IRC channel logs

<oriansj>stikonas: merged

<oriansj>daddy: the stage0-posix release is done

<daddy>can you get a release tarball as well? that's the part i'm having difficulty with, can't get submodules through GitHub archives

<oriansj>daddy: github does that on every tag: https://github.com/oriansj/stage0-posix/archive/refs/tags/Release_1.7.0.tar.gz

<daddy>the github one doesn't include submodules, it looks like you uploaded one manually for 1.6.0

<daddy>that said, we're also considering whether we should allow use of release assets vs src assets, so this might not be how stagex moves forward in the future - we may choose to just download the submodules we need directly. if you'd rather wait until i can confirm if it's necessary, that's also fine.

<matrix_bridge><Andrius Štikonas> oriansj: I think daddy wants make-dist tarballs

<matrix_bridge><Andrius Štikonas> janneke added support for creating them to our makefiles

<daddy>I think stagex consensus is to download all source tarballs and unpack manually so it's not as pressing an issue but it may help someone else who tries to download everything all in one go

<Googulator>daddy: after the XZ incident, I'd argue against preferring source tarballs to Git repositories...

<daddy>Googulator: in this case, i mean the ones automatically generated by GitHub

<andydude>What's "the XZ incident"?

<nimaje> https://www.openwall.com/lists/oss-security/2024/03/29/4 "backdoor in upstream xz/liblzma leading to ssh server compromise"

<nimaje>the backdoor was added to the executable by a changed configure script (I think) (it was already in the repo as a binary "test file" (which was never used by the tests))

<joostvb> https://en.wikipedia.org/wiki/XZ_Utils_backdoor

<janneke>that's why, when i add a `dist' target to make, i also make sure the tarball will be reproducible

<janneke>so they can be checksummed/signed

<janneke>gitlab's tarballs are not (guaranteed to be) reproducible

<janneke>and thus can be a problem

<andydude>is there a wiki or readme for making reproducible tarballs?

<janneke>ACTION hasn't seen one

<andydude>like is there a --no-timestamps feature?

<tobtoht_>andydude: here is an example: https://paste.debian.net/plainh/fe30dae0

<tobtoht_>`git ls-files --recurse-submodules` instead of `find` if you want to package a git repo including submodules and want to exclude .gitignored files

<tobtoht_>`git archive` if you don't need submodules

<matrix_bridge><Andrius Štikonas> tobtoht_: well, that's what make dist does there for stage0-posix

<stikonas> https://github.com/oriansj/stage0-posix/blob/8ea80b69ff33c3e1d1696b67a926ba055c03543d/makefile#L167

<matrix_bridge><Andrius Štikonas> I can create one later today

<lrvick>Where is the source for kaem-optional-seed? https://github.com/oriansj/bootstrap-seeds/tree/e027b7f9da2092d41d4d249c5a6e7ce5c991cf07/POSIX/x86 ?

<lrvick>having trouble tracking it down

<matrix_bridge><Andrius Štikonas> lrvick: same directory

<matrix_bridge><Andrius Štikonas> https://github.com/oriansj/bootstrap-seeds/blob/e027b7f9da2092d41d4d249c5a6e7ce5c991cf07/POSIX/x86/kaem-minimal.hex0

<lrvick>oh okay. different filename threw me off

<lrvick>and didn't see a make target for it, but that's fine

<stikonas>oriansj: doesn't matter this time but next time before the release maybe better to replace "current" with a version number in https://github.com/oriansj/stage0-posix/blob/master/CHANGELOG.org#current

<stikonas>also apprently that make target is only good if your worktree is empty...

<stikonas>just ran it in my normal dev repo and it created 8 MiB tarball

<stikonas>I guess with all build artifacts...

<stikonas>annoyingly to make release note page on github I have to manually reformat Changelog.org to markdown...

<stikonas>ok, I've uploaded tarball with submodules to https://github.com/oriansj/stage0-posix/releases/tag/Release_1.7.0

<ekaitz>stikonas: what do you know about stagex?

<stikonas>ekaitz: not much really

<ekaitz>it was mentioned to me by zig's author right now

<ekaitz> https://codeberg.org/stagex/stagex

<stikonas>but my understanding is that it's largely live-bootstrap in docker

<stikonas>lrvick: wrote it

<ekaitz>yeah, that's mostly what i understood yeah