January 2012 - Board - oVirt List Archives

FOSDEM sessions
by Itamar Heim 01 Feb '12

01 Feb '12

fyi we got the following sessions in the FOSDEM[1] Open Source Virtualization and Cloud devroom. if you are planning to be in FOSDEM drop us an email if you would want to meet, discuss, catch up, etc. 1. Virtualization Management the oVirt way - Introducing oVirt (Itamar Heim) 2. VDSM - The oVirt Node Management Agent (Federico Simoncelli) 3. Open Virtualization – Engine Core: Internals and Infrastructure (Omer Frenkel) apart of it there are also some kvm sessions in the hypervisor main track. Hope to meet you there, Itamar [1] http://fosdem.org/2012/

3 3

release process details
by Jon Choate 30 Jan '12

30 Jan '12

given that the release date is potentially in three working days, is there someone knowledgeable who can add detail to this page? http://www.ovirt.org/governance/releases-and-release-management I'm guessing with the go/no-go meeting coming up on Monday, there may be increased interest in the release management process. Jon

2 1

Re: package signing
by David Jaša 30 Jan '12

30 Jan '12

Doron Fediuck píše v Ne 29. 01. 2012 v 14:21 +0200: > On 26/01/12 18:20, David Jaša wrote: > > Doron Fediuck píše v Čt 26. 01. 2012 v 11:01 -0500: > >> +1 for the need. > >> I think we should give md5 or similar hashes, > > > > There is already file with md5 hashes in the repo but it has no meaning > > wrt attack prevention because it is not accessible via https, let alone > > HTTP Strict Transport Security so it can be mangled by attacker together > > with packages themselves. > > > Setting up https access is probably the way to go. > We can sign the hash file as well, but that's just for binaries. > > >> and let distro's do the signing. > >> > > > > Distros take care of it during their package build process, no need to > > worry about that. But if we offer packages on our site, they should be > > also signed. > > > Actually, I just got the diff between our views; > Indeed when you distribute binaries, I agree you should sign it. > The thing is, I do not think we should distribute binaries. Fedora > should distribute ovirt RPM's, and other distro's should do the same > using their own packaging mechanisms. For example, Gentoo will look > for the sources tarball, and during the installation will d/l it, > compile and deploy according to the relevant (signed) ebuild. > > This is why fundamental projects will give you such links: > http://www.x.org/releases/X11R7.6/src/ > http://www.kernel.org/pub/linux/kernel/v3.x/ > http://kde.mirrorcatalogs.com/stable/4.8.0/ > > You may also see rel-notes, change-log and doc's, but no binaries. > > I'm aware of the fact many projects (postgres and others) provide > binaries as well, but my view is that this is the distro's task > to package & sign the binaries, and the project's task to provide > a stable release tarball of sources. > I think we agree more than it seems. IMO we should provide binaries of just development versions of oVirt for widely-used stable distributions which do not have better ways to create custom repos (like OpenSuse Build Service or Ubuntu PPA) - we do this for Fedora, Debian would be a good candidate, too. David > > David > > -- David Jaša, RHCE SPICE QE based in Brno GPG Key: 22C33E24 Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24

2 1

Minutes from Go/No-Go meeting 2012-01-30
by Mike Burns 30 Jan '12

30 Jan '12

Minutes: http://ovirt.org/meetings/ovirt/2012/ovirt.2012-01-30-15.01.html Minutes (text): http://ovirt.org/meetings/ovirt/2012/ovirt.2012-01-30-15.01.txt Log: http://ovirt.org/meetings/ovirt/2012/ovirt.2012-01-30-15.01.log.html Quick summary: Issues across multiple packages will cause a delay in the release. Thanks Mike

1 0

oVirt First Release Delay
by Ofer Schreiber 30 Jan '12

30 Jan '12

Due to several issues raised in the release meeting today [1], we're postponing oVirt's first release. We will re-evaluate the release date on Wednesday, during the weekly irc meeting. Thanks, The oVirt team [1] Release meeting minutes can be found at: http://ovirt.org/meetings/ovirt/2012/ovirt.2012-01-30-15.01.html

1 0

First release go/no go meeting on Monday (30.01)
by Ofer Schreiber 29 Jan '12

29 Jan '12

All, As decided in the last oVirt sync meeting, we will have a go/no meeting about our first release in the upcoming Monday (30.01.12), 15:00 UTC. I'm inviting you all to join this important meeting in the official #ovirt irc channel. Thanks, Ofer Schreiber oVirt Release Manager

2 2

oVirt slide decks & other collateral
by Jason Brooks 26 Jan '12

26 Jan '12

I've created marketing and marketing/collateral categories on the ovirt.org wiki, and started a page listing the slide decks that we have for the project so far: http://www.ovirt.org/wiki/OVirt_Slide_Decks. At the top of the page I've linked to a new, generic ovirt deck, assembled out of the other decks, meant to be used for project overview-type presentations. Karsten Wade used a version of this generic deck for his recent talk at SCALE: http://www.ovirt.org/wiki/User:Quaid/SCALE_10x_presentation. His version spreads the text out over multiple slides to combat the dense "wall of text" effect on some of these. To a similar end, I'm working on thinning out some of these slides, as well as adding screenshots from the current version of the code, and making some of the diagrams less Red Hat-centric. If you have other feedback on this deck, or suggestions/requests for other pieces of collateral the project could benefit from, please let me know, and/or add to the wiki under the relevant categories. Thanks, Jason

2 4

RE: package signing
by Doron Fediuck 26 Jan '12

26 Jan '12

+1 for the need. I think we should give md5 or similar hashes, and let distro's do the signing. Sent from my Android phone. Please ignore typos. -----Original Message----- From: David =?UTF-8?Q?Ja=C5=A1a?= [djasa(a)redhat.com] Received: Thursday, 26 Jan 2012, 15:33 To: board(a)ovirt.org Subject: package signing Hi, at least nightly fedora repo is not signed (i didn't look at the other ones but I suspect that all other repos are also unsigned). We should establish package signing infrastructure and we should also publish signing key fingerprint on SSL/TLS-secured page to prevent any MITM attack aimed on ovirt repo users. David -- David Jaša, RHCE SPICE QE based in Brno GPG Key: 22C33E24 Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24 _______________________________________________ Board mailing list Board(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/board Sent from my Android phone. Please ignore typos.

1 0

package signing
by David Jaša 26 Jan '12

26 Jan '12

Hi, at least nightly fedora repo is not signed (i didn't look at the other ones but I suspect that all other repos are also unsigned). We should establish package signing infrastructure and we should also publish signing key fingerprint on SSL/TLS-secured page to prevent any MITM attack aimed on ovirt repo users. David -- David Jaša, RHCE SPICE QE based in Brno GPG Key: 22C33E24 Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24

1 0

Tagline on ovirt.org does not communicate a clear and simple message
by Stefan Hajnoczi 19 Jan '12

19 Jan '12

Hi, The tagline on ovirt.org is long and unclear: "Complete and Comprehensive Open Source Infrastructure and Management Virtualization Platform for the Data Center". "Complete and Comprehensive" is almost a tautology. "Infrastructure and Management Virtualization Platform" does not make sense, I'm not sure what a "Management Virtualization Platform" is. Something shorter would communicate what ovirt.org is about better. This tagline is used in the <h2> and <title> (shortened). It's important because this is how visitors learn what oVirt is and whether to read more. How about shortening it to, "Complete Open Source Virtualization Platform for the Data Center"? Thanks to mburns on #ovirt for directing me to infra(a)ovirt.org and board(a)ovirt.org. Stefan

8 17