hannes/hannes.robur.coop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

updated from main (commit 212884184b)

Browse source
This commit is contained in:
Canopy bot 2022-11-17 15:25:11 +00:00
parent 2a73e4a6c6
commit f0ab16e326
1 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
atom
View file

@ -1,5 +1,5 @@
<feed xmlns="http://www.w3.org/2005/Atom"><link href="https://hannes.robur.coop/atom" rel="self"/><id>urn:uuid:981361ca-e71d-4997-a52c-baeee78e4156</id><title type="text">full stack engineer</title><updated>2022-11-17T12:41:11-00:00</updated><entry><summary type="text">&lt;p&gt;fleet management for MirageOS unikernels using a mutually authenticated TLS handshake&lt;/p&gt;
</summary><published>2022-11-17T12:41:11-00:00</published><link href="Posts/Albatross" rel="alternate"/><content type="html">&lt;h2&gt;Deploying MirageOS unikernels&lt;/h2&gt;
</summary><published>2022-11-17T12:41:11-00:00</published><link href="/Posts/Albatross" rel="alternate"/><content type="html">&lt;h2&gt;Deploying MirageOS unikernels&lt;/h2&gt;
&lt;p&gt;More than five years ago, I posted &lt;a href=&quot;/Posts/VMM&quot;&gt;how to deploy MirageOS unikernels&lt;/a&gt;. My motivation to work on this topic is that I'm convinced of reduced complexity, improved security, and more sustainable resource footprint of MirageOS unikernels, and want to ease deployment thereof. More than one year ago, I described &lt;a href=&quot;/Posts/Deploy&quot;&gt;how to deploy reproducible unikernels&lt;/a&gt;.&lt;/p&gt;
&lt;h2&gt;Albatross&lt;/h2&gt;
&lt;p&gt;In recent months we worked hard on the underlying infrastructure: &lt;a href=&quot;https://github.com/roburio/albatross&quot;&gt;albatross&lt;/a&gt;. Albatross is the orchestration system for MirageOS unikernels that use solo5 with &lt;a href=&quot;https://github.com/Solo5/solo5/blob/master/docs/architecture.md&quot;&gt;hvt or spt tender&lt;/a&gt;. It deals with three tasks:&lt;/p&gt;
@ -79,7 +79,7 @@ $ pkg install solo5 albatross
&lt;p&gt;After five years of development and operating albatross, feel free to get it and try it out. Or read the code, discuss issues and shortcomings with us - either at the issue tracker or via eMail.&lt;/p&gt;
&lt;p&gt;Please reach out to us (at team AT robur DOT coop) if you have feedback and suggestions. We are a non-profit company, and rely on &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donations&lt;/a&gt; for doing our work - everyone can contribute.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/deployment" term="deployment"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:1f354218-e8c3-5136-a2ca-c88f3c2878d8</id><title type="text">Deploying reproducible unikernels with albatross</title><updated>2022-11-17T12:41:11-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;Re-developing an opam cache from scratch, as a MirageOS unikernel&lt;/p&gt;
</summary><published>2022-09-29T13:04:14-00:00</published><link href="Posts/OpamMirror" rel="alternate"/><content type="html">&lt;p&gt;We at &lt;a href=&quot;https://robur.coop&quot;&gt;robur&lt;/a&gt; developed &lt;a href=&quot;https://git.robur.io/robur/opam-mirror&quot;&gt;opam-mirror&lt;/a&gt; in the last month and run a public opam mirror at https://opam.robur.coop (updated hourly).&lt;/p&gt;
</summary><published>2022-09-29T13:04:14-00:00</published><link href="/Posts/OpamMirror" rel="alternate"/><content type="html">&lt;p&gt;We at &lt;a href=&quot;https://robur.coop&quot;&gt;robur&lt;/a&gt; developed &lt;a href=&quot;https://git.robur.io/robur/opam-mirror&quot;&gt;opam-mirror&lt;/a&gt; in the last month and run a public opam mirror at https://opam.robur.coop (updated hourly).&lt;/p&gt;
&lt;h1&gt;What is opam and why should I care?&lt;/h1&gt;
