So, today we will talk about how we develop our money for the last four years, and first
of all the things about myself.
So, my name is Andrew, I help with many years of experience doing different stuff.
I do redhead based something for 13 years already, and I am a money architect from the day one.
So, why the person who asked questions about why I am going to sit this way or another,
because I basically was involved in every decision made.
So, as it said previously, yesterday we surveyed four years, first our first public release,
it was, yeah, so it was 8.3, better, a purple manu, and it was released like exactly
55 days after it had an announcement about like Santos Linux 8 and the 5, and in the beginning
it was like, it's very early stage, so we had just one architecture, it was Intel obviously,
we were exactly at head loan, we didn't have any secure boot support, we didn't have any
euros yet, we did the cafe new rattle opens cup, but Santos never have themselves kind of fine.
Anyway, we during four years we changed everything about this, except obviously 55 days we can't
change the past. So, today we're talking about, I'm a municipal system, and it's our way to build packages
for seven architecture already, how we maintain images, we maintain a lot of them, and we try to
maintain the easiest way, the most transparent way, to make it easier to contribute to them,
how we unwoked upgrades inside the enterprise new secure systems, because in the personal
Linux, it's not possible to just do the NF update and go from seven to age, for example.
How we decided on why the decided to stop being rattle on, how we bring back devices support,
how we decided to run on older CPUs and what had runs, and our future plans, so let's start.
Every since starts here, so we build a package in our build system that we develop to make for
all this for years, obviously, we develop it. It's a context of several companies,
core components are there, so it's a server from 10 build node sign node, some file,
the difference between sign node and sign file is that sign node is dedicated for RPM sign in,
sign file is just a little service to sign and you rent them file, like RAPOMD or checksum file,
with PGP, we have used a lot of open source projects, obviously, and there's a hood that
one of the projects I want to talk about is pop, so pop is basically a certified storage,
so it allows us to store RAPOMD packages, Python models and so on,
organize them into RAPOMD and it's used by RAPOMD for many years, it's now used by Fedora Cooper,
and also it's used by Almanus build system, so basically we decided to build our
system around RAPOMD storage. Why we need it? What's wrong with God? Nothing wrong with
them, but we just have our own vision, we have a lot of the experience doing packages and builds
and so on, so that's why we decided to have our own build system and well, it's a way we want,
and what we can do, so we can build, obviously, for some architecture, now we can build for
RAPOMD as well, we can build models, kind of think from RAPOMD 8 and 9 generations,
we can sign a binary responsible for Intel and ARM architecture, so we can release build images,
Intel, build packages into RAPOMD storage and export to file systems and to primary mirrors and
to mirrors around the world, we can collect security advisers from RAPOMD Head,
public sources, modify them, and provide in different ways, and also now we can do our own
advisers because sometimes, as not being RAPOMD anymore, we can do CV fixes much earlier.
So, cool thing about power here, so how we resolve this, we don't need to rebuild the whole
RAPOMD, it's a whole recompose, so it has to add us, so it has to include updates, we just can
with public and just add RAPOMD packages to RAPOMD and then see it, so how it works here, so
in container CDs, when you release packages, so it allows you to basically see where packages
goes, so as you can see, you have storage source package, both to source RAPOMD, like no architecture
RAPOMD goes to make any architecture, this particular package is a small CD package, so it goes to
32 bits and 64 bits, and other packages goes to corresponding architecture, and we decide where to
place package, like base of a sub-sumer or whatever, because we monitor ourselves and we monitor
and send to a stream, so we see where packages will place it and place the same way.
So, as for security patching, so the threat provides public data for it, so it's not a problem for
us to get security information, it's available in API, it's available in all feed, which is
deprecated right now, but still available, it's about a new way called VAX documents, RSS fees,
and this information is totally not for us to work with our libraries, because it has IDs,
descriptions, CVs, whatever, so what we can do later, so we collect this information from it
have put into this UI, and here, when container can control what we release, packages might
do changes to title, description, whatever, if it's necessary to to brand something, so
so yes, and that how it release to public, and also recently, because we started to
release in a base before it had we need our own way to release security advisor, so basically
we can create just new security advisor with an informational one there, and then when it's created
we can public in different ways, so we public them to our other side, to mailing these to our
says feed, we public to our specific format, just on, and also it used by several security
planners, we still publish them to overall feed, and we're not going to deprecate this,
I hope that info.xml, which we included in any dnf repo, and to work with dnf
to on user site, and always visit a base is kind of a new model, a Google thing, for example,
release of dnfs in this format. Next topic for today is images, so we release a lot of images
of different kinds, and we try to build them easier for our community and contributors, so first
of all, obviously, we need to build types of images, but because we don't use corgi anywhere,
we have to punch it all, which is used by the patterns and so on, so we patch it to not use
and not provide to corgi, so our fork is available, anyone can use it, also we obviously
will provide our configuration files, and to make things easier, we also provide guide
how to build and might be obsessed to images yourself. For container images for Docker podman,
so we build them in GitHub actions, to make it super easy for everyone, to contribute there,
so it's possible to build for any architecture, we push them to Docker hub to acquire a lot of
GitHub packages, and we create poor quest to Docker official library because obviously we are
official image server, wife media images also created in GitHub actions, so no problem, so we build
for into an entire RAM, we upload types of images and logs to Amazon history market, and we also
announce these builds in our like chat channel of live media sick, so everyone can try it
then before they will appear publicly for everyone who knows, perhaps, Raspberry Pi, and we also
support Raspberry Pi files, a five-facing Google has the first RPM based distribution who started to
support it, so I also build completely in GitHub actions, we are easy to contribute, I also publish
to history, and chat channel. According to the program images, a lot of them will build, so
open-step, open-name of Azure Amazon, Oracle, GCP, we don't build them because Google do that on their
sites, so send to them, and the program images of any kind, including images for a RAM, for Apple,
Silicon Maps, Macs, for VMware Fusion, and Parallels, this part is not really good, I might
do it right now, obviously we have a lot of configurations and scripts, but we need to automate
it in GitHub actions, so if you have good GitHub actions, you can help us with this.
