Binary and container images releases #6

Ghost commented 2022年11月06日 11:33:00 +01:00

A binary release (amd64 & arm64) and container image (root & rootless) of Gitea 1.18 is self-published. Exactly the same as the Gitea releases, only with the 100% Free Software promise.

See the task list of the codename repository for more details.

A binary release (amd64 & arm64) and container image (root & rootless) of Gitea 1.18 is self-published. Exactly the same as the Gitea releases, only with the 100% Free Software promise. See the [task list of the codename repository](https://codeberg.org/codename/codename/milestone/2794) for more details.

oliverpool commented 2022年11月07日 07:27:30 +01:00

nitpick: consider replacing "docker" with "container image".
And if a software must quoted, podman is probably to be prefered (as far as I know, moby is the open-core of the proprietary docker software).

nitpick: consider replacing "docker" with "container image". And if a software must quoted, podman is probably to be prefered (as far as I know, moby is the open-core of the proprietary docker software).

Ghost commented 2022年11月07日 09:41:02 +01:00

@Gusted Do you think that's enough for the launch?

@Gusted Do you think that's enough for the launch?

Ghost commented 2022年11月07日 09:41:35 +01:00

nitpick: consider replacing "docker" with "container image".
And if a software must quoted, podman is probably to be prefered (as far as I know, moby is the open-core of the proprietary docker software).

Good point, I replaced as suggested.

> nitpick: consider replacing "docker" with "container image". > And if a software must quoted, podman is probably to be prefered (as far as I know, moby is the open-core of the proprietary docker software). Good point, I replaced as suggested.

Gusted commented 2022年11月07日 17:26:31 +01:00

@Gusted Do you think that's enough for the launch?

I've also linked some other things codename/meta#9 (comment), but technical-wise, we would need to take a hard look at the code to ensure that promise, while I'm sure it's already the case, even I still find new code bits in Gitea. But otherwise it's fine.

> @Gusted Do you think that's enough for the launch? I've also linked some other things https://codeberg.org/codename/meta/issues/9#issuecomment-667892, but technical-wise, we would need to take a hard look at the code to ensure that promise, while I'm sure it's already the case, even I still find new code bits in Gitea. But otherwise it's fine.

Ghost commented 2022年11月07日 17:39:06 +01:00

Auditing the existing codebase is a formidable task indeed. Keeping an eye on merged pull requests when they look like they could lead to be linked to proprietary software is easier.

Auditing the existing codebase is a formidable task indeed. Keeping an eye on merged pull requests when they look like they could lead to be linked to proprietary software is easier.

Gusted commented 2022年11月07日 19:10:09 +01:00

Alright, also good. I'm already passively looking at new pull requests and issues, so this should be fine.

Alright, also good. I'm already passively looking at new pull requests and issues, so this should be fine.

Ghost commented 2022年11月07日 19:40:07 +01:00

I'm also doing it daily, as part of my Gna! duties https://gitea.gna.org/Gna/organization/issues/22 between the two of us that will have to do.

I'm also doing it daily, as part of my Gna! duties https://gitea.gna.org/Gna/organization/issues/22 between the two of us that will have to do.

Ryuno-Ki commented 2022年11月07日 20:50:12 +01:00

Perhaps worth a new ticket, but auditing should also look out for vulnerabilities.
I've heard, one such audit was done in the past.

Perhaps worth a new ticket, but auditing should also look out for vulnerabilities. I've heard, one such audit was done in the past.

Gusted commented 2022年11月07日 20:56:53 +01:00

Perhaps worth a new ticket, but auditing should also look out for vulnerabilities.

I'm by no mean a security researcher (even though I did found a couple in Gitea), but yeah that would be a bit harder to also think trough every logical step etc. especially with the commits that add new features. Ideally I would also look for that, but it's pure luck that I spot something in my 👀.

I've heard, one such audit was done in the past.

Luckily I know this was mentioned in the Gitea general chatroom:

techknowlogick: Yes, but it was commissioned by a third party and the condition that they provided us the report under was that we are unable to disclose who performed the audit. They are a well known company though, and they didn’t find any serious issues (nothing to warrant a CVE)

And a required security audit would be done as part of a NLNet grant, due to the conditions of the last grant, that never really happend (I and another contributor did got in contact with the security audit company as part of the previous NLNet grant, but nothing ever happend).

> Perhaps worth a new ticket, but auditing should also look out for vulnerabilities. I'm by no mean a security researcher (even though I did found a couple in Gitea), but yeah that would be a bit harder to also think trough every logical step etc. especially with the commits that add new features. Ideally I would also look for that, but it's pure luck that I spot something in my 👀. > I've heard, one such audit was done in the past. Luckily I know this was mentioned in [the Gitea general chatroom](https://matrix.to/#/!bXIgKPtRdSXHBnVBaz:osgeo.org/$HAJ7JQV-Vx3UWPI00UtQj_bbzim69J_I_xXRUsRDS2c?via=libera.chat&via=t2bot.io&via=matrix.org): > techknowlogick: Yes, but it was commissioned by a third party and the condition that they provided us the report under was that we are unable to disclose who performed the audit. They are a well known company though, and they didn’t find any serious issues (nothing to warrant a CVE) And a required security audit would be done as part of a NLNet grant, due to the conditions of the last grant, that never really happend (I and another contributor did got in contact with the security audit company as part of the previous NLNet grant, but nothing ever happend).

Ghost commented 2022年11月07日 21:08:17 +01:00

I and another contributor did got in contact with the security audit company as part of the previous NLNet grant, but nothing ever happend

Are there more information about that available publicly?

> I and another contributor did got in contact with the security audit company as part of the previous NLNet grant, but nothing ever happend Are there more information about that available publicly?

Gusted commented 2022年11月07日 21:10:23 +01:00

It was discussed in the private maintainers chatroom and I will need to keep that information confidence.

It was discussed in the private maintainers chatroom and I will need to keep that information confidence.

Ghost commented 2022年11月08日 18:22:51 +01:00

For the launch I propose to build releases for:

• binaries amd64 & arm64
• containers root & rootless

and leave the more exotic architectures (arm5, etc.) and windows for later. Unless someone with knowledge of those is willing to step up before the launch. So that sorting out problems specific to them can be done.

For the launch I propose to build releases for: * binaries amd64 & arm64 * containers root & rootless and leave the more exotic architectures (arm5, etc.) and windows for later. Unless someone with knowledge of those is willing to step up before the launch. So that sorting out problems specific to them can be done.

Gusted commented 2022年11月09日 19:07:44 +01:00

I'm able to test amd64 + arm64 binaries. I'm not knowledgeable enough for containers. I don't have access to arm5 + Winodws, so that's a no for me as well.

I'm able to test amd64 + arm64 binaries. I'm not knowledgeable enough for containers. I don't have access to arm5 + Winodws, so that's a no for me as well.

Ghost commented 2022年11月23日 18:00:57 +01:00

All is ready for creating the binary & container releases (see the corresponding CI:).

All is ready for creating the binary & container releases (see the [corresponding CI:](issues)).