Meeting started at 2026-06-30 14:00:29 UTC

The Meeting name is 'Fedora Atomic Initiative'

!hi

John Eckersberg: John Eckersberg (jeckersb)

!hi

Colin Walters: Colin Walters (walters)

!hi

!hi

!hi

jmarrero: Joseph Marrero (jmarrero)

Sean Thrailkill: Sean Thrailkill (snthrailkill)

nimbinatus: Laura Santamaria (nimbinatus) - she / her / hers

!hi

Hristo Marinov: Hristo Marinov (hricky) - he / him / his

we'll start the agenda ~5 after

So far, we've got (1) unified pipeline and (2) something from Timothée

!hi

Clément Verna: Clement Verna (cverna) - he / him / his

Maybe Timothee's is next week. Not sure :D

lol, sounds good. We'll see what happens today :D

ok, let's get this party started

!hi

Timothée Ravier: Timothée Ravier (siosm) - he / him / his

jmarrero: the floor is yours :)

I started this draft for a Change Proposal to unify all atomic/bootc variants pipelines: https://fedoraproject.org/wiki/Changes/AtomicUnifiedPipeline

nimbinatus gave a cookie to jmarrero. They now have 5 cookies, 1 of which were obtained in the Fedora 44 release cycle

This is the first pass, the idea is that instead of having multiple teams and SIGS managing and working on the same kind of problems to unify those efforts.

I am not sure if adding Agents to the same pipeline is going to derail the effort, we could split it in two Change Requests 1) For pipeline/testing 2) for Agent integration into the pipeline

(meta but there's a discussion on the devel list about moving stuff to git, which would be easier to collaborate/comment on)

Thanks for doing this! There's some details but I'm in favor of the overall direction. I think ideally this week we just pull the trigger on having a new unified repo on the fedora forge with konflux set up from the start that builds fedora 45 content at least to a staging location

I am not sure if adding Agents to the same ChangeRequest is going to derail the effort, we could split it in two Change Requests 1) For pipeline/testing 2) for Agent integration into the pipeline

!hi

jcapitao: Joel Capitao (jcapitao) - he / him / his

This sounds like a big scope for a change request

single* change request

and F45 as a timeline would be tight

I also like the unifed repo, where anyone can easily start building their OS based on bootc

I agree this is the long term direction we should aim for but we should do this in steps

What steps you propose Timothée Ravier ?

I think we have a change request to get the bootc base images built and released using konflux?

https://fedoraproject.org/wiki/Changes/konflux-atomic-change-proposal

We do: https://fedoraproject.org/wiki/Changes/konflux-atomic-change-proposal

lol jinc

lol jinx

So I would say that getting the base images built from Konflux from the new forge would be a good first step

Then we need to make those official (figure out signing, etc.)

In parallel, we can start building the Atomic Desktops one using the same flow but likely not the same repo immediately as we need to keep things working for the ostree images

I started drafting https://fedoraproject.org/wiki/Changes/BuildAtomicDesktopsWithKonflux

IMO, I don't think we need to block on signing. I would consider it more as a nice to have.

Seems like we are duplicating the effort moving first all to Konflux, but I agree we could start moving the bootc one to Konflux and slowly add new variants, turning off the old pipeline.

Not sure I follow. If we want to be able to switch the Atomic Desktops to those new images we must have those signed by the official Fedora keys

IMO, the goal is to have an issue to get place for people to drop a container file and build their images. Not specific to Atomic Desktop

There will be case when we want things to be official, and other cases when we don't need

Hum, is this part of the scope of this change?

IMO, the goal is to get place for people to drop a container file and build their images. Not specific to Atomic Desktop

IMO, the goal is to get a place for people to drop a container file and build their images. Not specific to Atomic Desktop

I thought this was only about producing our existing variants using a unified pipeline

THis change is only intended to unify the Fedora images. Not for users/others to build their own.

