uk: Комп'ютерні науки

description: What are we going to do without Docker inside Kubernetes clusters? Dockershim has been deprecated in Kubernetes 1.20 and is scheduled to be removed in 1.22. That begs some questions. What are we going to do without Docker inside Kubernetes clusters? Which container engine should we choose? How are we going to build container images? Is that change for the better, or should we start panicking? Let's see what are out options among container enginers as well as for building container images. This might just as well be an impetus for making changes that we should have made a while ago.

uk: вхід без авторизації

name: Docker Is No More! What Now?: How Are We Going To Live Without Docker?


Jakub Dżon

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Operator SDK is a solid foundation for building robust applications for Kubernetes; one of such applications is the VM import operator (https://github.com/kubevirt/vm-import-operator) allowing Kubernetes administrators to easily import their oVirt-managed virtual machines to KubeVirt. In this talk, the speaker will show how his team used Operator SDK to build the VM import operator and how that operator can be used. The Kubernetes is on a rise and thanks to its capabilities many developers and administrators want to migrate their workloads there, which not always is possible right away or easy to do. VM import operator can help in decomposing any applications previously running in oVirt. If the current deployment doesn’t allow for that, Operator SDK can ease the burden of either migrating existing applications to a new stack or building tools that can allow existing software to run in a completely new environment. The attendees will: - learn basic principles guiding development with OperatorSDK; - learn how VM import operator works; - know how to import their oVirt workloads to Kubernetes, hassle-free.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Virtual machine import to KubeVirt: Operator SDK use case

FOSDEM VZW

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Until now, you could define seccomp policies in Kubernetes to allow or deny system calls but not much more. The new Seccomp Notify feature in Linux 5.9 will enable more complex policies and the ability to write your own agents to handle new use cases in Kubernetes. Attend to find out why and how! Seccomp is a feature of the Linux kernel that allows to filter the system calls that a process is allowed to execute. This is commonly used by containers as a way to improve the isolation between the container and the host. Both container runtime runc and Kubernetes allow users to define a Seccomp policy via the OCI Runtime Specification and the PodSpec respectively. Seccomp recently grew a new feature called the Seccomp Notify in Linux 5.0 and improved in Linux 5.9. This allows a seccomp policy not only to take an immediate decision on whether to allow or deny a system call, but also to defer the control to an external process that I called the Seccomp Agent. The Seccomp agent can decide to block the system call, let it continue, or, up to some extent, execute the system call on behalf of the container. This allows new use cases like running privileged workloads in a safer way and some unprivileged container builds setups. In this talk, I will present the Seccomp Notify feature and the architecture in runc that makes use of it. I will describe the current status of this feature in Kubernetes. I will demonstrate a couple of use cases in Kubernetes and show how easy it is to build your own seccomp agent in Golang to support new use cases. The audience can expect mentions of pidfd_getfd, the addfd ioctl, and more.

uk: вхід без авторизації

name: Seccomp Notify on Kubernetes: The new Linux superpower coming to a Kubernetes cluster near you!


uk: Комп'ютерні науки

description: Pull is one of the time-consuming steps in the container lifecycle. One of the root causes is the current OCI Image Spec that cannot run containers before the entire image contents being locally available. Stargz Snapshotter is a subproject of containerd that tries to solve this problem by "lazy pulling" - starting up containers without waiting for the entire image contents are downloaded but necessary chunks are fetched on-demand. This project proposes OCI-alternative but OCI-compatible lazy-pullable image format eStargz. In this session, Kohei, one of the initial maintainers of Stargz Snapshotter project, will show an introduction to this project and the recent integration activities with tools in the community. In this session, Kohei will show the overview of Stargz Snapshotter including eStargz structure and its optimization and content verification, the lazy pulling technique done by this snapshotter and the relationship between this snapshotter and containerd's remote snapshotter feature. He will also talk about recent integration activities with tools, including fast image build by lazy pulling of "base" images on BuildKit, quick containers startup on Kubernetes. Recent standardization activity of eStargz to OCI Image Spec will also be covered.

uk: вхід без авторизації

name: Build and Run Containers With Lazy Pulling: Adoption status of containerd Stargz Snapshotter and eStargz


uk: Комп'ютерні науки

description: Want the smallest setup with fully redundant storage, networking and compute that's capable of running both containers and virtual machines? Well, this is it. This talk will go over the journey of building a 3 nodes redundant cluster meant to host public web services. The setup boils down to Ceph for storage, OVN for networking, LXD for compute/management and some fancy BGP networking for external network redundancy. All of that running on 3 identical machines bought on eBay and some reasonable SSD/HDD bought new. Finding cloud computing a bit too expensive for your taste? Whether it's because of storage, network or compute costs, the convenience of having instances running within seconds can easily be outweighed by the bill at the end of the month. In this case, cloud hosting already wasn't an option and instead renting dedicated servers from the likes of Hetzner and OVH was done. This is already a lot more affordable but gets problematic when you'd like a cluster of them as fast interconnect between rental servers is uncommon and/or gets expensive quite quickly. So wanting to move from standalone servers to a small redundant cluster, the only option that made financial sense ended up going with buying servers and finding a local co-location facility to host them. Not wanting to have to pay on-site staff or go onsite whenever something fails, the setup is quite focused on resiliency, allowing for the loss of an entire server or the loss of components from many servers without significant impact on the cluster. The end result is effectively a tiny personal cloud, capable of running most common workloads, running on used server hardware in a colo facility with an estimated price per month, assuming a 5 years lifespan on the hardware roughly equivalent to renting just two reasonably sized machines from a dedicated server provider.

uk: вхід без авторизації

name: Fully redundant LXD cluster: Bullet proof storage, networking and compute on the cheap


MariaDB Buildbot Container environments

uk: Комп'ютерні науки

description: Containers are a central point for the MariaDB buildbot. In fact, almost all our builds run in Docker containers. In this short presentation, I will talk about the container environment used in order to build MariaDB from source both on Linux and Windows. Then, I will present some of the challenges associated with running Windows in a Docker container and finally I will focus on some of the advantages of having a container based continuous integration infrastructure. Due to their obvious advantages in terms of speed and flexibility, when developing our new continuous integration framework, we aimed to have an almost container only environment. Because of this, buildbot.mariadb.org uses almost exclusively Docker containers for all the workers. In this way, using a single dockerfile, we can define in an easy and concise manner all the required environments. The process begins with choosing the operating system. Here, we have quite a large pool of 15+ operating systems varying from different Linux distributions to Windows, each running in a Docker container. The process continues by installing the MariaDB build dependencies. In the end, the buildbot components are installed. Finally, we need to make sure that the buildbot worker process starts on container startup. In this way, we obtain a clean environment that can easily be deployed to different platforms. One of the most challenging things was to run Windows in a Docker container. While the main steps remain the same as described above, I will talk about the main differences between the Windows dockerfile in comparison to a Linux one to emphasise the similarities and differences between the two.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The Serverless computing paradigm facilitates the use of cloud computing resources by developers without the burden of administering and maintaining infrastructure. This simplification of cloud programming appears ideal (in theory) but the catch is that when someone needs to perform a more complex task, things could get a bit more complicated. Hardware acceleration, for instance, has been a pain point, even for traditional cloud computing programming models: IaaS providers chose dedicated solutions to avoid interference and preserve tenant isolation (device passthrough), while losing one of the most important benefits of virtualization, flexibility in workload placement through live migration. Various solutions have been proposed to overcome this limitation (API remoting, hardware slicing etc.). In the Serverless world though, do we need users to interface with a hardware device directly? Most serverless deployments are backed by containers, however, the most popular (and used) one, AWS Lambda, uses a ligthweight VMM (AWS Firecracker) integrated in the container ecosystem, in order to ensure strict isolation, while maintaining scalability. To this end, enabling hardware acceleration on this kind of deployment incurs the same pain points with traditional cloud infrastructure. Kata containers evolved from clear containers and offer hypervisor support for popular orchestrators container deployments such as docker, Kubernetes etc. Through kata containers, AWS Firecracker VMs can be easily provisioned as Pods on a kubernetes system, serving workloads prepared as container images. We build on the kata container runtime and port the necessary components to support vAccel, a lightweight framework for hardware acceleration on VMs, on Firecracker. In this talk, we briefly go through vAccel, its design principles and implementation, while focusing on the integration with kata-containers and the end-to-end system applicability on ML inference workloads. We present a short patch for kata-containers to support AWS Firecracker v0.23.1, and go through the necessary patching to add the vAccel framework on k8s. Finally, we present a short demo that scales image classification purpose-built microVMs across a working K8s cluster with GPUs. Hardware acceleration for serverless deployments has never been more secure!

