DFFML Rolling Alice: Engineering Logs: Volume 0: Architecting Alice, 24 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Architecting Alice: Volume 0: Part 86: Rolling an OS

Description

https://github.com/intel/dffml/discussions/1406#discussioncomment-3710510

A

All right welcome back, okay, I couldn't help myself. Obviously it's a little bit early, um no more blue screens, please so, uh basically to recap:.

A

I've been trying to install Linux uh since about June or May.

A

um And so what I would like is for um our good friend Gabe here to provide us with some binaries hot off the press? Okay, so what are we going to do so? I woke up and I saw tweet from Gabe I woke up around 4 40 10 in the morning and I thought.

A

Oh no um I'm in a Twitter thread with Matthew Garrett who's doing a weekend project and and so I thought we need to make things things things things things should happen fast right um so uh and then I saw Luke um and I saw Luke. Saying: okay, look. You guys are up, okay, um all right, yeah Yeah, so basically um I thought. Why don't we just go ahead? Luke said something about chain guard here and then there was some discussion which paralleled some of what we talked about yesterday. But I.

A

Don't think this video happens, it's I'm not sure. So, basically I mentioned what we were doing and then I saw oh I. Guess it's gone. Okay well, I saw Luke, say something so that made me think I wonder because because Matthew says Matthew says so what Matthew says is basically hey.

A

How about you know we uh make it really easy for people to run these signal relays? um Well, wouldn't it be great, if uh you know we had some remote access station abilities, um but okay, so yeah, yeah, yeah yeah I mean the remote attestation in the container is a different thing. We're not going to talk about that right now, but I think you know we're talking about the base OS.

A

So um so the thing is, let's see so, let's see, let's see what do we need to do to make this happen? I mean I, don't know if they're packaging so so question one is: um let's throw a TPM and SSI service on there did I already sit without an SSI service, so that's the fun part too. So, basically, we can just throw whatever the hell we want in here, and you know what else I realized.

A

um We have our handy dandy, USB somewhere that we made and there's another computer um I still don't have that 3.5 millimeter.

A

Cable, though so.

A

A

That means I have to reboot this machine and and I don't want to. I would like to be able to do this well and scream stream screen in case I forget something foreign.

A

You know why don't we just spin up a VM, all right? Okay, okay, you know what I can pay for a VM like a few minutes.

A

Okay, it's a thing. It's a thing: people do it. People pay for stuff. It's not a big deal.

A

uh Outside the TCP google.com.

A

Okay, let's just give us a service.

A

San Francisco.

A

Okay, and what are we gonna? Do? Let's go Debian?

A

Oh, let's go fedora, okay, because we're already doing through it. That means we can just install. Basically, that means we don't have to deal with this much stuff. I'm just going to download we're. Just gonna fix inflation, inflation. Oh no, inflation doesn't in inflation. Inversely affects visual ocean droplets.

A

Okay, um I, don't know if I have any of these all right so time for a new one.

A

No I don't have that one do I. Have that one. We probably have this one right.

A

Okay, but we have this one, you have the key. Who knows what we made the password?

A

Okay, um oh you know, and let's just actually make this like a little bit- beefier. Okay. Hopefully this doesn't take us too long, maybe gigabyte.

A

Let's get four CPUs, okay, all right, so this will cost us almost 10 cents. All right, we're running up the bill here.

A

A

And I think it's going to make a slug. It just prove the First Column. So.

A

A

A

Let's see, can we get in we're in wonderful, okay, so um all right, fantastic! Oh my God. Look at that! Look at that! It's so easy! Oh my God!

A

A

This really makes you want to pay people to just provide you with the hardware but um I'm persistent. So you know, um let's just get back to what we were doing. We gotta stay focused. So uh what what would I like? Well I would love for Gabe to give us some of these SSI service binaries right, and why would I like that? Well, uh that would be fantastic because then we can go ahead and roll the SSI service in and have it auto started.

A

So we can do the title of this video, which is decentral, Alice, decentralized, decentralis, decentralis, decentralis, so decentralis, Alice, Os, decentralis, Os decentralis, some decent, decent Dallas OS and it's decentralized decent trials, OS! Okay, so uh it sounds kind of like some fake made up Latin, okay, um which is exactly what happened there. So let's go and find out how we use upload artifact.

