{"action":"created","issue":{"url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/871","repository_url":"https://api.github.com/repos/postmarketOS/pmbootstrap","labels_url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/871/labels{/name}","comments_url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/871/comments","events_url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/871/events","html_url":"https://github.com/postmarketOS/pmbootstrap/issues/871","id":271207789,"number":871,"title":"Binary Repository #2","user":{"login":"ollieparanoid","id":6033024,"avatar_url":"https://avatars1.githubusercontent.com/u/6033024?v=4","gravatar_id":"","url":"https://api.github.com/users/ollieparanoid","html_url":"https://github.com/ollieparanoid","followers_url":"https://api.github.com/users/ollieparanoid/followers","following_url":"https://api.github.com/users/ollieparanoid/following{/other_user}","gists_url":"https://api.github.com/users/ollieparanoid/gists{/gist_id}","starred_url":"https://api.github.com/users/ollieparanoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ollieparanoid/subscriptions","organizations_url":"https://api.github.com/users/ollieparanoid/orgs","repos_url":"https://api.github.com/users/ollieparanoid/repos","events_url":"https://api.github.com/users/ollieparanoid/events{/privacy}","received_events_url":"https://api.github.com/users/ollieparanoid/received_events","type":"User","site_admin":false},"labels":[{"id":651646422,"url":"https://api.github.com/repos/postmarketOS/pmbootstrap/labels/architecture","name":"architecture","color":"fbca04","default":false},{"id":668727409,"url":"https://api.github.com/repos/postmarketOS/pmbootstrap/labels/discussion","name":"discussion","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":{"login":"ollieparanoid","id":6033024,"avatar_url":"https://avatars1.githubusercontent.com/u/6033024?v=4","gravatar_id":"","url":"https://api.github.com/users/ollieparanoid","html_url":"https://github.com/ollieparanoid","followers_url":"https://api.github.com/users/ollieparanoid/followers","following_url":"https://api.github.com/users/ollieparanoid/following{/other_user}","gists_url":"https://api.github.com/users/ollieparanoid/gists{/gist_id}","starred_url":"https://api.github.com/users/ollieparanoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ollieparanoid/subscriptions","organizations_url":"https://api.github.com/users/ollieparanoid/orgs","repos_url":"https://api.github.com/users/ollieparanoid/repos","events_url":"https://api.github.com/users/ollieparanoid/events{/privacy}","received_events_url":"https://api.github.com/users/ollieparanoid/received_events","type":"User","site_admin":false},"assignees":[{"login":"ollieparanoid","id":6033024,"avatar_url":"https://avatars1.githubusercontent.com/u/6033024?v=4","gravatar_id":"","url":"https://api.github.com/users/ollieparanoid","html_url":"https://github.com/ollieparanoid","followers_url":"https://api.github.com/users/ollieparanoid/followers","following_url":"https://api.github.com/users/ollieparanoid/following{/other_user}","gists_url":"https://api.github.com/users/ollieparanoid/gists{/gist_id}","starred_url":"https://api.github.com/users/ollieparanoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ollieparanoid/subscriptions","organizations_url":"https://api.github.com/users/ollieparanoid/orgs","repos_url":"https://api.github.com/users/ollieparanoid/repos","events_url":"https://api.github.com/users/ollieparanoid/events{/privacy}","received_events_url":"https://api.github.com/users/ollieparanoid/received_events","type":"User","site_admin":false}],"milestone":null,"comments":7,"created_at":"2017-11-04T17:10:10Z","updated_at":"2017-11-07T00:03:12Z","closed_at":null,"author_association":"OWNER","body":"## What won't work any time soon\r\n### Reproducible builds\r\nThe first binary repository approach involved reproducible builds, and it turned out not to be feasible and it wouldn't provide any real security benefit. Read https://github.com/postmarketOS/pmbootstrap/issues/64#issuecomment-334252443 for details. But we need a binary repository, it makes development much easier (compiling KDE takes forever, and we have some developers for whom compiling kernels also takes hours).\r\n\r\nPlease note, that I chose the reproducible build route to provide maximum security. We do not only run the binaries from this repository on the target devices (phones, tablets, ...), but also on the PCs where we develop (e.g. the cross-compilers `gcc-armhf`, ...), and sometimes even with root access (e.g. the `heimdall` flasher application).