uk: вхід без авторизації

name: ML inference acceleration on K8s > with kata containers & AWS Firecracker


uk: Комп'ютерні науки

description: Although Kubernetes is the leading container orchestration solution, it does not necessarily solve all container management-related challenges that one might face. Leaving fashions aside, some other technologies may actually be a better solution for some use cases and projects. Kubernetes is actually a very complex technology, with limited support for multi-tenancy and lacking secure isolation between tenants. Kubernetes does not offer cloud-like self-service provision features for users either. Cloud providers and cloud management tools try to bridge these gaps by offering managed Kubernetes-as-a-Service platforms, adding an extra control layer that ends up increasing management complexity, resource consumption and associated costs. OpenNebula brings exciting new features to the container orchestration ecosystem. OpenNebula’s recent integration with Docker Hub provides users with immediate access to official Docker images. Now they can be easily imported into an OpenNebula cloud and orchestrated as a KVM-based virtual machine, as a LXD system container or even as a Firecracker micro-VM. With its native support for multi-tenancy, self-service provision and secure isolation between tenants, OpenNebula has become a simpler alternative to Kubernetes to easily set up multi-tenant Containers-as-a-Service on private, hybrid and edge cloud environments. In this talk we will show a live demo on how to automatically deploy a Containers-as-a-Service on the edge to orchestrate multi-container applications using OpenNebula’s recent integration with the Docker Hub marketplace.

uk: вхід без авторизації

name: The OpenNebula alternative to Kubernetes for Containers-as-a-Service


By The Power of toolbox!

uk: Комп'ютерні науки

description: Immutable OSes are great, but not being able to --for instance-- install new distribution packages (or having to reboot every time you do so) may be really tedious, especially for developers. Except, you can install whatever you want without having to reboot, and without breaking the consistency and "the immutability" of the OS itself either. How? Well, in one word, with toolbox. In some more words: come to the talk. So, let's say that your driver is an immutable OS, like Fedora Silverblue, openSUSE MicroOS, EndlessOS, etc. And let's say you are a power user and/or a developer. So, how do you perform your daily tasks, and how do you do your development on such a system, where you cannot install the compiler for the language you're writing the code in? Why, you ask? Well, because immutable OSes are often cleaner, more consistent, more reliable, and a lot harder to break than traditional ones. But that comes at the price of (for instance, on Silverblue and MicroOS) having to reboot several times a day, which is often a showstopper. Unless we leverage containers in order to provide users with a read-write environment that can be easily spawned, and inside which they can "live" and do most of their work (especially if they're doing any development!). This is usually done with something called "toolbox". In fact, Fedora Silverblue has a toolbox. openSUSE MicroOS has a toolbox, which is similar but also different from Silverblue's one. But that's not all of it, e.g., someone came up with podbox and someone else with coretoolbox. This talk will show the reasons why having some kind of toolbox is absolutely necessary inside an immutable OS. We will also try to explain the differences between some of the existing approaches and their implementations. And, last but not least, we will showcase --through real-life examples-- how, by taking advantage of a toolbox, you can elect an immutable OS to be the daily driver of your main development workstation, and not have to reboot it (unless you actually want to!)

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The Solarwinds breach at the end of 2020 is an event that we won't truly understand the breadth and depth of for some time - if ever. But already, several discussions we've been having in the abstract for years have become very concrete. Firstly, the systems we use to develop, code, build and deploy our code are all essential production systems - and should be treated as such. And second, securing the software supply chain is one of the most underrated aspects of security and is often overlooked. All software today is built with dependencies. The vast availability of incredible open source tooling has allowed all of us to stand on the shoulders of giants and build software better and faster than we could have ever dreamed, even 5 or 10 years ago. However, a discussion of these dependencies - both explicit and transient - as links in the software supply "chain" couldn't be more accurate. And the truth is, a chain is only as strong as its weakest link. In this talk, we'll examine what is known of the complexities and sophisticated tradecraft from the Solarwinds / Sunburst attack. But perhaps more importantly, we'll delve into the simple, practical security measures that were missed, allowing the attack to get a foothold in the first place.

uk: вхід без авторизації

name: As Strong as the Weakest Link: Securing the Software Supply Chain


uk: Комп'ютерні науки

description: The talk introduces DepClean, an open-source tool that we developed to automatically determine the presence of bloated dependencies in Maven artifacts. DepClean performs a deep static analysis of the dependency network and suggests direct and transitive dependencies to be removed or excluded. Given an application and its build file, DepClean collects the complete dependency tree (the list of dependencies declared in the pom.xml, as well as the transitive dependencies) and analyzes the bytecode of the artifact and all its dependencies to determine the presence of bloated dependencies. DepClean also generates a clean variant of the build file in which bloated dependencies are removed. This talk focuses on one specific type of software dependency: bloated dependencies. They are libraries that are packaged with the application's compiled code but that are actually not necessary to build and execute the application. In other words, they are libraries declared as dependencies in a build file, which can be removed from the file and the build still successfully passes. As a consequence of bloated dependencies, the binary file includes more code than necessary. An artificially large binary is an issue when the application is sent over the network (e.g., web applications) or it is deployed on small devices (e.g., embedded systems). In addition, bloated dependencies embed vulnerable code that can be exploited while being actually useless for the application. Overall, bloated dependencies needlessly increase the difficulty of managing and evolving software applications. We present our analysis of 9639 Java artifacts hosted on Maven Central, including 723444 dependency relationships. Our key result is as follows: 2,7% of the dependencies directly declared are bloated, 15,4% of the inherited dependencies are bloated, and 57% of the transitive dependencies of the studied artifacts are bloated. Based on these results, we distill and discuss two possible causes: the cascade of unwanted transitive dependencies induced by direct dependencies and the multi-module Maven projects' dependency heritage mechanism. Our qualitative assessment of DepClean involves 30 notable open-source projects. For each project, we used DepClean to generate a pom.xml file without bloated dependencies and submitted the changes as a pull request to the project. Notably, our work yielded 21 merged pull requests by open-source developers, and 140 bloated dependencies were removed. In summary, our results indicate that developers pay attention to their dependencies when they are notified of the problem, which stresses the need to engineer, i.e., analyze, maintain, and test POM files.

uk: вхід без авторизації

name: DepClean: Automatically revealing bloated software dependencies in Maven projects


uk: Комп'ютерні науки

description: When developing open source software end-user applications or reusable software packages, developers depend on software packages distributed through package managers such as npm, Packagist, Cargo, RubyGems. In addition to this, empirical evidence has shown that these package managers adhere to a large extent to semantic versioning principles. Packages that are still in major version zero are considered unstable according to semantic versioning, as some developers consider such packages as immature, still being under initial development. This presentation reports on large-scale empirical evidence on the use of dependencies towards 0.y.z versions in four different software package distributions: Cargo, npm, Packagist and RubyGems. We study to which extent packages get stuck in the zero version space, never crossing the psychological barrier of major version zero. We compare the effect of the policies and practices of package managers on this phenomenon. We do not reveal the results of our findings in this abstract yet, as it would spoil the fun of the presentation. This empirical study builds further on our earlier work, in which we have studied different kinds of dependency management issues in software package distributions. The current empirical evolutionary study is based on recent package management metadata of 1.5 million packages, totaling 12 million package releases and 56 million package dependencies. We analyse dependency version constraints to determine: * to which extent packages depend on 0.y.z releases of other packages; * whether packages with major version zero ever cross the psychological barrier of 1.0.0; * whether there is any reluctance to depend on 0.y.z packages; * whether dependency constraints are more permissive than what semantic versioning dictates for packages in major version zero.

uk: вхід без авторизації

name: Lost in Zero Space: Can we trust depending on packages with major version zero?


uk: Комп'ютерні науки

description: Despite best intentions, Open Source releases with regression errors are published every day. In the best case scenario, a downstream user detects it early thanks to good tests, files an issue, and the maintainer can fix it before too many people have upgraded. Other scenarios involve various degrees of brokenness and games of "is it broken for everyone or just me?". Renovate Bot is an open source dependency automation tool but which also is run as a free app on github.com, where it is installed into almost 200,000 repositories. A feature called "Merge Confidence" helps downstream users know if a release is likely good or not based on automatically sourced crowd data (tests, deployments, rollbacks). Now we are planning to turn the focus upstream to help open source maintainers get an early indication of accidentally breaking releases and even provide a mechanism for downstream users to opt into silent pre-release testing so that major features can be smoke tested downstream before release.

uk: вхід без авторизації

name: Early warning signs for open source breakages: Using crowd feedback from dependency automation as an early warning indicator


uk: Комп'ютерні науки

description: Every software ecosystem seems to have a package manager these days, but reusing software across these ecosystems is still a challenge. Major Linux distributions package software from a wide range of languages, but they restrict the versions you can install, and they make deep assumptions about compilers and runtime libraries to keep everything compatible. If you need a newer libc or a newer Python than the OS offers, you're often on your own. Python packaging supports native libraries, but it imposes strict rules on package builders to ensure that the binaries work in many places. Some packagers break the rules, e.g., TensorFlow binary packages (wheels) will only work on Ubuntu, frustrating users of other distributions. Containers provide some hope, but only if you stay inside their sandbox. If you your container to talk to a fast network or a GPU, you'll need to ensure binary compatibility between the container and the host OS. Is every ecosystem a walled garden or can we make it easier to bridge the gap? This talk takes a deeper look at the Application Binary Interface (ABI) and its place at the heart of nearly every software ecosystem. We'll look at the assumptions made by modern dependency management systems about toolchains and ABI. Most tools assume that toolchains and ABI are fixed, making it hard to take a package from one ecosystem and transplant it in another. We'll talk about how we can build dependency managers that can reason better about ABI compatibility, making decisions not just about which software versions to install but also about how those software versions should be built. We'll look at the types of metadata that need to be managed to enable a more flexible software environment, and how it affects the complexity of dependency resolution. Finally, we'll look at how some of these issues are being addressed in Spack, an open source package manager for high performance computing applications, which can span multiple languages, compilers, platforms, and software stacks.