A

But now myself, I can know myself, I'm obviously very excited about this. Can you imagine, um can you imagine if we could just roll OS images on the Fly Like This, just I would love it.

A

It's too exciting I can't even sleep. It's so exciting.

A

The question is: go install mage, build okay, so where is where build? Build, build, go tags, okay,.

A

um Okay, so where do the binaries come out? Building tests, task or CBT Mage test? Okay, so manage file, has CI test from CI test run tests run Docker compose build up, Docker compose okay. So we want the docker compose file so where's the compose file uh build uh doctor compose okay, so context, okay, Swagger serve serve command command, Okay, so command is serve.

A

A

App okay, so this says output explicitly.

A

Two doctor exercise service, so I think if we don't.

A

Depends on Jaeger so do a lot of people. um Let's see.

A

Okay, decent Trust.

A

Operating system would be so much.

A

A

A

Ssi service, okay, so what am I gonna do I'm, just like I, don't even I, don't even I, don't I don't want to build, go I, don't want to build go so what am I going to do? I'm gonna patch, the uh main CI job for the SSI service, so that it just uploads golang binaries for us every time and then every time that good old game makes a change or anybody else makes change we're just going to get a fresh binary.

A

So um that way we can always have the most up-to-date stuff with SSI service. So um I would like to understand, see. Look now we're burning, we're burning! Look we burned through a hole like.

A

A

Well, we don't want you, you too Okay, so.

A

A

I, just I don't want to know what the binary name is. Gary called I'm, really confused.

A

Maybe it's just I'll install it.

A

A

Get built by default.

A

A

A

Service command.

A

So I think by default it just builds to something called command, because if you don't specifically name something.

A

Believe go Lang just builds.

A

Yeah, so what is it and then? What is the build stage? Do yeah to manage, build.

A

A

So go build tags and then so three dots with building means build everything. So I'm just kind of assuming.

A

So push branches main purpose, for instance- mean all right. So let's just go ahead and give it a shot right. So we're gonna.

A

Mm-Hmm, okay, so, let's see so we're uh adding so there's a Code, Cub upload and now we're just adding this upload artifact at the end of the file here and we're going to see the path is.

A

Building tags outside should be doing okay, so we execute mage, build.

A

You should build this stuff, so.

A

Okay, I'm gonna put command. Let's find out what happens so, let's see so we always take a look at the commit style of previous books and projects so, for example, uh very helpful to go. So let's see what you know, what what kind of commits does this look like? Okay, basically, there's no structure, so we can write whatever the hell we want.

A

um Okay so uh provide development, builds as foreign.

A

Built runners post.

A

A

Let's do centralis, oh it's decent, trellis, sorry, okay, fantastic Okay, so and then let's go find Luke's Creek.

A

What's going on.

A

A

A

Oh yeah I know I just saw this and it reminded me of the SSI service. Wait you're, not even involved in that I. Don't know why this reminded me of that.

A

I'm confusing Luke and Gabe that's what's happening.

A

Well, it's okay! It's early! The point is we're gonna, we're gonna. um The point is hopefully no blue screen. So oh and solar pump, okay, so.

A

Let us do what we were doing. Okay, so.

A

Okay, so we'll try to do this full shebang here. um So first thing I'm going to do is uh these are at Dash m d d x.

A

A

A

Scratch messages authorized keys, okay, so the cat got a search.

A

A

A

So we're going to create the dot SSH directory, we're going to add our key to the authorized key file in the in the in the dot SSH directory and then we're going to ssh in as our new user actually not quite yet, because first we need to give us pseudo, so I should have done. We should use a mod and I'm using I'm, using this machine and doing every command so that if I fire up another machine, um it'll be it'll, be fine. Okay, so group pseudo does not exist.

A

So let's try wheel, Maybe Okay, so.

A

A

Okay, so this is the magic text, so we want to.

A

So basically, what we're going to do is we're going to say.

A

Percent pseudos are basically a bind and replace any lines that start with percent pseudo and make them say and no password. Please um and.

A

We're going to do this in in place of Dash I, okay and we're going to do it to Etsy two doors or.

A

Unexpected, okay, so right doesn't like these.

A

A

A

A

Terminated s expression.

A

Let's just look at the file.

A

A

There's no pseudo and I thought okay, so this makes it easy. Let's just add this to the end of the file. I have never done. Okay. um Definitely do here, editing the line just add the new line at the end of the file or whatever do that.

