Hello, good morning.
Thanks everyone for joining us.
So my name is Micheal Olazharas,
and I'm a customer success executive at Ratat.
So I'm not on the engineering part,
but I contribute to Fedora during my lead
Hawaii of all free time,
not with me.
I will tell you maybe.
I think I would have might,
but I can speak louder.
So I'm Daniel.
I'm working on a password.
I had a sister so right here.
I'm trying to contribute to Fedora M.
and Rust and EBPF mostly.
Okay, so today's talk is about Rust.
There are PMs and the final out of dependency building.
So let's see how this started.
Daniel was working on a project,
I just called BPSman,
which is an EBPF manaya for Linux and Kubernetes.
That is part of the CNC, since June last year.
And as part of his job last year,
there was decision that was done in,
during first them as the introduction of BPSman.
But there was another job that was being working parallel.
That was to integrate BPSman into Fedora as a default EBPF manaya.
So we were discussing about this.
So I started to help to provide the,
my little knowledge of how to package staff for Fedora.
So we started some discussion on how this should be done.
So let's see how we started packaging the BPSman.
BPSman, BPSman, it's a main components are written in Rust.
It's right now available in Fedora 42,
but we started working Fedora 40.
It took two releases because well dependency health as we call it.
And mainly it's all the aspects written by Rust to RPM
that we will show, discuss a little bit about it now.
So what Rust's packaging guidelines says that all the package
should not use being bundle trades.
So that means that every single dependency,
every single trace should be part of the distribution by,
before building the final, the final interest in part.
And the same thing with Fedora packaging guidelines.
Every package should make effort to avoid having multiple separate upstream projects
bundled to get in a single package.
So taking that into mind,
the main way to package Rust things,
to Fedora is using Rust to RPM.
Rust to RPM is a tool written by the Rust Sieg,
special interest group.
And it's designed and it's been used to create
some templating like, that's multiple checks before creating the template.
That would be the later used to build the package.
This kind of tools are great because it provides like the best practices
on the created spec.
There's another one for go to RPM and all the kind of languages.
And it helps to have like a standardized way of doing things
which is always helpful.
The tool is written in Python.
So there are a few commands that are missing here.
But it would be something like this Rust to RPM,
the project you want to package,
download the sources and try to build it.
So in the case of PPFMA,
we can see that it was just already alert in the 14 different
components we're missing to be able to build PPFMA or PPFMA.
Sorry.
So let's, for example, start with the first one.
It was IAR.
You try to be LIA with the same commands and you see that IAR is missing IAR object.
So you try to be LIA object to have IAR to have BPFMA.
And you see that IAR object is missing in the BPF.
And you go with the BPF to have IAR object to have IAR to have BPFman.
And you see that you are missing JSON.
And then you try to build JSON and you see that JSON is already available in federal
but it's not a release you want.
So you need to check the sources and see what you can do here.
Like update the package or just patch it or whatever.
And we can keep with other components like OECB distribution.
You see that it's missing for packages.
And we will start with like OCI and checking what's is missing.
And so on and so on.
And you find 6 star.
And it's missing 22 dependencies.
And well, I guess you see the trend, what's the trend here.
And what's the main problem to package.
Something complex as BPFman.
So during our initial investigations,
we found that the word like several different stacks that were missing.
Including no shady distribution,
sick store, tonic or system digital.
But the word like other dependencies that were two new.
For Fedora.
So that means that we had to update the ones that were in Fedora.
Maybe in some occasions could be like creating compact packages.
Or patching other packages to be able to use the new dependencies.
Another word like tool.
BPFman were using dependencies that were tool for Fedora.
So that required BPFman to to update the code or in the dependencies.
The thing is that.
Based on in our so-called investigation,
we saw that more than 200 new packages were required to include BPFman as part of Fedora.
And that's quite complex thing to do just for one package.
So that's when we started to discuss why not build everything
and to make Danny's life a little bit easier.