Some two with the first I think, we released almalinux is almalinux depot 2 because we created this
project with sentoS7, 8 and 5 in mind, so we know that there are a lot of systems with sentoS6, sentoS8,
available, so we need to integrate them without any reviews, without any problems, so we provide
two for that, and we provide migration guide, how to do that, and with this two you can go from any
8 across the system to almalinux, and from any 9 across the system to almalinux 9, but what you need
to do if you want to jump from one version to another, so we decided to start to elevate
project for this, so because we knew that sentoS7 and the 5 is also expected pretty soon, so
it based on route ahead leap for in work, so it has to migrate as route 7 to 8 for example,
but this still doesn't allow to use anything but route ahead, and it doesn't support
search patching levels, and it's very hard to find the system production without Apple Rep, for example,
so we think that so we maintain our version of this tool that supports non-retreat distribution,
so it's actually not only up not all the almalinux, so we support all of them, and we support several
reports, like Apple, Docker, MariaDB and whatever, and it's really easy to contribute there if you want
to extend this list, so currently support pass as a following, so almalinux, so S10 isn't better yet,
so it's not kind of recommended, but sentoS3n is available a target, so you can go all the
way from sentoS6 to sentoS3n can, I can say it would be easy, but this will save some mental health
for you definitely, so yes, so we maintain the repository report for that, you can contribute there,
and configuration data, like Rep or files, like in 1000 configurations has stored in the
leak data, so yes, and there is a contribution guide which shows exactly how to sort of
put your report to evaluate the make it work, so during first them we were requested for
RP Infusion, for example, so we are ready for such contributions as well,
everything was fine before this, so in 2000, 23, it had decided not to upload
like package sources anymore to sendoSGit and they only available behind subscription, it's not a
problem, I mean to get subscription developer subscription allows it, it's not a problem even to
buy subscription, the problem is that this subscription agreement doesn't allow it to use this
sources for your distribution, so we took our time to think about agmalinux viewers and decided
that is right, because we are fine, sources is not a big problem by the way, because we still have
40% about 40% of them from RATKTBI, it's exactly RATKT sources, they are public, they are legal,
everything is fine, and we took other of 60% from packages from sentoS3M, the way that RATKT
does that, I mean we don't sendoS3M rebuild, so almalinux is a little bit behind sentoS3M,
exactly the same way as RATKT behind sentoS3M, so sources is not a problem, we have them,
but what is cool now, I do not be in RATKT clone, so we can do bug fixes earlier,
because sometimes community members come to us and say, please fix this, and before that we said,
oh we can't, because we are at RATKT clone, we need to fix this in RATKT first, but now we can fix this ourselves,
the same situation was vulnerability, and also as a distribution developer, we have
ability to get information without vulnerability's earlier, then they will come public, so we
prepare it for this, and also we have some derivatives, all right, so we have done strings,
and we need, we can now propose them to include their specific changes to almalinux, of course,
if they don't affect almalinux users in any way, to move this part to us and let them focus on their
work, and also we can include more device drivers to support other hardware, so I will show you
how we do that, so let's go one by one bug fixes, one case in November we were contacted about
the zip to update, so this update basically, security updates that RATKT made, break, broken,
like that interface test, so we were contacted by the zip developer about this, he said,
you should apply another patch from upstream to make it work and explain this situation,
so we took three days for us to release update, a great issue in RATKT GERR, and send
who requests for CentOS Stream 8 and 9 to fix this, and then actually RATKT 9 never got this update
anyway, but RATKT 8 got this update several days ago, so little bit longer, so for some time we were
only one with working zip to, as for security, this happened sometimes, I think our first case was
a ZenBlit vulnerability in AMD processors, so we started extensive testing of Linux firmware
of the package update with our community, and did update on July this year, like that year,
and update appear in RATKT, like two months later, and recent example is open SSH,
vulnerability, so thanks to developers, like my little list, we have this information before,
so we were able to release update, like two days before RATKT, is it one kind of an also
appropriate, but it's enough to talk to the system of us, so and for the RATKT if CS, we can help
them do their work, I think the most popular RATKT right now is 12 Linux, so decided to use
my Linux repos and my Linux build packages in their products since version 8.5, and just focus on
their work, so yes, and one of the examples is called in it package, for example, so we may
end up maintaining parts in our money, so we maintain parts to both our money and so they don't
