just learned about this project erjic that does seccomp+bwrap sandboxing https://codeberg.org/prisixia/erjic the interface is really nicely designed and i believe will fit the needs of my build system perfectly
-
@hipsterelectron
@guix (and @nixos_org I believe) use Linux containers for package builds, without network access.
#guix
#nixos
#reproduciblebuilds
@reproducible_builds@janneke @hipsterelectron @guix @nixos_org @reproducible_builds I/we do this at work. Of corse, we’re beholden to RPM so nothing is _binary_ reproducible.
-
we also have a checksum graph and achieve bit-for-bit reproducibility, and we also (as of v1) build in a sandbox, because sandboxing is actually the easiest part of all this
this is why erjic can be an optional dependency for my build system. because sandboxing is not standardized by POSIX, it will need OS-specific implementations anyway. if you make sandboxing a core assumption of your dependency graph architecture, your dependency graph too will need to be replicated across OSes. and if you have no concept of a dependency except a checksum, you have no capability to make any universally-quantified logical statements—it's (at best) existential
-
this is why erjic can be an optional dependency for my build system. because sandboxing is not standardized by POSIX, it will need OS-specific implementations anyway. if you make sandboxing a core assumption of your dependency graph architecture, your dependency graph too will need to be replicated across OSes. and if you have no concept of a dependency except a checksum, you have no capability to make any universally-quantified logical statements—it's (at best) existential
and i do in fact mean higher-order mathematical logic. i'm not a logician, but i believe the analogy of cryptographic reproducibility is somewhere between propositional and first-order logic—while the checksum graph is starkly propositional, i suspect the nix and guix languages support enough abstraction for parameterized recipes, which seems first-order to me (but this is not my field).
-
and i do in fact mean higher-order mathematical logic. i'm not a logician, but i believe the analogy of cryptographic reproducibility is somewhere between propositional and first-order logic—while the checksum graph is starkly propositional, i suspect the nix and guix languages support enough abstraction for parameterized recipes, which seems first-order to me (but this is not my field).
the spack model would be appropriately summarized with BE NOT AFRAID: https://spack.readthedocs.io/en/latest/spec_syntax.html
Here is an example of using a complex spec to install a very specific configuration of mpileaks:
spack install mpileaks@1.2:1.4 +debug ~qt target=x86_64_v3 %gcc@15 ^libelf@1.1 %clang@20The figure below helps you get a sense of the various parts that compose this spec:
-
the spack model would be appropriately summarized with BE NOT AFRAID: https://spack.readthedocs.io/en/latest/spec_syntax.html
Here is an example of using a complex spec to install a very specific configuration of mpileaks:
spack install mpileaks@1.2:1.4 +debug ~qt target=x86_64_v3 %gcc@15 ^libelf@1.1 %clang@20The figure below helps you get a sense of the various parts that compose this spec:
we do happen to employ the ASP logic language through the clingo ASP solver. lots of good resources on ASP https://potassco.org/resources/, which is kind of like SAT/SMT except that universal quantifier expressions can be stated and solved over infinite graph-structured solution spaces
-
we do happen to employ the ASP logic language through the clingo ASP solver. lots of good resources on ASP https://potassco.org/resources/, which is kind of like SAT/SMT except that universal quantifier expressions can be stated and solved over infinite graph-structured solution spaces
i was hired by LLNL right as spack was transitioning from a messy non-backtracking serial graph solver (our own, in python, grown organically over the decade since spack was created) to clingo (this was a huge risk). the reason we could do this was because package recipes were already declarative, and already described all versions of a package across all architectures at once.
this is super important: we already had a logical model—we just needed a more powerful solver. the solver did not dictate our logic. we applied the solver to our use case.
-
i was hired by LLNL right as spack was transitioning from a messy non-backtracking serial graph solver (our own, in python, grown organically over the decade since spack was created) to clingo (this was a huge risk). the reason we could do this was because package recipes were already declarative, and already described all versions of a package across all architectures at once.
this is super important: we already had a logical model—we just needed a more powerful solver. the solver did not dictate our logic. we applied the solver to our use case.
this is the advantage of protocols. spack was made for LLNL to provide a service to our physicists. these physicists encompass mathematicians and programmers—LLNL does simulations, so like the spack team, they're necessarily applied scientists. the tools development group (TDG) does spack, but our larger org within LLNL computing also developed parallelism libraries, which themselves made use of memory management primitives
-
this is the advantage of protocols. spack was made for LLNL to provide a service to our physicists. these physicists encompass mathematicians and programmers—LLNL does simulations, so like the spack team, they're necessarily applied scientists. the tools development group (TDG) does spack, but our larger org within LLNL computing also developed parallelism libraries, which themselves made use of memory management primitives
the purpose of all of this is to bring deep hardware-dependent concerns all the way up to the application layer, because HPC is generally one of the fields that requires this at all times. but notice something very important—the application layer is not the spack team, nor the RAJA team, but the scientists we serve.
our goal is to make their scientific work more efficient than any alternative. that's how we broke the nuclear fusion net-positive efficiency barrier after 60 years. that's what differentiates LLNL from LANL, who still pretends quantum computing is totally real.