&lt;p&gt;&lt;a href=&quot;https://opam.ocaml.org&quot;&gt;Opam&lt;/a&gt; is the OCaml package manager (also used by other projects such as &lt;a href=&quot;https://coq.inria.fr&quot;&gt;coq&lt;/a&gt;). It is a source based system: the so-called repository contains the metadata (url to source tarballs, build dependencies, author, homepage, development repository) of all packages. The main repository is hosted on GitHub as &lt;a href=&quot;https://github.com/ocaml/opam-repository&quot;&gt;ocaml/opam-repository&lt;/a&gt;, where authors of OCaml software can contribute (as pull request) their latest releases.&lt;/p&gt;
&lt;p&gt;When opening a pull request, automated systems attempt to build not only the newly released package on various platforms and OCaml versions, but also all reverse dependencies, and also with dependencies with the lowest allowed version numbers. That's crucial since neither semantic versioning has been adapted across the OCaml ecosystem (which is tricky, for example due to local opens any newly introduced binding will lead to a major version bump), neither do many people add upper bounds of dependencies when releasing a package (nobody is keen to state &amp;quot;my package will not work with &lt;a href=&quot;https://erratique.ch/software/cmdliner&quot;&gt;cmdliner&lt;/a&gt; in version 1.2.0&amp;quot;).&lt;/p&gt;
@ -110,7 +110,7 @@ $ pkg install solo5 albatross
&lt;p&gt;To conclude, we managed within a month to develop this opam-mirror cache from scratch. It has a reasonable footprint (CPU and memory-wise), is easy to maintain and easy to update - if you want to use it, we also provide &lt;a href=&quot;https://builds.robur.coop/job/opam-mirror&quot;&gt;reproducible binaries&lt;/a&gt; for solo5-hvt. You can use our opam mirror with &lt;code&gt;opam repository set-url default https://opam.robur.coop&lt;/code&gt; (revert to the other with &lt;code&gt;opam repository set-url default https://opam.ocaml.org&lt;/code&gt;) or use it as a backup with &lt;code&gt;opam repository add robur --rank 2 https://opam.robur.coop&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Please reach out to us (at team AT robur DOT coop) if you have feedback and suggestions. We are a non-profit company, and rely on &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donations&lt;/a&gt; for doing our work - everyone can contribute.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/opam" term="opam"/><category scheme="https://hannes.robur.coop/tags/deployment" term="deployment"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:0dbd251f-32c7-57bd-8e8f-7392c0833a09</id><title type="text">Mirroring the opam repository and all tarballs</title><updated>2022-10-11T12:14:07-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;How to monitor your MirageOS unikernel with albatross and monitoring-experiments&lt;/p&gt;
</summary><published>2022-03-08T11:26:31-00:00</published><link href="Posts/Monitoring" rel="alternate"/><content type="html">&lt;h1&gt;Introduction to monitoring&lt;/h1&gt;
</summary><published>2022-03-08T11:26:31-00:00</published><link href="/Posts/Monitoring" rel="alternate"/><content type="html">&lt;h1&gt;Introduction to monitoring&lt;/h1&gt;
&lt;p&gt;At &lt;a href=&quot;https://robur.coop&quot;&gt;robur&lt;/a&gt; we use a range of MirageOS unikernels. Recently, we worked on improving the operations story thereof. One part is shipping binaries using our &lt;a href=&quot;https://builds.robur.coop&quot;&gt;reproducible builds infrastructure&lt;/a&gt;. Another part is, once deployed we want to observe what is going on.&lt;/p&gt;
&lt;p&gt;I first got into touch with monitoring - collecting and graphing metrics - with &lt;a href=&quot;https://oss.oetiker.ch/mrtg/&quot;&gt;MRTG&lt;/a&gt; and &lt;a href=&quot;https://munin-monitoring.org/&quot;&gt;munin&lt;/a&gt; - and the simple network management protocol &lt;a href=&quot;https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol&quot;&gt;SNMP&lt;/a&gt;. From the whole system perspective, I find it crucial that the monitoring part of a system does not add pressure. This favours a push-based design, where reporting is done at the disposition of the system.&lt;/p&gt;
