 Hello everyone, this is a platform Sieg meeting April 25th, 2023 and today we have Mark Wait, Kevin Martens, myself and Kenneth. Welcome everyone! We have a few open action items as always, not so many subjects ongoing and we have a few things to share with you about what's been done in the previous weeks. So it's been about one month I guess, previous meeting was cancelled because of me I'm afraid. So let's start with the open action item. We still have container images to deprecate for the Blue Ocean container and I don't know if many people use them still now but Mark and I went to different conferences lately and I guess Mark, as I got the same feedback as you got, people love Blue Ocean. I don't know if they're using the container or just the plugins but they do love it. So we have to be careful not to just say it's done, it's over, you have to deal with it. We have to be more nice with people, nicer with people about that. Well and we're not deprecating Blue Ocean the feature, right? No. This is not taking away the plugins that implemented, it's only taking away an ancient container image that we don't maintain because we've replaced it years ago with instructions at install time how you can get the same functionality with a standard container. So this is a really simple one in terms of persuading users, they just need to use the correct container. But now the deprecation piece, I had a conversation in Doc's office hours with Alex Brandus and with Chris Stern in Doc's office hours Asia discussing further the idea of how to present the deprecation to users and how to do that and I think I'm that much closer to a pull request to Jenkins Core that will give us a way to make this deprecation visible to the users relatively simply and reuse it for other deprecations. That was good news. Can't wait to see that happening. Thank you Mark. Now we had an issue going on last meeting and it's still going I think it won't be solved soon but it's none of our fault I would say. Somebody was requesting an Alpine R64 image and of course we can't supply it because Timurine does not support R64 Alpine images. So yes we have some workarounds we have lots of other R64 images I think we have Debian for JDK 11 and JDK 17 for example so why not. The user said he wanted to provide some content some help but we haven't heard anything from him yet so we'll see. I hesitated adding a comment earlier today asking if he wanted to close or not but we'll see. Next let's switch to what has been done in the previous weeks. We had quite an adventure with the DigiSert called Signing for MSI Installer and Jafi. Mark you even had to get lawyers involved into that. Wow but in the end you succeeded you got the right certificate for MSI but I think in the meantime the community decided not to sign the JAR files anymore am I right? No as far as I know we're still signing the JAR files I'll have to check the question. I have a valid question like I have an automated check that checks that so it's easy to check. Next time which means three years from now I guess we'll do something better. We'll take some more time ahead of the deadline so that we don't get in the same situation once again and I think that's it for that subject unless you find the information mark about the JAR or not it's not that important. Yeah I'll look separately because my automation checks on my own install and it's checking LTS so it wouldn't have changed anyway. Okay and today we're looking enough to have Kenneth with us. He worked on the PPC64LE comeback into the Docker images and we've seen some nice progress since the last meeting. The Docker agent PR has been merged. Congrats. Same for the Docker SSH agent. I've seen earlier today that the inbound agent tests were still failing but I guess that's something which was expected Kenneth. Yeah I just put a note in today actually. I was under the impression that once the Docker agent was in the repository that they were automatically going to tag it and that hasn't happened so you still have to manually tag it yourself locally if you build it so I put that in the note. Okay thank you. Okay so I'm not sure I'm understanding so what you're saying is so I see Linux, ARMv7, ARM64 and S390 on the inbound agent. Was that the one you were describing Kenneth? Now so if you yeah the inbound agent needs to pull down a tagged version of the Docker agent. So if you look if you click on the PR link the one yep if you click yeah if you click on that link take a look at my note I give some details there. Yeah right there the one above that. Oh okay yeah this note. Yeah because we have another problem Damian is walking on it we have an issue with a Windows server but okay no image found for architecture. Now take a look at the exact tag it's trying to pull so it's Jenkins agent and then it's you know that that that specific tag is what's in the the Docker bake file of the inbound agent it wants that so it's easy to fix somebody somebody just needs to tag those images in the official repository so you see my output from below I tagged it locally after so I first pulled down the two official images and then I locally tagged them so that I could build the inbound agent. Got it so that's an easy fix but on our side yeah and I wasn't sure if that was something that I needed to do in my pull request but I don't think so I think yeah I don't think you actually have permission to do it right that's a applying it okay so the what I'm I'm catching up Kenneth sorry so it's what I see is we've got a or Bruno open up open up hub.docker.com and I want to look at the Jenkins slash agent because I think that's the one that corresponds to the the repository we were just looking at or no this is the upstream this is the one that needs to be tagged I believe oh ah there it is good okay all right so click the plus two more yes all right so we have this one as we have latest with ppc64 le good yeah okay so there's that that bit of evidence then there was 3107 dot and here's where I need to see there it is so yes okay so look for 30 let's see I'm gonna well look for JDK 17 oh that's perfect yes okay so JDK 17 scrolled down a little bit past the windows stuff there the one that says latest nope nope not latest a little further maybe keep going there okay JDK 17 we already see it so on screen and bullseye so each of those has ppc64 le good okay so we've got something from which we can pull and the next one down I think Kenneth is the one you were alluding to 3107 dot v66 yada yada now it's dash eight but that's the one we