-
the purpose of all of this is to bring deep hardware-dependent concerns all the way up to the application layer, because HPC is generally one of the fields that requires this at all times. but notice something very important—the application layer is not the spack team, nor the RAJA team, but the scientists we serve.
our goal is to make their scientific work more efficient than any alternative. that's how we broke the nuclear fusion net-positive efficiency barrier after 60 years. that's what differentiates LLNL from LANL, who still pretends quantum computing is totally real.
the point of this hagiography is not to claim the US is good at science, or that the spack team is smarter than anyone else (except LANL, who is overrated). in fact, i believe the netherlands is far better at funding science, and i fervently hope their physicists develop better silicon fabrication techniques soon.
the US is in fact terrible at funding science. but government employees are different from military generals or failson politicians. and in this hostile environment with funding swings every 4 years, this is what we arrived at to defend science from being beholden to IBM
-
the point of this hagiography is not to claim the US is good at science, or that the spack team is smarter than anyone else (except LANL, who is overrated). in fact, i believe the netherlands is far better at funding science, and i fervently hope their physicists develop better silicon fabrication techniques soon.
the US is in fact terrible at funding science. but government employees are different from military generals or failson politicians. and in this hostile environment with funding swings every 4 years, this is what we arrived at to defend science from being beholden to IBM
blue gene? that beat kasparov? that machine is still running. it was also the last IBM machine purchased by LLNL, because IBM cannot be relied upon to provide features for any sum of taxpayer money. they are completely incapable of it. the first exascale machine (possibly second, idgaf) is instead a completely modular supercomputer from consumer AMD chips. and spack enables the government to pay AMD a bazillion dollars for bragging rights without getting stuck into a software–hardware monopoly like IBM loves
-
blue gene? that beat kasparov? that machine is still running. it was also the last IBM machine purchased by LLNL, because IBM cannot be relied upon to provide features for any sum of taxpayer money. they are completely incapable of it. the first exascale machine (possibly second, idgaf) is instead a completely modular supercomputer from consumer AMD chips. and spack enables the government to pay AMD a bazillion dollars for bragging rights without getting stuck into a software–hardware monopoly like IBM loves
open source, in the informal sense, is something todd gamblin (spack creator, one of my favorite people in the whole world) convinced the DOE to invest in (like i did at twitter), and he was immediately proven right, because a ridiculous number of other labs are now using spack.
this also means the power relations spack enables (there are always power relations in any org) are now available elsewhere. spack in this view is an institutional and political tool—just like every other package manager.
-
open source, in the informal sense, is something todd gamblin (spack creator, one of my favorite people in the whole world) convinced the DOE to invest in (like i did at twitter), and he was immediately proven right, because a ridiculous number of other labs are now using spack.
this also means the power relations spack enables (there are always power relations in any org) are now available elsewhere. spack in this view is an institutional and political tool—just like every other package manager.
you can and should argue that "b2b vs b2c" codifies deeply corporate-centric profit relations, especially those advanced by VCs and tech startups. in that way, it's a harmful analogy, and it exposes my preconceptual bias from employment (twitter in US tech, and LLNL in US government/academia). i would love to hear ways the "customer" terminology inculcates harmful assumptions we should steer away from. please dunk on me. write screeds of my misdeeds.
-
you can and should argue that "b2b vs b2c" codifies deeply corporate-centric profit relations, especially those advanced by VCs and tech startups. in that way, it's a harmful analogy, and it exposes my preconceptual bias from employment (twitter in US tech, and LLNL in US government/academia). i would love to hear ways the "customer" terminology inculcates harmful assumptions we should steer away from. please dunk on me. write screeds of my misdeeds.