uk: вхід без авторизації

name: Reusing dependencies across ecosystems: what stands in the way?


uk: Комп'ютерні науки

description: The goal of the EU project FASTEN is being able to perform a more sophisticated analysis of security-vulnerability propagation, licensing compliance, and dependency risk profiles (among others) by relying on the call-level dependency network of the whole software ecosystem. We outline the purpose and structure of the project, and present some preliminary results.

uk: вхід без авторизації

name: Software Ecosystems as Networks: Advances on the FASTEN project


uk: Комп'ютерні науки

description: The tool Antora creates documentation websites from AsciiDoc sources stored in Git repositories. Users can browse the generated website and select the version matching the software they use. Navigation outlines, search and cross-references between pages allow users to find answers to their questions. Several open-source software projects like Camel, Debezium and Couchbase use this solution. For developers it is normal to develop software in collaboration using their IDE and a version control system like Git. The same type of collaboration is possible when all documentation is versioned in a markup-format like AsciiDoc. This talk presents the basics of an Antora setup and walks through all the steps from editing content in the IDE to updating the documentation site using continuous integration and delivery.

uk: вхід без авторизації

name: Creating a documentation site for users with AsciiDoc and Antora


uk: Комп'ютерні науки

description: I observed a white paper authoring collaboration workflow problem at my Forbes 50 employer wherein a tedious workflow around legacy tooling caused undue stress, headaches, rework, and, ultimately, a cosmetically poor-looking document with inconsistent content and styles. Knowing that a good document requires both good content and presentation, I proposed and led the creation of a simple workflow amenable to our team's software engineers and data scientists: treating the white paper text as code with technologies including Markdown, GitHub Enterprise, Pandoc, LaTeX, and a review process that gets the tooling out of the way in order to enable content authors to focus less on logistics and more on writing and reviewing. The result was that a team of seven engineers and data scientists created a 50-page document containing text, diagrams, equations, graphics, and more in just two weeks. The result greatly pleased our directors and executives. They praised our team not only for the incredibly valuable content but also for the professional appearance of the document. When they learned about the peer review process we used to create it, they wanted more teams to use it. This talk focuses on the problems of passing around files by email or shared drives, the problems of collaborative editing of online documentation, and the problems we're still addressing in our solution that we've now used to author several significant internal documents.

uk: вхід без авторизації

name: An documentation workflow loved by both Data Scientists and Engineers: Using Pandoc with VCS and CI/CD


uk: Комп'ютерні науки

description: The combination of AsciiDoc and Gradle should be well known by now. But what if you want to go beyond? Have you ever tried to include UML diagrams the easy way, convert Excel to AsciiDoc or export your results to Confluence? This talk shows you what you can really do if you treat your docs as code and apply some tricks you only did to your code before. Forget about copy & paste your images to your documentation – let the build do it! Create different docs for different stakeholders and even run automated tests on your docs! In this talk, Ralf will give an short overview of the open source documentation tool chain "docToolchain". He will open up the Docs-as-Code solution space with some new and fresh ideas and show where the Docs-as-Code approach is heading to. As the maintainer of the open source tool called "docToolchain", Ralf tries to push the Docs-as-Code approach further to its limits. Every new idea finds its place in the docToolchain. It is by now a collection of quite helpful tasks of your every day documentation needs.

uk: вхід без авторизації

name: Docs-as-Code with AsciiDoc & docToolchain: A journey to the limits


uk: Комп'ютерні науки

description: Originally having been developed for the open source projects at Facebook, Docusaurus now serves as an easy-to-use tool across many open-source projects. Having worked with it on the Google Season of Docs for transforming Rucio's documentation & as the SIG DOCS lead for LitmusChaos, this talk is an exposition of my experiences with the static site generator. I hope to benefit others looking at migrating to/using this tool with the contents.

uk: вхід без авторизації

name: Taming the 'Saurus: My experiments with the Docusaurus


uk: Комп'ютерні науки

description: Learn about the missing ingredient from your Docs-as-Code recipe, a headless CMS (Content Management System). Let's understand the problems writers face and how adding a CMS to your Docs toolchain helps solve (some of) them. We'll look at a sample docs-as-code repository and then add a CMS to the mix. We'll then go through authoring new topics and editing existing docs with our CMS (Look ma, no Git). There's no doubt that the docs-as-code approach for documentation provides a robust workflow, offers immediate product evaluation, and allows you to easily track and revert changes along with many other benefits. However, it also involves other meta tasks such as dealing with Git workflow and managing repositories. There might be times when you need inputs from folks from different departments who don't know Git or don't have access to the platform on which you're hosting your docs repository. For such cases, extending your docs-as-code project by adding a Content Management System (CMS) is surprisingly helpful. Having a CMS allows you to create and edit your documentation right from the browser. It's like WordPress for your documentation project. There are many open-source CMS's available, but this talk focuses on a particular CMS that fits best for managing documentation projects. You begin by installing the CMS in your documentation project (or using the pre-baked starter template). Afterward, you configure the CMS and creates forms that map to your content structure. People can then create new content from the browser, which automatically gets converted to a new pull request in your docs repository.

uk: вхід без авторизації

name: Make Git-free contributions a reality: (for your Docs as Code project)


uk: Комп'ютерні науки

description: Thomas Cort link checking suite is Node.js software to make the checking of links in documentation sites (and not only doc) easy and efficient. It can be used as a standalone or in a CI process. It's configurable and of course as an open source project, you can customise and participate by pushing Pull Requests. As one of the maintainers of this tool suite, I will provide an overview of the link checking process as well as a tour of the reasons why you should care about your links and a demo of how this specific tool works. The specific following points will be discussed: - Why you should check your doc links and why it matters from a freedom point of view. - How to use Markdown Link Check (demo) - What are your options to test with Markdown Link Check: run it locally on Node.js (demo), Docker, CI jobs (demo), Github Action... - How to get involved in Markdown Link Check project.

uk: вхід без авторизації

name: Check your links with the Link Check suite: Benefits of using Markdown Link Check and related tools


uk: Комп'ютерні науки

description: PostgreSQL has been maintaining its documentation in DocBook for over twenty years. It's been successful but not without challenges. PostgreSQL is often praised for its excellent documentation, and PostgreSQL is also often criticized for its hard-to-approach documentation. Maintaining documentation for a project such as PostgreSQL comes with a number of challenges. There are many challenges writing good documentation, but in this talk we'll focus on the tooling. First, the documentation is quite big: In a printable format it is over 2000 pages. This pushes many build tools beyond their limits. And of course we also want documentation builds to finish in a reasonable time. Second, we need tooling longevity and portability. Database server software is long-running software. We still need to be able to patch and rebuild everything many years from now. In the world of writing and publishing tools, there is often a new idea every few years with many dependencies and no long-term track record, which makes it difficult for us to adopt things like that. It took us many years to get just a few graphics into the documentation because the tooling issues were too overwhelming. DocBook has been good to us, but there have been plenty of struggles along the way, and there are some concerns about the future.

uk: вхід без авторизації

name: 20 years with DocBook: Experiences from the PostgreSQL project


uk: Комп'ютерні науки

description: In 2017 Nexmo (now Vonage) launched their first documentation portal as a Ruby on Rails site. Fast forward more than 3 years and the Vonage API Developer is now running on a custom-built open-source tool we call Station. Station powers multiple documentation portals, and allows us to achieve numerous organizational goals. How did we arrive at Station and not get derailed in the process? In this talk, we will take a deep dive into the technical journey behind Station. What does the tech stack look like? How did we solve some serious technical challenges converting a Ruby on Rails website into an executable tool, and what did we learn along the way? We haven't reached the end of the line in the evolution of Station yet, and we will discuss what stops are next in the journey. In the dialectic between being feature-rich and being overly complex and complicated, Station presents a model forward. Let's explore that model together.

uk: вхід без авторизації

name: On The Fast Track to Station: The Transformation of a Docs Portal Into a Docs Platform Tool


uk: Комп'ютерні науки

description: Let's face it: our documentations are more often than not at least one step behind our implementations. This becomes a problem when it prevents our users from effectively using what we produce as developers. In this talk, you will learn from its maintainers an in depth introduction of terraform-docs, how users apply the tool to automate the documentation of Terraform modules to always keep implementation and documentation consistent whenever a part of their code changes. You will also get to know about more possibilities, such as the automated rendering of Jenkins pipelines to execute Terraform code using the same tool.

uk: вхід без авторизації

name: Automate IaC documentations with terraform-docs: Introduction to terraform-docs and a showcase of a real world example


The Apache OpenOffice Documentation

uk: Комп'ютерні науки

description: Working with OpenOffice in the documentation effort is rewarding and benefits the community! Join me to discuss documentation! The transcript for this presentation is attached. The presentation editable designs in Draw - see link for template. Step 1. Draw edits for design Download template Open in Openoffice.org Draaw Edit Step 2. Create Presentation 1.Copy page from Draw 2.Paste slide to Impress. 3. Place image of presenter in Master slide 4. Review impress slides with master image 5. Start Presentation mode 6. Begin recording session Very little editing at all with this method. Note: Original designs using venngage. In accordance with the Terms of Service, output PDF, import PDF to Draw for editable free content. GFDL.

uk: вхід без авторизації


The future of Base

uk: Комп'ютерні науки

description: In this talk I will be talking about base. Base is the Database focused Application within Apache OpenOffice. We will start of with a short Description where Base comes from, and what the Idea behind base has been. I will sum up discussions that have taken place on development Mailinglist. And I would like to take some visions up from the previous discussions and talk a bit about what Base would needs if we would go into the direction of analytics and big data.

uk: вхід без авторизації


OpenOffice UNO Programming with Groovy

uk: Комп'ютерні науки

description: The talk will discuss using the Apache Groovy programming language with Apache OpenOffice UNO API's and some associated projects that allow this to happen. Projects include the Groovy UNO Extension that adds convenience methods to the OpenOffice API's allowing less coding, an OpenOffice Extension that adds Groovy as a macro language to the office, and an associated extension to add sample macros to the office written in Groovy. Examples of usages like Groovy scripts as OpenOffice client applications, OpenOffice macros in Groovy, and a compiled OpenOffice extension application in Groovy.