&lt;p&gt;The rise of monitoring where graphs are done dynamically (such as &lt;a href=&quot;https://grafana.com/&quot;&gt;Grafana&lt;/a&gt;) and can be programmed (with a query language) by the operator are very neat, it allows to put metrics in relation after they have been recorded - thus if there's a thesis why something went berserk, you can graph the collected data from the past and prove or disprove the thesis.&lt;/p&gt;
@ -224,7 +224,7 @@ _stack.V4V6) (_ : sig end) (Management : Mirage_stack.V4V6) = struct
&lt;p&gt;When you configure &lt;a href=&quot;https://grafana.com/docs/grafana/latest/getting-started/getting-started-influxdb/&quot;&gt;Grafana to use InfluxDB&lt;/a&gt;, you'll be able to see the data in the data sources.&lt;/p&gt;
&lt;p&gt;Please reach out to us (at team AT robur DOT coop) if you have feedback and suggestions.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/deployment" term="deployment"/><category scheme="https://hannes.robur.coop/tags/monitoring" term="monitoring"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:b8f1fa5b-d8dd-5a54-a9e4-064b9dcd053e</id><title type="text">All your metrics belong to influx</title><updated>2022-03-08T11:26:31-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;Finally, we provide reproducible binary MirageOS unikernels together with packages to reproduce them and setup your own builder&lt;/p&gt;
</summary><published>2021-06-30T13:13:37-00:00</published><link href="Posts/Deploy" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
</summary><published>2021-06-30T13:13:37-00:00</published><link href="/Posts/Deploy" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
&lt;p&gt;MirageOS development focus has been a lot on tooling and the developer experience, but to accomplish &lt;a href=&quot;https://robur.coop&quot;&gt;our&lt;/a&gt; goal to &amp;quot;get MirageOS into production&amp;quot;, we need to lower the barrier. This means for us to release binary unikernels. As described &lt;a href=&quot;/Posts/NGI&quot;&gt;earlier&lt;/a&gt;, we received a grant for &amp;quot;Deploying MirageOS&amp;quot; from &lt;a href=&quot;https://pointer.ngi.eu&quot;&gt;NGI Pointer&lt;/a&gt; to work on the required infrastructure. This is joint work with &lt;a href=&quot;https://reynir.dk/&quot;&gt;Reynir&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;We provide at &lt;a href=&quot;https://builds.robur.coop&quot;&gt;builds.robur.coop&lt;/a&gt; binary unikernel images (and supplementary software). Doing binary releases of MirageOS unikernels is challenging in two aspects: firstly to be useful for everyone, a binary unikernel should not contain any configuration (such as private keys, certificates, etc.). Secondly, the binaries should be &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;reproducible&lt;/a&gt;. This is crucial for security; everyone can reproduce the exact same binary and verify that our build service did only use the sources. No malware or backdoors included.&lt;/p&gt;
&lt;p&gt;This post describes how you can deploy MirageOS unikernels without compiling it from source, then dives into the two issues outlined above - configuration and reproducibility - and finally describes how to setup your own reproducible build infrastructure for MirageOS, and how to bootstrap it.&lt;/p&gt;
@ -282,7 +282,7 @@ _stack.V4V6) (_ : sig end) (Management : Mirage_stack.V4V6) = struct
&lt;p&gt;We are aware that the web interface can be improved (PRs welcome). We will also work on the rebuilder setup and run some rebuilds.&lt;/p&gt;