but i like the word "customer" because it's missing from "open source". when maintainers (consider xz-utils) are overwhelmed, they're serving microsoft customers. but those customers can't reach them, and certainly can't pay them. microsoft, and google, and facebook, and certainly amazon, are serving as middlemen and doing a shit fucking job at it
-
but i like the word "customer" because it's missing from "open source". when maintainers (consider xz-utils) are overwhelmed, they're serving microsoft customers. but those customers can't reach them, and certainly can't pay them. microsoft, and google, and facebook, and certainly amazon, are serving as middlemen and doing a shit fucking job at it
i especially seek to destroy google for vengeance, but the entire cloud apparatus runs on not just gnu/linux, but every fucking maintainer in between. more and more it's musl/linux because glibc is monopolistic, yet somehow linus torvalds is the only one getting rich off this shit
-
i especially seek to destroy google for vengeance, but the entire cloud apparatus runs on not just gnu/linux, but every fucking maintainer in between. more and more it's musl/linux because glibc is monopolistic, yet somehow linus torvalds is the only one getting rich off this shit
the end user, living the dream of linux on the desktop, largely uses gnome or KDE. fun fact: arch's
pacmannow has a new type of dependency, that's not listed as optional but can be uninstalled freely. KDE's "baloo" which indexes your entire hard drive and can't be turned off must be uninstalled with-Rddafter nearly every-Syuupgrade. it's not registered insystemctl—it just pops up inps. if you ever provide your location to the weather in the KDE clock, it cannot be removed, not without undocumented changes in~/.config.who is the customer for this? who benefits? who is all this for?
-
the end user, living the dream of linux on the desktop, largely uses gnome or KDE. fun fact: arch's
pacmannow has a new type of dependency, that's not listed as optional but can be uninstalled freely. KDE's "baloo" which indexes your entire hard drive and can't be turned off must be uninstalled with-Rddafter nearly every-Syuupgrade. it's not registered insystemctl—it just pops up inps. if you ever provide your location to the weather in the KDE clock, it cannot be removed, not without undocumented changes in~/.config.who is the customer for this? who benefits? who is all this for?
i was shocked to finally understand the zen of slackware thanks to @miss_rodent's patient explanation. no dependencies? what's the point then? why not build everything by hand? but i slowly began to pull these apart:
- a distro package recipe bundles the code for your distro
- a package manager builds or downloads the package by name (checking signatures and/or checksums)
afaiu, slackware does that just fine. and it is better than building from source by hand, because someone else did the work to build it reliably and install it in the right places. what it doesn't do is enforce a correctness constraint that forces you to pull in packages you didn't explicitly consent to (!!!)
-
i was shocked to finally understand the zen of slackware thanks to @miss_rodent's patient explanation. no dependencies? what's the point then? why not build everything by hand? but i slowly began to pull these apart:
- a distro package recipe bundles the code for your distro
- a package manager builds or downloads the package by name (checking signatures and/or checksums)
afaiu, slackware does that just fine. and it is better than building from source by hand, because someone else did the work to build it reliably and install it in the right places. what it doesn't do is enforce a correctness constraint that forces you to pull in packages you didn't explicitly consent to (!!!)
@hipsterelectron @miss_rodent so what you're saying is the package manager slacks off
-
i was shocked to finally understand the zen of slackware thanks to @miss_rodent's patient explanation. no dependencies? what's the point then? why not build everything by hand? but i slowly began to pull these apart:
- a distro package recipe bundles the code for your distro
- a package manager builds or downloads the package by name (checking signatures and/or checksums)
afaiu, slackware does that just fine. and it is better than building from source by hand, because someone else did the work to build it reliably and install it in the right places. what it doesn't do is enforce a correctness constraint that forces you to pull in packages you didn't explicitly consent to (!!!)
transitive dependencies absolutely raise questions about user consent. and failing to separate the human groups communicating across the dependency graph leads to consent violations by fiat. @ariezra's Industry Unbound used the term "engineering fiat" for intentional corporate violations of their customer's consent and it put words to what i had observed but could never verbalize from google and the rest
-
i was shocked to finally understand the zen of slackware thanks to @miss_rodent's patient explanation. no dependencies? what's the point then? why not build everything by hand? but i slowly began to pull these apart:
- a distro package recipe bundles the code for your distro
- a package manager builds or downloads the package by name (checking signatures and/or checksums)
afaiu, slackware does that just fine. and it is better than building from source by hand, because someone else did the work to build it reliably and install it in the right places. what it doesn't do is enforce a correctness constraint that forces you to pull in packages you didn't explicitly consent to (!!!)
@hipsterelectron @miss_rodent wait, what? Isn’t Slackware rpm-based?
-
@hipsterelectron @miss_rodent wait, what? Isn’t Slackware rpm-based?
@hipsterelectron @miss_rodent I guess not. My use of Slackware was in the very early aughts without reliable access to binary package repositories, so after initial install, I built a lot of things from source.