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: The localization process for Apache OpenOffice: Anatomy of an improvement


uk: Комп'ютерні науки

description: The Apache OpenOffice wiki is the major source of information about OpenOffice for developers. A major restructuring is ongoing an d we will discuss what has been done and what remains to be done.

uk: вхід без авторизації

name: Rebuilding the Apache OpenOffice wiki: Analysis and a roadmap


Status OpenOffice

uk: Комп'ютерні науки

description: Time to look on the past year, and asses where is the Project. This talk will summerize the 2020 reports, give an overview on Discussions and Activities within the Project. If you want a quick look where the Project is and where we head, then Visit this Talk!

uk: вхід без авторизації


Abracadabra, now everyone's a remotee!

uk: Комп'ютерні науки

description: Management is difficult even under the best of circumstances and managing globally-distributed teams is even more so. With the global COVID-19 pandemic and the restrictions it forced on all of us, management is nothing like the best of circumstances. With the pandemic, suddenly everyone is a remotee – even people who have no experience in working remotely, and no desire to work in such an environment. In this talk, I’ll explore how the lessons learned from navigating a globally-distributed open source community can come in to play when managing a suddenly disturbed team. I’ll examine how taking a cue from open source communities can help managers handle this new landscape with flexibility, clemency, and above all, empathy.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: During this talk, you'll learn about topics like cross-cultural collaboration, giving and receiving feedback, and active listening -- all things that are vital to the health of our open source communities. During this talk, you'll learn about topics like cross-cultural collaboration, giving and receiving feedback, and active listening -- all things that are vital to the health of our open source communities. After reading many self-help books, watching various TED Talks, and listening to a ton of podcasts, I've condensed my learnings to help you improve your communications skills, deal with conflict, and collaborate better than ever not only in FOSS, but also everywhere else.

uk: вхід без авторизації

name: Communication Hacks: Strategies for fostering collaboration and dealing with conflict in open source


uk: Комп'ютерні науки

description: The open source is getting mature and there are a lot of established ways of behavior, expectations even, that both contributors and maintainers of a codebase have. Some of these expectations are explicit in contributing files, whereas others are implicit and more of a cultural behaviour we as a group have taken on over the years. Governments and civil servants come from a very different background and when they start developing publishing software in the open under a free licenses, these cultures may meet, and sometimes even clash. We know that individual volunteer contributors differ from corporate contributors, how do public workers as contributors fit into this. How public workers contribute has to do with how they operate, and how the society expect them operate in other fields of their operation. If not understood properly, this can lead to frustration of a FOSS contributor who want to make a useful contribution to a codebase developed by a public organization. In this talk we will try to give you the tools and the mindset that will help you succeed when submitting those merge requests. "As a volunteer I am making contributions to a codebase managed by a public organization and it's behaving differently than the FOSS I am used to and here is why and how to adapt."

uk: вхід без авторизації

name: Contributing (with) civil servants: How government and public sector open source projects and contributors are different from individual and corporate ones.


uk: Комп'ютерні науки

description: We often see many open source projects struggle with maintaining quality documentation and finding contributors who are interested in helping with project documentation. There are several reasons for this, such as many viewing documentation as a separate product from code or a belief that people will be able to make sense of what the code is doing by reading the code. For these and other reasons, documentation work is often done at the last minute and done by people with low motivation and minimum effort. So the quality of the output will naturally suffer. These issues can be addressed by ensuring that documentation is everyone’s responsibility and that documentation is a core part of the product created using the same development and community processes. Besides, documentation is often an entry point for new community members and is a great place for early contributions. When everyone in the community is actively engaged in documentation--e.g., reviewing documentation fixes--it can help provide a valuable onboarding experience for new community members. In this session, the speakers will share their experience in documentation from both foundation-based open source projects and open source software companies. There will be a discussion on how community contributions for documentation can be encouraged and how community members can apply their learnings from documentation to other areas of open source communities.

uk: вхід без авторизації

name: Ensuring that documentation is a first-class citizen in open source projects


uk: Комп'ютерні науки

description: What do you do when the interest of your different constituencies are in conflict? Who do you favor and why? The 4 Freedoms and the OSD were designed for a small community of hobbyists. They offer little help when it comes to addressing the challenges open source faces today. Does open source need a W3C-inspired "priority of constituencies?" In this talk we’ll dig into the priority of constituencies, see how it could apply to open source, and get some interesting insights out of doing so. From its inception, open source—and free software before it—was built around ethical notions: give people agency and power over their software so they could use, modify, and share it as they pleased to accomplish whatever it is that they wanted to do with it. In a world where running software required programming skills, there was a lot of overlap between users and developers of open source, and so this rather simple framework was sufficient to deal with open source’s different constituencies. Since then, open source has become ubiquitous. As a result, the number of constituencies has ballooned: there are indie and corporate contributors and maintainers, open source software vendors, developers building proprietary code on top of open source, end-users who don’t know anything about software, people impacted by open source software who are not even using it, cloud providers, etc., etc. When the interests of these different actors are in conflict, which one of them do we favor and why? Neither the Four Freedoms nor the Open Source Definition (OSD) really helps us answer that question. Faced with similar issues, other communities have designed really effective frameworks to guide their decision making processes. W3C’s “priority of constituencies” is such a framework. In this talk we’ll dig into what W3C’s priority of constituencies is, outline its benefits, but also its limits. We’ll then see how we could apply the priority of constituencies to open source, what that reveals about the complexity of the open source ecosystem, and in particular how the parts that are difficult to fit in such a framework are precisely those that have made the news in the past few years.

uk: вхід без авторизації

name: Does open source need its own Priority of Constituencies?


uk: Комп'ютерні науки

description: Even a large Open Source project is at risk to have a too internal focus. Listening to users does not come by itself. This presentation describes the logic behind the user engagement of the MariaDB Foundation, which has been complemented during 2020 by "MariaDB Server Fests", virtual events reaching nearly 20.000 users.

uk: вхід без авторизації

name: Ensuring user focus of open source development: Case MariaDB Server: Encouraging and conducting external evaluation of activities


Improving Onboarding in FOSS

uk: Комп'ютерні науки

description: Open-source software is code that is designed to be publicly accessible. Open source has core principles that make it rely on collaboration between contributors and companies in order to achieve a common goal. To attain more collaborations, onboarding in most open source communities should be considered a priority. Oftentimes, beginners who are new to open source projects develop cold feet a short while after joining a community because they are not properly onboarded into the community. Onboarding plays a major role in the performance of and productivity of contributors. In this session, I would like to talk on: - What is quality onboarding? - Effects of poor Onboarding in a community -The need for improved onboarding - How onboarding can be improved? - Impact of quality onboarding

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Mental health is becoming a bigger and bigger focus, and this rise in awareness picked up even more speed with the current health crisis. People are now more aware of the importance of their own mental health and self-care. By its nature and the kind of interaction that comes with it, free software is prone to emphasizing and worsening issues related to mental health, specifically with anxiety and burnout. In this talk, I'll share with you my experience dealing with my own mental health issues in the context of working on free software, and try to give you leads to take better care of yourself and of the people around you.

uk: вхід без авторизації

name: Mental health and FOSS: What I wish I’d been told before I got into free software, and more


uk: Комп'ютерні науки

description: In the MariaDB Foundation we have been trying to respond to the challenges of the "new normal" by organising a series of online events that we called MariaDB ServerFest. Taking a step from holding Unconferences for 50+ participants to an online event for thousands of viewers is a challenging and exciting learning process. In this lightning talk I would like to share some war stories, ideas and experiences from this journey.

uk: вхід без авторизації

name: Organizing online events and "the New Normal"


uk: Комп'ютерні науки

description: Open source is becoming the main ingredient for companies to success. To achieve it, companies need to manage efficiently their relationship with open source projects. And that’s the main goal for companies’ Open Source Program Office (OSPO). So, they are key for companies success. But, additionally, they could be very important for open source projects sustainability. During this talk, you will learn about the responsibilities and benefits of having an OSPO in your organization, why should companies adapt to open source and adopt an OSPO, how it makes a difference to have a team responsible for viewing, managing, making critical decisions, contributions back to open source projects, and providing oversight for open source initiatives on their company and where they should start. Also, we will give real examples of how companies are doing this today and their impact for the community. Additionally, you will learn about communities and initiatives to help you having a successful OSPO, like OpenChain Project, TODO Group and CHAOSS, the importance of CHAOSS to give actual data and insights about open source projects and a bigger perspective with analytics and how data and metrics from the OSPO can help companies tackle their corporate strategy.