\r\n\r\nWhat we have left from this approach and can use, are mirrors for hosting the packages (thanks to @MartijnBraam, see #365).\r\n\r\n### Alpine building postmarketOS packages\r\nSo the next best thing would be, if Alpine built our packages along with the official packages. Then we wouldn't need to trust another person for providing the packages. Two Alpine developers had the idea of providing a PPA-like system at some point in the future, and therefore I've asked on the mailing list.\r\n\r\nThe short answer is, that they would need a new build system first, for which there is no time plan and that Alpine focuses on its upcoming 3.7 release so they don't have time for this.\r\n\r\n[Looks like](https://lists.alpinelinux.org/alpine-infra/0198.html) we can talk about this again after 3.7, but realistically even if it worked out that way, it won't happen in the next few months, which means for me that we better have a short-term solution.\r\n\r\n## Short-term solution\r\nIt seems to me, that the fastest way to get this going is if I build all the packages myself, but not reproducible. This might be the next best deal regarding trust, because you need to sort-of trust me already for the `pmbootstrap` code, which also runs on your computer and while you can just read it, people rarely read all code before executing it.\r\n\r\nI would use an i3 CPU with cross-compilation (which I'm using right now to do bigger builds), which is slower than what @PureTryOut uses. But then again, we use ccache and we only need to build changed packages. As long as the packages compile regularly, the delay shouldn't be more than one day or so, which is a lot better than what we have now (no binary packages).\r\n\r\nFor the first iteration, I would trigger the builds manually and I might be able to set this up in a week or so. I would write a script, that does the following:\r\n* Clone `pmbootstrap`\r\n* Build some (later all) packages\r\n* Upload the whole packages folder to the official mirror\r\n\r\nFuture ideas:\r\n* Delete outdated packages from the repo (use `zap -m`)\r\n* GitHub trigger to build automatically whenever a commit lands in master\r\n* compile natively on armhf/aarch64 (maybe on old quad-core phones? even the lg-mako has a quad core - compiling natively is better to avoid bugs from qemu)\r\n* use a bigger machine for compiling if required\r\n\r\n**Thanks for reading. What does everybody think about this proposal?**\r\n\r\n@MartijnBraam: could you configure the primary mirror, so that packages can be uploaded via rsync or similar (right now we pull them from a git repository, but that isn't so great for binary files)? And as I understand it, the other mirror automatically syncs from the primary mirror, or how does it work?"},"comment":{"url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/comments/342329698","html_url":"https://github.com/postmarketOS/pmbootstrap/issues/871#issuecomment-342329698","issue_url":"https://api.github.com/repos/postmarketOS/pmbootstrap/issues/871","id":342329698,"user":{"login":"ollieparanoid","id":6033024,"avatar_url":"https://avatars1.githubusercontent.com/u/6033024?v=4","gravatar_id":"","url":"https://api.github.com/users/ollieparanoid","html_url":"https://github.com/ollieparanoid","followers_url":"https://api.github.com/users/ollieparanoid/followers","following_url":"https://api.github.com/users/ollieparanoid/following{/other_user}","gists_url":"https://api.github.com/users/ollieparanoid/gists{/gist_id}","starred_url":"https://api.github.com/users/ollieparanoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ollieparanoid/subscriptions","organizations_url":"https://api.github.com/users/ollieparanoid/orgs","repos_url":"https://api.github.com/users/ollieparanoid/repos","events_url":"https://api.github.com/users/ollieparanoid/events{/privacy}","received_events_url":"https://api.github.com/users/ollieparanoid/received_events","type":"User","site_admin":false},"created_at":"2017-11-07T00:03:12Z","updated_at":"2017-11-07T00:03:12Z","author_association":"OWNER","body":"That sounds like a good solution!\r\nSo here is my initial push with some binary packages. Notably all cross-compilers, and the `maemo` folder for all architectures, as well as some device kernels and most packages for `x86_64` (e.g. weston). I've force pushed over the old reproducible builds approach, which might be the reason why your mirrors did not pick it up yet.\r\n\r\nhttps://github.com/postmarketOS/binary-package-repo\r\n\r\n@MartijnBraam: Could you set up rsync access to both mirrors when you have time, so I could sync them up directly?"}}
{"actor":{"display_login":"ollieparanoid"}}