| 24 Oct 2022 |
 Arian | We have a whitelist of syscalls here: | 08:35:15 |
| Arian | https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/acme/default.nix#L63-L70 | 08:35:16 |
| Arian | so maybe lego and minica are doing new syscalls that aren't in this list | 08:35:27 |
| Arian | lego seems to be calling setrlimit (which tbh is a weird thing for a process to do themselves) and idk if that one is allowed by default | 08:36:04 |
| Arian | minica stacktrace is very... uninformative | 08:36:14 |
| Arian | anyhow this means that the acme module is properly broken. this is a release blocker | 08:36:44 |
| Arian | Andreas Schrägle: could you please open an issue so we can add it to the release blocker list? | 08:37:07 |
 Andreas Schrägle | In reply to @arianvp:matrix.org
Andreas Schrägle: could you please open an issue so we can add it to the release blocker list? does this not block the (non -small) channel anyways? | 08:38:39 |
| Arian | idk if this VM test is in the list. | 08:38:57 |
| Arian | if it is then we're good :) | 08:39:00 |
| Andreas Schrägle | looks like it isn't. I'll open an issue. | 08:41:04 |
| Arian | We should probably change that btw | 08:41:29 |
| Arian | channel update shouldnt cause people's certs to expire =) | 08:42:09 |
 hexa | this is about @resources | 12:43:59 |
| hexa | and go 1.19 | 12:44:01 |
| hexa | https://github.com/NixOS/nixpkgs/issues/197443 | 12:44:34 |
| hexa | * this is about @resources, setrlimit specifically | 12:45:24 |
| hexa | https://github.com/NixOS/nixpkgs/pull/197544 | 13:11:12 |
 m1cr0man | Only checking here now. Approved that pr 🙂 | 13:15:09 |
| hexa | still running the tests | 13:19:16 |
| Arian | Yikes | 13:19:38 |
| hexa | wonder why it failed on ofborg for x86_64-linux | 13:19:39 |
| Arian | So much for Go stability guarantee. | 13:19:45 |
| hexa | * wondering why it failed on ofborg for x86_64-linux | 13:19:46 |
| hexa | not sure we can fault them when we do downstream hardening | 13:20:13 |
| Arian | Also i think Systemd already unconditionally setrlimits too | 13:20:19 |
| hexa | In reply to @hexa:lossy.network
wondering why it failed on ofborg for x86_64-linux and completed on aarch64-linux 🤡 | 13:21:01 |
| Arian | Funnily they broke it by reading a systemd blog post | 13:21:41 |
| Arian | https://github.com/golang/go/issues/46279 | 13:21:43 |
| Arian | Which is very ironic | 13:21:47 |