uk: вхід без авторизації

name: Open Source Program Offices (OSPO) and their role in OSS ecosystems: How having an OSPO might help to open source software ecosystem sustaintability


uk: Комп'ютерні науки

description: The Open Source Initiative's definition of "open source" focuses exclusively on a list of approved licenses: Only software using one of the approved licenses counts as open source. This narrow definition is concerned only with the shape of business contracts designed to de-risk corporate involvement in FLOSS. But we all know that what makes open source amazing is not the licensing, but the community. Open source is defined in practice by its community-driven, collaborative mode of software development. So it should be no surprise that the best open source projects have a laser focus on building thriving communities. Nor should it surprise us that many projects using OSI-approved licenses appear open source in name only. Ethics is the study of how to get along with others. This makes it the perfect tool for understanding how to build thriving, successful communities. In this talk, I argue that the Ethical Source Definition actually provides a more compelling definition of "open source" than the OSD. It better accords with community usage of the term, capturing what makes open source unique and successful.

uk: вхід без авторизації

name: Open Source is More Than Just a License: Why an exclusive focus on licensing is an impoverished view of what open source truly is


uk: Комп'ютерні науки

description: It is impossible to bring every idea, every innovation, and every improvement you can think of to fruition. Doing a little less allows you to honor the finite amount of time each person can give to your cause or project or workplace. But how do you start cutting those todo's down to a manageable level? Groups of passionate people are fantastic at generating more ideas and tasks then they can possibly collectively execute on and open source communities are no exception. It is impossible to bring every idea, every innovation, and every improvement you can think of to fruition. It may sound counter-intuitive, but skipping things, scaling down and doing less can help you be more effective. A project that consistently over-commits itself will eventually alienate people, so it makes sense to cut those todo's down to a manageable level, but how do you start? This talk will cover: How to figure out what to trim and what not to trim When to pull back and how to do it gracefully How to preemptively choose to do less Doing a little less allows you to honor the finite amount of time each person can give to your cause or project or workplace. Tasks that are done with ample time can be done with more care and are less prone to error. People who aren't constantly feeling like they're up against impossible deadlines will be happier, well-rested people that are more likely to stay involved for longer. Let's do less!

uk: вхід без авторизації

name: How I Learned to Stop Worrying and Love Doing Less


uk: Комп'ютерні науки

description: The new reality requires extreme flexibility. Many people might be switching open source communities these days stepping in their new roles. The pandemic might bring you to where you would never expected to be. What if you need to start working for a competing vendor and become an advocate of a totally different technology ecosystem? “Just do it” would answer many of your questions, but not all of them. Ethical issues related to integrity, practical failures related to lack of knowledge, the inability to use background info accumulated previously would become factors preventing you from success. In our talk, we will combine practical advice from a community manager who moved from MySQL to PostgreSQL environment, with recent findings from academic research in community management. We’ll talk about practical techniques to transform a good community professional into a person of high trust. We will discuss ways to build your community not only around vendors, projects or technologies, but also around yourself, as an inspiring community professional. Finally, we’ll speak about scientifically based ways of building trust in a new community, and leveraging the old ties in the ethical and constructive way.

uk: вхід без авторизації

name: Switching Open Source Communities: How to Stay Authentic to Yourself and Find Hidden Benefit In Your New Role


Zoom out to zoom in on the community

uk: Комп'ютерні науки

description: Open Source is all about the community being able to engage with each other efficiently. This is why events such as FOSDEM are so essential to enable us to meet members of our communities face to face to create these essential connections. In 2020 the annual OSS physical event circuit was broken due to the pandemic, and was replaced with online versions. It has meant we spent the year on weekly zoom project team/ steering committees & more meetings online. Then we have yet more zoom webinar or some other online tool for our flagship OSS events. This can be sufficient when you know the people on a mature community, as you may have met them before, but what for new OSS communities just starting out?. How can we get that personal connection that is needed to help avoid unnecessary conflicts due to simple misunderstandings. What people see in print, say in a gerrit review comment, can seem a lot more severe if you do not really know the person who had typed it. That is why I'd like to give my experience from 2020. Lessons I have learned and adapted in my meeting. To take the time to step back/zoom out in our OSS commnity meetings, and take just a little time so we can zoom in on the people.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This presentation will cover the practices and tools you can use to improve compliance with open source licenses as a hobbyist or small business using OpenEmbedded/Yocto Project, Buildroot or other Embedded Linux build systems. The focus will be on practical steps that don't require excessive time, effort or consultation with expensive lawyers. This presentation will also discuss license compliance pitfalls to avoid. No legal advice will be given in this talk. Many presentations and articles about open source license compliance focus on the needs of large corporate users of open source and aren't well suited to individual hackers/makers or small businesses. However, even if you don't have the public profile and deep pockets of a large organisation you should be thinking about how you can empower users of your software or physical product to take advantage of their rights around open source software. Rather that trying to develop a comprehensive enterprise-grade open source policy what you need is some steps to get started, some rules of thumb and some tools which are relatively straightforward to use. License compliance is a process and even if you don't feel you have the resources to achieve perfect compliance it's important to take the steps that are within your reach.

uk: вхід без авторизації

name: Embedded Linux License Compliance for Hackers & Makers


uk: Комп'ютерні науки

description: A few years ago at balena, we designed and built a robust carrier board for the Raspberry Pi 3 Compute Module, specifically targeting IoT use cases, called the balena Fin. We are now starting the design process for a successor, and are asking for input, ideas, and advice on what should be included, excluded, or optional. Let's talk about form-factor and size, SoC and SoM choices (pros and cons), memory and storage, connectivity, ports and port placement, expansion, and intended use-cases. Designing a board with community input and dialogue results in a better product in the end, and meets more people's needs. As experts, we'd love to hear your thoughts! balena leverages, and produces, a lot of open source software. Etcher (flashing utility), balenaOS (Yocto-based operating system), and balenaEngine (Moby-based container runtime) are OSS and available on GitHub, and OpenBalena is an open source IoT Fleet Management platform. On the hardware side of the organization, we want to replicate as much of that openness as possible, and so our design process is all done in the open as well. Thus, let's have a chat about what you think is important and should be included in an industrial strength IoT single board computer.

uk: вхід без авторизації

name: Feedback Wanted: What features and design choices are needed for an Industrial IoT SBC?


uk: Комп'ютерні науки

description: Long gone are the times of executing the OS in-place from memory-mapped flash upon reset. A modern SoC now comes with complex mask ROM firmware, with driver, filesystem, protocol and crypto support for loading... yet another bootloader. In his talk, Ahmad follows this chain of bootloaders until the kernel is started, stopping along the way for RAM setup, peripherial initialization, runtime services and other interesting sights. Getting acquainted with the bootstrap process on a modern ARM-based SoC can be an intimidating task: Documentation speaks of Boot ROM, blobs, SPL, secure monitor, trusted execution environment, Open Firmware Device Trees all interacting with each other and with a bootloader to facilitate kernel boot. The talk intends to shed some light onto this. Starting with an overview of the bare minimum needed to bootstrap an i.MX8M, it retraces the steps of the barebox bootloader, and firmware loaded by it, until Linux eventually takes over.

uk: вхід без авторизації

name: From Reset Vector to Kernel: Navigating the ARM Matryoshka


uk: Комп'ютерні науки

description: We all know the benefits of open software, but not as many of us take the step into designing and building the hardware to run it on. Consumers are left with a choice of mass-market devices - hoping the company doesn't turn off its servers, and doesn't sell their data - or going DIY and soldering up things themselves. We need a wealth of Indie Manufacturers, building open hardware devices to provide more options and freedom to end users. This talk shows MCQN Ltd's path on that journey and how you could follow it too. We'll look at the whole process of making an open hardware product, from the design through to batch manufacturing and shipping. Sharing the open-source tools used plus the services and kit you'd need.

uk: вхід без авторизації

name: Adding Open Hardware to Open Software for a More Equitable IoT: How I Became an Indie Manufacturer and How You Can Too


uk: Комп'ютерні науки

description: Join and discover how to build your own embedded Linux system completely from scratch. You will build your own toolchain, bootloader and kernel, that you will run on system with the new Risc-V open Instruction Set Architecture emulated by QEMU. You will also build a minimal root filesystem by yourself thanks to the BusyBox project. You will finish by controlling the system through a tiny webserver. The approach will be to provide only the files that are strictly necessary. That's all the interest of embedded Linux: you can really control and understand everything that runs on your system, and see how simple the system can be. That's much easier than trying to understand how a GNU/Linux system works from a distribution as complex as Debian! You will also get details about what's specific to the Risc-V architecture, in particular about the various stages of the boot process. At the end of the presentation, you will leave with all the hardware (!), source code build instructions and demo binaries to reproduce everything by yourself at home, and add your own improvements. Most of the details should also be useful to people using other hardware architectures (in particular arm and arm64). Michael Opdenacker here proposes a new version of an older presentation he made 15 years ago to discover embedded Linux, and which was for a long time one of his most downloaded presentations. This presentation should be particularly useful for people who are new to embedded Linux and/or to Risc-V, don't have Risc-V hardware yet, and wish to test each new release of the Linux kernel and U-Boot on this new architecture, to report possible regressions and propose missing features.

