the only topic so far is opening up our Gitlab. Greetings, Jelle van der Waa

1 2

[arch-devops] Unable to push packages
by Sébastien Luttringer 02 Aug '21

02 Aug '21

Hello, I'm failing to push diffutils on gemini this morning. gemini.ao ~ $ ./packages-db/db-update ==> ERROR: Package testing/diffutils-3.8-1-x86_64.pkg.tar.zst does not have a valid signature ==> Removing left over lock from [testing] (x86_64) gemini.ao ~ $ gpg --no-auto-check-trustdb --homedir /etc/pacman.d/gnupg -- verify staging/testing/diffutils-3.8-1-x86_64.pkg.tar.zst.sig gpg: WARNING: unsafe ownership on homedir '/etc/pacman.d/gnupg' gpg: assuming signed data in 'staging/testing/diffutils-3.8-1- x86_64.pkg.tar.zst' gpg: Signature made Mon 02 Aug 2021 06:32:45 AM UTC gpg: using RSA key 57224EC9A5FCA6FBC92BB8AA4A1AFC345EBE18F8 gpg: Note: trustdb not writable gpg: please do a --check-trustdb gpg: Good signature from "Sébastien Luttringer <seblu(a)seblu.net>" [marginal] gpg: aka "Sébastien Luttringer <root(a)seblu.net>" [marginal] gpg: aka "Sébastien Luttringer <seblu(a)archlinux.org>" [marginal] gpg: aka "Sébastien Luttringer <sebastien(a)luttringer.net>" [full] gpg: aka "Sébastien Luttringer <sebastien.luttringer(a)epita.net>" [marginal] gpg: aka "Sébastien Luttringer <sebastien.luttringer(a)gmail.com>" [full] I think the server trust store need to be fixed. Regards, Sébastien "Seblu" Luttringer

2 2

[arch-devops] GitLab group application
by Dario Giovannetti 20 Jul '21

20 Jul '21

Hey friends, I'm user Kynikos on the wiki (administrator since 2011): in response to [1], I'd like to apply to become a member of our GitLab group, specifically with the goal of reviewing the confidential discussion in issue #375 [2]. I've already successfully gained access to my Keycloak account. [1] https://lists.archlinux.org/private/staff/2020-September/000475.html [2] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/375 Cheers :) Dario Giovannetti

2 1