Chaos Computer Club - recent events feed

During the last year, I have spent several months on a project, that was sponsored by a grant from the NLnet NGI0 initiative. It is about an operating system, that only has packages that can be reproduced anywhere anytime bit-by-bit. I call it R-B-OS - the Reproducible-Builds-Operating-System. Last year when we had https://events.opensuse.org/conferences/oSC24/program/proposals/4378 , most of the work was still ahead. Now it is completed and I can tell how it went. I'll tell about the journey. And I'll tell about the result. RBOS has some unique properties: - The collection of sources are defined by a single hash, and so are the binaries produced from it. It is a 1->1 mapping. - When I change a toolchain package (e.g. gcc), I can let it rebuild and see exactly what changed in other places. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

An update on Aeon Desktop by Richard Brown. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

“Der moderne Faschismus kommt digital”, sagen manche. Wie funktionieren aber eigentlich KI oder LLMs (Large Language Model), was können sie und was können sie insbesondere nicht? Welche Ideologien von (rechten) Techbro-Oligarchen wie Elon Musk, Peter Thiel, Sam Altman und Co. stehen dahinter? Werden wir alle bald arbeitslos oder entscheidet KI sogar über Abschiebungen oder Gerichtsprozesse? Wie viel Energie und Wasser wird dafür verbraucht? Und wie wird dadurch Macht auf die konzentriert, die diese Systeme kontrollieren? Language: DE Translation: YES Recording: YES How do AI and LLMs (Large Language Model) work, what can they do, and what can't they do? What ideologies of techbro-oligarchs like Elon Musk, Peter Thiel, Sam Altman, and others are behind them? Are we all going to be unemployed soon? Will AI decide on deportations and court cases? How much energy and water will this consume? And how will this concentrate power in the hands of those who control these systems? Language: DE Translation: YES Recording: YES Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://c3voc.de

Psychedelisch Assistierte Psychotherapie (PAT) erlebt nach jahrzehntelanger Verdrängung ein erstaunliches Comeback. Forschende sprechen von einer Renaissance, Medien berichten von Durchbrüchen. Was einst als riskant galt, wird zunehmend ernst genommen. Doch kann ein Trip wirklich heilen? Der Vortrag verbindet Forschung mit Alltag und zeigt, wie Psychedelika im Gehirn wirken und in der Therapie helfen können. Turn on, tune in, drop by :) Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://c3voc.de

SUSE Package Hub delivers open source packages to enterprise users in combination with SUSE Linux Enterprise Server. This talk covers the basic understanding how Package Hub is designed to work since it is sharing a collection of same sources with the corresponding openSUSE Leap version. Furthermore we will show the planned future, what is going to change, and how to contribute. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Overview of Git package workflow with OBS Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Open source software is powering global innovation. In less developed regions, it's not just technology but a catalyst for closing the digital divide and fueling economic and social progress. This session explores how open source software goes beyond just coding as it creates real opportunities and positive change in the world’s least developed areas. For software developers in underserved regions, open source software offers free access to advanced technologies. This empowers them to build innovative IT solutions tailored to their communities’ unique needs. I will highlight the many benefits of adopting and customizing open source software in developing countries. These include lower IT costs for small businesses and organizations, and the ability to repair and reuse older computers and devices. By extending the life of hardware, open source software helps reduce electronic waste and environmental harm caused by discarded proprietary technology. Open source also boosts digital literacy and encourages collaboration and contribution within local tech communities, helping to bridge technology gaps. Using real examples from Africa, this session will show how open source projects are transforming education, healthcare, and other vital sectors, while helping to close the digital divide. Attendees will learn how their open source projects and contributions can create meaningful economic and social impact, especially in underserved and remote communities. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