uk: вхід без авторизації

name: Embedded Linux from scratch in 45 minutes


uk: Комп'ютерні науки

description: The Xilinx ZynqMP SoC includes a powerful H.264/H.265 Video Codec Unit (VCU) which Xilinx supports with an out-of-tree driver and user space library. The allegro driver from mainline Linux allows to use the VCU using the standard V4L2 encoder API without requiring any custom user space. I will explain why I wrote the driver, show how the VCU is used from a driver perspective, and present the current state of the driver and which features are still missing. The Zynq UltraScale+ MPSoC integrates several ARM cores and an FPGA into a single chip. One variant of this SoC includes an H.264/H.265 Allegro DVT Video Codec Unit (VCU). Although Xilinx did a good job supporting the ZynqMP in mainline Linux, the VCU was originally only supported via an out-of-tree driver. It consists of a user space library and a firmware blob, which interact via a custom IOCTL interface. Unfortunately, this has security implications as the user space handles physical buffer addresses. Fortunately, the V4L2 mem2mem device API for video codecs avoids this problem by using abstract DMA buffers. Many applications already use these APIs, and various drivers for hardware codecs already implement these APIs. Thus, a V4L2 driver for the VCU allows reusing existing applications such as FFmpeg and GStreamer on the ZynqMP.

uk: вхід без авторизації

name: The Road to the Mainline ZynqMP VCU Driver


uk: Комп'ютерні науки

description: MutantC is a open source and open hardware shell for a RPi form factor boards. It includes hardware keyboard, sliding display with touchscreen, battery with charging circuit, etc. This short talk will be introduction of the project, it's goals and of the v3 hardware revision.

uk: вхід без авторизації

name: MutantC v3 "Hardware shell for a RPi form factor boards": open source and hardware PDA shell


uk: Комп'ютерні науки

description: The networking stack is one of the most complex and optimized subsystem in the Linux kernel, and for a good reason. Between the wild range of applications, the complexity and variety of the networking hardware, getting good performances while keeping the stack easily usable from userspace has been a long-standing challenge. Nowadays, complex Network Interface Controllers (NICs) can be found even on small embedded systems, bringing powerful features that were previously found only in the server world closest to day to day users. This is a good occasion to dive into the Linux Networking stack, to discover what is used to make networking as fast as possible, by both using all the features of the hardware, but also implementing some clever software tricks. In this talk, we'll cover these various techniques, ranging from simple batch processing with NAPI, queue management with RSS, RPS, XPS and so on, flow steering and filtering with ethool and TC, to finish with the newest big change that is XDP. We'll dive into these various techniques and see how to configure them to squeeze the most out of your hardware, and discover that what was previously in the realm of datacenters and huge computers can now also be appliable to embedded linux development.

uk: вхід без авторизації

name: Networking Performances in the Linux Kernel


uk: Комп'ютерні науки

description: The modern vehicle audio system is built with a number of networked components that are needed for many complex and integrated functionalities such as active noise cancellation, warning sounds, diagnostics, etc. And thus, complex and flexible audio setups are a fundamental design need for modern vehicles. GENIVI AASIG analyzes various scenarios of integrating Android in this complex setup and analyzes the maturity and gaps of Android Automotive solution in this context. This talk aims to highlight some of the findings of the group and discuss further investigation topics in this area The talk will give a short overview of the audio system design choices with Android. As part of the analysis towards integrating Android in the complex setup that exists today, the first step group took was to extract raw PCM stream out of Android context. The talk will discuss the implementation of this and the various design tradeoffs and decisions that was taken. The next step would be to connect Android to audio network. Currently A2B and AVB are being investigated. Further investigations includes topics like: ECNR handling, calibration mechanisms, how to utilize DSPs in various system configuration (virtualization, containerization, multi HW).

uk: вхід без авторизації

name: Networked Audio in Android Automotive, Extracting RAW PCM streams


uk: Комп'ютерні науки

description: The connected car has been around some time but we are still waiting for a large breakthrough when it comes to third party services powered by vehicle data. The fragmentation of different technical solutions makes it difficult for 3rd parties or developers to work with easily accessible vehicle APIs. To tackle this, the GENIVI Cloud & Connected Services project is designing an end-to-end communication framework starting from the data transfer from embedded systems in the vehicles and spanning to cloud based APIs. The framework is built on open protocols and is demonstrated with open-source reference code with the aim of simplifying implementation work for both car manufacturers and 3rd party developers. This presentation will detail the work results to date and will be co-presented by Kevin Valdek from HIGH MOBILITY and Ulf Bjorkengren from Geotab. We’ll have a look at the key technical challenges and considerations that are necessary to make in order to create a successful framework. Designing a useful API for developers starts in the vehicle where topics like the data model is already considered. Further on, we’ll show a Proof-of-Concept implementation that anyone can try out. The Proof-of-Concept implements a data server in the vehicle that exposes an API to data clients, such as backend servers. The data transfer interface follows the W3C Vehicle API protocol and the Proof-of-Concept brings in additional considerations in the cloud to make APIs available to 3rd party developers. The GENIVI Alliance is a non-profit automotive industry alliance that develops standard approaches for integrating operating systems and middleware present in the centralized and connected vehicle cockpit. The Cloud & Connected Services project is performed by a work group that is open for anyone to join and to contribute to.

uk: вхід без авторизації

name: Designing an open communication framework for the connected car: Embedded, Mobile and Automotive devroom


Open Harmony - more than an OS

uk: Комп'ютерні науки

description: Breaking hardware boundaries, transcending the classic dichotomy of an OS, this is what OpenHarmony is about. Catering the needs from tiny sensors up to powerful systems, from edge to cloud. In this presentation Stefan will address questions every FOSS developer will have, when hearing about OpenHarmony for the first time. If you are curious about the architecture, used FOSS projects, or want to know more about contribution guidelines and start picking in the code this talk would be a good start. Stefan will talk about the multiple-kernel approach, the distributed architecture and layers. He will also explain our public development infrastructure and contribution flows.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Igalia has been developing a new open source Mesa driver for the Raspberry Pi 4 since December 2019. This talk will discuss the development story and current status of the driver, provide a high level overview of the major design elements, discuss some of the challenges we found in bringing specific aspects of Vulkan 1.0 to the V3D GPU platform and finally, talk about future plans and how to contribute to the on-going development effort.

uk: вхід без авторизації

name: Overview of the Open Source Vulkan Driver for Raspberry Pi 4


Safety and open source, oh my?

uk: Комп'ютерні науки

description: At FOSDEM 2020 we introduced Eclipse iceoryx, a true zero-copy middleware for safety-critical applications like automated driving. At FOSDEM 2021 we will give an overview of what needs to be considered when writing safety software in the open, share our experience regarding the development workflow and present the progress of the Eclipse iceoryx certification. Developing software in the automotive industry can be tedious. Old compilers, out-dated toolchains, resource constraint hardware. “Only use something which has been proven in-use” most safety engineers would argue. Well, hardly anyone would object, no one wants to jeopardise peoples lives when bringing a car on the road. The question we asked ourselves quite often in the last year: How can one combine the momentum and the freedom of an open source project while not compromising on the quality and safety? Apex.AI has extensive knowledge on the design and implementation of safety-critical applications written in modern C++ and is focused on certifying the robot operating system (ROS 2) according to the international standard for functional safety ISO26262. We will present an overview over the typical automotive software development process and discuss our modifications in the development workflow that we created for Eclipse iceoryx. Furthermore, we will share the key architectural design decisions, give examples of safe vs. unsafe code and conclude with a brief insight into the lessons learned.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: TerosHDL is an open source project focused in the development and integration of EDA tools in an IDE. It's currently based on VSCode and Atom. The goal of TerosHDL is bringing all facilities of software code tools to the HDL development: linter, code completion, simulators management, automate documentation, snippets… TerosHDL is an open source project focused in the development and integration of EDA tools in an IDE. It is currently based on VSCode and Atom. The goal of TerosHDL is bringing all facilities of software code tools to the HDL development: linter, code completion, simulators management, automate documentation, snippets… We will introduce TerosHDL VSCode with multiple features. In the new release the architecture has been completely rebuild, reduce some dependencies and clarify the code. Some of the new features are: - Verilog/SystemVerilog support. - Linter. - Dependencies viewer. - State machine viewer. - More beautiful documentation.

uk: вхід без авторизації

name: TerosHDL: An open-source IDE for FPGA: The goal of TerosHDL is make the VHDL/SV/Verilog development easier and reliable. It is a powerful open source IDE based on VSCode


uk: Комп'ютерні науки

description: Utilizing secure boot should be simple. Our current tooling is badly integrated, abstractions leaking and the code bases are not reusable. Functionality is spread between several projects and not one covers all your needs. This amounts to a confusing landscape. sbctl and go-uefi is a tool, and a low-level UEFI library, that attempts to push the secure boot landscape forward. In this talk I'll do a short introduction of secure boot and the tooling people normally use. We will look at the different use cases each of them provide and missing functionality. Then I'll do a short demonstration of sbctl and go-uefi. The goal is to try provoke some ideas how we can make secure boot more accessible for users. Currently the tooling assumes some familiarity with secure boot implementation details (signature lists, PK/KEK/db keys and so on) and that shouldn't be needed to have a fairly basic secure boot setup.