need to rebuild it, so this happens sometimes with the RATKT, and for additional hardware, yes,
a lot of users started noticing that when they tried to migrate from 10 to 7 to 8, for example,
a lot of old storage devices stopped working for them, and the same for network devices, so we
calibrated with a RATKT project which provides models for such drivers, for such devices, and just
merged this to Almalinux stock kernel for this particular drivers, and this cover, I mean, almost
all cases like this, so yes, how to do that, we maintain several patches in Almalinux stock kernel,
so first patch is global patch to allow you to just move all the disabled PCI-IDs to unmentantly,
so now it works and says that drivers not maintained, which is true, but it still works, which is great,
and also we maintain several specific patches for several specific drivers to enable additional
PCI-IDs there. So yeah, I was special enough, I think, but then we decided, okay, how to do
more special things, how to bring major changes, how to test them, how to be better prepared for
next major release, and we did an Almalinux kit and announced it in October of last year,
so what is it? It doesn't have any minor versions, it's based on sentoestring,
then sources supported at least five years, just like them, it's our recommendation for better,
and 92% of packages went directly to a wrong kit and to better, and it allows to get
stable updates earlier, just like sentoestring 10 allows to do that for a third,
but from the first day we had a lot of changes, comparison to sendoestring, so it is built
for this framework, it's enabled, so how easily profile and debug your applications,
secure boot is supported for Intel and TMZ, we bring back spice protocol, last for that,
and let's head drop it since, let's head 9, same happened to KVM,
virtualization on an IBM hour, it was dropped, but we brought it back, we support even more,
disabled devices, and we decided to support our traditional architecture,
so basically Red Hatten will start working on CPUs after 2013 and we did it for CPUs after
2008, so basically the same CPUs were Red Hatten 9, or Malin's 9 works, so how to do that,
this level of architectures are supported, so the higher levels, the better CPU you need to work,
so they are supported in RPM, but unfortunately nowhere else, so we had to patch
like 20 packages to make it work in Kitten, so he listed here, so we are going to
contribute this work, for this one, to work for Dora, in the Intel center stream,
there is some other issue with this level of architectures, because this code will
left, it doesn't work for it, for example, because it's not exact, this architecture,
so we have to patch this on our side, but proper decision is to make code looks like a
right block, so we already had conversations about this with Dora guys, and hope they will start
help helping us, so what's our plans for this year, so it's like Al Malinux 10,
stable recently, we started working recently on Al Malinux 10, for this five, and tells
to expect this year, and for several words, we started discussions on technical student committee
level about Apple 10 for V2, because it's nice to have a minus for V2, but without Apple,
like it's kind of not complete, so we also need to build this, so join discussions if you
have something to say, we need to extend our automation to focus on cool stuff, not on our daily
things, and we also are going to improve contributor experience, so more contribution guides,
more deplace and de facto, and whatever, so yes, that's our plans, and this is what we do every
day, this is how we do that, so if you think that it's great, and your hard feels it's great,
so we have a lot of six where you can join, so I build six course six, so just check them out
in our V2, and join what we do, it will be happy to see you there, thank you
you. Do we have any questions? That's an interesting spot, can you please pass it over?
Hi, on the slide for Armandinov's kit, and you had a point saying firefox and thunderbird,
or included, but you didn't strike out, and you didn't say, oh yes, I forgot to mention this obviously,
so yes, from the start we have firefox and thunderbird, but recently we could have decided to
add them as well, so it's not a difference anymore, but obviously we have them. Any more questions?
I was looking for Armandinov's 10 for cloud images, but it was not in the battle,
so I was wondering, is it going to be first released in the release, or would it be like a
pretty release of the cloud images, specifically the generic sounds? So we released cloud images
for Keaton already, so we have them, but not the 10 better, but don't better, okay we can do that.
In Keaton works fine, I was just wondering. Do we have times for the more questions?
One more? Yeah. Any more questions?
Might as well. So, for this claim, I mean, before I ask this question, I work for that head,
but the famous article that I think was Matt Hicks wrote on this continuing in this
center's sources, essentially said, this enables other distributions to make a difference,
and, you know, thank you for that. And so, wouldn't you more or less agree that
because of this decision, Armandinov's is now better than it was before, because it can offer a
difference, and is now added value compared to the largest copy in real?
Yes, personally, I think so. It's better now. Okay, thank you.
That is it, thank you so much.