This session explores the utilization of parallelism and rolling updates within Ansible playbooks to expedite deployment processes and facilitate faster releases. As organizations strive for agility and efficiency in their software delivery pipelines, optimizing deployment strategies becomes crucial. By leveraging Ansible's parallel execution capabilities and implementing rolling updates, teams can reduce deployment times and minimize downtime, thereby enhancing overall release velocity. This session provides insights into the benefits and techniques of employing parallelism and rolling updates in Ansible playbooks to achieve swift deployment and accelerate software releases. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Do you want to detect threats real-time and easily search logs to find relevant information? By default, incoming log messages are treated in log management apps as one long string. This is good enough if you just want to store logs. However, if you also want to act on log messages, you need more structured information. Syslog-ng and other applications also let you parse log messages. While parsing structured logs, like JSON, is easy, unstructured logs need a lot of work. This is where sequence can help you: if you have enough logs to analyze, it can automatically generate parser rules for syslog-ng and LogStash. Name-value pairs (sometimes also called “macros”) are probably one of the most useful parts of syslog-ng. Macros have been a core feature of syslog-ng since the beginning: incoming log messages were parsed by syslog-ng and various fields (priority, facility, date, program, PID and message) were stored into name-value pairs. You could use these to reformat log messages or use these values in file names. Without additional parsing, syslog-ng treats the message part of a log message as one long string. While this might be valid in some use cases, many log messages look like an almost complete English sentence with some variable parts in it. Just think about SSH login messages: they include the username, the source IP and port, and the login method embedded in a sentence. You might want to create an alert in syslog-ng for such messages (for example, if a root user logs in). However, if the whole message is a single string, you cannot do that. PatternDB can find important information in unstructured log messages, like the above-mentioned SSH login message, and create name-value pairs from the information it finds. PatternDB rules are easier to write than regular expressions and also need less resources to run. There are various parsers for structured log messages as well, like the CSV, JSON and XML parsers. You can also combine these and build really complex parsers. Sometimes, the syslog header might be missing from log messages, so you need to create a parser for the whole message. Message parsing and name-value pairs give you a lot more flexibility when it comes to filtering or templating log messages. For example, you can send an alert to Slack when someone logged in as a root user through SSH, or you can forward two important fields from an extremely long log message to save network bandwidth and disk space. You can use it to hide sensitive information and send only what is required to various destinations. Sequence-RTG allows you to automatically generate parser rules for syslog-ng and LogStash. Creating parser rules from scratch is a painful process. However, if you have enough log messages to analyze, sequence can do the heavy lifting for you. Of course, you might need to rename some of the name-value pairs, but that is a lot easier. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Recent global political events have up ended the global order. Coupled with the EOL of Windows 10, does Desktop Linux have a shot at the mass replacement of Windows in the corporate and government sectors? This wide ranging talk will cover the reasons why I think it does, and how we might achieve this goal. I believe it is easier than we think. **#Endof10 event** Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

FragDenStaat, bekannt für ihre unermüdliche Arbeit für Transparenz und Gerechtigkeit, gegen Überwachung und Staatswillkür, bei uns im Zelt! Auch Umweltgerechtigkeit ist eine Frage der Informationsfreiheit, und Informationen sind Grundlage jeder guten Kampagne. Sei es zur Räumung in Lützerath, Wasserverschmutzung von Tesla, Lobbyarbeit, Braunkohle-Deals oder dem Wasserverbrauch der großen Konzerne. Kommt und lernt den KlimaHelpDesk kennen! Language: DE Translation: YES Recording: YES FragDenStaat, known for their tireless work for transparency and justice, against surveillance and state despotism, will be joining us in our tent! Climate justice is also a matter of freedom of information and information is the basis of every good campaign. Whether it's the eviction in Lützerath, water pollution by Tesla, lobbying, brown coal deals, or the water consumption of large corporations. Come and get to know the ClimateHelpDesk! Language: DE Translation: YES Recording: YES Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://c3voc.de

