{"push_id":2978171136,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"1d6347fe971761978244413b578552f7082e3299","before":"a4a49724d6f898fd5e76bd6de49d36f7ed8d237e","commits":[{"sha":"3956fc885b39e0a0755547f07067b206606142eb","author":{"name":"Matthew Leeds","email":"424ec9dbc7f06560bd9f0866b438a24a0e995bb7@endlessm.com"},"message":"Allow disabling pulling from LAN/USB/Internet\n\nCurrently libostree essentially has two modes when it's pulling refs:\nthe \"legacy\" code paths pull only from the Internet, and the code paths\nthat are aware of collection IDs try to pull from the Internet, the\nlocal network, and mounted filesystems (such as USB drives). The problem\nis that while we eventually want to migrate everyone to using collection\nIDs, we don't want to force checking LAN and USB sources if the user\njust wants to pull from the Internet, since the LAN/USB code paths can\nhave privacy[1], security[2], and performance[3] implications.\n\nSo this commit implements a new repo config option called \"repo-finders\"\nwhich can be configured to, for example, \"config;lan;mount;\" to check\nall three sources or \"config;mount;\" to disable searching the LAN. The\nset of values mirror those used for the --finders option of the\nfind-remotes command. This configuration affects pulls in three places:\n1. the ostree_repo_find_remotes_async() API, regardless of whether or\nnot the user of the API provided a list of OstreeRepoFinders\n2. the ostree_repo_finder_resolve_async() /\nostree_repo_finder_resolve_all_async() API\n3. the find-remotes command\n\nThis feature is especially important right now since we soon want to\nhave Flathub publish a metadata key which will have Flatpak clients\nupdate the remote config to add a collection ID.[4]\n\nThis effectively fixes https://github.com/flatpak/flatpak/issues/1863\nbut I'll patch Flatpak too, so it doesn't pass finders to libostree only\nto then have them be removed.\n\n[1] https://github.com/flatpak/flatpak/issues/1863#issuecomment-404128824\n[2] https://github.com/ostreedev/ostree/issues/1527\n[3] Based on how long the \"ostree find-remotes\" command takes to\n  complete, having the LAN finder enabled slows down that step of the\n  pull process by about 40%. See also\n  https://github.com/flatpak/flatpak/issues/1862\n[4] https://github.com/flathub/flathub/issues/676\n\nCloses: #1758\nApproved by: cgwalters","distinct":true,"url":"https://api.github.com/repos/ostreedev/ostree/commits/3956fc885b39e0a0755547f07067b206606142eb"},{"sha":"1d6347fe971761978244413b578552f7082e3299","author":{"name":"Matthew Leeds","email":"424ec9dbc7f06560bd9f0866b438a24a0e995bb7@endlessm.com"},"message":"lib/repo-pull: Disable LAN updates by default\n\nThis commit disables searching on the local network for refs, unless\nexplicitly requested by the user either by changing the value of the\n\"core.repo-finders\" config option, or by passing an OstreeRepoFinderAvahi to\nostree_repo_find_remotes_async() / ostree_repo_finder_resolve_async(),\nor by specifying \"lan\" in the --finders option of the find-remotes\ncommand.\n\nThe primary reason for this is that ostree_repo_find_remotes_async()\ntakes about 40% longer to complete with the LAN finder enabled, and that\nAPI is used widely (e.g. in every flatpak operation). It's also probable\nthat some users don't want ostree doing potentially unexpected traffic\non the local network, even though everything pulled from a peer is GPG\nverified.\n\nFlathub will soon deploy collection IDs to everyone[1] so these code\npaths will soon see a lot more use and that's why this change is being\nmade now.\n\nEndless is the only potential user of the LAN updates feature, and we\ncan revert this patch on our fork of ostree. For it to be used outside\nEndless OS we will need to upstream eos-updater-avahi and\neos-update-server into ostree.\n\n[1] https://github.com/flathub/flathub/issues/676\n\nCloses: #1758\nApproved by: cgwalters","distinct":true,"url":"https://api.github.com/repos/ostreedev/ostree/commits/1d6347fe971761978244413b578552f7082e3299"}]}
{"actor":{"display_login":"rh-atomic-bot"}}