Hi, I'm taking the library to forward this to the broader community and answering as much questions as I can :)
- at NYU, we have an 8-core VM with 8GB of RAM, although we will probably update this sometime soon. - I think if you guys could use more cores/ram, although I think this is somewhat of an open question. I'm sure people at the debian project will probably know better. - The rebuilders are separate from the debian project, which makes things easier for both, a security and governance standpoint. I think it would be due to discuss/standardize the in-toto query endpoints, as well as start talking about having witnesses/submitters to the rebuilder transparency log :) Cheers! -Santiago. P.S. +Morten, as he's the brains behind the transparency log. ----- Forwarded message from Jose Miguel Parrella <[email protected]> ----- Date: Mon, 19 Aug 2019 23:00:31 +0000 From: Jose Miguel Parrella <[email protected]> To: "[email protected]" <[email protected]> CC: "[email protected]" <[email protected]>, Matt Bearup <[email protected]> Subject: Setting up a MS-hosted rebuilder with in-toto metadata We're interested in setting up an Azure-hosted rebuilder<https://urldefense.proofpoint.com/v2/url?u=https-3A__salsa.debian.org_reproducible-2Dbuilds_debian-2Drebuilder-2Dsetup&d=DwIFAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=yZMPY-APGKyVIX7HgQFZJA&m=OHg27uJzPTMAWC-xp85HQBTXU20vf51f8NK1LZSMOrI&s=dV5yYTv2mGwPXBQsp-bYTyqZVx8Ymun6mTOzKMp2gX4&e= > for Debian packages, and publishing in-toto metadata of our rebuilds for public consumption. I know NYU<https://reproducible-builds.engineering.nyu.edu/> and Bergen<https://urldefense.proofpoint.com/v2/url?u=http-3A__158.39.77.214_&d=DwIFAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=yZMPY-APGKyVIX7HgQFZJA&m=OHg27uJzPTMAWC-xp85HQBTXU20vf51f8NK1LZSMOrI&s=izPOtOdUodNca2blPUROOCOyVE9jeDWgW_cRaTNzLlk&e= > both run rebuilders now. I read it very quickly but I didn't see tons of base system packages in those rebuilders, and those are the ones we are rebuilding, so we might be alone for a while but at least it's a step in the right direction. I have some questions: * What infrastructure are the two universities using today? * What are the infrastructure requirements for a Debian rebuilder by Microsoft today? * What is the governance of the rebuilders? Is this a project part of Debian CI or is this something else? Are the rebuilders part of the DSA infrastructure? We also have some packages we build and publish via packages.microsoft.com. Virtually all of those are Microsoft software built by Microsoft, but there is at least one rebuild there (Moby) which we could potentially also publish in-toto metadata for. What would you suggest we do as next steps? Thanks, JMP ----- End forwarded message -----
signature.asc
Description: PGP signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
