<daniels>
(however again noting that we do have aarch64 runners that also execute armv7 just fine, so you can run them natively rather than qemu ...)
<Adrinael>
Yes, that's on TODO
<bentiss>
yeah, that would leave mips that needs qemu-user
<bentiss>
but that also means building igt images for arm
<bentiss>
Adrinael: if the IRC ack works, ack from me too
<Adrinael>
bentiss, sure, thanks. What's that in the form of $name <$email> ?
<MrCooper>
I'd also recommend consolidating common stuff into a .template which is extended by the jobs
<bentiss>
daniels: sadly, adding x5c to the openid jwks endpoint seems like a rabbit hole: patching /-/jwks is easy enough, but not the one from /oauth/discovery/keys (advertized by /.well-known/openid-configuration), because it uses doorkeeper-openid_connect ruby gem, and the RSA implementation of Ruby doesn't easily gives the x5c, but the pem you have to tweak :(
<bentiss>
Adrinael: Acked-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
<daniels>
bentiss: blargh
<daniels>
MrCooper: you forgot 'properly using ci-templates' ;)
<MrCooper>
that's kind of another story, wouldn't automagically add the gstreamer tag :)
<Adrinael>
Alright that's pushed and I hunted down last few pipelines that were using jamming runners
<Adrinael>
fdo-packet-m1xl runners might still have zombies
<daniels>
bentiss: oh that's nice
<daniels>
I wonder why the call was unused before ... ?
<bentiss>
daniels: on minio-packet we use that URL, but ceph is using the .well-known to retrieve the jwks url, which points at the doorkeeper ruby gem internal
<bentiss>
and that's where we are screwed
<daniels>
nginx rewrite the .well-known path?
<bentiss>
well, if I have to patch gitlab, I can also patch the internal route redirect :)
ximion has joined #freedesktop
<daniels>
heh, true
NotYes has joined #freedesktop
andrew1 has joined #freedesktop
NotYes has quit [Ping timeout: 480 seconds]
ximion has quit []
<karolherbst>
oh no 502 :(
<karolherbst>
ahh back again
<mupuf>
yep...
<karolherbst>
but overall a bit slow atm
andrew1 has quit []
<bentiss>
daniels: I'm dumb and I don't understand a bit about crypto... :( -> the 'to_pem' function was not exporting the cert, but the key itself :/ so it doesn't work
<bentiss>
and https://myarch.com/oauth2-jwt-verification-best-practices/ -> "Avoiding creating the x509 cert for each key allows for easier update/more frequent rotation of the keys and usually, resource servers rotate keys on a frequent basis, e.g., every three months." so not having x5c is a feature :(
<daniels>
right, that's why I was suggesting to use the JWK endpoint, else we have to maintain & distribute the cert chain
<bentiss>
well, in amy cases, even the jwk endpoint doesn't have a cert