Maybe I am out of scope 😅

I would say it's related, but we would need a pretty clear understanding of the procedures for that

That could be a future change proposal, though

hmm, but the Konflux pipelines are already kinda unified. Fedora CoreOS and bootc are using the same pipeline ref (and also the draft PR for AtomicDesktop)

2. We want to have the possibility to allow others to build on the same pipeline with a simple YAML file update instead of needing to set this up ourselves.

So it sounds like we've got a couple things going here:

1. We collectively want to move all of the current bootc-based image artifacts into the same build pipeline. We've been working toward this, but we want to formalize it for FESCo?

I think a big part of the proposal is the monorepo

I guess the main goal of this ChangeRequest would be to put everything in one monorepo

gotcha

yeah exqactly

also probably a konflux tenant

Monorepo enables single pipeline/Konflux tenant, then?

basically?

The idea is all teams look at the same infra, pipelines and repo

yes, as a repo can be onboarded to one Konflux tenant only (because of webhook mechanism)

🤔 So yeah, Timothée Ravier would know better than me, but this does sound like multiple change proposals. I don't know if there's anything like an epic that then has multiple change proposals (other than an initiative like we have 😅 but we aren't making new initiatives right now). This initiative can be that, though; it was flexible to meet what we realized we needed.

I get the idea, there would be economies of scale

I am a little uncertain about tethering ourselves to a 6 month cycle for this stuff though, conceptually *mostly* it doesn't affect the user experience, just how it is built

So, we currently follow the change proposal process, but that doesn't mean we can't get it done outside of the cycle

I feel the change proposal is more about communicating, but I agree this is a gap in Fedora's process. Everything is linked to the 6 months release schedule

if it takes one month, since we're already on more rolling releases for many things, it's fine. Just needs to understand that for the 45, 46, 47... releases versus rawhide, things will get released in the next cycle, or used that way

From my perspective, we don't need a new change request for the first step that we need to do now which is to move the bootc images to the new forge. We would need one for signing, making them official and pushed to the fedora namespace

But we can't really ask for approval for that until we have the pipeline running

as that would be fairly theoretical

(but we can draft them)

Does it need to be more than asking FESCo "hey we're going to switch from pungi to konflux" as a tracker issue and asking for feedback?

Currently we don't have any atomic image in the new forge and signed?

We've already done the Konflux switch request

I definitely think that it needs a change request to make anything built by Konflux an official deliverable as this is not the consensus right now

https://fedoraproject.org/wiki/Changes/konflux-atomic-change-proposal

We did the change request for building them, not to make them official deliverables

^^ this was to lead to the official one

it's in the change request that that's the intended direction once we've proven the move

https://pagure.io/fesco/issue/3547 was approved already?

>Note that this is to start a discussion with the goal of making sure no one is blindsided by our eventual goal of production for F45 :)

I was pretty explicit with my wording on that change request

I think it's just waiting for us to Do It ?

No, we still need to open the final production change request

but I've been waiting as we needed to prove the staging one works

that's the "parallel artifacts" part

if it's working, then we can report that back and open the formal request for prod

If you mean the bootc image, they are not on the new forge yet and they are not signed

for information, we have a plan with jbtrystram and Jeremy Cline for the signing in Konflux

To me, the signing part should be its own change request as that would layout all the work and clarification needed to get to "Konflux can sign official Fedora artifacts"

!hi

jligon: Jeff Ligon (jligon)

OK, So concrete steps 1) Move bootc images to the new forge and make sure it's wired and building according to https://pagure.io/fesco/issue/3547 2) New change request for final production change? 3) Unification Change Request using the bootc pipeline already running as unification/mono repo place?

Do images need to be signed first and then moved to Fedora Forge?

[jmarrero](https://matrix.to/#/@jmarrero:matrix.org) That looks good to me

Same, that looks correct to me in terms of steps

This means we don't need a new change proposal for each variant to get signing approval etc right?

