bbjimmy_mobile has quit [Ping timeout: 480 seconds]
<Coldfirex>
I have not. wasnt sure if that would mess with getting back into Windows later. If I can simply change it back after with no negatives then I can try that
nhtello has joined #haiku
Coldfirex has quit [Quit: Page closed]
AlienSoldier has quit [Read error: Connection reset by peer]
ClaudioM has joined #haiku
mbrumbelow has quit [Read error: Connection reset by peer]
B2IA has quit [Quit: Vision[0.10.3]: i've been blurred!]
bitigchi has joined #haiku
B2IA has joined #haiku
bitigchi has quit [Ping timeout: 480 seconds]
deavmi has quit [Ping timeout: 480 seconds]
silas has quit [Ping timeout: 480 seconds]
boistordu has joined #haiku
dr_evil_ has joined #haiku
boistordu_old has quit [Ping timeout: 480 seconds]
<kallisti5[m]>
as a backup, you can switch over to our IPFS repos...
<Animortis>
I'm OK just wanted to make sure we knew
_whitelogger has joined #haiku
<Animortis>
Yup np
<kallisti5[m]>
ok. fixed. It was an issue on our side.
<Animortis>
Cool
<Animortis>
Downloads running super fast now lol
Animortis has quit [Quit: leaving]
Animortis has joined #haiku
Animortis has quit [Quit: leaving]
bitigchi has joined #haiku
AGMS has joined #haiku
rodolphoeck has joined #haiku
<AGMS>
Yes, just updated my Nightly Haiku, now at full bandwidth of my network connection (1.8MB/s) rather than a third of that (0.5MB/s).
<AGMS>
And that's from Canada, updating via eu.hpkg.haiku-os.org
AGMS has quit []
<kallisti5[m]>
also, give the IPFS gateways I mentioned above a try. They should be in sync with our normal repos
Animortis has joined #haiku
nhtello has quit [Quit: Vision[0.10.3]: i've been blurred!]
Anarchos has joined #haiku
lorglas has joined #haiku
gouchi has joined #haiku
vezhlys has quit [Quit: Leaving]
cruxbox has joined #haiku
lorglas has quit [Quit: Vision[0.10.3]: i've been blurred!]
cruxbox has left #haiku [#haiku]
lorglas has joined #haiku
Animortis has quit [Quit: leaving]
Animortis has joined #haiku
nhtello has joined #haiku
<AlwaysLivid[m]>
kallisti5: Do you think Haiku would ever be able to ship the IPFS repositories by default?
<AlwaysLivid[m]>
Just wondering for the most part, I understand this is experimental.
<Anarchos>
AlwaysLivid[m] what is IPFS ?
<AlwaysLivid[m]>
TL;DR Something like torrents, but more permanent and structured.
<kallisti5[m]>
Definitely not for R1 / Beta 3 based on how it works so far. There are some issues around "new content". To keep things simple... When my node publishes updates to the Haiku / Haikuports repos, that new content is only on my node (until the people mirroring it pick up the changes)
<AlwaysLivid[m]>
Hypothetically, everyone could choose to mirror the packages for Haiku, and it isn't possible in theory for anyone to manipulate the files.
<AlwaysLivid[m]>
So, basically anyone can theoretically mirror Haiku packages.
<kallisti5[m]>
What that means is accessing those files on gateways means they have to "find" my node
<kallisti5[m]>
which can take > 30 seconds until more people mirror the latest content
<kallisti5[m]>
which means your request fails for a while until more nodes in the network notice it
<AlwaysLivid[m]>
... That's not bad, right?
<AlwaysLivid[m]>
I'm more concerned about the fact that many IPFS-related tools seem to be authored in Go, when our version of Go is pretty much significantly outdated. Not sure.
<kallisti5[m]>
* Everyone updates from the "latest packages"
<kallisti5[m]>
It's not really an issue for "existing content", but it's kinda top heavy:
<kallisti5[m]>
* The network needs time to locate the "latest packages" but knows they exist
Animortis has quit [Quit: Vision[0.10.3]: i've been blurred!]
<AlwaysLivid[m]>
There's also concerns about IPFS being bad for the environment if deployed at a large scale.
Animortis has joined #haiku
<kallisti5[m]>
nah. IPFS doesn't mine or anything
<kallisti5[m]>
the only cpu + disk time is copying the packages around
<AlwaysLivid[m]>
NVM I mixed it up
<kallisti5[m]>
> I'm more concerned about the fact that many IPFS-related tools seem to be authored in Go, when our version of Go is pretty much significantly outdated. Not sure.
<kallisti5[m]>
This is a good point. We need to improve our go port :-)
<AlwaysLivid[m]>
Yeah.
Animortis has quit [Remote host closed the connection]
<kallisti5[m]>
One reason i've been investigating it as you said... anyone can mirror Haiku.
<kallisti5[m]>
even if you have a dynamic IP address
<AlwaysLivid[m]>
Yup.
<AlwaysLivid[m]>
I understand IPFS for the most part, I think.
<AlwaysLivid[m]>
I should read their white paper...