would reference in the build is that correct Kenneth did I understand right okay so well okay wait a sec let's send that so then this means okay take me back to the other page Bruno the Kenneth's notes yeah I don't think that I don't know if that's the exact tag that the inbound is referencing is it because you're using dash five right yeah that well that's what you live on yeah that's okay well then it may be as simple as changing this to a dash eight because dash five I don't think ever had a ppc64 le but dash eight does well the question is do you want to update the docker bake file of the inbound agent to use the newer version of the agent and you know so this is what the head revision of the docker bake file is going to look for for the inbound agent do you simply just want to update that you know rather than retag anything usually I think I think the release process for this repository is that there is automation that offers pull requests to apply the new version the new tag 3107 dot something something dash eight to this thing and so I'm a little surprised that it hasn't already detected that and offered an upgrade for ppc 64 le I think it's hard coded in the bake file for the inbound agent well except look at pull request 340 top of the top top one there is that the one we were just looking at yeah dash eight yeah okay so so does this one scroll scroll a little further downward I want to see what other comments there are oh okay all right so this I think this is what Damian was saying this one is the one we need in order to publish inbound agents because it will automatically update and if you show us the diffs Bruno I think we'll see that the ppc agent the ppc reference in in the build in build x was changed here so I'll find no deep in maybe eight yeah yeah and so isn't that the one it's not 17 slash dbn but 11 slash dbn 11 where are you can see it but yes in the docker bake it is changed for everyone yes so I think I think this is the pull request we want and when this thing merges then we get ppc 64 le in inbound agent I guess so oh I see all right so this this will request got delayed yeah I think and if we read it it says hey we've got a delay we've got to diagnose what's going wrong with the windows server that's a key component of this build process all right um should I delete my comment or oh no no your comment is great it's perfect your your comment is is spot on your comment is ideal we could we could do the alternative that you offered or we can just use what Damian links to the number 340 pull request and and Damian I think preference will be let's just use 340 of course yeah so it would take maybe a few more hours or days before it gets solved right okay yeah I just wanted to point out that that's what that's the reason it was failing thank you now I had an open question I hadn't seen an answer to this when the agent the Jenkins agent image not the inbound agent but the agent image was merged I assumed Damian must have gotten the agreement from the security team because Kenneth did you hear anything that said oh yeah security says go ahead um he didn't tell me anything specific but I understood um that was the case but great I don't know if that was more around the controller image maybe and and and that could be that's it may be that that's why the controller hasn't been merged yet that that I'm not sure of okay thank you so you hadn't heard anything oh go ahead Bruno don't go ahead my fault go ahead okay so I heard something from Damian regarding the security team and the new images which may also talk about these new architectures and I think the compromise was that we would have a documentation that would say we won't warranty anything security related we do our best and you're on your own I think that's output and there may be somewhere on Jenkins.io GitHub repo pull request that talks about our security involvement there there is and there's a pull request pending if you'll open up in your web browser uh to jenkinsci slash docker we can actually look at how that read how they've phrased that it's a good one for us to review with Kenneth so that so that he sees what how they phrased it I feel quite comfortable with how they phrased it so this is Vodek Filone writing so he's the security officer and what he says was the Jenkins project takes security seriously when an image is published the latest image and the latest available packages are used we rely on the base image provider for the security of the system libraries voila yeah I agree and blah blah blah yeah so I guess that's one way of accepting new architectures and new images and so on we do what we can in particular my some my images are actually the same base as all the other architectures I wasn't introducing a new base anyway so there wasn't anything new right exactly and so so the the same strengths and weaknesses of the existing Debian occur also for ppc64 identical yeah that's cool and I think that your controller image where with it sorry about that so yeah the controller PR has not been merged yet no and I also had an opportunity to test the two agents that were built and those are working I ran some builds on them so is there anything we are expecting from you on this one I guess not now this is the review I think we're waiting for okay got it so we're almost at the end of the process hopefully thanks a lot for your contributions Kenneth anything to add to that subject more Kenneth Kevin no I think I think it's it's proceeding it's actually proceeding a little faster than I expected it to so that's great congrats Kenneth thank you very much yeah my pleasure next nothing groundbreaking for the agent images we have a few new releases so for ssh agents with a new version of dbm ppc64 le as we've seen and use of the latest java 11 versions so 11 dot 0 dot 18 thank you mark for that and for the docker agents release we have a new version of our climax a new version of both side and of course ppc64 le support back and there's something by demian but haven't looked at that which I did a new feature which is the expose the default image user to the environment variable user I guess that was linked to issue entered previously but I don't know anything more about that okay if there anything you would like to add a comment a subject a question remark anything I guess not so it looks like it's a wrap thanks a lot folks for attending this meeting hopefully the recording will be available from 24 to 48 hours and see you two weeks from now thanks a lot bye bye thanks bye bye everybody bye