uk: вхід без авторизації

name: Improving the Secure Boot landscape: sbctl & go-uefi


OpenBMC introduction and porting guide

uk: Комп'ютерні науки

description: OpenBMC is an Open Source Software project started in an effort to create a secure, scalable, open source firmware code for BMC. Apart from the usual benefits arising from Open Source nature, OpenBMC brings in additional advantages like a.) state-of-the-art build system based on Yocto - an embedded linux distribution - which simplifies the process of building customized Linux, b.) Robust Managebility framework based on (4 pillars - REST, JSON, HTTPS, ODATAv4) RedFish, c.) Superior Modularity with D-bus IPC mechanism which is known for its well defined interfaces, d.) Ability to customize the code, e.) Support for IPMI, etc.

uk: вхід без авторизації


GRUB: Project Status Update

uk: Комп'ютерні науки

description: The presentation will discuss current state of GRUB upstream development and cooperation with distributions. The first part of presentation will be focusing on last year, current and future GRUB development efforts. The second part will discuss cooperation between GRUB upstream and distros. In general it will show current progress in the project and main pain points. One of the goals of the presentation is to solicit some help from the community. Maintainers are quite busy and they are not able to solve all issues themselves. So, help from others is greatly appreciated. At the end of presentation Q&A session is planned.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: With the advancement of open source firmware projects, we need a reliable quality assurance process to automate the firmware level testing. In this talk I'd like to show how we build up a ecosystem for open-source firmware testing and show by example how we integrated one project into that ecosystem. This talk aims to give a status update what has been show on the OSFC2020, and also encourage people to get involved and participate in open-source firmware testing. All code shown is open-source and available by the time of FOSDEM'21.

uk: вхід без авторизації

name: How to build up an ecosystem for open-source firmware testing


uk: Комп'ютерні науки

description: During that presentation I will run a quick demo of the OSFCI infrastructure which is developed by HPE to validate and build Open Source Firmware stack on Proliant server. I will introduce an overview at how the code works, and how to get involve, and make scale the platform. This project is available on github. https://github.com/hewlettpackard/osfci OSFCI is an interactive testing platform for Open Source Firmware. From a single web browser, a firmware developer can recompile ROM at BMC and System level, load them to a real system, and execute an interactive session to validate firmware behavior on real hardware. The goal of this infrastructure is to provide end to end validation automation for firmware development, easing adoption for open source firmware at scale.

uk: вхід без авторизації

name: Building an interactive Continuous Integration platform for Open Source Firmware


uk: Комп'ютерні науки

description: Ampere Computing is a relatively new entrant into the server space, recently launching its 80-core ARM64 Altra processor on the Mt. Jade platform. In this talk, I'll cover the status of various open-source projects such as EDK2, LinuxBoot, OpenBMC and OpenOCD on Ampere's processors and platforms. For those interested in learning more about Ampere and our engagement in open-source firmware, this is the talk for you.

uk: вхід без авторизації

name: Open Source Firmware Status on Ampere Platforms


uk: Комп'ютерні науки

description: RISC-V is a relatively new ISA and platform, which has been evolving rapidly. A few Linux distributions already have good support and have compiled most of their packages for it. The boot process has been neglected and only recently did everyone start using the widely used embedded bootloader U-Boot instead of a custom research bootloader. We have ported the EDK2 reference implementation of UEFI to make the boot process more like current desktops and servers. This talk explains how we did that, how it works and how we got Linux to boot. We also want to explain what's left to do and how we can move in the direction of a RISC-V server platform.

uk: вхід без авторизації

name: EDK2 UEFI on RISC-V: Open Source Firmware, BMC and Bootloader devroom


uk: Комп'ютерні науки

description: Security Protocol and Data Model (SPDM) is a standard published by the Distributed Management Task Force (DMTF) organization Platform Management Components Intercommunication (PMCI) working group. SPDM’s vision is to resolve the long-lasting problem of compatible secure communication solution between two endpoints of embedded systems. Protocols defined by SPDM can be used for a wide range of security functionalities including authentication of hardware/firmware identities, delivering measurements, performing attestation, and establishing session keys for secure communication channels. This presentation introduces OpenSPDM, an open-source sample implementation which implements an SPDM requester utility to validate a vendor’s responder implementation. The talk covers SPDM 1.0 device authentication and firmware measurement collection, and SPDM 1.1 session creation for data communication protection. The audience will learn the main components of the SPDM protocol. A firmware solution builder will learn how to implement a SPDM requester to perform device authentication/attestation and create a secured session with a target device. A device builder will learn how to implement a SPDM responder for authentication/measurement requests and create a secured session to protect communications.

uk: вхід без авторизації

name: An Opensource SPDM implementation for secure device communication


uk: Комп'ютерні науки

description: There is existing work in the public space on how to correctly construct a DRTM launch but not an equivalent amount on how to maintain the integrity of the DRTM launch over the lifecycle of a system. In particular a specific area of concern is how to correctly construct a secure upgrade for the DRTM launch that minimizes the risk of the process being corrupted. There are a few challenges that must be overcome and in this presentation these will be covered along with a novel approach that will address the challenges.

uk: вхід без авторизації

name: Secure Upgrades with DRTM: (How not to get owned through updates)


uk: Комп'ютерні науки

description: Much of the Secure and Trusted Boot ecosystem is built around UEFI. However, not all platforms implement UEFI, including IBM's Power machines. In this talk, I will talk about my team's ongoing work on secure boot of virtual machines on Power. This is an important use case, as many Power machines ship with a firmware hypervisor, and all user workloads run as virtual machines or "Logical Partitions" (LPARs). Linux Virtual Machines on Power boot via an OpenFirmware (IEEE1275) implementation which is loaded by the hypervisor. The OpenFirmware implementation then loads grub from disk, and grub then loads Linux. To secure this, we propose to: - Teach grub how to verify Linux-module-style "appended signatures". Distro kernels for Power are already signed with these signatures for use with the OpenPower 'host' secure boot scheme. - Sign grub itself with an appended signature, allowing firmware to verify grub.

uk: вхід без авторизації

name: Secure boot without UEFI: booting VMs on Power(PC)


uk: Комп'ютерні науки

description: Disaggregated computing today relies more on add-in-cards like FPGAs/Smart NICs/xPUs. Traditionally add-in-cards have relied on IPMI based manageability solutions. However, the newer standards from DMTF (PMCI protocol stack) provide more robust and scalable solutions for add-in card manageability. SPDM provides the attestation and secure communication channel between the BMC and the add-in cards. MCTP/PLDM stack provides mechanisms for the BMC to auto discover card’s capabilities and carry out manageability functions like sensor monitoring, event logging, firmware updates etc. This provides significant advantage over IPMI which lacked secure communications and had limitations on supporting advanced high speed interfaces like PCIe and had limitations on number of sensors it could support. We plan to present on how add-in-cards can be managed through PMCI protocols and how do we model the add-in-cards’ manageability functions in a way a DataCentre orchestration software can consume it (i.e. Redfish modelling of add-in-cards). The implementation is planned for OpenBMC and a variety of Add-In-Cards can be supported through a standard manageability model.

uk: вхід без авторизації

name: Open source PMCI stack implementation for add-in-card manageability.


uk: Комп'ютерні науки

description: This is the continuation of the "Status of AMD platform in coreboot" presented last year on the Open Source Firmware, BMC and Bootloader devroom. The talk will cover the news around the AMD support in Open Source Firmware ecosystem from the past year. You will hear, among others, about: FSF RYF KGPE-D16 platform revival, AMD Ryzen R1000/V1000 series AGESA integration into open source TianoCore EDK2, TrenchBoot new features and updates and current support of AMD Picasso and Cezanne SoCs in coreboot, pure open-source on AMD Rome platform in oreboot. The history of AMD cooperation in coreboot projects reaches 2007 where the first contribution appeared for the Geode LX processors. AMD's open-source support continued for many years until now (with some break). This presentation will briefly introduce the history of AMD and coreboot, the evolution of the code, processors, creation of CIMX and AGESA and so on. It will also show the gradual change in the AMD attitude to open-source and introduction of binary platform initialization. Binary blobs, very disliked by the open-source community started to cause problems and raised the needs for workarounds to support basic processor features. Soon after that AMD stopped supporting the coreboot community. Moreover, recent coreboot releases started to enforce certain requirements on the features supported by the silicon code base. Aging platforms kept losing interest and many of them (including fully open ones) are being dropped from the main tree. Nowadays AMD released the newest AGESA with the cooperation of hired coreboot developers, but only for Google and their Chromebooks based on Ryzen processors. 3mdeb trying hard with this ecosystem showing that the AGESA can be integrated into Open Source Firmware like TianoCore EDK2 on the example of AMD Ryzen R1000/V1000 processor. Even FSF RYF KGPE-D16 platform is experiencing its second youth by being revived to the main coreboot tree. If you are curious about these activities and many more like TrenchBoot new features or AMD Picasso an Cezanne SoC support in coreboot, pure open-source on AMD Rome in oreboot, this presentation is for you.