I think it's independent as it's two different things in Konflux

I'd say so

Yes, hopefully we start "small" with the bootc base images and we get that approved and that opens the way to add more images once we've provent that this works well and shaken all the issues

My only concern is in line with Colin Walters 's this does not mean that we need to wait 6 months for each change request right?

Basically, we are just constrained on the speed of our work and FESCO approvals.

We could submit the signing one for F45

but we need to move quickly as the testable deadline is mid august

Also do note the new signing infra isn’t deployed yet, but hopefully in staging at least in the next few weeks

Basically, we are just constrained on the speed of our work and FESCO approvals?

I’ve been out for various reasons since flock but I’ll be focusing on that later this week and next

We could start signing with a staging key (i.e. just not the Konflux key) to prove that this works

We can submit the proposal and if we slip that's OK

+1

Wouldn't it currently fall under https://fedoraproject.org/wiki/Changes/konflux-atomic-change-proposal though, if it's focused on staging?

OK, I am happy to join that proposal as owner too Timothée Ravier.

Can we submit a proposal for 45 and postpone it to 46 in case we don't finish it on time?

i.e., using Konflux with any key for staging = success if we get a usable artifact?

Yes, this happens all the time

Can we submit a proposal for 45 and postpone it to 46 in case we don't complete it on time?

If we have anyone interested in co-owning https://fedoraproject.org/wiki/Changes/BuildAtomicDesktopsWithKonflux please let me know or add yourself and we can refine it for after the signing one. We can add it as dependency.

We can file a separate proposal about the monorepo for F46 maybe?

backing up a second, I wanted to understand - are we agreed to aim for an `atomic` tenant that holds both the current "bootc" base images and atomic desktops and maybe coreos in the future?

I'd be happy to co-own the signing one, and I guess jbtrystram as well

(Also, 15-minute warning. If there's another topic for today, do we want to go to it or punt it to next week?)

Colin Walters: I would agree :)

I do

awesome!

[Colin Walters](https://matrix.to/#/@walters:fedora.im) I'm on board with that

🎉

We just (small detail) need to get it working before we can ask everyone to move to it ;à

:)

ohh well that created a confetti animation... sorry

yeah but, I think we have the people and tools, it should really I think just be a focused matter of a few days of knowledgeable people to stand up a repo in the forge, the tenant and have it output staging images right?

suddenly everyone stopped typing 😂

I think so, I can try to wrangle a couple of people interested.

in theory 😅

If we ensure all the right people have access etc

10-minute warning :)

I think so, I can try to get together a couple of people interested.

We started moving repos to prod, but stg is empty. Are we going to move some repos there?

we are awaiting for a token from releng to integrate Konflux-Forgejo, since a while now

The main blocker for the Atomic Desktops to move to a monorepo is that we would have to maintain 2 repos with the configs until we are ready to switch all Atomic Desktops users to the bootable containers

jcapitao: https://forge.fedoraproject.org/releng/tickets/issues/13341 ?

(or we would have to build the ostree ones from the bootc repo)

(I'd like to async discuss this after, I don't understand what would require two repos)

Colin Walters: yes indeed

We need to keep buldiung the ostree Atomic Desktops right now

Right, but we can do that as an export-from-container flow or so but anyways we can async discuss this

OK so if we're blocking on https://forge.fedoraproject.org/releng/tickets/issues/13341 let's keep up momentum there and if we need a sync meeting let's do that

5-min warning

Well, they are currently different package sets, so different builds. We would have to figure out the signing, import into ostree repo, etc. I'm not opposed to that, but I don't really want to do that either.

I would prefer to work on getting us ready to use Konflux

(random aside, but another thing that would likely make sense to move to this unified model is Podman "machine-os", at least potentially)

Let's continue async, we can use next week meeting to talk about progress on this and additional details we figure out?

All right, folks, time's about up. Last comments?

Thanks you everyone! Specially nimbinatus

this was the most successful meeting i think ive ever seen for us? yay us?

And time. Thanks all for coming!

bahahaha