&lt;p&gt;Please reach out to us (at team AT robur DOT coop) if you have feedback and suggestions.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/deployment" term="deployment"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:331831d8-6093-5dd7-9164-445afff953cb</id><title type="text">Deploying binary MirageOS unikernels</title><updated>2021-11-15T11:17:23-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;Elliptic curves (ECDSA/ECDH) are supported in a maintainable and secure way.&lt;/p&gt;
</summary><published>2021-04-23T13:33:06-00:00</published><link href="Posts/EC" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
</summary><published>2021-04-23T13:33:06-00:00</published><link href="/Posts/EC" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
&lt;p&gt;Tl;DR: mirage-crypto-ec, with x509 0.12.0, and tls 0.13.0, provide fast and secure elliptic curve support in OCaml and MirageOS - using the verified &lt;a href=&quot;https://github.com/mit-plv/fiat-crypto/&quot;&gt;fiat-crypto&lt;/a&gt; stack (Coq to OCaml to executable which generates C code that is interfaced by OCaml). In x509, a long standing issue (countryName encoding), and archive (PKCS 12) format is now supported, in addition to EC keys. In tls, ECDH key exchanges are supported, and ECDSA and EdDSA certificates.&lt;/p&gt;
&lt;h2&gt;Elliptic curve cryptography&lt;/h2&gt;
&lt;p&gt;&lt;a href=&quot;https://mirage.io/blog/tls-1-3-mirageos&quot;&gt;Since May 2020&lt;/a&gt;, our &lt;a href=&quot;https://usenix15.nqsb.io&quot;&gt;OCaml-TLS&lt;/a&gt; stack supports TLS 1.3 (since tls version 0.12.0 on opam).&lt;/p&gt;
@ -326,7 +326,7 @@ _stack.V4V6) (_ : sig end) (Management : Mirage_stack.V4V6) = struct
&lt;h2&gt;Footer&lt;/h2&gt;
&lt;p&gt;If you want to support our work on MirageOS unikernels, please &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donate to robur&lt;/a&gt;. I'm interested in feedback, either via &lt;a href=&quot;https://twitter.com/h4nnes&quot;&gt;twitter&lt;/a&gt;, &lt;a href=&quot;https://mastodon.social/@hannesm&quot;&gt;hannesm@mastodon.social&lt;/a&gt; or via eMail.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/tls" term="tls"/><category scheme="https://hannes.robur.coop/tags/security" term="security"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:16427713-5da1-50cd-b17c-ca5b5cca431d</id><title type="text">Cryptography updates in OCaml and MirageOS</title><updated>2021-11-19T18:04:52-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;Home office, MirageOS unikernels, 2020 recap, 2021 tbd&lt;/p&gt;
</summary><published>2021-01-25T12:45:54-00:00</published><link href="Posts/NGI" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
</summary><published>2021-01-25T12:45:54-00:00</published><link href="/Posts/NGI" rel="alternate"/><content type="html">&lt;h2&gt;Introduction&lt;/h2&gt;
&lt;p&gt;2020 was an intense year. I hope you're healthy and keep being healthy. I am privileged (as lots of software engineers and academics are) to be able to work from home during the pandemic. Let's not forget people in less privileged situations, and let’s try to give them as much practical, psychological and financial support as we can these days. And as much joy as possible to everyone around :)&lt;/p&gt;
&lt;p&gt;I cancelled the autumn MirageOS retreat due to the pandemic. Instead I collected donations for our hosts in Marrakech - they were very happy to receive our financial support, since they had a difficult year, since their income is based on tourism. I hope that in autumn 2021 we'll have an on-site retreat again.&lt;/p&gt;
&lt;p&gt;For 2021, we (at &lt;a href=&quot;https://robur.coop&quot;&gt;robur&lt;/a&gt;) got a grant from the EU (via &lt;a href=&quot;https://pointer.ngi.eu&quot;&gt;NGI pointer&lt;/a&gt;) for &amp;quot;Deploying MirageOS&amp;quot; (more details below), and another grant from &lt;a href=&quot;https://ocaml-sf.org&quot;&gt;OCaml software foundation&lt;/a&gt; for securing the opam supply chain (using &lt;a href=&quot;https://github.com/hannesm/conex&quot;&gt;conex&lt;/a&gt;). Some long-awaited releases for MirageOS libraries, namely a &lt;a href=&quot;https://discuss.ocaml.org/t/ann-first-release-of-awa-ssh&quot;&gt;ssh implementation&lt;/a&gt; and a rewrite of our &lt;a href=&quot;https://discuss.ocaml.org/t/ann-release-of-ocaml-git-v3-0-duff-encore-decompress-etc/&quot;&gt;git implementation&lt;/a&gt; have already been published.&lt;/p&gt;