<kallisti5[m]>
it's all *really* interesting to be honest. The issue I mentioned above can be solved... pretty much you have to "repin" /ipns/hpkg.haiku-os.org for IPFS to cache the "latest data"
<kallisti5[m]>
When my little Raspberry Pi 4 on my home network adds packages... it's the only location that the chunks are available until others "repin"
<kallisti5[m]>
right now I try to coordinate and "release new packages, then pin them within an hour or so on a VM in another geographic location"
<kallisti5[m]>
that adds more knowledge to the network on the new data and who has it
<AlwaysLivid[m]>
Wait, you're using a Raspberry Pi.
<kallisti5[m]>
Another example is getting past IP blocks. Russia blocks our Digital Ocean VM (they block all DO VM's)
<AlwaysLivid[m]>
What storage medium are you using?
<AlwaysLivid[m]>
Yeah, noticed, read on the website too.
<kallisti5[m]>
yeah.. all "seeding" from a RPi4 at my house
<AlwaysLivid[m]>
Hopefully not an SD card? :P
<AlwaysLivid[m]>
I figured that I could ask universities in my area as to whether they'd be willing to mirror Haiku, but I think I need to discuss this with the rest of you before I suddenly take on a representative role or whatever.
<kallisti5[m]>
I have a 1TiB Sandisk SSD strapped to it via USB 3
<AlwaysLivid[m]>
I have one too, I just need to start booting from it.
<AlwaysLivid[m]>
The power's just about right, nicely enough.
Animortis has joined #haiku
<AlwaysLivid[m]>
I also noticed that old releases are at risk of disappearing because the mirrors keep ditching them - they're also available on the Internet Archive, right?
<kallisti5[m]>
at the moment the flow is: builders -> Wasabi s3 buckets <- Raspberry Pi 4 -> IPFS
<kallisti5[m]>
it's kinda a mess... but with Wasabi's threat that we're using too much bandwidth (and shutting us down last month) the IPFS stuff is my backup
<AlwaysLivid[m]>
... Should I contact educational institutions?
<AlwaysLivid[m]>
That sort of does sound worrying.
<kallisti5[m]>
lol. So, we really can
<kallisti5[m]>
* lol. So, we really can't rsync mirror for now
<kallisti5[m]>
there's no signature checking on our repos. That's the other half of the issue
<kallisti5[m]>
If we start blasting mirrors out everywhere, we don't know if they have been tampered with
<AlwaysLivid[m]>
wait, I think we're not on the same page, I'm talking about main releases and you're talking about the entire software repository too.
<kallisti5[m]>
correct :-)
<kallisti5[m]>
we do have some mirrors already for our releases
<AlwaysLivid[m]>
... so the problem is 'who the hell would manage the PGP keys', I presume?
<AlwaysLivid[m]>
Interestingly enough, the University of Athens still mirrors the last BeOS release.
<kallisti5[m]>
nah. I already sign the haiku repo automatically (haikuports doesn't though). The issue is pkgman has no checking built-in
<AlwaysLivid[m]>
(Athens, Greece)
<AlwaysLivid[m]>
alongside with a lot of other stuff.
<AlwaysLivid[m]>
Jesus, this long TO-DO list just keeps getting bigger and bigger.
<kallisti5[m]>
it's rabbit holes all the way down lol
<kallisti5[m]>
that's why IPFS was my panic "for now" backup option
<AlwaysLivid[m]>
So, has minisign been reimplemented for HaikuDepot in particular but not pkgman or...?
<kallisti5[m]>
it has signature checking built in.. and most recently it added a way to verifying gateways are being truthful about the network contents
<kallisti5[m]>
nothing has been implemented anywhere
<kallisti5[m]>
I started adding signatures to the repo files in haiku 's repo build
<AlwaysLivid[m]>
ohhhhh
<kallisti5[m]>
nobody is picking them up yet :-)
<kallisti5[m]>
the repo files contain sha256 checksums of every package (those are checked)
<AlwaysLivid[m]>
Yeah, not to be confused with the ones in HaikuPorts
<AlwaysLivid[m]>
How will it be established that the signature the end user will receive the correct signature?
<kallisti5[m]>
so as long as we sign the repo files themselves, it should be a "good enough" chain of custody for now.
<kallisti5[m]>
we have a public key
<kallisti5[m]>
it may not even be public right now lol
<AlwaysLivid[m]>
like in Haiku?
<AlwaysLivid[m]>
like do we ship builds with the key
<kallisti5[m]>
we can skip the untrusted comment.. it's ignored by cli apps
<kallisti5[m]>
Ideally the public key will be populated by the haiku package
<PulkoMandy>
trying to remember what Debian does
<PulkoMandy>
IIRC they have a two step process, where 1) you get the keys (from a package or manually download) and 2) the first time a key is used, apt asks you if you want to trust it
<PulkoMandy>
this way the user can easily see if a new key suddenly pops up and check that it's what they really want
<kallisti5[m]>
so it sounds like I still need to add it to the filesystem :P
<AlwaysLivid[m]>
you can also update the keyring
<AlwaysLivid[m]>
it expires after a while
<PulkoMandy>
in that case, yes (add it to the haiku package? or maybe a separate package that isn't updated everytime we change a line of code)
<PulkoMandy>
yes, I think what they do is automatically accept new GPG keys that are signed by the previous key or something like that?
<nephele[m]>
i dont recall having to manually trust keys after installing them with apt or dpkg