Now, Danny will tell you what the steps to do so.
Let's do that.
Let's see if it works.
Don't go too far away.
Okay, this is here.
Can you talk to me well?
It's okay.
Awesome.
So let's make all the same.
So far, like the current status.
Well, it wasn't great.
So I originally intended to go.
Every dependency.
But it was a pain because in the end as you say,
there was more than 200.
So I guess that even at the very end,
it was 500, especially because there were two main,
let's say,
worse offenders.
We were basically A.
It has a lot of BPFstar in the hood.
And of course, 6 store.
We saw the missing cryptographic SSLs and so forth.
So we were wondering about, like,
okay, what if we bend or bendering comes also with a lot of responsibility?
Which is okay.
We can also use Rust to RPM to the bendering.
So it offers you a dashboard option.
And then you can just handle it all.
But well, theoretically.
Because there's an option in Rust to RPM.
Which is super cool.
It allows you to do patching from the cargo.
Toma let you go out for your own spec.
And that's great.
But that really doesn't work when you do bendering.
Because it's basically just only affecting the cargo.
Toma on your own.
So in this example here.
And I'm going to do this big enough.
If not, I can make it bigger.
But anyway.
So let me get you an example.
One of the biggest offenders was,
even by legal issues,
I create a graphic dependency that we can't really use.
It's B4-3 for a elliptic curve.
That's fabulous for sure.
Kindly told us.
And well, we had a quite a discussion with that.
So I was wondering,
okay, how do I handle this kind of situation?
Do it on, and then the solutions were,
yes, create a straight.
Do it by hand.
I wouldn't do things by hand just to let you see.
Or just give it a try.
See how it works.
It's really just work.
So after give it a try.
So first, and before I handle it,
you said, okay, I'll just make some buzzescript
that gets called on the prep site.
And we'll do that.
What happened for me?
I, okay.
I wasn't really that noticeable at cargo.
So cargo has a checksum that handles in the bendering.
And it doesn't provide you with tools to re-run it again.
So what happened was that you had these checksum
for this specific cryptography,
looks on the liquid crypto.
It can just take it out later.
And then you said, hey, I'm not fine with you.
You modified this and it's, I'm not happy with that.
So I started to take how different packets
is where hell in this.
Oh, this is probably the way.
So the other packets are handling this,
and I'll show you later on a little things.
So even the pure rust packets in, in Fedora.
It has a knackley hack about all, yes,
delete all these checksum in, in our spec.
Even worse, it's not like, yeah, it used to read those.
It's that you need to do some ugly replacement
and put empty JSON in every file.
So I started speaking with the guys from the Rusty group,
mainly Fabio, Nelson Michel Lind.
And we decided to have a meeting a few days prior to the frozen here,
which one of the outcomes was, hey,
this is not good enough.
Let's try to create something new.
So we somehow were thinking about, like,
I'm happy to collaborate with everybody who's interested in this.
Having a new tool called RustorpM-Bendor,
that's still in the works in the terms of naming.
But the idea of the asset that this is going to be leaving
on the RustorpM helper repo, which is in Rust,
and it's going to be having just a call
from basically the Python entry point from the main RustorpM.
The idea for that is that we'll be able to do this kind of patching,
not only for, you know, like, cargo the terminal in the spec file,
but also for the Bendering, if simple.
The main idea is just for this to be following one super simple Rust structure,
so basically leave main.rs or something like that.
I guess we shouldn't go on, you know, more complex use cases
because then we will be starting having edge cases,
and it's going to be very falling for us.
And note, and this is really important,
that we are not encouraging people to use Bendering for everything.
This is going to be easier.
What we Bender also comes quite a responsibility,
because for instance, let's say a Dupendor,
let's all migrate over for dependencies.
There's an issue with those, like a security issue.
The secret would be able to automatically handle that all,
and also this is not go.
