Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Attune - Build and publish APT repositories in seconds

github.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Show HN: Attune - Build and publish APT repositories in seconds

#21

Post by rlpb »

ilikebits wrote: post #13
benwilber0 wrote: post #11

Earlier quoted context omitted.

What is an example of something that would require "distributed signing"?

Our use case is customers who (1) want to use a managed cloud hosting service that we provide, but (2) are not willing to give us their signing keys. Our design allows them to keep all of their signing keys local to their environment. To our knowledge, we have not found another provider who supports both of these requirements. It's not some amazing technical innovation, but it is one of those annoying paper cuts that…

Signing an unsigned apt repository is about three gpg commands though. I don't see how this kind of thing requires a whole separate product.

Re: Show HN: Attune - Build and publish APT repositories in seconds

#22

Post by benwilber0 »

ilikebits wrote: post #13
benwilber0 wrote: post #11

Earlier quoted context omitted.

What is an example of something that would require "distributed signing"?

Our use case is customers who (1) want to use a managed cloud hosting service that we provide, but (2) are not willing to give us their signing keys. Our design allows them to keep all of their signing keys local to their environment. To our knowledge, we have not found another provider who supports both of these requirements. It's not some amazing technical innovation, but it is one of those annoying paper cuts that…

> when we tried to use them in production at scale

Debian and Ubuntu have been using them in production and "at scale" for decades. What are the "sharp edges" that you're trying to solve?

Re: Show HN: Attune - Build and publish APT repositories in seconds

#23

Post by ilikebits »

3np wrote: post #20

Looks neat! What would be really valuable for us would be future support for other distros/repos. A more unified interface for synchronized publishing across say dep/rpm/archlinux/alpine when we have multi-distro packages to build and publish.

Yeah, multi-distro and multi-arch is something on our roadmap! We're especially interested in automating the more annoying OS-specific parts of releasing, like MacOS notarization.

Re: Show HN: Attune - Build and publish APT repositories in seconds

#25

Post by pabs3 »

jauntywundrkind wrote: post #9

Yes, it's Rust ;). Sign of quality to me. Excited to try. I ran a reprepo for a couple of years & it wasn't the worst to run, but not fun either. My confidence in efficiently publishing packages was super low, never improved much. It also mandated running a web server (configuring my nginx to point at the repo filesystem), not very batteries included. https://wiki.debian.org/DebianRepository/SetupWithReprepro

It looks like Golang to me?

Edit: the CLI part is Golang and the rest(?) is Rust.

Re: Show HN: Attune - Build and publish APT repositories in seconds

#26

Post by pabs3 »

ilikebits wrote: post #12
jauntywundrkind wrote: post #9

Yes, it's Rust ;). Sign of quality to me. Excited to try. I ran a reprepo for a couple of years & it wasn't the worst to run, but not fun either. My confidence in efficiently publishing packages was super low, never improved much. It also mandated running a web server (configuring my nginx to point at the repo filesystem), not very batteries included. https://wiki.debian.org/DebianRepository/SetupWithReprepro

Thanks for trying, and sorry in advance for the rough edges :) We're also working on a hosted service! If you'd like a sneak peek, send us a message at founders@attunehq.com (or email me directly at eliza@attunehq.com). I'm happy to talk about your specific needs and see if we can build something for them. (And yes, it is Rust. I keep trying to find projects where I get to stretch my Haskell wings again, but unfortun…

Will you be rewriting the Golang part in Rust?

Re: Show HN: Attune - Build and publish APT repositories in seconds

#27

Post by ilikebits »

pabs3 wrote: post #26
ilikebits wrote: post #12

Earlier quoted context omitted.

Thanks for trying, and sorry in advance for the rough edges :) We're also working on a hosted service! If you'd like a sneak peek, send us a message at founders@attunehq.com (or email me directly at eliza@attunehq.com). I'm happy to talk about your specific needs and see if we can build something for them. (And yes, it is Rust. I keep trying to find projects where I get to stretch my Haskell wings again, but unfortun…

Will you be rewriting the Golang part in Rust?

We don't plan to do that right now. The CLI isn't that complicated, and the choice for that was driven more by Go's excellent cross-compilation story than anything else.

It would be a fun thing to do if we had the resources to get equally good cross-compilation in Rust, but we're focused on building functionality right now.

Re: Show HN: Attune - Build and publish APT repositories in seconds

#28

Post by ilikebits »

benwilber0 wrote: post #22
ilikebits wrote: post #13

Earlier quoted context omitted.

Our use case is customers who (1) want to use a managed cloud hosting service that we provide, but (2) are not willing to give us their signing keys. Our design allows them to keep all of their signing keys local to their environment. To our knowledge, we have not found another provider who supports both of these requirements. It's not some amazing technical innovation, but it is one of those annoying paper cuts that…

> when we tried to use them in production at scale Debian and Ubuntu have been using them in production and "at scale" for decades. What are the "sharp edges" that you're trying to solve?

That's true! The Debian and Ubuntu folks are also experts at this. In our experience, the sharp edges generally affect teams that don't have a lot of in-house expertise in this, and where release engineering is not a core engineering competency that they want to invest in.

Re: Show HN: Attune - Build and publish APT repositories in seconds

#29

Post by ilikebits »

rlpb wrote: post #21
ilikebits wrote: post #13

Earlier quoted context omitted.

Our use case is customers who (1) want to use a managed cloud hosting service that we provide, but (2) are not willing to give us their signing keys. Our design allows them to keep all of their signing keys local to their environment. To our knowledge, we have not found another provider who supports both of these requirements. It's not some amazing technical innovation, but it is one of those annoying paper cuts that…

Signing an unsigned apt repository is about three gpg commands though. I don't see how this kind of thing requires a whole separate product.

Yeah, solving this locally for one repository definitely isn't that hard at all. Most of the features we're building become useful when you're trying to build CI integrations for a larger team while also complying with enterprise security requirements (e.g. audit logging, HSM key protections, etc.).
Post reply on HN