Recent content on Emanuele Rocca
This is the story of an investigation conducted by Jochen Sprickerhof, Helmut Grohne, and myself. It was true teamwork, and we would have not reached the bottom of the issue working individually. We think you will find it as interesting and fun as we did, so here is a brief writeup. A few of the steps mentioned here took several days, others just a few minutes. What is described as a natural…
There is more than one way to do it, but it seems that The Right Way to build Debian packages today is using sbuild with the unshare backend. The most common backend before the rise of unshare was schroot . The official Debian Build Daemons have recently transitioned to using sbuild with unshare , providing a strong motivation to consider making the switch. Additionally the new approach means: (1)…
Here are my notes about copying PGP keys to external hardware devices such as Yubikeys. Let me begin by saying that the gpg tools are pretty bad at this. MAKE A COUPLE OF BACKUPS OF ~/.gnupg/ TO DIFFERENT ENCRYPTED USB STICKS BEFORE YOU START. GPG WILL MESS UP YOUR KEYS. SERIOUSLY. For example, would you believe me if I said that saving changes results in the removal of your private key? Well…
This time it’s about enabling new kernel config options in the official Debian kernel packages. A few dependencies are needed to run the various scripts used by the Debian kernel folks, as well as to build the kernel itself: apt install git gpg python3-debian python3-dacite apt build-dep linux With that in place, fetch the linux and kernel-team repos: git clone --depth 1…
There are many valid reasons to create a custom Debian Installer image. You may need to pass some special arguments to the kernel, use a different GRUB version, automate the installation by means of preseeding , use a custom kernel, or modify the installer itself. If you have a EFI system, which is probably the case in 2023, there is no need to learn complex procedures in order to create a custom…
UPDATE : this post unexpectedly ended up on Hacker News and I received a lot of comments. The two most important points being made are (1) that Secure Boot on the RPi as described here is not actually truly secure. An attacker who successfully gained root could just mount the firmware partition and either add their own keys to the EFI variable store or replace the firmware altogether with a…
To create a bootable EFI drive to use with QEMU, first make a disk image and create a vfat filesystem on it. $ dd if=/dev/zero of=boot.img bs=1M count=512 $ sudo mkfs.vfat boot.img By default, EFI firmwares boot a specific file under /efi/boot/ . The name of such file depends on the architecture: for example, on 64 bit x86 systems it is bootx64.efi , while on ARM it is bootaa64.efi . Copy…
Some notes on using debvm , an amazing piece of software I’ve started using only recently. Create a new virtual machine: $ debvm-create You now have a virtual machine with Debian Sid of your host native architecture (probably amd64). The image file is called rootfs.ext4. You’ve got 1G of disk space in the VM. You can now just run the VM! You will be automatically logged is as root. $ debvm-run…
All graybeard hackers know that: (1) Docker is silly, and (2) containers are very useful. This post is about running pretty much any Linux distribution on top of a Debian host using chroots, which technically speaking aren’t containers but for my purposes pretty much are. The chroot can be used in a disposable fashion or it can be instructed to persist any modifications made to the filesystem. The…
In the past few years autopkgtest established itself as the system for automated testing of Debian packages. Although there is good documentation available, both in terms of the command itself and the details about writing tests , I often have to look around and copy-paste code to add automated testing to Python libraries. For this reason, I’m dropping a few notes here. They’re surely going to be…
The release of DTrace in 2005 marked a turning point in the world of UNIX systems when it comes to production analysis, and more in general it greatly helped the process of understanding what’s going on under the covers by means of dynamic tracing. Various systems inspired by DTrace have been developed throughout the years, including SystemTap and bpftrace . Although these systems differ in…
For a personal project of mine I’ve been using a wildcard TLS certificate issued by Let’s Encrypt. certbot made the process of creating the certificate extremely easy, I just had to apt install certbot and then run the following command, duly copy-pasted from the Internet: certbot --manual certonly --agree-tos --email ema@example.org --preferred-challenges=dns -d '*.example.org' The command gave…
One of the Amazon reviewers of 'Sun Performance and Tuning: Java and the Internet' gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago. The book Roland reviewed was published in 1998, and it is a second edition. The first edition (1994) has a significantly different title: ' Sparc &…
As of December 2020, there is an alternative to wpa_supplicant. It works. It’s called iwd , iNet Wireless Daemon, and you can use it on Debian systems today. Now, if you use Linux and you’ve never heard of wpa_supplicant before, you are a lucky person. Starting some weeks ago, all my videoconferences got interrupted after a few minutes, ping example.org said 'not today', and I was sad. Looking at…
SystemTap allows to instrument Linux systems at runtime. By using it, you can gather insights about running programs, including the Linux kernel itself, without invoking them in specific ways, modifying them, or indeed even having access to their source code. On Debian systems and derivatives, including Ubuntu, get started with SystemTap by installing the systemtap package as well as the Linux…
Contacts, LOL so 90s. E-mail: ema@linux.it . My PGP key is 0x50FDB7A3 , and this is the full fingerprint if you want to verify it: 9545 9696 1928 1C17 FFAC 5891 D508 5A07 50FD B7A3 . IRC: ema on OFTC and Libera Mastodon: @ema @ fosstodon.org Twitter: @realEmaRocca GitHub: https://github.com/ema/
Emanuele Rocca. Packages Not Using The Default Build Flags: A Taxonomy . DebConf25, IRISA, Jul 2025, Brest, France. pp.4. G. Pierre, T. Kielmann, E. Rocca, K. Razavi, B. IJff, H. Fernandez, R. Figueiredo, A. Uta, A. Vintila, A. Oprescu, T. Schuett, M. Berlin, M. Artac, A. Cernivec, ConPaaS: An Integrated Runtime Environment for Elastic Cloud Applications , in: HPDC (Poster), 2013. My Erdős number…
Packages not using the default build flags: a taxonomy ( slides , video ) 2025-07-15, Debconf 25, Brest, France Enabling Architectural Features in Debian: PAC and BTI on arm64 ( slides , video ) 2025-02-02, FOSDEM 25, Brussels, Belgium Debian Live ( slides , video ) 2024-10-12, Mini-debconf, Cambridge, United Kingdom Hardware Enablement in Debian: Lenovo Thinkpad X13s ( slides , video ) 2023-11-25,…