### Introduction: The Need for Secure and Reliable Booting In the ever-evolving landscape of Linux distributions, security and boot reliability have become paramount concerns. Traditionally, the boot process relied on separate kernel and initrd components, leading to potential vulnerabilities and complexities. This presentation delves into the journey of integrating a more robust and secure boot mechanism by leveraging the Unified Kernel Image (UKI). ### Static and Signed Initrd: Establishing a Foundation for Integrity We will begin by outlining the critical need for a static and signed initrd within modern Linux systems. The dynamic nature of traditional initrd generation can introduce vulnerabilities, as the contents are often generated at boot time, potentially exposing the system to tampering. By moving towards a static initrd, we achieve a higher level of predictability and security. Signing this static initrd ensures its integrity, preventing unauthorized modifications and bolstering the system's overall protection. ### Building and Distributing Static Initrd in openSUSE A brief overview of the practical steps involved in building a static initrd will be provided. We will explore the methods employed to streamline this process and integrate it seamlessly into the openSUSE distribution. ### The Unified Kernel Image (UKI): Definition and Advantages The core focus of this presentation will be the Unified Kernel Image (UKI). We will define what a UKI is, explaining its structure and the benefits it offers. This approach significantly simplifies the boot process, enhancing security and reducing the attack surface. ### Building in openSUSE: Challenges and Solutions for Enhanced Reliability We will then showcase the specific work undertaken within the openSUSE distribution to build and integrate UKIs. This includes the process to build from the open build service, and the necessary tooling to manage them and the bootloader configuration. We will discuss the challenges encountered and the solutions implemented to ensure a smooth distribution from the OBS to UKI-based booting system. But also features like addons, snapshots or profiles. This integration allows for efficient distribution and management of UKIs, ensuring consistent and reliable boot environments across various openSUSE installations. ### Future Directions and Conclusion: Towards More Robust Boot Environments Finally, we will discuss the future direction of UKI implementation in openSUSE, including potential enhancements. This conference aims to provide a comprehensive overview of the UKI implementation in openSUSE, offering valuable insights for system administrators, developers, and security enthusiasts alike. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

How is Slowroll doing? What happened in the last year? What challenges are ahead? Let me tell ya... Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

The Linux kernel scheduler is a critical component, profoundly impacting system performance and responsiveness. Traditionally, changing the scheduler has involved recompilation, rebooting, or complex kernel module management – a significant barrier for experimentation and fine-grained performance tuning. SchedKit dramatically simplifies this process, enabling users to dynamically switch between schedulers at runtime, without reboots or kernel modifications, opening up new possibilities in customizing kernel scheduling for the specific usecase. This talk introduces SchedKit, a new open-source project leveraging the power of eBPF and the sched_ext framework. SchedKit allows users to leverage custom Linux schedulers as standard OCI (Open Container Initiative) images. These scheduler containers are then launched and managed by the user's preferred container runtime (e.g., Docker, Podman, containerd). Through the magic of eBPF and sched_ext, SchedKit seamlessly attaches these containerized schedulers to the running kernel, changing the existing scheduling policy. Thanks to `schedctl` we can automatically download a new scheduler, run it, and have it attached to all the subsequent processes. ... and it's of course available on openSUSE! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

openSUSE Leap is a "traditional" community distribution built on binary packages from SLES. In this session, we'll dive into the recently released openSUSE Leap 16.0 Beta, exploring its new features and changes. We'll also cover the migration process from Leap 15, including any challenges or considerations to keep in mind. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Last three years I have talked at this conference about SUSE’s plans, the products to come, as well as the technology included. As over the time the plans are adjusted, this session will summarise the state of the matters, SUSE's plan for upcoming product releases and, most importantly, what it means for openSUSE Leap and Micro. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Using configuration management like SALT or ansible for servers or more or less simple applications is standard practice in the industry. But, what if we talk about complex systems with special configurations and complex interactions? In the production industry we talk about "digital twins", which enables faster development and better integrations. For IT systems we talk now about a "digital blueprint" for our systems. Right now it's a vision we are evaluating - it should enable us to do "one-click-installations" of complex landscapes as well as generating a human readable description of the architecture. It hopefully shifts us from "define an architecture and implement something similar manually" or "sketch the architecture of an existing system" to a system synchronized with the architecture. A big part is the structured, templated description of the system and conventions or defaults how systems typically look like. We'll look at some already existing building blocks useful for implementing the vision, but we'll also sketch some missing parts or ideas to raise the full potential of our vision. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

When using tools like RPM or Zypper for updating packages, there is a risk of incomplete updates or breaking the running system. To overcome these challenges, we have developed **container-snap**, a prototype plugin designed to deliver **atomic OS updates** that are fully applied or rolled back without compromising the system's state. **container-snap** leverages OCI images as the source for updates and integrates seamlessly with openSUSE’s [tukit](https://github.com/openSUSE/transactional-update) for transactional OS updates. By utilizing **Podman’s btrfs storage driver**, it creates bootable btrfs subvolumes directly from OCI images, effectively turning them into atomic OS snapshots. This allows you to build OS images using familiar tools like Docker or Buildah and deploy the container image on your host. This lightning talk covers the following topics: - The `container-snap` architecture and implementation details - Main development challenges and solutions - Lessons learned in bridging container tech and OS updates - A live demo showcasing atomic updates in action Join this session to learn more about how to boot from an OCI image without bricking your system! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