uk: вхід без авторизації

name: Open Source Firmware status on AMD platforms 2021


uk: Комп'ютерні науки

description: Existing attestation schemes require pre-signed enclave images and provide few means of including runtime-dependent configuration data (like report data, enclave held data, configid). In multi-party settings in which the parties may not always fully trust each other, attestation of multiple pieces of code or data images via these means is cumbersome and inefficient. For example, consider the case of a secure cloud service running a JavaScript interpreter, which interprets a third-party script, in which case both, the interpreter and the script, can interfere with each other's attestation evidence as they share an address space. Similarly, a group of users may want to compute a shared result over all of their combined data, but without sharing their data with each other. Attestation in such scenarios is greatly simplified by a technique called Extended Enclave Initialization Data (EEID), which provides a secure and convenient means to combine all required attestation evidence, and to automatically re-sign images (with a well known service key) during enclave startup to ensure that all of the code and data is loaded and attested appropriately. An added benefit is that even single-party applications can use this technique to automatically re-sign enclave images with modified configuration settings (like memory size and thread count), independent of, or in addition to, underlying TEE support for configuration changes. EEID is currently available as an experimental feature for SGX enclaves in the Open Enclave SDK and it is used in multiple prototype services at Microsoft.

uk: вхід без авторизації

name: Secure Multi-Party Applications in Open Enclave


uk: Комп'ютерні науки

description: If you’re designing a project where security is uppermost, but you want to make it easy to use and compatible with multiple platforms (existing and future), what principles should you follow, and how do they translate into an architecture and actual code. We’ll present the 10 security design principles of the Enarx project, and discuss why they led us to where we are today: a Rust-based open source project with a WebAssembly run-time.

uk: вхід без авторизації

name: Rust, WebAssembly and open source: Enarx design choices


uk: Комп'ютерні науки

description: Enclave technologies such as SGX generally have a relatively high context-switching cost. This is particularly noticeable when doing (network) I/O. In this talk we'll present the first non-LibOS implementation of an asynchronous I/O model for SGX. This gives you a language-native async I/O programming experience in Rust, outperforming any other way to build SGX network services.

uk: вхід без авторизації

name: Lightning fast enclave network services with async I/O


uk: Комп'ютерні науки

description: Graphene is a lightweight library OS, designed to run a single Linux application in an isolated environment. Currently, Graphene runs on Linux and Intel SGX enclaves on Linux platforms. With Intel SGX support, Graphene can secure a critical application in a hardware-encrypted memory region and protect the application from a malicious system stack with minimal porting effort. This talk will discuss the design, implementation, features, lessons learned, and the current status of the project. The talk will highlight some of the technical challenges of enabling unmodified applications in restricted secure environments such as Intel SGX enclaves.

uk: вхід без авторизації

name: Graphene Library OS: Running unmodified applications in SGX enclaves


uk: Комп'ютерні науки

description: In the ARM world, Secure Boot is typically a BootROM feature, which allows for verification of the loaded binaries (firmware, bootloader, Linux kernel) prior executing it. The main idea is to prevent the untrusted code from running on our platform. The general approach is similar across vendors, but there is no standardization in this area. During this talk we will review the Secure Boot features in ARM SoCs from some of the most popular vendors. Not only will we analyze the Secure Boot presence or its features, but we will also focus on the tools and documentation availability. It is a known fact that often such documentation requires a signed NDA with an SoC vendor, which makes it difficult to use by regular users.

uk: вхід без авторизації

name: Overview of Secure Boot state in the ARM-based SoCs


uk: Комп'ютерні науки

description: What if millennials reinvented microkernels? How would they design them, what CPU features would they use? Modern component-based systems, in particular microkernels, are impractical. While it is relatively easy to develop a small microkernel, it is almost impossible to build a component-based environment that can effectively reuse existing components and programs from mainstream systems. The experience of big projects, like Genode, L4Re, rump-kernel, etc. shows that it is an infinite catch-up game when developers try to reproduce POSIX environment and Linux kernel interfaces, while the mainstream systems are constantly evolving. In this talk, I will discuss what to do with this infinite loop. I will show, that: the root cause of the problem is the messaging-based API of component-based systems, which is hardly compatible with POSIX but fundamental a monolithic system can be partitioned without the use of messages but requires some constraints in its design and implementation Modern hardware features like Intel MPK gives new opportunities for kernel developers and allows to resolve some old systems problems. I will present CubicleOS, a sketch of a LibOS based on Unikraft. CubicleOS does not use messages, works as automatic partitioning system, and turns monolithic Unikraft into a set of isolated components.

uk: вхід без авторизації

name: CubicleOS: a component-based system without messaging: Millennials try to reinvent something again


uk: Комп'ютерні науки

description: Emerging applications like artificial intelligence and autonomous car require high security-assurance, which stimulates the wide-spread deployment of trusted execution environment (TEE). However, prior enclave systems are far from the ideal for three reasons. 1) Scalability: only support limited secure memory or limited number of instances; 2) Performance: not well-fit the requirements of high-performance application, e.g., poor secure communication performance; 3) Security: many still have security flaws, e.g., suffering cache-based side channels attacks. Penglai-Enclave is proposed to overcome these challenges. The Penglai open-source project aims to build a scalable and efficient TEE system based on RISC-V, which is made powerful through hardware-assisted scalable physical memory isolation extensions. Our evaluations show that Penglai can achieve more than 1,000 concurrently running instances even in a resource-restricted device. We also have supported libraries like ARM PSA on Penglai to ease the development of trusted applications, and applied formal methods to validate its software TCB.

uk: вхід без авторизації

name: Penglai: Verifiable and Scalable TEE System


uk: Комп'ютерні науки

description: In this talk, we present an open-source framework to develop heterogeneous, distributed enclaved applications. The main feature of our framework is to provide a high level of abstraction over the platform-specific TEE layer and over the secure communication between different modules, leaving to a developer only the task to write the application’s logic. We provide a notion of event-driven programming to develop distributed enclave applications in Rust and C for heterogeneous TEEs, including Intel SGX, ARM TrustZone and the open-source Sancus. This heterogeneity brings our work to a broad range of use cases, which include cloud processing, mobile devices and lightweight IoT. Our framework ensures strong security guarantees based upon mutual attestation of security-critical software components.

uk: вхід без авторизації

name: An Open-Source Framework for Developing Heterogeneous Distributed Enclave Applications


Opening: Welcome, overview, lineup

uk: Комп'ютерні науки

description: A brief introduction to the room and to the sessions.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Previous work such as Plundervolt has shown that software-based undervolting can induce faults into Intel SGX enclaves and break their security guarantees. However, Intel has addressed this issue with microcode updates. We later discovered that there is a physical connection on the motherboard which allows us to control the voltage and conduct fault injection. In this talk, we will present a low-cost device: Voltpillager, which use this physical connection to break the guarantees provided by SGX again. On a standard motherboard, there is a separate Voltage Regulator (VR) chip that generates and controls the CPU voltage. Our tool, VoltPillager, uses this to connect to the (unprotected) interface of the VR and control that voltage. Based on this, we then mount fault-injection attacks that breach confidentiality and integrity of Intel SGX enclaves, and present proof-of-concept key-recovery attacks against cryptographic algorithms running inside SGX. Our results may require a rethink of the widely assumed SGX adversarial model, where a cloud provider hosting SGX machines is assumed to be untrusted but has physical access to the hardware.

uk: вхід без авторизації

name: Hardwared Based CPU Undervolting on The Cheap: Stealing Your Secrets for $30


uk: Комп'ютерні науки

description: Keystone is an open framework for building customizable trusted execution environments (TEEs) based on RISC-V for various platforms and use cases. Instead of building a single instance of TEE hardware, Keystone provides security primitives, which can be composed by the software framework. The enclave developer and the platform provider can customize the TEE in order to meet their threat models or platform configurations. The Keystone project aims to build an open standard for TEEs by providing a generic and formally-verified interface for a wide range of devices. We envision that every hardware can have a secure TEE with almost no additional cost. In this talk, we will discuss the current state and future directions of the project.

uk: вхід без авторизації

name: Keystone: towards an open standard for trusted execution environments


uk: Комп'ютерні науки

description: In this presentation we will introduce Veracruz, a project recently adopted by the Confidential Compute Consortium, exploring how efficient, collaborative computations between mutually distrusting parties can be developed using a mixture of hardware- and software strong isolation mechanisms. Veracruz uses Arm TrustZone, Intel SGX, AWS Nitro Enclaves, or the high-assurance seL4 microvisor, to provide a "neutral ground" within which a collaborative computation takes place, shielded from prying or interference by the host of the computation. The computation itself is realised by a WebAssembly program which sandboxes the computation, means Veracruz programs are portable across different isolation technologies, and allows multi-party computations to be quickly written in high-level programming languages with standard development tools. Potential use-cases for Veracruz include support for privacy-preserving collaborative machine-learning, privacy-preserving surveys, polls, elections, or auctions, and safely delegating computations from weak devices to more powerful devices, amongst many others. Veracruz began life as a research project within the Security group at Arm Research. However, after reaching maturity, we recently open-sourced the project on Github (see: https://github.com/veracruz-project/veracruz) as a precursor to adoption by the Confidential Compute Consortium, and all development is now done in the open. We are especially interested in attracting collaborators, as we have many ideas for where the project can go next, and are interested in hearing of other ideas and potential use-cases, too.

uk: вхід без авторизації

name: Veracruz: privacy-preserving collaborative compute