A

um Okay, yeah, that's a much better approach. Oh man messing around with all these SCD commands.

A

Okay, so let's just put it in there.

A

Okay in my file.

A

All right, okay! So now it's in there! So now.

A

Okay, so now, let's ssh in as my user.

A

Okay, fantastic pseudo, apt, okay,.

A

Upgrade Dash y uh cat: oh we're on Fedora: let's do a dnf grade.

A

A

Splendid, okay, so um U curium is the first thing we need here. Okay, I'm glad we got a fast one. um Oh it's suck, so it looks like when you don't do windows too, but that we don't need that we have our soon to be invented. Decentralis, OSU, centralis or while not invented rolled, doesn't want to take anything to come up with that idea.

A

um So, let's see.

A

Yeah okay, so what did we want? Again? Oh, let's go download Okay. So let's create a CH root. See you true! Okay! So let's make a CH root.

A

Oh I guess it's already in a we're already under.

A

We're already recording this, so it's being double reported so.

A

A

I'd speak triple recruit, so we have this stream. We have the stream of the local terminal and then we have this stream of the remote terminal. Okay, interesting.

A

All right, so what do we need to do? We need to download, we probably want like admin or something.

A

Because we can run containers now that we have like a proper Linux distro. So we can just do this. The right way kernel core, compare that package I want that. Okay! So where are kernel core sshd, okay, so there's a few things or not uh assistant games.

A

So there's a few things that are going to be extra important for a true OS, okay and there's the TPM right. Okay. So what? What does? um What does Matthew? What was that conversation was around the TPM, so where's, our Droid, okay, so SSI service, TPM.

A

Okay, they're running 3.2, so that's good and then uh I didn't pull request. The name Branch didn't run.

A

A

All right so we're going to take user space from wolfen kernel from Fedora Will Roll in um SSI service binaries.

A

To auto start on boot and see what we can do about TPMS, okay,.

A

A

Let's see if this is even reasonably feasible.

A

I, don't even know if I have a TPM.

A

The door is shin, binary has already been signed with access yeah, so I'm not entirely up to date on the whole secure boot discussion.

A

Oh look: look who it is.

A

That's right, yeah, a small world so.

A

Sweet Jesus tell me this is not this branch is 666. Come on it's fine! Oh please, please! Okay, please I was like. Please tell me, please tell me we're now running this out of Matthew's old repo, then that's what's signed. Please please tell me, that's not the case.

A

That can't possibly be the case right.

A

A

Okay, complying with PE authe technical specifications.

A

Generated key has some secure bit so I'm, trying to figure out whether we can do the secure boot train here in any sort of reasonable way.

A

So I don't know if we're going to use grub, so this creates a key.

A

And then we'll probably need to sign.

A

A

All right well, we'll see I'm. Definitely not okay, I mean realistically I'm, never gonna get to this, but there's seldom do we get to the point where that happens so.

A

A

A

On the internet so kind of not really it within the draw model to care.

A

So yeah, okay, so then we were going.

A

To pull request, okay, so, let's just like to this.

A

Do some trellis.

A

A

So uh let's grab hot man.

A

Okay, so podman is basically like Docker but uh less tied to that company. um So.

A

A

A

And now I have to go. This is uh this? Is KVM so I mean it's not a huge deal.

A

Look at that! That's the virtualization! Thank you very much all right, so pogman qemu X.

A

What else do we need Earl, tar.

A

Yeah, let's just call that good.

A

Decides to install a lot of cute emus, which is fine I've, always wondered if the qemu BNC over websocket works. If anybody's got a network, I'm very curious I have never been able to make it work. I really wanted to work with this I think it's a fedora or red hat project that does the websockets, which that's the client-side version, because then you could have. Basically you know you could you could you could web sock it pop proxy?

A

All of the the display traffic? You could do that over something more interesting like a webrtc channel, but I haven't been able to make it work over websockets in the first place. So.

A

Okay, let's write our Docker file: um I'm sorry, Dr Paul looked like so van Docker file, Okay, so.

A

From let's check out these chain guard images.

A

Where there's not like open.

A

Excuse me excuse me.

A

Does that mean I can't use these.

A

A

A

I don't understand.

A

How to use chain guard images.