@ -392,7 +392,7 @@ _stack.V4V6) (_ : sig end) (Management : Mirage_stack.V4V6) = struct
&lt;h2&gt;Footer&lt;/h2&gt;
&lt;p&gt;If you want to support our work on MirageOS unikernels, please &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donate to robur&lt;/a&gt;. I'm interested in feedback, either via &lt;a href=&quot;https://twitter.com/h4nnes&quot;&gt;twitter&lt;/a&gt;, &lt;a href=&quot;https://mastodon.social/@hannesm&quot;&gt;hannesm@mastodon.social&lt;/a&gt; or via eMail.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:bc7675a5-47d0-5ce1-970c-01ed07fdf404</id><title type="text">The road ahead for MirageOS in 2021</title><updated>2021-11-19T18:04:52-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;A MirageOS unikernel which traces the path between itself and a remote host.&lt;/p&gt;
</summary><published>2020-06-24T10:38:10-00:00</published><link href="Posts/Traceroute" rel="alternate"/><content type="html">&lt;h2&gt;Traceroute&lt;/h2&gt;
</summary><published>2020-06-24T10:38:10-00:00</published><link href="/Posts/Traceroute" rel="alternate"/><content type="html">&lt;h2&gt;Traceroute&lt;/h2&gt;
&lt;p&gt;Is a diagnostic utility which displays the route and measures transit delays of
packets across an Internet protocol (IP) network.&lt;/p&gt;
&lt;pre&gt;&lt;code class=&quot;language-bash&quot;&gt;$ doas solo5-hvt --net:service=tap0 -- traceroute.hvt --ipv4=10.0.42.2/24 --ipv4-gateway=10.0.42.1 --host=198.167.222.207
@ -737,7 +737,7 @@ $ solo5-hvt --net:service=tap0 -- traceroute.hvt ...
&lt;p&gt;Motivation for this traceroute unikernel was while talking with &lt;a href=&quot;https://twitter.com/networkservice&quot;&gt;Aaron&lt;/a&gt; and &lt;a href=&quot;https://github.com/phaer&quot;&gt;Paul&lt;/a&gt;, who contributed several patches to the IP stack which pass the ttl through.&lt;/p&gt;
&lt;p&gt;If you want to support our work on MirageOS unikernels, please &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donate to robur&lt;/a&gt;. I'm interested in feedback, either via &lt;a href=&quot;https://twitter.com/h4nnes&quot;&gt;twitter&lt;/a&gt;, &lt;a href=&quot;https://mastodon.social/@hannesm&quot;&gt;hannesm@mastodon.social&lt;/a&gt; or via eMail.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/protocol" term="protocol"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:ed3036f6-83d2-5e80-b3da-4ccbedb5ae9e</id><title type="text">Traceroute</title><updated>2021-11-19T18:04:52-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;A tutorial how to deploy authoritative name servers, let's encrypt, and updating entries from unix services.&lt;/p&gt;
</summary><published>2019-12-23T21:30:53-00:00</published><link href="Posts/DnsServer" rel="alternate"/><content type="html">&lt;h2&gt;Goal&lt;/h2&gt;
</summary><published>2019-12-23T21:30:53-00:00</published><link href="/Posts/DnsServer" rel="alternate"/><content type="html">&lt;h2&gt;Goal&lt;/h2&gt;
&lt;p&gt;Have your domain served by OCaml-DNS authoritative name servers. Data is stored in a git remote, and let's encrypt certificates can be requested to DNS. This software is deployed since more than two years for several domains such as &lt;code&gt;nqsb.io&lt;/code&gt; and &lt;code&gt;robur.coop&lt;/code&gt;. This present the authoritative server side, and certificate library of the OCaml-DNS implementation formerly known as &lt;a href=&quot;/Posts/DNS&quot;&gt;µDNS&lt;/a&gt;.&lt;/p&gt;
&lt;h2&gt;Prerequisites&lt;/h2&gt;
&lt;p&gt;You need to own a domain, and be able to delegate the name service to your own servers.