In this presentation, I will give an introduction to the projects that the Future Technology team is working on and report on the current status. Some of the bigger topics are: - Update on Full Disk Encryption with TPM and Fido2 - Adding grub2-BLS support: - YaST2 - Images (including with full disk encryption) - Making it the default - Adding FDE+TPM support to YaST2 - New features for transactional-update and rework of /etc handling - systemd-sysext on MicroOS - systemd-pull and OBS - New tools (e.g. sndiff) - And much more Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Are you in search of RPM-based CI for your project hosted on GitHub or GitLab? Allow us to introduce [Packit](https://packit.dev/), the upstream integration tailored specifically for RPM distributions. Initially conceived for Fedora, Packit now extends its capabilities to encompass the entire RPM family. In this presentation, we will explore Packit and how to use it for your project. Attendees can expect an examination of: * **RPM Builds and Testing**: Learn how Packit simplifies the process of running RPM builds and conducting tests directly on pull requests. * **RPM Repositories**: Discover how Packit allows you to provide your users with dependable RPM repositories, featuring builds sourced from every new commit or release. This functionality ensures users receive a consistent and up-to-date state of the project. * **Progress of Automated Upstream Version Updates**: As part of the [Google Summer of Code project last year](https://summerofcode.withgoogle.com/archive/2024/projects/dC93EbFr), we are also working on supporting the automatic syncing of new upstream versions to the Open Build Service (OBS). Uncover the benefits of this automated approach in simplifying package maintenance and ensuring alignment with upstream developments. Come and see! Feedback and collaboration are more than welcome! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

In this talk, I’ll share my personal experience using Linux as a student, from high school to university. I’ll talk about what it is like, what challenges I face, and how I manage day-to-day study tasks with Linux. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

When proprietary products are discontinued or bought up by competitors, your own (decision-making) freedom can quickly become precarious. A discontinued product forces you to migrate, incurs costs, and imposes unwelcome decisions. Not so with open source software: it offers me the freedom to develop the code further at any time, either on my own or with new partners, and to set up new support chains. The freedom not to have to migrate and the freedom not to have to work with an unpleasant service provider. Even drastic changes in product and business strategy can be avoided by taking matters into your own hands. At least that's the theory. But does it work in practice? This report is about a very recent case: about software that wasn't supposed to die, and a team that absolutely wanted to continue. It also shows where theory meets practice and the headwinds you have to face when you just go for it. But: a community has to do what a community has to do. And that can also mean: let's fork! Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Uyuni offers two powerful APIs (XMLRPC and JSON) to integrate additional third-party applications. This talk demonstrates two integrations that allow users driving infrastructure automation: - an [Ansible collection](https://github.com/stdevel/ansible-collection-uyuni) that integrates Uyuni into Ansible and Event-driven Ansible. It allows controlling managed systems and enables users to continue using pre-existing Ansible environments such as AWX or Ansible Semaphore. Using this, fully automated patch management workflows are possible. - [a Terraform / OpenTofu provider MVP](https://github.com/svalabs/terraform-provider-uyuni) that can create resources within Uyuni I'd like to use this session to discuss how we can improve third-party integrations for Uyuni - e.g. by using the upcoming [OpenAPI](https://github.com/OAI/OpenAPI-Specification) / [Swagger](https://swagger.io/) functionality. This could speed-up development heavily. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

SELinux is a Mandatory Access Control (MAC) system that enhances a system's security by enforcing policy-based access control rules. For a long time openSUSE and SUSE have relied heavily on AppArmor as default MAC system. With the decision to switch to SELinux as default MAC on SLE 16 and openSUSE Tumbleweed, there are multiple challenges that we have to overcome to integrate SELinux into those distributions. This session will give an overview on the current state of SELinux in openSUSE and SUSE, the plans for the future and what it means for users. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

Rick Spencer has a passion for leading teams in the creation of amazing software. He strives to create clarity of vision, passion for quality, and user-centered decision making to both small and large software development teams. Rick is a General Manager with SUSE since January 2024. He has held positions at InfluxData, Canonical Ltd. and Microsoft Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de