So we can, just magically, you know, patch that they go more than him,
substitute data, and that's it.
As far as I know.
So in the end, it's going to be depending on every maintainer responsibility,
and what would happen if we don't have no.
So far, we got four or five big offenders, if I remember correctly.
Then sadly, one of the biggest offenders is BPM, BPM, BPM itself.
And the second one is, like, the matrix client, that fractal.
If I remember correctly.
We got a few more, but it's not like we are encouraging people to do that.
This is something like, is that it's here.
You may use it, but please speak with us beforehand.
So, then also, yeah.
So this is when you, we are using, like, a Rastorpian dashp,
this opens.
This is just your, you saw a cardinal tomapile.
So, for instance, you know, you may want to try what happens
if we just remove this dependency, and if it goes south, for example.
It creates a patch for you, and you'll be following,
you'll be able to use that in your aspect.
Okay, so let me also see this for you.
Sorry, yeah, here.
So, some examples for you.
Is this big enough? They make bigger?
Cool.
How about now?
Okay, thank you.
So, this is an example.
This is BPM itself, but you can see that we are doing here,
and not really hack, to basically go and remove the text on.
I don't think this is acceptable, and even the RastPack
as itself does it this way in, in Fedora, and I've seen a lot of those.
There's also another thing, I guess, we should also give you the try,
which is this number one.
And that's also that we spoke in this week's made in,
that when you're using Rastorses, it may, every now and then,
get confused by a shibank, and the macro would say boom.
So, this is not all the other thing.
There's a couple of things, also, there may be some more dependencies,
so for instance, Ring is also, okay, so I've seen that there's a lot
of package maintenance here, more for Fedora, others,
but I just wondering, because when I started doing this,
I noticed that I had to go and modify a lot of licenses here
in some random packages.
So, how many of you have had to open a pull request
to every repo, just to add any license,
because otherwise you wouldn't be able to get into a repo, I guess, a lot of data.
Please raise your hands.
Thank you.
In this case, this is for Ring.
The guy didn't reply to me at all, ever.
So, I had to go and do this early hack as well.
But getting even to the Rast itself, this is Rast in Fedora.
And, again, this is what you probably, no?
Okay, anyway, whoever.
So, see the trends?
Okay, awesome.
So, let's peel back.
In the end, after all these,
I could finally go to have BPM on.
It's meant to be in Fedora 42.
It took a couple of months, sadly,
but I learned a lot into the process.
And I hope that we are going to be able to make the Rast Packaging
better in the future for Fedora,
which is a good thing.
At the same time, we are getting more contributors,
which is awesome, even in the north here.
So, this is basically recapping a little bit,
the idea that we had at the Rast,
which is okay.
Let's identify vendor dependencies.
Apply the patches.
Well, not really patched.
That's what we find the vendor in dependencies.
Using Rast to RPM vendor or whatever name it has in the end.
And, we package now to make with Rast to RPM
and push it to the repo.
Recapping again.
There are a few things that we identified in this meeting,
so we are totally happy to get collaboration done.
This is the first one.
This is me.
Not sure if you can see that big enough.
But anyway, I'm going to be trying to put that into this separate repo.
But I'm totally happy to get collaborations.
And in fact, one of the important things I want to mention
is that so far, most of the packages are also being commented
by the Rastseek.
So thank you for that guys.
But this is visiting one.
It will be commented by the EPPF's group,
which is basically three people.
So please help us.
So I also wanted to highlight this.
This came also as a part of the new established EPPF's group,
which I also spoke about yesterday.
So if you are interested in to EPPF Rast,
AIA or any kind of rate,
the project, please don't hesitate to write to us.
Next.
This is basically for people who couldn't come here.
But please, please,
try not to use Mandarin in Rast in Fedora.
But if you need to,
oh, let's get your life easier, which is the new tool.
Okay.
Questions of R.
You don't have to go away nor is.
You might get in the mic?