@ -1012,7 +1012,7 @@ $ ocertify 10.0.42.2 foo.mirage
&lt;p&gt;I'd like to thank all people involved in this software stack, without other key components, including &lt;a href=&quot;https://github.com/mirage/ocaml-git&quot;&gt;git&lt;/a&gt;, &lt;a href=&quot;https://irmin.io/&quot;&gt;irmin 2.0&lt;/a&gt;, &lt;a href=&quot;https://github.com/mirleft/ocaml-nocrypto&quot;&gt;nocrypto&lt;/a&gt;, &lt;a href=&quot;https://github.com/haesbaert/awa-ssh&quot;&gt;awa-ssh&lt;/a&gt;, &lt;a href=&quot;https://github.com/mirage/ocaml-cohttp&quot;&gt;cohttp&lt;/a&gt;, &lt;a href=&quot;https://github.com/solo5/sol5&quot;&gt;solo5&lt;/a&gt;, &lt;a href=&quot;https://github.com/mirage/mirage&quot;&gt;mirage&lt;/a&gt;, &lt;a href=&quot;https://github.com/mmaker/ocaml-letsencrypt&quot;&gt;ocaml-letsencrypt&lt;/a&gt;, and more.&lt;/p&gt;
&lt;p&gt;If you want to support our work on MirageOS unikernels, please &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donate to robur&lt;/a&gt;. I'm interested in feedback, either via &lt;a href=&quot;https://twitter.com/h4nnes&quot;&gt;twitter&lt;/a&gt;, &lt;a href=&quot;https://mastodon.social/@hannesm&quot;&gt;hannesm@mastodon.social&lt;/a&gt; or via eMail.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/deployment" term="deployment"/><category scheme="https://hannes.robur.coop/tags/protocol" term="protocol"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:e3d4fd9e-e379-5c86-838e-46034ddd435d</id><title type="text">Deploying authoritative OCaml-DNS servers as MirageOS unikernels</title><updated>2021-11-19T18:04:52-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;MirageOS unikernels are reproducible :)&lt;/p&gt;
</summary><published>2019-12-16T18:29:30-00:00</published><link href="Posts/ReproducibleOPAM" rel="alternate"/><content type="html">&lt;h2&gt;Reproducible builds summit&lt;/h2&gt;
</summary><published>2019-12-16T18:29:30-00:00</published><link href="/Posts/ReproducibleOPAM" rel="alternate"/><content type="html">&lt;h2&gt;Reproducible builds summit&lt;/h2&gt;
&lt;p&gt;I'm just back from the &lt;a href=&quot;https://reproducible-builds.org/events/Marrakesh2019/&quot;&gt;Reproducible builds summit 2019&lt;/a&gt;. In 2018, several people developing &lt;a href=&quot;https://ocaml.org&quot;&gt;OCaml&lt;/a&gt; and &lt;a href=&quot;https://opam.ocaml.org&quot;&gt;opam&lt;/a&gt; and &lt;a href=&quot;https://mirage.io&quot;&gt;MirageOS&lt;/a&gt;, attended &lt;a href=&quot;https://reproducible-builds.org/events/paris2018/&quot;&gt;the Reproducible builds summit in Paris&lt;/a&gt;. The notes from last year on &lt;a href=&quot;https://reproducible-builds.org/events/paris2018/report/#Toc11410_331763073&quot;&gt;opam reproducibility&lt;/a&gt; and &lt;a href=&quot;https://reproducible-builds.org/events/paris2018/report/#Toc11681_331763073&quot;&gt;MirageOS reproducibility&lt;/a&gt; are online. After last years workshop, Raja started developing the opam reproducibilty builder &lt;a href=&quot;https://github.com/rjbou/orb&quot;&gt;orb&lt;/a&gt;, which I extended at and after this years summit. This year before and after the facilitated summit there were hacking days, which allowed further interaction with participants, writing some code and conduct experiments. I had this year again an exciting time at the summit and hacking days, thanks to our hosts, organisers, and all participants.&lt;/p&gt;
&lt;h2&gt;Goal&lt;/h2&gt;
&lt;p&gt;Stepping back a bit, first look on the &lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;goal of reproducible builds&lt;/a&gt;: when compiling source code multiple times, the produced binaries should be identical. It should be sufficient if the binaries are behaviourally equal, but this is pretty hard to check. It is much easier to check &lt;strong&gt;bit-wise identity of binaries&lt;/strong&gt;, and relaxes the burden on the checker -- checking for reproducibility is reduced to computing the hash of the binaries. Let's stick to the bit-wise identical binary definition, which also means software developers have to avoid non-determinism during compilation in their toolchains, dependent libraries, and developed code.&lt;/p&gt;