Yeah.
We have similar issue with Goseg.
Do you think it could be a prior to Goseg?
Yeah, go ahead.
Yes, can you just, when is your,
they have mic?
He was saying that the Goseg also had a similar issue.
I have no body things.
It would be a good idea to have something to add to the Goseg.
So the reason I'm going discussion at the moment,
I think that there is a big difference
on how Rast is packaged on upstream against
compared to how Goseg is done,
like I guess,
like Carbo is doing checks and things like that,
that go directly ignore.
With Goseg, it's quite easy to fork and do,
like whatever you want to do with so many dependencies.
But it's true that the go and Rast have both that kind of dependency.
I feel still that Gose way worse.
So yeah, there is an ongoing discussion,
and it should be a proposal for Fedora,
43 to start moving,
go packages to vendor,
to be vendor ones.
We did a rough estimation,
that that could be to remove more than 1,500 packages from Fedora
if all the main used go packages are vendor.
So I think that can be a good thing,
because it's such a complex to maintain them,
and there is no correct dependency check between models.
So someone can break the API,
it will work for the application.
We need to introduce compact packages,
it's not easy to do anything though,
because you need to be changing the path for so many things.
So yeah, there is a tool that is called go vendor tools
and there will be a discussion.
But there is an ongoing discussion in the devil list right now,
and there will be,
I expect there will be a proposal for Fedora 43.
In the case of Rast,
as Daniel was saying,
with this kind of tooling,
it will be easier.
I don't think that Rast is at the moment,
in the situation where vendor in stuff,
by default,
it's a good thing,
because the start to screw right now with Rast,
and Rast see is much better than anything.
Yeah, besides that,
again,
I'm telling you that vendor in comes with a lot of responsibility.
I don't know if it's for about go,
but I don't know if it's for about whether you would,
how would you handle,
like you know,
upgrading the bundle dependencies,
because you may get into huge security issues at some point.
Thank you.
I'm going to relay questions to you that are in the online chat,
people who are in the feed.
So one of the questions is,
would it make more sense to automate,
and make easier importing new SRPM dependency packages?
It's repetitive, right?
Sorry?
I can't clarify this.
I will play it for the chat.
Yeah.
So they say that they want to just import new dependencies
with the SRPN,
but the SRPN so forth,
I mean, you need to have a total of the dependencies,
so I don't really understand what they mean to do.
Yeah, go ahead.
If I understand the question correctly,
it's mostly about the bottleneck for reviewing new packages.
Oh, God, yeah.
And, um,
yes, that's sometimes a problem,
but usually we have, I mean,
five or six active Siegmembers in Rust.
So usually the way times are not that bad,
and if you need something reviewed quickly,
then just ask us and we can handle that within a few days,
so usually.
And that's usually the bigger bottleneck,
then actually making a package,
because Rust2APM takes like two seconds to run.
Yeah.
When it works.
Yeah.
It usually does.
It's not really a question,
but I wanted to say thank you,
because I am packaging for open-susers.
And by default,
we vendor all Rust libraries,
because we don't have like,
manpower to package all these dependencies.
Um,
and I think this will be very helpful.
I try to integrate it,
because I've also stumbled a lot of times across like,
patching vendor Rust dependencies,
and yeah.
So thank you very much.
Yeah, thank you very,
happy to collaborate with you guys.
You're very interested.
Yeah.
Okay, then.
Any more questions?
The question is,
is there a reason why the word bundled was used instead of fendered?
I probably because I'm also going to be better,
and I'm working with an operator as a force,
so he basically will cross my mind.
So, come with me.
Okay, then.
Again, thanks a lot for staying here today,
and I'll be back tomorrow to come here to my session.
Um, again,
thanks, Fabio,
and the Rust group there for Dora,
and they made a guide for hosting the band this week.
It's been really helpful.
So thank you all,
and I enjoyed the remaining post them.
Thank you.