@ -1054,7 +1054,7 @@ $ orb build --twice --keep-build-dir --diffoscope &amp;lt;your-favourite-opam-pa
&lt;p&gt;An item on my list for the future is to distribute the opam export, build hashes and build environment artifacts in a authenticated way. I want to integrate this as &lt;a href=&quot;https://in-toto.io/&quot;&gt;in-toto&lt;/a&gt; style into &lt;a href=&quot;https://github.com/hannesm/conex&quot;&gt;conex&lt;/a&gt;, my not-yet-deployed implementation of &lt;a href=&quot;https://theupdateframework.github.io/&quot;&gt;tuf&lt;/a&gt; for opam that needs further development and a test installation, hopefully in 2020.&lt;/p&gt;
&lt;p&gt;If you want to support our work on MirageOS unikernels, please &lt;a href=&quot;https://robur.coop/Donate&quot;&gt;donate to robur&lt;/a&gt;. I'm interested in feedback, either via &lt;a href=&quot;https://twitter.com/h4nnes&quot;&gt;twitter&lt;/a&gt;, &lt;a href=&quot;https://mastodon.social/@hannesm&quot;&gt;hannesm@mastodon.social&lt;/a&gt; or via eMail.&lt;/p&gt;
</content><category scheme="https://hannes.robur.coop/tags/package%20signing" term="package signing"/><category scheme="https://hannes.robur.coop/tags/security" term="security"/><category scheme="https://hannes.robur.coop/tags/mirageos" term="mirageos"/><id>urn:uuid:09922d6b-56c8-595d-8086-5aef9656cbc4</id><title type="text">Reproducible MirageOS unikernel builds</title><updated>2021-11-19T18:04:52-00:00</updated><author><name>hannes</name></author></entry><entry><summary type="text">&lt;p&gt;Five years since ocaml-x509 initial release, it has been reworked and used more widely&lt;/p&gt;
</summary><published>2019-08-15T11:21:30-00:00</published><link href="Posts/X50907" rel="alternate"/><content type="html">&lt;h2&gt;Cryptographic material&lt;/h2&gt;
</summary><published>2019-08-15T11:21:30-00:00</published><link href="/Posts/X50907" rel="alternate"/><content type="html">&lt;h2&gt;Cryptographic material&lt;/h2&gt;
&lt;p&gt;Once a private and public key pair is generated (doesn't matter whether it is plain RSA, DSA, ECC on any curve), this is fine from a scientific point of view, and can already be used for authenticating and encrypting. From a practical point of view, the public parts need to be exchanged and verified (usually a fingerprint or hash thereof). This leads to the struggle how to encode this cryptographic material, and how to embed an identity (or multiple), capabilities, and other information into it. &lt;a href=&quot;https://en.wikipedia.org/wiki/X.509&quot;&gt;X.509&lt;/a&gt; is a standard to solve this encoding and embedding, and provides more functionality, such as establishing chains of trust and revocation of invalidated or compromised material. X.509 uses certificates, which contain the public key, and additional information (in a extensible key-value store), and are signed by an issuer, either the private key corresponding to the public key - a so-called self-signed certificate - or by a different private key, an authority one step up the chain. A rather long, but very good introduction to certificates by Mike Malone is &lt;a href=&quot;https://smallstep.com/blog/everything-pki.html&quot;&gt;available here&lt;/a&gt;.&lt;/p&gt;
&lt;h2&gt;OCaml ecosystem evolving&lt;/h2&gt;
&lt;p&gt;More than 5 years ago David Kaloper and I &lt;a href=&quot;https://mirage.io/blog/introducing-x509&quot;&gt;released the initial ocaml-x509&lt;/a&gt; package as part of our &lt;a href=&quot;https://nqsb.io&quot;&gt;TLS stack&lt;/a&gt;, which contained code for decoding and encoding certificates, and path validation of a certificate chain (as described in &lt;a href=&quot;https://tools.ietf.org/html/rfc6125&quot;&gt;RFC 5280&lt;/a&gt;). The validation logic and the decoder/encoder, based on the ASN.1 grammar specified in the RFC, implemented using David's &lt;a href=&quot;https://github.com/mirleft/ocaml-asn1-combinators&quot;&gt;asn1-combinators&lt;/a&gt; library changed much over time.&lt;/p&gt;